guix/gnu/packages/librewolf.scm, branch master

gnu: librewolf: Update to 154.0-2 [security-fixes].

2026-08-20T17:32:29+00:00

Fixes:
CVE-2026-75874: Sandbox escape in the Remote Settings Client component
CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL
                component
CVE-2026-74935: Privilege escalation in the DOM: Networking component
CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly
                component
CVE-2026-74937: Use-after-free in the JavaScript: GC component
CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
CVE-2026-74939: Privilege escalation in the DOM: Navigation component
CVE-2026-74940: Use-after-free in the Graphics: Text component
CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL
                component
CVE-2026-74942: Privilege escalation in the Remote Settings Client
                component
CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
CVE-2026-74945: Information disclosure in the Graphics: Text component
CVE-2026-74946: Privilege escalation due to incorrect boundary
                conditions in the Graphics: CanvasWebGL component
CVE-2026-74947: Privilege escalation due to invalid pointer in the
                Graphics component
CVE-2026-74948: Information disclosure in the Graphics component
CVE-2026-74949: Privilege escalation due to use-after-free in the
                Graphics: Canvas2D component
CVE-2026-74950: Privilege escalation in the Downloads API component
CVE-2026-74951: Clickjacking issue in Firefox for Android
CVE-2026-74952: Privilege escalation in the Application Update
                component
CVE-2026-74953: Privilege escalation in the Networking: Cookies
                component
CVE-2026-74954: Information disclosure due to side-channel in the
                Storage: Cache API component
CVE-2026-74955: Privilege escalation in the Request Handling component
CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers
                component
CVE-2026-74957: Mitigation bypass in the Safe Browsing component
CVE-2026-74958: Information disclosure in the WebRTC component
CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
CVE-2026-74960: Site isolation issue in the WebExtensions component
CVE-2026-74961: Side-channel in the Web Audio component
CVE-2026-74962: Site isolation issue in the Networking: Cookies
                component
CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies
                component
CVE-2026-74964: Integer overflow in the Graphics component
CVE-2026-74965: Privilege escalation in the Shell Integration
                component
CVE-2026-74966: Information disclosure in the Form Autofill component
CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback
                component
CVE-2026-74968: Site isolation issue in the Graphics: WebRender
                component
CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
CVE-2026-74970: Site isolation issue in the Graphics component
CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus
                Handling component
CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions
                component
CVE-2026-74973: Race condition, use-after-free in the Graphics
                component
CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib
                component
CVE-2026-74975: Spoofing issue in the Downloads component in Firefox
                for Android
CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT
                component
CVE-2026-74977: Integer overflow in the Graphics component
CVE-2026-74978: Clickjacking issue in the Widget component
CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
CVE-2026-74980: Clickjacking issue in the Downloads component in
                Firefox for Android
CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs
                component
CVE-2026-74982: Denial-of-service in the Widget component
CVE-2026-74983: Mitigation bypass in the Data Loss Prevention
                component
CVE-2026-74984: Race condition in the JavaScript Engine component
CVE-2026-74985: Privilege escalation in the Enterprise Policies
                component
CVE-2026-74986: Site isolation issue in the CSS Parsing and
                Computation component
CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14,
                Firefox ESR 153.1 and Firefox 154
CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and
                Firefox 154
CVE-2026-74989: Internally found bugs fixed in Firefox 154
CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39,
                Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

* gnu/packages/librewolf.scm (librewolf): Update to 154.0-2.
(firefox-l10n): Update to 25feb12abf0f49b24210a9a6b76dcd4bca9d05bb.

Change-Id: I1678c60088e3f1ad4bc04de9b66f05e89ab4ed61

gnu: librewolf: Update to 153.0.4-1.

2026-08-14T03:59:11+00:00

* gnu/packages/librewolf.scm (librewolf): Update to 153.0.4-1.

Change-Id: I2ec2422eab7fb8a550114eb07090d7942ae51152

gnu: librewolf: Update to 153.0.3-1.

2026-08-08T04:17:25+00:00

* gnu/packages/librewolf.scm (librewolf): Update to 153.0.3-1.
(firefox-l10n): Update to 6795ea14a5bd5ed79a930e6759823c7236476ae4.
(make-librewolf-source): Make ff_source_tarball substitution tolerant of
whitespace, and preserve what whitespace is present.

Change-Id: Ifaba8b5bbaba829ad62b8c7507fa877dc3bd78b4

gnu: librewolf: Update to 153.0-3. [security-fixes]

2026-07-27T01:46:34+00:00

* gnu/packages/librewolf.scm (librewolf): Update to 153.0-2.

