gnu: librewolf: Update to 150.0-1. [security-updates]

Contains fixes for:
CVE-2026-6746: Use-after-free in the DOM: Core & HTML component
CVE-2026-6747: Use-after-free in the WebRTC component
CVE-2026-6748: Uninitialized memory in the Audio/Video: Web Codecs
               component
CVE-2026-6749: Information disclosure due to uninitialized memory in
               the Graphics: Canvas2D component
CVE-2026-6750: Privilege escalation in the Graphics: WebRender
               component
CVE-2026-6751: Uninitialized memory in the Audio/Video: Web Codecs
               component
CVE-2026-6752: Incorrect boundary conditions in the WebRTC component
CVE-2026-6753: Incorrect boundary conditions in the WebRTC component
CVE-2026-6754: Use-after-free in the JavaScript Engine component
CVE-2026-6755: Mitigation bypass in the DOM: postMessage component
CVE-2026-6756: Mitigation bypass in Firefox for Android
CVE-2026-6757: Invalid pointer in the JavaScript: WebAssembly
               component
CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-6759: Use-after-free in the Widget: Cocoa component
CVE-2026-6760: Mitigation bypass in the Networking: Cookies component
CVE-2026-6761: Privilege escalation in the Networking component
CVE-2026-6762: Spoofing issue in the DOM: Core & HTML component
CVE-2026-6763: Mitigation bypass in the File Handling component
CVE-2026-6764: Incorrect boundary conditions in the DOM: Device
               Interfaces component
CVE-2026-6765: Information disclosure in the Form Autofill component
CVE-2026-6766: Incorrect boundary conditions in the Libraries
               component in NSS
CVE-2026-6767: Other issue in the Libraries component in NSS
CVE-2026-6768: Mitigation bypass in the Networking: Cookies component
CVE-2026-6769: Privilege escalation in the Debugger component
CVE-2026-6770: Other issue in the Storage: IndexedDB component
CVE-2026-6771: Mitigation bypass in the DOM: Security component
CVE-2026-6772: Incorrect boundary conditions in the Libraries
               component in NSS
CVE-2026-6773: Denial-of-service due to integer overflow in the
               Graphics: WebGPU component
CVE-2026-6774: Mitigation bypass in the DOM: Security component
CVE-2026-6775: Incorrect boundary conditions in the WebRTC component
CVE-2026-6776: Incorrect boundary conditions in the WebRTC: Networking
               component
CVE-2026-6777: Other issue in the Networking: DNS component
CVE-2026-6778: Invalid pointer in the Audio/Video: Playback component
CVE-2026-6779: Other issue in the JavaScript Engine component
CVE-2026-6780: Denial-of-service in the Audio/Video: Playback
               component
CVE-2026-6781: Denial-of-service in the Audio/Video: Playback
               component
CVE-2026-6782: Information disclosure in the IP Protection component
CVE-2026-6783: Incorrect boundary conditions, integer overflow in the
               Audio/Video: Playback component
CVE-2026-6784: Memory safety bugs fixed in Firefox 150 and Thunderbird
               150
CVE-2026-6785: Memory safety bugs fixed in Firefox ESR 115.35, Firefox
               ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and
               Thunderbird 150
CVE-2026-6786: Memory safety bugs fixed in Firefox ESR 140.10,
               Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

* gnu/packages/patches/librewolf-150.0-encoding_rs-rust-fix.patch: New file.
* gnu/local.mk: Add new patch to dist_patch_DATA.
* gnu/packages/librewolf.scm (make-librewolf-source): Apply new patch.
* gnu/packages/librewolf.scm (librewolf): Update to 150.0-1.
[arguments #:phases use-mozzarella]: Update Mozzarella URLs.  Fixes #1923.

