nongnu: firefox-esr: Update to 153.0esr [security fixes].

Fixes CVE-2026-15718, CVE-2026-15719, CVE-2026-16349, CVE-2026-16350,
CVE-2026-16351, CVE-2026-16352, CVE-2026-16353, CVE-2026-16354,
CVE-2026-16355, CVE-2026-16356, CVE-2026-16357, CVE-2026-16358,
CVE-2026-16359, CVE-2026-16360, CVE-2026-16361, CVE-2026-16362,
CVE-2026-16363, CVE-2026-16368, CVE-2026-16369, CVE-2026-16371,
CVE-2026-16374, CVE-2026-16375, CVE-2026-16377, CVE-2026-16379,
CVE-2026-16381, CVE-2026-16383, CVE-2026-16387, CVE-2026-16390,
CVE-2026-16391, CVE-2026-16396, CVE-2026-16405, CVE-2026-16412.

* nongnu/packages/mozilla.scm (firefox-esr): Update to 153.0esr.
[source]<patches>: Remove -esr, -ge-138 from patch names.  Sort.
[inputs]: Use icu4c-78, clang-19, rust-cbindgen-0.29.4.
(rust-cbindgen-0.29.4): New variable.
(firefox)[source]<patches>: Remove -ge-138 from patch name.
[inputs]: Drop icu4c replacement.
* nongnu/packages/patches/firefox-ge-138-compare-paths.patch: Rename from
this...
* nongnu/packages/patches/firefox-compare-paths.patch: ... to this.
* nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch,
nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch: Delete files.
* nongnu/packages/wasm.scm (wasm32-wasi-clang-runtime): Inherit from
clang-runtime-19.
[native-inputs]: Use clang-19.
[inputs]: Use llvm-19.
(wasm32-wasi-clang) [base]: Use llvm-19.  Drop #:patches.
(wasm32-wasi-libcxx) [version]: Use llvm-19.
[arguments]<#:configure-flags>: Add -DLIBCXXABI_USE_LLVM_UNWINDER=OFF.

Signed-off-by: Jonathan Brielmaier <jonathan.brielmaier@web.de>

5 files changed, 17 insertions, 93 deletions

diff --git a/nongnu/packages/mozilla.scm b/nongnu/packages/mozilla.scm
index 085d65f..4f97cec 100644
--- a/nongnu/packages/mozilla.scm
+++ b/nongnu/packages/mozilla.scm
@@ -88,25 +88,25 @@
 
 ;; Update this id with every firefox update to its release date.
 ;; It's used for cache validation and therefore can lead to strange bugs.
-(define %firefox-esr-build-id "20260720102539")
+(define %firefox-esr-build-id "20260720102245")
 
