gnu: librewolf: Update to 154.0-2 [security-fixes].

Fixes:
CVE-2026-75874: Sandbox escape in the Remote Settings Client component
CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL
                component
CVE-2026-74935: Privilege escalation in the DOM: Networking component
CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly
                component
CVE-2026-74937: Use-after-free in the JavaScript: GC component
CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
CVE-2026-74939: Privilege escalation in the DOM: Navigation component
CVE-2026-74940: Use-after-free in the Graphics: Text component
CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL
                component
CVE-2026-74942: Privilege escalation in the Remote Settings Client
                component
CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
CVE-2026-74945: Information disclosure in the Graphics: Text component
CVE-2026-74946: Privilege escalation due to incorrect boundary
                conditions in the Graphics: CanvasWebGL component
CVE-2026-74947: Privilege escalation due to invalid pointer in the
                Graphics component
CVE-2026-74948: Information disclosure in the Graphics component
CVE-2026-74949: Privilege escalation due to use-after-free in the
                Graphics: Canvas2D component
CVE-2026-74950: Privilege escalation in the Downloads API component
CVE-2026-74951: Clickjacking issue in Firefox for Android
CVE-2026-74952: Privilege escalation in the Application Update
                component
CVE-2026-74953: Privilege escalation in the Networking: Cookies
                component
CVE-2026-74954: Information disclosure due to side-channel in the
                Storage: Cache API component
CVE-2026-74955: Privilege escalation in the Request Handling component
CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers
                component
CVE-2026-74957: Mitigation bypass in the Safe Browsing component
CVE-2026-74958: Information disclosure in the WebRTC component
CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
CVE-2026-74960: Site isolation issue in the WebExtensions component
CVE-2026-74961: Side-channel in the Web Audio component
CVE-2026-74962: Site isolation issue in the Networking: Cookies
                component
CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies
                component
CVE-2026-74964: Integer overflow in the Graphics component
CVE-2026-74965: Privilege escalation in the Shell Integration
                component
CVE-2026-74966: Information disclosure in the Form Autofill component
CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback
                component
CVE-2026-74968: Site isolation issue in the Graphics: WebRender
                component
CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
CVE-2026-74970: Site isolation issue in the Graphics component
CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus
                Handling component
CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions
                component
CVE-2026-74973: Race condition, use-after-free in the Graphics
                component
CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib
                component
CVE-2026-74975: Spoofing issue in the Downloads component in Firefox
                for Android
CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT
                component
CVE-2026-74977: Integer overflow in the Graphics component
CVE-2026-74978: Clickjacking issue in the Widget component
CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
CVE-2026-74980: Clickjacking issue in the Downloads component in
                Firefox for Android
CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs
                component
CVE-2026-74982: Denial-of-service in the Widget component
CVE-2026-74983: Mitigation bypass in the Data Loss Prevention
                component
CVE-2026-74984: Race condition in the JavaScript Engine component
CVE-2026-74985: Privilege escalation in the Enterprise Policies
                component
CVE-2026-74986: Site isolation issue in the CSS Parsing and
                Computation component
CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14,
                Firefox ESR 153.1 and Firefox 154
CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and
                Firefox 154
CVE-2026-74989: Internally found bugs fixed in Firefox 154
CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39,
                Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

* gnu/packages/librewolf.scm (librewolf): Update to 154.0-2.
(firefox-l10n): Update to 25feb12abf0f49b24210a9a6b76dcd4bca9d05bb.