Firefox 153.0 contains fixes for:
CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation
                component
CVE-2026-16350: Incorrect boundary conditions in the Audio/Video:
                cubeb component
CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
CVE-2026-16351: Sandbox escape due to use-after-free in the DOM:
                Navigation component
CVE-2026-16352: Sandbox escape due to use-after-free in the Disability
                Access APIs component
CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly
                component
CVE-2026-16364: Incorrect boundary conditions in the Audio/Video:
                Playback component
CVE-2026-16365: Privilege escalation in the DOM: Workers component
CVE-2026-16366: Privilege escalation in the DOM: Navigation component
CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL)
                component
CVE-2026-16354: Information disclosure in the Graphics: ImageLib
                component
CVE-2026-16367: Sandbox escape due to invalid pointer in the
                Disability Access APIs component
CVE-2026-16368: Incorrect boundary conditions in the JavaScript:
                WebAssembly component
CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly
                component
CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT
                component
CVE-2026-16356: Sandbox escape due to use-after-free in the Disability
                Access APIs component
CVE-2026-16357: Incorrect boundary conditions in the Graphics
                component
CVE-2026-16370: Mitigation bypass in the DOM: Networking component
CVE-2026-16371: Privilege escalation in the DOM: Navigation component
CVE-2026-16372: Privilege escalation in the DOM: Content Processes
                component
CVE-2026-16373: Information disclosure in the Privacy component in
                Firefox for Android
CVE-2026-16374: Information disclosure in the Framework component in
                DevTools
CVE-2026-16375: Site isolation issue in the Networking: HTTP component
CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component
CVE-2026-16377: Mitigation bypass in the PDF Viewer component
CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop
                component
CVE-2026-16379: Privilege escalation in the DOM: Content Processes
                component
CVE-2026-16358: Site isolation issue in the Graphics: WebRender
                component
CVE-2026-16380: Mitigation bypass in the Networking component
CVE-2026-16381: Same-origin policy bypass in the Networking: DNS
                component
CVE-2026-16382: Mitigation bypass in the DOM: Service Workers
                component
CVE-2026-16383: Mitigation bypass in the DOM: Networking component
CVE-2026-16384: Information disclosure due to uninitialized memory in
                the Graphics: WebGPU component
CVE-2026-16385: Information disclosure due to uninitialized memory in
                the Graphics: WebGPU component
CVE-2026-16386: Information disclosure due to uninitialized memory in
                the Graphics: WebGPU component
CVE-2026-16387: Site isolation issue in the Networking component
CVE-2026-16388: Sandbox escape in the DOM: Networking component
CVE-2026-16389: Incorrect boundary conditions, integer overflow in the
                Libraries component in NSS
CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
CVE-2026-16391: Information disclosure in the Storage: IndexedDB
                component
CVE-2026-16392: JIT miscompilation in the JavaScript Engine: JIT
                component
CVE-2026-16393: Incorrect boundary conditions in the Graphics: WebGPU
                component
CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP
                component
CVE-2026-16394: Mitigation bypass in the DOM: Security component
CVE-2026-16395: Integer overflow in the Audio/Video component
CVE-2026-16396: Privilege escalation in WebExtensions
CVE-2026-16397: Clickjacking issue in the WebExtensions component in
                Firefox for Android
CVE-2026-16398: Site isolation issue in the Graphics component
CVE-2026-16399: Site isolation issue in the DOM: Navigation component
CVE-2026-16400: Information disclosure in the DOM: Security component
CVE-2026-16401: Privilege escalation in the Data Loss Prevention
                component
CVE-2026-16402: Integer overflow in the Graphics: ImageLib component
CVE-2026-16403: Spoofing issue in the Address Bar component
CVE-2026-16404: Spoofing issue in Firefox for Android
CVE-2026-16405: Information disclosure in the Networking: WebSockets
                component
CVE-2026-16406: Mitigation bypass in the Networking component
CVE-2026-16407: Mitigation bypass in the DOM: Service Workers
                component
CVE-2026-16408: Integer overflow in the Audio/Video: Playback
                component
CVE-2026-16409: Invalid pointer in the Security: PSM component
CVE-2026-16410: JIT miscompilation in the JavaScript Engine: JIT
                component
CVE-2026-16411: Memory safety bugs fixed in Firefox 153
CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and
                Firefox 153
CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38,
                Firefox ESR 140.13 and Firefox 153

Change-Id: I5257f0ea9954099337b4b5beb60e7788a0fc6e05
Signed-off-by: Ian Eure

gnu: firefox-l10n: Update to 235fd5b0427bec104e6af4055756b286554fce17.

2026-07-27T01:46:31+00:00

* gnu/packages/librewolf.scm (firefox-l10n): Update to 235fd5b0427bec104e6af4055756b286554fce17.

Change-Id: Ibf31c8a7a4d9b107afee32e52bb352422d6be988
Signed-off-by: Ian Eure

gnu: librewolf: Update to 152.0.6-1 [security-fixes].

2026-07-18T23:42:14+00:00

Contains fixes for:
CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly
                component
CVE-2026-15719: Site isolation in the DOM: Navigation component

* gnu/packages/librewolf.scm (librewolf): Update to 152.0.6-1.

Change-Id: Ib130bc8510bcc8c9e25c5bd5b85615c6c24ee2be

gnu: firefox-l10n: Update to e42882cfa3ac852e9df3683aed1dc27b3a62b9fb.

2026-07-18T23:42:13+00:00

* gnu/packages/librewolf.scm (firefox-l10n): Update to e42882cfa3ac852e9df3683aed1dc27b3a62b9fb.

Change-Id: Iaece459886ce59391ea60d58c4e175d11234c70c

gnu: librewolf: Update to 152.0.5-1.

2026-07-11T05:05:33+00:00

* gnu/packages/librewolf.scm (librewolf): Update to 152.0.5-1.

Change-Id: I92a76d6eb377331b7d7795a375a1393f66c01fc9

gnu: firefox-l10n: Update to 6ee6f5c40c1c46d85d49da26ecb5e42ba1167650.

2026-07-11T05:05:30+00:00

* gnu/packages/librewolf.scm (firefox-l10n): Update to 6ee6f5c40c1c46d85d49da26ecb5e42ba1167650.

Change-Id: Id1873e9d255c3fb9cbf6a37c3664630c0aa41454

gnu: librewolf: Update to 152.0.4-1 [security-fixes].

2026-07-03T00:25:39+00:00

Contains fixes for:
CVE-2026-14241: Memory safety bugs fixed in Firefox 152.0.4

* gnu/packages/librewolf.scm (librewolf): Update to 152.0.4-1.
* gnu/packages/patches/librewolf-neuter-locale-download.patch: Adjust to apply
cleanly.

Change-Id: I80a5b8be81fc178cac1bd7a102cd48ba7b8c72d7