 (define-public firefox-esr
   (package
     (name "firefox-esr")
-    (version "140.13.0esr")
+    (version "153.0esr")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://archive.mozilla.org/pub/firefox/releases/"
                            version "/source/firefox-" version ".source.tar.xz"))
        (sha256
-        (base32 "00adf648nrhzngb4ssx31l17bh4zym491mx7b8ca3g9ajk39sfzm"))
+        (base32 "1dbcc80wq1354pzy6wg17gm81qiddyf5b3384fva865ivkgdkqyv"))
        (patches
         (nongnu-patches
+         "firefox-add-store-to-rdd-allowlist.patch"
+         "firefox-compare-paths.patch"
          "firefox-restore-desktop-files.patch"
-         "firefox-ge-138-compare-paths.patch"
-         "firefox-esr-use-system-wide-dir.patch"
-         "firefox-esr-add-store-to-rdd-allowlist.patch"))
+         "firefox-use-system-wide-dir.patch"))
        ;; XXX: 75 Mo (800+ Mo uncompressed) of unused tests.
        ;; Removing it makes it possible to compile on some systems.
        (modules '((guix build utils)))
@@ -460,7 +460,7 @@
         gtk+
         gtk+-2
         hunspell
-        icu4c-76
+        icu4c-78
         jemalloc
         libcanberra
         libevent
@@ -498,7 +498,7 @@
         alsa-lib
         autoconf-2.13
         `(,rust-firefox-esr "cargo")
-        clang-18
+        clang-19
         llvm
         wasm32-wasi-clang-toolchain
         m4
@@ -508,7 +508,7 @@
         pkg-config
         python
         rust-firefox-esr
-        rust-cbindgen-0.28
+        rust-cbindgen-0.29
         which
         yasm))
     (native-search-paths
@@ -543,7 +543,7 @@ Release (ESR) version.")
        (patches
         (nongnu-patches
          "firefox-restore-desktop-files.patch"
-         "firefox-ge-138-compare-paths.patch"
+         "firefox-compare-paths.patch"
          "firefox-use-system-wide-dir.patch"
          "firefox-add-store-to-rdd-allowlist.patch"))
        ;; XXX: 75 Mo (800+ Mo uncompressed) of unused tests.
@@ -557,9 +557,6 @@ Release (ESR) version.")
             (replace 'set-build-id
               (lambda _
                 (setenv "MOZ_BUILD_DATE" #$%firefox-build-id)))))))
-    (inputs
-     (modify-inputs inputs
-       (replace "icu4c" icu4c-78)))
     (native-inputs
      (modify-inputs native-inputs
        (replace "rust" rust-firefox)
diff --git a/nongnu/packages/patches/firefox-ge-138-compare-paths.patch b/nongnu/packages/patches/firefox-compare-paths.patch
index b7d92d7..b7d92d7 100644
--- a/nongnu/packages/patches/firefox-ge-138-compare-paths.patch
+++ b/nongnu/packages/patches/firefox-compare-paths.patch
diff --git a/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch b/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch
deleted file mode 100644
index 4bdaa7d..0000000
--- a/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff --git a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-index 4eff5e6..42171eb 100644
---- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-+++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-@@ -476,6 +476,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() {
-   // Various places where fonts reside
-   policy->AddTree(rdonly, "/usr/X11R6/lib/X11/fonts");
-   policy->AddTree(rdonly, "/nix/store");
-+  policy->AddTree(rdonly, "/gnu/store");
-   // https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/e434e680d22260f277f4a30ec4660ed32b591d16/files/fontconfig-flatpak.conf
-   policy->AddTree(rdonly, "/run/host/fonts");
-   policy->AddTree(rdonly, "/run/host/user-fonts");
-@@ -485,6 +486,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() {
-   // Bug 1848615
-   policy->AddPath(rdonly, "/usr");
-   policy->AddPath(rdonly, "/nix");
-+  policy->AddPath(rdonly, "/gnu");
- 
-   AddLdconfigPaths(policy);
-   AddLdLibraryEnvPaths(policy);
-@@ -934,6 +936,7 @@ SandboxBrokerPolicyFactory::GetRDDPolicy(int aPid) {
-   policy->AddTree(rdonly, "/usr/lib64");
-   policy->AddTree(rdonly, "/run/opengl-driver/lib");
-   policy->AddTree(rdonly, "/nix/store");
-+  policy->AddTree(rdonly, "/gnu/store");
- 
-   // Bug 1647957: memory reporting.
-   AddMemoryReporting(policy.get(), aPid);
-@@ -1079,6 +1082,7 @@ SandboxBrokerPolicyFactory::GetUtilityProcessPolicy(int aPid) {
-   // Required to make sure ffmpeg loads properly, this is already existing on
-   // Content and RDD
-   policy->AddTree(rdonly, "/nix/store");
-+  policy->AddTree(rdonly, "/gnu/store");
- 
-   // glibc will try to stat64("/") while populating nsswitch database
-   // https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/nss_database.c;h=cf0306adc47f12d9bc761ab1b013629f4482b7e6;hb=9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3#l396
diff --git a/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch b/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch
deleted file mode 100644
index 564f12f..0000000
--- a/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-Replace "/usr/lib/mozilla" (the system-wide directory for extensions and
-native manifests) with "$ICECAT_SYSTEM_DIR".
-
-diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp
-index e3be04e70c..a3501c4f44 100644
---- a/toolkit/xre/nsXREDirProvider.cpp
-+++ b/toolkit/xre/nsXREDirProvider.cpp
-@@ -280,24 +280,11 @@ nsresult nsXREDirProvider::GetBackgroundTasksProfilesRootDir(
- static nsresult GetSystemParentDirectory(nsIFile** aFile) {
-   nsresult rv;
-   nsCOMPtr<nsIFile> localDir;
--#  if defined(XP_MACOSX)
--  rv = GetOSXFolderType(kOnSystemDisk, kApplicationSupportFolderType,
--                        getter_AddRefs(localDir));
--  if (NS_SUCCEEDED(rv)) {
--    rv = localDir->AppendNative("Mozilla"_ns);
--  }
--#  else
--  constexpr auto dirname =
--#    ifdef HAVE_USR_LIB64_DIR
--      "/usr/lib64/mozilla"_ns
--#    elif defined(__OpenBSD__) || defined(__FreeBSD__)
--      "/usr/local/lib/mozilla"_ns
--#    else
--      "/usr/lib/mozilla"_ns
--#    endif
--      ;
--  rv = NS_NewNativeLocalFile(dirname, getter_AddRefs(localDir));
--#  endif
-+  const char* systemParentDir = getenv("ICECAT_SYSTEM_DIR");
-+  if (!systemParentDir || !*systemParentDir) return NS_ERROR_FAILURE;
-+
-+  rv = NS_NewNativeLocalFile(nsDependentCString(systemParentDir),
-+                             getter_AddRefs(localDir));
- 
-   if (NS_SUCCEEDED(rv)) {
-     localDir.forget(aFile);
diff --git a/nongnu/packages/wasm.scm b/nongnu/packages/wasm.scm
index 3451489..ba74aea 100644
--- a/nongnu/packages/wasm.scm
+++ b/nongnu/packages/wasm.scm
@@ -67,11 +67,11 @@ other APIs.")
               license:expat))))
 
