guix/gnu/packages/librewolf.scm, branch librewolf-updates Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org gnu: librewolf: Update to 148.0.2-1 [security-fixes]. 2026-03-10T22:35:09+00:00 Ian Eure ian@retrospec.tv 2026-03-10T22:34:37+00:00 baed3ca1b6178fa66feaefd202d84e4dcdcf2ff3 Contains fixes for: CVE-2026-3845: Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android CVE-2026-3846: Same-origin policy bypass in the CSS Parsing and Computation component CVE-2026-3847: Memory safety bugs fixed in Firefox 148.0.2 * gnu/packages/librewolf.scm (librewolf): Update to 148.0.2-1. Change-Id: Id3868e10d38f5f111bd00bc140a9dc64f132caa9 
Contains fixes for:

CVE-2026-3845: Heap buffer overflow in the Audio/Video: Playback
               component in Firefox for Android
CVE-2026-3846: Same-origin policy bypass in the CSS Parsing and
               Computation component
CVE-2026-3847: Memory safety bugs fixed in Firefox 148.0.2

* gnu/packages/librewolf.scm (librewolf): Update to 148.0.2-1.

Change-Id: Id3868e10d38f5f111bd00bc140a9dc64f132caa9
gnu: librewolf: Update to 148.0-1 [security-fixes]. 2026-03-01T03:23:59+00:00 moksh mysticmoksh@riseup.net 2026-02-24T20:43:49+00:00 cf27ff3da3c9da11f8fe5f242165e7e8030a644f * gnu/packages/librewolf.scm (librewolf): Update to 148.0-1. [native-inputs]: Use clang-21 and llvm-21. Containes fixes for: CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android CVE-2026-2758: Use-after-free in the JavaScript: GC component CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component CVE-2026-2795: Use-after-free in the JavaScript: GC component CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component CVE-2026-2761: Sandbox escape in the Graphics: WebRender component CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component CVE-2026-2763: Use-after-free in the JavaScript Engine component CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component CVE-2026-2796: JIT miscompilation in the JavaScript: WebAssembly component CVE-2026-2797: Use-after-free in the JavaScript: GC component CVE-2026-2765: Use-after-free in the JavaScript Engine component CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component CVE-2026-2798: Use-after-free in the DOM: Core & HTML component CVE-2026-2769: Use-after-free in the Storage: IndexedDB component CVE-2026-2799: Use-after-free in the DOM: Core & HTML component CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component CVE-2026-2772: Use-after-free in the Audio/Video: Playback component CVE-2026-2773: Incorrect boundary conditions in the Web Audio component CVE-2026-2774: Integer overflow in the Audio/Video component CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software CVE-2026-2777: Privilege escalation in the Messaging System component CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR component CVE-2026-2800: Spoofing issue in the WebAuthn component in Firefox for Android CVE-2026-2780: Privilege escalation in the Netmonitor component CVE-2026-2781: Integer overflow in the Libraries component in NSS CVE-2026-2801: Incorrect boundary conditions in the JavaScript: WebAssembly component CVE-2026-2782: Privilege escalation in the Netmonitor component CVE-2026-2783: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-2802: Race condition in the JavaScript: GC component CVE-2026-2803: Information disclosure, mitigation bypass in the Settings UI component CVE-2026-2784: Mitigation bypass in the DOM: Security component CVE-2026-2785: Invalid pointer in the JavaScript Engine component CVE-2026-2804: Use-after-free in the JavaScript: WebAssembly component CVE-2026-2786: Use-after-free in the JavaScript Engine component CVE-2026-2805: Invalid pointer in the DOM: Core & HTML component CVE-2026-2787: Use-after-free in the DOM: Window and Location component CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP component CVE-2026-2789: Use-after-free in the Graphics: ImageLib component CVE-2026-2806: Uninitialized memory in the Graphics: Text component CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component CVE-2026-2791: Mitigation bypass in the Networking: Cache component CVE-2026-2807: Memory safety bugs fixed in Firefox 148 and Thunderbird 148 CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox Change-Id: I3baa7dee1c8667e8a6fc04e0112c1fddb8ed7d81 Signed-off-by: Ian Eure <ian@retrospec.tv> 
* gnu/packages/librewolf.scm (librewolf): Update to 148.0-1.
[native-inputs]: Use clang-21 and llvm-21.

