May 2026 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-15.0.14-build1
by Pier Angelo Vendrame (＠pierov) 18 May '26

18 May '26

Pier Angelo Vendrame pushed new tag mb-15.0.14-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-15.0.14-build1
by Pier Angelo Vendrame (＠pierov) 18 May '26

18 May '26

Pier Angelo Vendrame pushed new tag tbb-15.0.14-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41795&41796: Prepare Tor, Mullvad Browser 15.0.14
by Pier Angelo Vendrame (＠pierov) 18 May '26

18 May '26

Pier Angelo Vendrame pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: 1706a002 by Pier Angelo Vendrame at 2026-05-18T21:36:41+02:00 Bug 41795&41796: Prepare Tor, Mullvad Browser 15.0.14 - - - - - 8 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/geckoview/config - projects/go/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,3 +1,12 @@ +Mullvad Browser 15.0.14 - May 19 2026 + * All Platforms + * Updated Firefox to 140.11.0esr + * Updated NoScript to 13.6.19.1984 + * Bug 44958: Backport Security Fixes from Firefox 151 [tor-browser] + * Build System + * All Platforms + * Bug 41781: Fix clean section in rbm.local.conf.example [tor-browser-build] + Mullvad Browser 15.0.12 - May 07 2026 * All Platforms * Updated Firefox to 140.10.2esr ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,17 @@ +Tor Browser 15.0.14 - May 19 2026 + * All Platforms + * Bug 44958: Backport Security Fixes from Firefox 151 [tor-browser] + * Windows + macOS + Linux + * Updated Firefox to 140.11.0esr + * Android + * Updated GeckoView to 140.11.0esr + * Build System + * All Platforms + * Bug 41781: Fix clean section in rbm.local.conf.example [tor-browser-build] + * Bug 41798: Update the URL to versions.ini in relprep.py [tor-browser-build] + * Windows + Linux + Android + * Updated Go to 1.25.10 + Tor Browser 15.0.13 - May 08 2026 * All Platforms * Updated tor to 0.4.9.8 ===================================== projects/browser/config ===================================== @@ -114,9 +114,9 @@ input_files: - filename: dmg-root enable: '[% ! c("var/android") %]' - name: fenix-nightly-apk - URL: https://ftp.mozilla.org/pub/fenix/nightly/2026/05/2026-05-07-08-37-59-fenix… + URL: https://ftp.mozilla.org/pub/fenix/nightly/2026/05/2026-05-18-09-37-36-fenix… enable: '[% c("var/android") %]' - sha256sum: 02c00cffa9b3fd3614f5c074d67c64b8eae7e1cab40899a5a6e243ab9bb88479 + sha256sum: 6dc4e01fa2cea881d54f00e62e8e063fc5b27db4aa10c126952cbd28c959256a - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.19.1984.xpi name: noscript sha256sum: e4280bb2ae87b7dce2c43e416dab60f15a791d439bf9dde2d15b91c14b4163d1 ===================================== projects/firefox/config ===================================== @@ -18,12 +18,12 @@ container: use_container: 1 var: - firefox_platform_version: '140.10.2' + firefox_platform_version: '140.11.0' firefox_version: '[% c("var/firefox_platform_version") %]esr' browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 3 copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]' nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]' gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser @@ -112,6 +112,7 @@ targets: mullvadbrowser: git_url: https://gitlab.torproject.org/tpo/applications/mullvad-browser.git var: + browser_build: 2 gitlab_project: https://gitlab.torproject.org/tpo/applications/mullvad-browser updater_url: 'https://cdn.mullvad.net/browser/update_responses/update_1/' mar_id_prefix: 'mullvadbrowser-mullvad' ===================================== projects/geckoview/config ===================================== @@ -20,12 +20,12 @@ container: build_apk: 1 var: - firefox_platform_version: '140.10.2' + firefox_platform_version: '140.11.0' geckoview_version: '[% c("var/firefox_platform_version") %]esr' browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 3 gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]' deps: ===================================== projects/go/config ===================================== @@ -1,11 +1,11 @@ # vim: filetype=yaml sw=2 -version: '1.25.9' +version: '1.25.10' filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 var: - source_sha256: 0ec9ef8ebcea097aac37decae9f09a7218b451cd96be7d6ed513d8e4bcf909cf + source_sha256: 20cf04a92e5af99748e341bc8996fa28090c9ac98765fa115ec5ddf41d7af41d no_crosscompile: 1 setup: | mkdir -p /var/tmp/dist ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: bca639ef183dba065e6f9dc0bab86aedb03f9335 + git_hash: 6749f7ce29126312167aee8e07cd45a4aa4acb9d targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: 56f475a6c10e509aaff0657b9d864463d387cea7 + git_hash: a2e92e2c255377898a72be2fc0d073766a7ee4ed targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 2c08eef67c3e6d720b23b9766d12807e25fb805e + git_hash: 5cc66c03e5c3d4f35dd48fc5a5a721e5ea1fc384 compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -74,11 +74,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '15.0.13' + torbrowser_version: '15.0.14' torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2026/05/07 14:25:16' + browser_release_date: '2026/05/18 17:00:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: release browser_platforms: @@ -128,9 +128,10 @@ var: updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + - '[% IF c("var/tor-browser") %]15.0.13[% END %]' - 15.0.12 - 15.0.11 - - 15.0.10 + - '[% IF c("var/mullvad-browser") %]15.0.10[% END %]' mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # By default, we sort the list of installed packages. This allows sharing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-140.11.0esr-15.0-1-build2
by ma1 (＠ma1) 18 May '26