 (define-public wasm32-wasi-clang-runtime
-  (package (inherit clang-runtime-17)
+  (package (inherit clang-runtime-19)
     (native-inputs
-     (list clang-17
+     (list clang-19
            wasi-libc))
-    (inputs (list llvm-17))
+    (inputs (list llvm-19))
     (arguments
      (list
       #:build-type "Release"
@@ -109,8 +109,7 @@ other APIs.")
 
 (define-public wasm32-wasi-clang
   (let ((base
-         (clang-from-llvm llvm-17 wasm32-wasi-clang-runtime
-                          #:patches '("clang-17.0-fix-build-with-gcc-14-on-arm.patch"))))
+         (clang-from-llvm llvm-19 wasm32-wasi-clang-runtime)))
     (package
       (inherit base)
       (name "wasm32-wasi-clang")
@@ -132,7 +131,7 @@ other APIs.")
 (define-public wasm32-wasi-libcxx
   (package
     (name "wasm32-wasi-libcxx")
-    (version (package-version llvm-17))
+    (version (package-version llvm-19))
     (source (llvm-monorepo version))
     (build-system cmake-build-system)
     (arguments
@@ -173,7 +172,8 @@ other APIs.")
               "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
               "-DLIBCXXABI_ENABLE_SHARED=OFF"
               "-DLIBCXXABI_ENABLE_THREADS=OFF"
-              "-DLIBCXXABI_ENABLE_FILESYSTEM=OFF")
+              "-DLIBCXXABI_ENABLE_FILESYSTEM=OFF"
+              "-DLIBCXXABI_USE_LLVM_UNWINDER=OFF")
       #:tests? #f
       #:phases
       #~(modify-phases %standard-phases