Containes fixes for:
CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component
CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android
CVE-2026-2758: Use-after-free in the JavaScript: GC component
CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component
CVE-2026-2795: Use-after-free in the JavaScript: GC component
CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component
CVE-2026-2763: Use-after-free in the JavaScript Engine component
CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
CVE-2026-2796: JIT miscompilation in the JavaScript: WebAssembly component
CVE-2026-2797: Use-after-free in the JavaScript: GC component
CVE-2026-2765: Use-after-free in the JavaScript Engine component
CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component
CVE-2026-2798: Use-after-free in the DOM: Core & HTML component
CVE-2026-2769: Use-after-free in the Storage: IndexedDB component
CVE-2026-2799: Use-after-free in the DOM: Core & HTML component
CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component
CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component
CVE-2026-2772: Use-after-free in the Audio/Video: Playback component
CVE-2026-2773: Incorrect boundary conditions in the Web Audio component
CVE-2026-2774: Integer overflow in the Audio/Video component
CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component
CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
CVE-2026-2777: Privilege escalation in the Messaging System component
CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR component
CVE-2026-2800: Spoofing issue in the WebAuthn component in Firefox for Android
CVE-2026-2780: Privilege escalation in the Netmonitor component
CVE-2026-2781: Integer overflow in the Libraries component in NSS
CVE-2026-2801: Incorrect boundary conditions in the JavaScript: WebAssembly component
CVE-2026-2782: Privilege escalation in the Netmonitor component
CVE-2026-2783: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-2802: Race condition in the JavaScript: GC component
CVE-2026-2803: Information disclosure, mitigation bypass in the Settings UI component
CVE-2026-2784: Mitigation bypass in the DOM: Security component
CVE-2026-2785: Invalid pointer in the JavaScript Engine component
CVE-2026-2804: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-2786: Use-after-free in the JavaScript Engine component
CVE-2026-2805: Invalid pointer in the DOM: Core & HTML component
CVE-2026-2787: Use-after-free in the DOM: Window and Location component
CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP component
CVE-2026-2789: Use-after-free in the Graphics: ImageLib component
CVE-2026-2806: Uninitialized memory in the Graphics: Text component
CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component
CVE-2026-2791: Mitigation bypass in the Networking: Cache component
CVE-2026-2807: Memory safety bugs fixed in Firefox 148 and Thunderbird 148
CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird
CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox

Change-Id: I3baa7dee1c8667e8a6fc04e0112c1fddb8ed7d81
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: librewolf-bsys6: Update to 274e39ee40592f8bc6ca5d4ee699ec74aeeab983. 2026-03-01T03:23:58+00:00 moksh mysticmoksh@riseup.net 2026-02-24T20:28:25+00:00 dd0459d5979e45f545b9cff58168de4ff9a2ad55 * gnu/packages/librewolf.scm (librewolf-bsys6): Update to 274e39ee40592f8bc6ca5d4ee699ec74aeeab983. Change-Id: I548c901bdc5319d32dec6ccc7a3300063dbcf7c0 Signed-off-by: Ian Eure <ian@retrospec.tv> 
* gnu/packages/librewolf.scm (librewolf-bsys6): Update to 274e39ee40592f8bc6ca5d4ee699ec74aeeab983.