Change-Id: I7696abc0ac44d689190d9ef1e12704905c11d431

1 files changed, 14 insertions, 13 deletions

diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index b8b0ae3223d..e3bd013133c 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -125,14 +125,14 @@
   ;; ex:
   ;; tar xf /gnu/store/...-firefox-123.4.source.tar.xz -O \
   ;;     firefox-123.4/browser/locales/l10n-changesets.json | grep revision
-  (let ((commit "0245ffb160688061f0e0c67ea488bcdfdacbeca4"))
+  (let ((commit "fefe280d909d0eee8d60edd2a6db7d969df56c5b"))
     (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/mozilla-l10n/firefox-l10n.git")
             (commit commit)))
       (file-name (git-file-name "firefox-l10n" commit))
-      (sha256 (base32 "0y8xdxql04yys0wj685v4yp3kmx1ivnndg6z11vam8vszh0j7ak6")))))
+      (sha256 (base32 "0z1ksvspbn4bbzxdl2w4x7bg36j4rwhaby8g37apg4393frh558i")))))
 
 (define* (make-librewolf-source #:key version firefox-hash librewolf-hash l10n)
   (let* ((ff-src (firefox-source-origin
@@ -205,7 +205,8 @@
        (search-patches
         "librewolf-compare-paths.patch"
         "librewolf-use-system-wide-dir.patch"
-        "librewolf-add-store-to-rdd-allowlist.patch"))
+        "librewolf-add-store-to-rdd-allowlist.patch"
+        "librewolf-150.0-encoding_rs-rust-fix.patch"))
       ;; Slim down the tarball by removing unbundled libraries and 75 Mo (800+
       ;; Mo uncompressed) of unused tests.
       ;; TODO: Unbundle security/nss and media/libpng.
@@ -244,17 +245,17 @@
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
 ;; or: (format-time-string "%Y%m%d%H%M%S")
-(define %librewolf-build-id "20260409162101")
+(define %librewolf-build-id "20260421153818")
 
 (define-public librewolf
   (package
     (name "librewolf")
-    (version "149.0.2-2")
+    (version "150.0-1")
     (source
      (make-librewolf-source
       #:version version
-      #:firefox-hash "1kkhg3lgyakinn5ankxrlxbf39wi61mqbhwrj1l4q5l7y0n1m4va"
-      #:librewolf-hash "1bai8g2kc9snck2f724al29q6r57vkj3d7v58rf0mgzpqzvwnw5f"
+      #:firefox-hash "151rxzl80dm8jsxl6fwzgbirwq4zpms5adwwnbjcwdd1r3s3vr7v"
+      #:librewolf-hash "0iw9v3zc1fxc93yyhldqarxaypgmbndh2ylsy330kcbpb6p1gnmr"
       #:l10n firefox-l10n))
     (build-system gnu-build-system)
     (arguments
@@ -352,18 +353,18 @@
                              (cdr pref)))
                    `(("extensions.getAddons.search.browseURL"
                       ,(string-append
-                        "https://gnuzilla.gnu.org/mozzarella/"
+                        "https://gnuzilla.gnu.org/"
                         "search.php?q=%TERMS%"))
                      ("extensions.getAddons.get.url" .
-                      "https://gnuzilla.gnu.org/mozzarella")
+                      "https://gnuzilla.gnu.org")
                      ("extensions.getAddons.link.url" .
-                      "https://gnuzilla.gnu.org/mozzarella")
+                      "https://gnuzilla.gnu.org")
                      ("extensions.getAddons.discovery.api_url" .
-                      "https://gnuzilla.gnu.org/mozzarella")
+                      "https://gnuzilla.gnu.org")
                      ("extensions.getAddons.langpacks.url" .
-                      "https://gnuzilla.gnu.org/mozzarella")
+                      "https://gnuzilla.gnu.org")
                      ("lightweightThemes.getMoreURL" .
-                      "https://gnuzilla.gnu.org/mozzarella")))))))
+                      "https://gnuzilla.gnu.org")))))))
           (add-after 'patch-source-shebangs 'patch-cargo-checksums
             (lambda _
               (use-modules (guix build cargo-utils))