18 May '26

ma1 pushed new tag mullvad-browser-140.11.0esr-15.0-1-build2 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.11.0esr-15.0-1] 23 commits: Bug 2021222 - Cancel SpeechSynthesis when the page navigates away. r=eeejay
by ma1 (＠ma1) 18 May '26

18 May '26

ma1 pushed to branch mullvad-browser-140.11.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 80d06be5 by Paul Adenot at 2026-05-18T21:35:27+02:00 Bug 2021222 - Cancel SpeechSynthesis when the page navigates away. r=eeejay Override DisconnectFromOwner, which is called during navigation, to cancel any ongoing or queued speech utterances. Differential Revision: https://phabricator.services.mozilla.com/D290201 - - - - - 01b0cbdc by Valentin Gosu at 2026-05-18T21:35:29+02:00 Bug 2023943 - Make CookieNotification::GetOperation ID clone the ID r=baku,cookie-reviewers Differential Revision: https://phabricator.services.mozilla.com/D288379 - - - - - 63f596ee by Valentin Gosu at 2026-05-18T21:35:30+02:00 Bug 2024244 - Make socket transport hold a reference to TLSServerConnectionInfo r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D290394 - - - - - 7cf0eb67 by Kershaw Chang at 2026-05-18T21:35:32+02:00 Bug 2024260 - nsRequestObserverProxy cleanup, r=necko-reviewers,valentin Differential Revision: https://phabricator.services.mozilla.com/D290376 - - - - - fca37cac by Tom Schuster at 2026-05-18T21:35:33+02:00 Bug 2024443 - Make CryptoKey::GetAlgorithm more idiomatic. r=nkulatova Differential Revision: https://phabricator.services.mozilla.com/D290392 - - - - - 5f995e1a by Jan Grulich at 2026-05-18T21:35:35+02:00 Bug 2029894 - WebRTC backport: Fix double mapoffset application in PipeWire video capture a=dmeehan mmap() with mapoffset as the file offset already returns a pointer to the data at that offset, so passing it again to SPA_MEMBER was reading mapoffset bytes past the mapped region. Also queue the buffer back to PipeWire before returning on mmap failure to avoid leaking it. This is a simple backport of an WebRTC upstream change. Upstream commit: 9ee59b4ab343540923a23edd6429064c22571c3b Original Revision: https://phabricator.services.mozilla.com/D296761 Differential Revision: https://phabricator.services.mozilla.com/D297303 - - - - - 6b0d13c9 by Emilio Cobos Álvarez at 2026-05-18T21:35:36+02:00 Bug 2025968 - Don't allow fragmenting a MiddleCroppingBlockFrame. r=layout-reviewers,dshin This requires multicol and XUL (see prefs). But anyways easy to fix. Differential Revision: https://phabricator.services.mozilla.com/D289644 - - - - - 444c50fe by Dana Keeler at 2026-05-18T21:35:38+02:00 Bug 2027310 - improve thread coordination in ShowProtectedAuthPrompt r=jschanck Differential Revision: https://phabricator.services.mozilla.com/D291021 - - - - - 8e4070f1 by James Teh at 2026-05-18T21:35:39+02:00 Bug 2027308: Fix handling of empty text leaves. a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D294876 Differential Revision: https://phabricator.services.mozilla.com/D296555 - - - - - f6545c51 by Justin Link at 2026-05-18T21:35:41+02:00 Bug 2028274: Removed incorrect CloseHandle() in ~KeyWatcher() and also ensure that no in-flight callbacks are still going to fire r=win-reviewers,gstoll Differential Revision: https://phabricator.services.mozilla.com/D291328 - - - - - 6384e83a by Randell Jesup at 2026-05-18T21:35:42+02:00 Bug 2024665: Make nsIReplacedHttpResponse non-scriptable r=necko-reviewers,valentin Differential Revision: https://phabricator.services.mozilla.com/D288719 - - - - - e8feca10 by Rob Wu at 2026-05-18T21:35:44+02:00 Bug 1940116 - Ignore clicks shortly after extension popup closes r=rpl,Gijs Differential Revision: https://phabricator.services.mozilla.com/D288887 - - - - - aefd2c7d by Maurice Dauer at 2026-05-18T21:35:45+02:00 Bug 2025170 - Pass correct report index for blocked popups, r=emz Differential Revision: https://phabricator.services.mozilla.com/D290850 - - - - - ecc5dc9d by Edgar Chen at 2026-05-18T21:35:47+02:00 Bug 2025346 - Create RemoteObjectProxy properly; r=smaug Differential Revision: https://phabricator.services.mozilla.com/D293507 - - - - - e44241ce by Randell Jesup at 2026-05-18T21:35:49+02:00 