Change-Id: I548c901bdc5319d32dec6ccc7a3300063dbcf7c0
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: firefox-l10n: Update to c316776e57fcf5c11054c115054b083ce0790ce7. 2026-03-01T03:23:57+00:00 moksh mysticmoksh@riseup.net 2026-02-24T20:24:26+00:00 0b568bd65cc2df72f0d48fd850dfabcff491d29b * gnu/packages/librewolf.scm (firefox-l10n): Update to c316776e57fcf5c11054c115054b083ce0790ce7. Change-Id: Ia2677558cb0977f38589454885d2fdd6707f32f8 Signed-off-by: Ian Eure <ian@retrospec.tv> 
* gnu/packages/librewolf.scm (firefox-l10n): Update to c316776e57fcf5c11054c115054b083ce0790ce7.

Change-Id: Ia2677558cb0977f38589454885d2fdd6707f32f8
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: librewolf: Update to 147.0.4-1. 2026-02-19T05:12:23+00:00 moksh mysticmoksh@riseup.net 2026-02-17T18:00:36+00:00 abd5648c14d077a1e005f7b3ddcf2f13075cc310 contains fixes for: CVE-2026-2447: Heap buffer overflow in libvpx * gnu/packages/librewolf.scm (librewolf): Update to 147.0.4-1. Change-Id: I32fd2b71192434c53bf9f37b59632e2f64137191 Signed-off-by: Ian Eure <ian@retrospec.tv> 
contains fixes for:
CVE-2026-2447: Heap buffer overflow in libvpx

* gnu/packages/librewolf.scm (librewolf): Update to 147.0.4-1.

Change-Id: I32fd2b71192434c53bf9f37b59632e2f64137191
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: librewolf: Update to 147.0.3-2. 2026-02-07T20:05:04+00:00 moksh mysticmoksh@riseup.net 2026-02-07T10:32:54+00:00 d46b423c1d644dcd0d79e2e83cac0f72380c06ce * gnu/packages/librewolf.scm (librewolf): Update to 147.0.3-2. Change-Id: I0c4c97d86c4f22e46393da93ea89e22b84a29197 Signed-off-by: Ian Eure <ian@retrospec.tv> 
* gnu/packages/librewolf.scm (librewolf): Update to 147.0.3-2.

Change-Id: I0c4c97d86c4f22e46393da93ea89e22b84a29197
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: librewolf: Update to 147.0.3-1. 2026-02-06T16:22:37+00:00 moksh mysticmoksh@riseup.net 2026-02-05T14:43:09+00:00 28b956178c6676855f25d39429dfdb437ae6af74 * gnu/packages/librewolf.scm (librewolf): Update to 147.0.3-1. Change-Id: I700dfb3e00467f19105794b6e45c22ff07b26b52 Signed-off-by: Ian Eure <ian@retrospec.tv> 
* gnu/packages/librewolf.scm (librewolf): Update to 147.0.3-1.

Change-Id: I700dfb3e00467f19105794b6e45c22ff07b26b52
Signed-off-by: Ian Eure <ian@retrospec.tv>
gnu: librewolf: Update to 147.0.2-1 [security-fixes]. 2026-02-02T18:44:26+00:00 moksh mysticmoksh@riseup.net 2026-01-28T16:25:41+00:00 ce49f1c56706078a953ed16bceb84d4e5719f129 contains fixes for: CVE-2026-24868: Mitigation bypass in the Privacy: Anti-Tracking component CVE-2026-24869: Use-after-free in the Layout: Scrolling and Overflow componentn * gnu/packages/librewolf.scm (librewolf): Update to 147.0.2-1. Change-Id: Ie9b9d75d1be09f6e625ed85b7e6950fae27cf050 
contains fixes for:
CVE-2026-24868: Mitigation bypass in the Privacy: Anti-Tracking component
CVE-2026-24869: Use-after-free in the Layout: Scrolling and Overflow componentn

* gnu/packages/librewolf.scm (librewolf): Update to 147.0.2-1.