Change-Id: I1678c60088e3f1ad4bc04de9b66f05e89ab4ed61

2 files changed, 11 insertions, 12 deletions

diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index e15803944b9..d3c729af7e5 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -126,14 +126,14 @@
   ;; tar xf /gnu/store/...-firefox-123.4.source.tar.xz --wildcards -O \
   ;;     firefox-*/browser/locales/l10n-changesets.json \
   ;;     | grep revision | sort | uniq
-  (let ((commit "41ce89dc71671df0ebd8c286b3a5c96998b51c27"))
+  (let ((commit "25feb12abf0f49b24210a9a6b76dcd4bca9d05bb"))
    (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/mozilla-l10n/firefox-l10n.git")
             (commit commit)))
       (file-name (git-file-name "firefox-l10n" commit))
-      (sha256 (base32 "1k0rh2xll1ny7n4b3xd5q97i7fjx6qp89d06pbbv01dc9ldszj1c")))))
+      (sha256 (base32 "11g5k7frjmkrg2qvhf33a27dz5pj0hi5m0bnvarc83qdwdxh3s8d")))))
 
 (define* (make-librewolf-source #:key version firefox-hash librewolf-hash l10n)
   (let* ((ff-src (firefox-source-origin
@@ -245,17 +245,17 @@
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
 ;; or: (format-time-string "%Y%m%d%H%M%S")
-(define %librewolf-build-id "20260812151727")
+(define %librewolf-build-id "20260818200615")
 
 (define-public librewolf
   (package
     (name "librewolf")
-    (version "153.0.4-1")
+    (version "154.0-2")
     (source
      (make-librewolf-source
       #:version version
-      #:firefox-hash "0j4a0ak5658n6iwgx4jc0agqlf1dc403p6qkrw23pfv69j987app"
-      #:librewolf-hash "04f5yn0fsc0fbp907vfy6s8mkszdi4xnssn7xdxz7xrb9fmbdbjr"
+      #:firefox-hash "16mrk2s6rbdfarq5ixk67kh893srbghsxp10dn5gfq4ad2rwbkin"
+      #:librewolf-hash "1klhkgjx637r38y9d8igjy8hlhgvh5kk2arx817yyi3s773gif97"
       #:l10n firefox-l10n))
     (build-system gnu-build-system)
     (arguments
diff --git a/gnu/packages/patches/librewolf-neuter-locale-download.patch b/gnu/packages/patches/librewolf-neuter-locale-download.patch
index 2f6c86638cb..8bb29465392 100644
--- a/gnu/packages/patches/librewolf-neuter-locale-download.patch
+++ b/gnu/packages/patches/librewolf-neuter-locale-download.patch
@@ -2,17 +2,16 @@ diff --git a/scripts/librewolf-patches.py b/scripts/librewolf-patches.py
 index 48dc6bc..01a6c58 100755
 --- a/scripts/librewolf-patches.py
 +++ b/scripts/librewolf-patches.py
-@@ -150,12 +150,6 @@
+@@ -161,12 +161,6 @@
          with open(file, "w") as f:
              f.write("{}-{}".format(version,release))
  
--    print("-> Downloading locales from https://github.com/mozilla-l10n/firefox-l10n")
+-    print("-> Downloading locales from https://librewolf.dev/mirror/firefox-l10n")
 -    with TemporaryDirectory() as tmpdir:
--        exec(f"curl -so {tmpdir}/l10n.zip 'https://codeload.github.com/mozilla-l10n/firefox-l10n/zip/refs/heads/main'")
--        exec(f"unzip -qo {tmpdir}/l10n.zip -d {tmpdir}/l10n")
--        exec(f"mv {tmpdir}/l10n/firefox-l10n-main lw/l10n")
+-        exec(f"git clone --depth=1 https://librewolf.dev/mirror/firefox-l10n {tmpdir}/l10n")
+-        exec(f"rm -rf {tmpdir}/l10n/.git {tmpdir}/l10n/.github {tmpdir}/l10n/LICENSE {tmpdir}/l10n/README")
+-        exec(f"mv {tmpdir}/l10n lw/l10n")
 -
      print("-> Patching appstrings.properties")
      # Why is "Firefox" hardcoded there???
      exec("find . -path '*/appstrings.properties' -exec sed -i s/Firefox/LibreWolf/ {} \\;")
-