Bug 2025434: Return early in ClearKey r=media-playback-reviewers,padenot Differential Revision: https://phabricator.services.mozilla.com/D289646 - - - - - 549b8fc4 by Lee Salzman at 2026-05-18T21:35:51+02:00 Bug 2025877. r=gfx-reviewers,bradwerth Differential Revision: https://phabricator.services.mozilla.com/D293720 - - - - - 51284f96 by Valentin Gosu at 2026-05-18T21:35:52+02:00 Bug 2025888 - Make IncrementalTokenizer read entire buffer r=necko-reviewers,jesup Differential Revision: https://phabricator.services.mozilla.com/D290085 - - - - - 70dbb314 by Jens Stutte at 2026-05-18T21:35:54+02:00 Bug 2025942 - Fix off-by-one in a LogModuleManager::PrintFmt check. r=xpcom-reviewers,emilio Differential Revision: https://phabricator.services.mozilla.com/D290099 - - - - - 215b380c by Tooru Fujisawa at 2026-05-18T21:35:56+02:00 Bug 2025947 - Check data corruption in script decompression. r=bthrall Differential Revision: https://phabricator.services.mozilla.com/D290360 - - - - - 6f4394c7 by Iain Ireland at 2026-05-18T21:35:57+02:00 Bug 2027276: Use size_t when inflating UTF8 r=spidermonkey-reviewers,sfink Differential Revision: https://phabricator.services.mozilla.com/D291002 - - - - - 2e297634 by Matthew Gregan at 2026-05-18T21:35:59+02:00 Bug 2029281 - Update libcubeb to 626d7d9f906e9f3cfb70be9e58af0f5a5f399a74. r=cubeb-reviewers,pehrsons Differential Revision: https://phabricator.services.mozilla.com/D292234 - - - - - 66d05327 by Tom Schuster at 2026-05-18T21:36:01+02:00 Bug 2030385 - Fix non-contiguous nsIContentAnalysisResponse::Action serializer. r=dlp-reviewers,gstoll Differential Revision: https://phabricator.services.mozilla.com/D293519 - - - - - d2dfb405 by Randell Jesup at 2026-05-18T21:36:02+02:00 Bug 2032604: Check Jar entry names for nulls a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D295451 Differential Revision: https://phabricator.services.mozilla.com/D297033 - - - - - 42 changed files: - accessible/base/TextLeafRange.cpp - browser/base/content/test/popups/browser_popup_blocker.js - browser/components/extensions/ExtensionPopups.sys.mjs - browser/components/extensions/test/browser/browser.toml - + browser/components/extensions/test/browser/browser_ext_popup_after_close.js - browser/modules/PopupAndRedirectBlockerObserver.sys.mjs - dom/bindings/RemoteObjectProxy.cpp - dom/canvas/OffscreenCanvasDisplayHelper.cpp - dom/cookiestore/CookieStoreNotificationWatcher.cpp - dom/crypto/CryptoKey.cpp - dom/crypto/KeyAlgorithmProxy.h - dom/ipc/ContentParent.cpp - dom/media/eme/clearkey/ClearKeyBase64.cpp - dom/media/webspeech/synth/SpeechSynthesis.cpp - dom/media/webspeech/synth/SpeechSynthesis.h - + dom/media/webspeech/synth/test/file_speech_cancel_on_navigation_page1.html - + dom/media/webspeech/synth/test/file_speech_cancel_on_navigation_page2.html - dom/media/webspeech/synth/test/mochitest.toml - + dom/media/webspeech/synth/test/test_speech_cancel_on_navigation.html - dom/script/ScriptCompression.cpp - js/src/vm/CharacterEncoding.cpp - layout/generic/MiddleCroppingBlockFrame.cpp - media/libcubeb/moz.yaml - media/libcubeb/src/cubeb_jack.cpp - modules/libjar/nsJARChannel.cpp - netwerk/base/TLSServerSocket.cpp - netwerk/base/nsRequestObserverProxy.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/base/nsSocketTransport2.h - netwerk/cookie/CookieNotification.cpp - netwerk/protocol/http/nsIReplacedHttpResponse.idl - security/manager/ssl/nsNSSCallbacks.cpp - third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc - + third_party/libwebrtc/moz-patch-stack/9ee59b4ab3.no-op-cherry-pick-msg - toolkit/actors/PopupAndRedirectBlockingChild.sys.mjs - toolkit/actors/PopupAndRedirectBlockingParent.sys.mjs - toolkit/components/contentanalysis/ContentAnalysisIPCTypes.h - toolkit/components/contentanalysis/nsIContentAnalysis.idl - widget/windows/WinRegistry.cpp - xpcom/base/Logging.cpp - xpcom/ds/IncrementalTokenizer.cpp - xpcom/ds/IncrementalTokenizer.h The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/c4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/c4… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-140.11.0esr-15.0-1-build3
by ma1 (＠ma1) 18 May '26