Change-Id: Ie9b9d75d1be09f6e625ed85b7e6950fae27cf050
gnu: librewolf: Update to 147.0.1-3 [security-fixes]. 2026-01-21T02:05:03+00:00 Ian Eure ian@retrospec.tv 2026-01-14T02:25:03+00:00 2c34e9ccb687f8f87b5411215c973f6c5354c965 Contains fixes for: CVE-2026-0877: Mitigation bypass in the DOM: Security component CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics component CVE-2026-0881: Sandbox escape in the Messaging System component CVE-2026-0882: Use-after-free in the IPC component CVE-2026-0883: Information disclosure in the Networking component CVE-2026-0884: Use-after-free in the JavaScript Engine component CVE-2026-0885: Use-after-free in the JavaScript: GC component CVE-2026-0886: Incorrect boundary conditions in the Graphics component CVE-2026-0887: Clickjacking issue, information disclosure in the PDF Viewer component CVE-2026-0888: Information disclosure in the XML component CVE-2026-0889: Denial-of-service in the DOM: Service Workers component CVE-2026-0890: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 CVE-2026-0892: Memory safety bugs fixed in Firefox 147 and Thunderbird 147 * gnu/packages/librewolf.scm (librewolf-bsys6): New variable. * gnu/packages/librewolf.scm (make-librewolf-source): Don’t attempt to GPG sign the source tarball, the key isn’t available. * gnu/packages/librewolf.scm (librewolf): Update to 147.0.1-3. [native-inputs] Add librewolf-bsys6. [phases 'patch-icu-lookup]: Delete. [phases 'install-desktop-entry]: Use the .desktop file template from librewolf-bsys6. Change-Id: Ic7ff0197294cbb2485cb8db2f42f4fb499e39277 
Contains fixes for:
CVE-2026-0877: Mitigation bypass in the DOM: Security component
CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in
               the Graphics: CanvasWebGL component
CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in
               the Graphics component
CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics
               component
CVE-2026-0881: Sandbox escape in the Messaging System component
CVE-2026-0882: Use-after-free in the IPC component
CVE-2026-0883: Information disclosure in the Networking component
CVE-2026-0884: Use-after-free in the JavaScript Engine component
CVE-2026-0885: Use-after-free in the JavaScript: GC component
CVE-2026-0886: Incorrect boundary conditions in the Graphics component
CVE-2026-0887: Clickjacking issue, information disclosure in the PDF
               Viewer component
CVE-2026-0888: Information disclosure in the XML component
CVE-2026-0889: Denial-of-service in the DOM: Service Workers component
CVE-2026-0890: Spoofing issue in the DOM: Copy & Paste and Drag & Drop
               component
CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7,
               Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
CVE-2026-0892: Memory safety bugs fixed in Firefox 147 and Thunderbird
               147

* gnu/packages/librewolf.scm (librewolf-bsys6): New variable.
* gnu/packages/librewolf.scm (make-librewolf-source): Don’t attempt to GPG
sign the source tarball, the key isn’t available.
* gnu/packages/librewolf.scm (librewolf): Update to 147.0.1-3.
[native-inputs] Add librewolf-bsys6.
[phases 'patch-icu-lookup]: Delete.
[phases 'install-desktop-entry]: Use the .desktop file template from librewolf-bsys6.

Change-Id: Ic7ff0197294cbb2485cb8db2f42f4fb499e39277
gnu: firefox-l10n: Update to da03d1507bcec6952b788a21f3cfa95673b1da4c. 2026-01-21T02:05:02+00:00 Ian Eure ian@retrospec.tv 2026-01-14T02:24:38+00:00 679e30988b946454997aff70120b572187bb48a1 * gnu/packages/librewolf.scm (firefox-l10n): Update to da03d1507bcec6952b788a21f3cfa95673b1da4c. Change-Id: I5a0a62e39bda0a214f6915aef6a730438e596570 
* gnu/packages/librewolf.scm (firefox-l10n): Update to da03d1507bcec6952b788a21f3cfa95673b1da4c.

Change-Id: I5a0a62e39bda0a214f6915aef6a730438e596570