18 May '26

ma1 pushed new tag tor-browser-140.11.0esr-15.0-1-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.11.0esr-15.0-1] 23 commits: Bug 2021222 - Cancel SpeechSynthesis when the page navigates away. r=eeejay
by ma1 (＠ma1) 18 May '26

18 May '26

ma1 pushed to branch tor-browser-140.11.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 6f584e21 by Paul Adenot at 2026-05-18T09:52:07+02:00 Bug 2021222 - Cancel SpeechSynthesis when the page navigates away. r=eeejay Override DisconnectFromOwner, which is called during navigation, to cancel any ongoing or queued speech utterances. Differential Revision: https://phabricator.services.mozilla.com/D290201 - - - - - 31f70fc7 by Valentin Gosu at 2026-05-18T10:31:36+02:00 Bug 2023943 - Make CookieNotification::GetOperation ID clone the ID r=baku,cookie-reviewers Differential Revision: https://phabricator.services.mozilla.com/D288379 - - - - - ca319e19 by Valentin Gosu at 2026-05-18T10:33:36+02:00 Bug 2024244 - Make socket transport hold a reference to TLSServerConnectionInfo r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D290394 - - - - - 5e058d18 by Kershaw Chang at 2026-05-18T10:34:43+02:00 Bug 2024260 - nsRequestObserverProxy cleanup, r=necko-reviewers,valentin Differential Revision: https://phabricator.services.mozilla.com/D290376 - - - - - b7dd0244 by Tom Schuster at 2026-05-18T10:36:04+02:00 Bug 2024443 - Make CryptoKey::GetAlgorithm more idiomatic. r=nkulatova Differential Revision: https://phabricator.services.mozilla.com/D290392 - - - - - 865084e3 by Jan Grulich at 2026-05-18T10:49:03+02:00 Bug 2029894 - WebRTC backport: Fix double mapoffset application in PipeWire video capture a=dmeehan mmap() with mapoffset as the file offset already returns a pointer to the data at that offset, so passing it again to SPA_MEMBER was reading mapoffset bytes past the mapped region. Also queue the buffer back to PipeWire before returning on mmap failure to avoid leaking it. This is a simple backport of an WebRTC upstream change. Upstream commit: 9ee59b4ab343540923a23edd6429064c22571c3b Original Revision: https://phabricator.services.mozilla.com/D296761 Differential Revision: https://phabricator.services.mozilla.com/D297303 - - - - - 3c0d04ea by Emilio Cobos Álvarez at 2026-05-18T10:55:18+02:00 Bug 2025968 - Don't allow fragmenting a MiddleCroppingBlockFrame. r=layout-reviewers,dshin This requires multicol and XUL (see prefs). But anyways easy to fix. Differential Revision: https://phabricator.services.mozilla.com/D289644 - - - - - 30463934 by Dana Keeler at 2026-05-18T11:07:00+02:00 Bug 2027310 - improve thread coordination in ShowProtectedAuthPrompt r=jschanck Differential Revision: https://phabricator.services.mozilla.com/D291021 - - - - - 07e022c0 by James Teh at 2026-05-18T11:08:48+02:00 Bug 2027308: Fix handling of empty text leaves. a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D294876 Differential Revision: https://phabricator.services.mozilla.com/D296555 - - - - - a0f791eb by Justin Link at 2026-05-18T11:10:57+02:00 Bug 2028274: Removed incorrect CloseHandle() in ~KeyWatcher() and also ensure that no in-flight callbacks are still going to fire r=win-reviewers,gstoll Differential Revision: https://phabricator.services.mozilla.com/D291328 - - - - - 1c851bc4 by Randell Jesup at 2026-05-18T14:56:50+02:00 Bug 2024665: Make nsIReplacedHttpResponse non-scriptable r=necko-reviewers,valentin Differential Revision: https://phabricator.services.mozilla.com/D288719 - - - - - 335e16c4 by Rob Wu at 2026-05-18T15:36:23+02:00 Bug 1940116 - Ignore clicks shortly after extension popup closes r=rpl,Gijs Differential Revision: https://phabricator.services.mozilla.com/D288887 - - - - - 837b9c77 by Maurice Dauer at 2026-05-18T15:50:41+02:00 Bug 2025170 - Pass correct report index for blocked popups, r=emz Differential Revision: https://phabricator.services.mozilla.com/D290850 - - - - - 9bd17e3d by Edgar Chen at 2026-05-18T16:12:57+02:00 Bug 2025346 - Create RemoteObjectProxy properly; r=smaug Differential Revision: https://phabricator.services.mozilla.com/D293507 - - - - - d66a3c3e by Randell Jesup at 2026-05-18T16:19:07+02:00 Bug 2025434: Return early in ClearKey r=media-playback-reviewers,padenot Differential Revision: https://phabricator.services.mozilla.com/D289646 - - - - - c49edfcd by Lee Salzman at 2026-05-18T18:57:20+02:00 Bug 2025877. r=gfx-reviewers,bradwerth Differential Revision: https://phabricator.services.mozilla.com/D293720 - - - - - cd88cabc by Valentin Gosu at 2026-05-18T18:58:24+02:00 Bug 2025888 - Make IncrementalTokenizer read entire buffer r=necko-reviewers,jesup Differential Revision: https://phabricator.services.mozilla.com/D290085 - - - - - 7f679086 by Jens Stutte at 2026-05-18T19:13:42+02:00 Bug 2025942 - Fix off-by-one in a LogModuleManager::PrintFmt check. r=xpcom-reviewers,emilio Differential Revision: https://phabricator.services.mozilla.com/D290099 - - - - - 35fe931c by Tooru Fujisawa at 2026-05-18T19:14:55+02:00 Bug 2025947 - Check data corruption in script decompression. r=bthrall Differential Revision: https://phabricator.services.mozilla.com/D290360 - - - - - 8fc98260 by Iain Ireland at 2026-05-18T19:21:08+02:00 Bug 2027276: Use size_t when inflating UTF8 r=spidermonkey-reviewers,sfink Differential Revision: https://phabricator.services.mozilla.com/D291002 - - - - - a19a10ba by Matthew Gregan at 2026-05-18T19:27:57+02:00 Bug 2029281 - Update libcubeb to 626d7d9f906e9f3cfb70be9e58af0f5a5f399a74. r=cubeb-reviewers,pehrsons Differential Revision: https://phabricator.services.mozilla.com/D292234 - - - - - eac7548a by Tom Schuster at 2026-05-18T19:35:23+02:00 Bug 2030385 - Fix non-contiguous nsIContentAnalysisResponse::Action serializer. r=dlp-reviewers,gstoll Differential Revision: https://phabricator.services.mozilla.com/D293519 - - - - - 5fef0fd1 by Randell Jesup at 2026-05-18T19:49:07+02:00 Bug 2032604: Check Jar entry names for nulls a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D295451 Differential Revision: https://phabricator.services.mozilla.com/D297033 - - - - - 42 changed files: - accessible/base/TextLeafRange.cpp - browser/base/content/test/popups/browser_popup_blocker.js - browser/components/extensions/ExtensionPopups.sys.mjs - browser/components/extensions/test/browser/browser.toml - + browser/components/extensions/test/browser/browser_ext_popup_after_close.js - browser/modules/PopupAndRedirectBlockerObserver.sys.mjs - dom/bindings/RemoteObjectProxy.cpp - dom/canvas/OffscreenCanvasDisplayHelper.cpp - dom/cookiestore/CookieStoreNotificationWatcher.cpp - dom/crypto/CryptoKey.cpp - dom/crypto/KeyAlgorithmProxy.h - dom/ipc/ContentParent.cpp - dom/media/eme/clearkey/ClearKeyBase64.cpp - dom/media/webspeech/synth/SpeechSynthesis.cpp - dom/media/webspeech/synth/SpeechSynthesis.h - + dom/media/webspeech/synth/test/file_speech_cancel_on_navigation_page1.html - + dom/media/webspeech/synth/test/file_speech_cancel_on_navigation_page2.html - dom/media/webspeech/synth/test/mochitest.toml - + dom/media/webspeech/synth/test/test_speech_cancel_on_navigation.html - dom/script/ScriptCompression.cpp - js/src/vm/CharacterEncoding.cpp - layout/generic/MiddleCroppingBlockFrame.cpp - media/libcubeb/moz.yaml - media/libcubeb/src/cubeb_jack.cpp - modules/libjar/nsJARChannel.cpp - netwerk/base/TLSServerSocket.cpp - netwerk/base/nsRequestObserverProxy.cpp - netwerk/base/nsSocketTransport2.cpp - netwerk/base/nsSocketTransport2.h - netwerk/cookie/CookieNotification.cpp - netwerk/protocol/http/nsIReplacedHttpResponse.idl - security/manager/ssl/nsNSSCallbacks.cpp - third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc - + third_party/libwebrtc/moz-patch-stack/9ee59b4ab3.no-op-cherry-pick-msg - toolkit/actors/PopupAndRedirectBlockingChild.sys.mjs - toolkit/actors/PopupAndRedirectBlockingParent.sys.mjs - toolkit/components/contentanalysis/ContentAnalysisIPCTypes.h - toolkit/components/contentanalysis/nsIContentAnalysis.idl - widget/windows/WinRegistry.cpp - xpcom/base/Logging.cpp - xpcom/ds/IncrementalTokenizer.cpp - xpcom/ds/IncrementalTokenizer.h The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/b3693a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/b3693a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.11.0esr-15.0-1] 3 commits: Bug 1962625 - Add locationspecific to PopupAutoComplete a=dmeehan DONTBUILD
by Pier Angelo Vendrame (＠pierov) 18 May '26

18 May '26

Pier Angelo Vendrame pushed to branch mullvad-browser-140.11.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: ad78fa61 by Dimi at 2026-05-18T18:33:06+02:00 Bug 1962625 - Add locationspecific to PopupAutoComplete a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D299380 Differential Revision: https://phabricator.services.mozilla.com/D300231 - - - - - ca7d9cf2 by Edgar Chen at 2026-05-18T18:33:06+02:00 Bug 2038439 - Clean up stylesheets when destroying Document/ShadowRoot; a=dmeehan DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D299725 Differential Revision: https://phabricator.services.mozilla.com/D300239 - - - - - c40827d1 by Nika Layzell at 2026-05-18T18:33:07+02:00 Bug 2038678 - Clean up unnecessary object traversal for remoteType, a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D299731 Differential Revision: https://phabricator.services.mozilla.com/D300374 - - - - - 13 changed files: - browser/base/content/main-popupset.inc.xhtml - browser/components/aboutlogins/AboutLoginsParent.sys.mjs - browser/components/migration/MigrationWizardParent.sys.mjs - dom/base/Document.cpp - dom/base/DocumentOrShadowRoot.cpp - dom/base/ShadowRoot.cpp - dom/chrome-webidl/WindowGlobalActors.webidl - dom/ipc/WindowGlobalParent.cpp - dom/ipc/WindowGlobalParent.h - services/fxaccounts/FxAccountsWebChannel.sys.mjs - toolkit/actors/WebChannelParent.sys.mjs - toolkit/components/extensions/ConduitsParent.sys.mjs - toolkit/modules/WebChannel.sys.mjs Changes: ===================================== browser/base/content/main-popupset.inc.xhtml ===================================== @@ -133,7 +133,8 @@ hidden="true" overflowpadding="4" norolluponanchor="true" - nomaxresults="true" /> + nomaxresults="true" + locationspecific="true" />  <panel is="search-autocomplete-richlistbox-popup" ===================================== browser/components/aboutlogins/AboutLoginsParent.sys.mjs ===================================== @@ -87,12 +87,9 @@ export class AboutLoginsParent extends JSWindowActorParent { // Only respond to messages sent from a privlegedabout process. Ideally // we would also check the contentPrincipal.originNoSuffix but this // check has been removed due to bug 1576722. - if ( - this.browsingContext.embedderElement.remoteType != - EXPECTED_ABOUTLOGINS_REMOTE_TYPE - ) { + if (this.manager.remoteType != EXPECTED_ABOUTLOGINS_REMOTE_TYPE) { throw new Error( - `AboutLoginsParent: Received ${message.name} message the remote type didn't match expectations: ${this.browsingContext.embedderElement.remoteType} == ${EXPECTED_ABOUTLOGINS_REMOTE_TYPE}` + `AboutLoginsParent: Received ${message.name} message the remote type didn't match expectations: ${this.manager.remoteType} == ${EXPECTED_ABOUTLOGINS_REMOTE_TYPE}` ); } ===================================== browser/components/migration/MigrationWizardParent.sys.mjs ===================================== @@ -62,9 +62,8 @@ export class MigrationWizardParent extends JSWindowActorParent { // make sure that any messages from content are coming from the privileged // about content process type. if ( - !this.browsingContext.currentWindowGlobal.isInProcess && - this.browsingContext.currentRemoteType != - E10SUtils.PRIVILEGEDABOUT_REMOTE_TYPE + !this.manager.isInProcess && + this.manager.remoteType != E10SUtils.PRIVILEGEDABOUT_REMOTE_TYPE ) { throw new Error( "MigrationWizardParent: received message from the wrong content process type." ===================================== dom/base/Document.cpp ===================================== @@ -2565,6 +2565,8 @@ Document::~Document() { mDocGroup->GetBrowsingContextGroup()->RemoveDocument(this, mDocGroup); } + DocumentOrShadowRoot::Unlink(this); + UnlinkOriginalDocumentIfStatic(); UnregisterFromMemoryReportingForDataDocument(); ===================================== dom/base/DocumentOrShadowRoot.cpp ===================================== @@ -62,9 +62,7 @@ void DocumentOrShadowRoot::AddSizeOfExcludingThis(nsWindowSizes& aSizes) const { } DocumentOrShadowRoot::~DocumentOrShadowRoot() { - for (StyleSheet* sheet : mStyleSheets) { - sheet->ClearAssociatedDocumentOrShadowRoot(); - } + MOZ_ASSERT(mStyleSheets.IsEmpty()); } StyleSheetList* DocumentOrShadowRoot::StyleSheets() { ===================================== dom/base/ShadowRoot.cpp ===================================== @@ -105,6 +105,8 @@ ShadowRoot::~ShadowRoot() { MOZ_DIAGNOSTIC_ASSERT(!OwnerDoc()->IsComposedDocShadowRoot(*this)); + DocumentOrShadowRoot::Unlink(this); + UnsetFlags(NODE_IS_IN_SHADOW_TREE); // nsINode destructor expects mSubtreeRoot == this. ===================================== dom/chrome-webidl/WindowGlobalActors.webidl ===================================== @@ -80,6 +80,9 @@ interface WindowGlobalParent : WindowContext { readonly attribute long osPid; + // The remote type of `this.domProcess`. + readonly attribute UTF8String? remoteType; + // A WindowGlobalParent is the root in its process if it has no parent, or its // embedder is in a different process. readonly attribute boolean isProcessRoot; ===================================== dom/ipc/WindowGlobalParent.cpp ===================================== @@ -591,6 +591,10 @@ const nsACString& WindowGlobalParent::GetRemoteType() { return NOT_REMOTE_TYPE; } +void WindowGlobalParent::GetRemoteType(nsACString& aRemoteType) { + aRemoteType = GetRemoteType(); +} + void WindowGlobalParent::NotifyContentBlockingEvent( uint32_t aEvent, nsIRequest* aRequest, bool aBlocked, const nsACString& aTrackingOrigin, ===================================== dom/ipc/WindowGlobalParent.h ===================================== @@ -218,6 +218,7 @@ class WindowGlobalParent final : public WindowContext, nsITransportSecurityInfo* GetSecurityInfo() { return mSecurityInfo; } const nsACString& GetRemoteType() override; + void GetRemoteType(nsACString& aRemoteType); void NotifySessionStoreUpdatesComplete(Element* aEmbedder); ===================================== services/fxaccounts/FxAccountsWebChannel.sys.mjs ===================================== @@ -244,10 +244,12 @@ FxAccountsWebChannel.prototype = { lazy.accountServer.asciiHost.endsWith("." + val) ); }); - let { currentRemoteType } = sendingContext.browsingContext; - if (shouldCheckRemoteType && currentRemoteType != "privilegedmozilla") { + if ( + shouldCheckRemoteType && + sendingContext.remoteType != "privilegedmozilla" + ) { log.error( - `Rejected FxA webchannel message from remoteType = ${currentRemoteType}` + `Rejected FxA webchannel message from remoteType = ${sendingContext.remoteType}` ); return; } @@ -471,6 +473,9 @@ FxAccountsWebChannel.prototype = { * The <EventTarget> where the message was sent. * @param sendingContext.principal {Principal} * The <Principal> of the EventTarget where the message was sent. + * @param sendingContext.remoteType {String} + * The remoteType from which the + * WebChannelMessageToChrome was sent. * @private * */ ===================================== toolkit/actors/WebChannelParent.sys.mjs ===================================== @@ -18,6 +18,7 @@ export class WebChannelParent extends JSWindowActorParent { browser: this.browsingContext.top.embedderElement, eventTarget: msg.data.eventTarget, principal: this.manager.documentPrincipal, + remoteType: this.manager.remoteType, }; // data must be a string except for a few legacy origins allowed by browser-content.js. if (typeof data == "string") { ===================================== toolkit/components/extensions/ConduitsParent.sys.mjs ===================================== @@ -165,19 +165,23 @@ const Hub = { let windowGlobal = actor.manager; while (windowGlobal) { - let { browsingContext: bc, documentPrincipal: prin } = windowGlobal; + let { + parentWindowContext: parent, + documentPrincipal: prin, + remoteType, + } = windowGlobal; if (prin.addonId !== extensionId) { throw new Error(`Bad ${extensionId} principal: ${prin.URI.spec}`); } - if (bc.currentRemoteType !== prin.addonPolicy.extension.remoteType) { - throw new Error(`Bad ${extensionId} process: ${bc.currentRemoteType}`); + if (remoteType !== prin.addonPolicy.extension.remoteType) { + throw new Error(`Bad ${extensionId} process: ${remoteType}`); } - if (!bc.parent) { + if (!parent) { return true; } - windowGlobal = bc.embedderWindowGlobal; + windowGlobal = parent; } throw new Error(`Missing WindowGlobalParent for ${extensionId}`); }, ===================================== toolkit/modules/WebChannel.sys.mjs ===================================== @@ -170,6 +170,9 @@ WebChannel.prototype = { * @param sendingContext.principal {Principal} * The <Principal> of the EventTarget where the * message was sent. + * @param sendingContext.remoteType {String} + * The remoteType from which the + * WebChannelMessageToChrome was sent. */ listen(callback) { if (this._deliverCallback) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/46… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/46… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-bundle-testsuite][main] 3 commits: Bug 40091: Fix minidump-stackwalk extraction for Windows
by brizental (＠brizental) 18 May '26

18 May '26

brizental pushed to branch main at The Tor Project / Applications / tor-browser-bundle-testsuite Commits: d4edf031 by Beatriz Rizental at 2026-05-18T11:58:17-03:00 Bug 40091: Fix minidump-stackwalk extraction for Windows - - - - - 3aac8b9d by Beatriz Rizental at 2026-05-18T12:08:46-03:00 Bug 40091: Drop architecture from MacOS installer URL - - - - - 39ccc1b3 by Beatriz Rizental at 2026-05-18T12:16:21-03:00 Bug 40091: Skip mullvad pipelines, for now - - - - - 2 changed files: - .gitlab/scripts/before_script.py - tools/trigger-test-pipeline.py Changes: ===================================== .gitlab/scripts/before_script.py ===================================== @@ -76,11 +76,19 @@ def download_minidump_stackwalk( ) -> None: dest_dir = Path(moz_fetches_dir) / "minidump-stackwalk" dest_dir.mkdir(parents=True, exist_ok=True) - - tar_path = Path("minidump-stackwalk.tar.xz") - download_file(minidump_stackwalk_url, tar_path, sha256) - extract_tar(tar_path, dest_dir) - print(f"Extracted minidump-stackwalk -> {dest_dir}") + print(f"Downloading minidump-stackwalk from {minidump_stackwalk_url}") + + is_zip = minidump_stackwalk_url.endswith(".zip") + archive_path = Path("minidump-stackwalk.zip" if is_zip else "minidump-stackwalk.tar.xz") + download_file(minidump_stackwalk_url, archive_path, sha256) + + print(f"Extracting {archive_path} -> {dest_dir}") + if is_zip: + with zipfile.ZipFile(archive_path) as zf: + zf.extractall(dest_dir) + else: + extract_tar(archive_path, dest_dir) + print(f"minidump-stackwalk ready at {dest_dir}") def get_android_sdk_repack_url(): ===================================== tools/trigger-test-pipeline.py ===================================== @@ -70,6 +70,9 @@ def build_inputs(step_name: str, publish_url: str, publish_dir: str) -> dict[str # Add the architecture as padding, to address the macos case which doesn't # have architecture in the step name since it is a universal build. browser, channel, platform, architecture = (step_name.split("-") + ["x86_64"])[:4] + if browser != "torbrowser": + logger.info("Only tor borwser tests are currently supported. Skipping.") + return None if channel != "nightly": logger.info("This script only knows how to handle nightly builds. Skipping.") return None @@ -90,7 +93,7 @@ def build_inputs(step_name: str, publish_url: str, publish_dir: str) -> dict[str case "windows": installer = f"{hyphenated_browser}-{platform}-{architecture}-portable-tbb-{channel}.{date}.exe" case "macos": - installer = f"{hyphenated_browser}-{platform}-{architecture}-tbb-{channel}.{date}.dmg" + installer = f"{hyphenated_browser}-{platform}-tbb-{channel}.{date}.dmg" case "android": installer = f"{hyphenated_browser}-qa-{platform}-{architecture}-tbb-{channel}.{date}.apk" case _: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-bundle-testsuite… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-bundle-testsuite… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 40091: Build and include mozharness in the android artifacts dir
by brizental (＠brizental) 18 May '26

18 May '26

brizental pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: f2a9cda8 by Beatriz Rizental at 2026-05-18T12:24:28-03:00 Bug 40091: Build and include mozharness in the android artifacts dir - - - - - 1 changed file: - projects/geckoview/build Changes: ===================================== projects/geckoview/build ===================================== @@ -37,6 +37,9 @@ echo "Starting ./mach build $(date)" # Naming convention is the same as Mozilla uses for their artifacts mv obj-*/gradle/build/mobile/android/geckoview_example/outputs/apk/*/geckoview_example-*.apk $artifactsdir/geckoview_example.apk mv obj-*/dist/target.* $artifactsdir + + ./mach python -m mozbuild.action.test_archive mozharness mozharness.zip + mv mozharness.zip $artifactsdir [% END %] echo "Build finished, copying the AAR to the to the destination directory $(date)" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0