head	1.5;
access;
symbols
	pkgsrc-2026Q3:1.3.0.2
	pkgsrc-2026Q3-base:1.3
	pkgsrc-2026Q2:1.1.0.2
	pkgsrc-2026Q2-base:1.1;
locks; strict;
comment	@# @;


1.5
date	2026.11.08.12.32.17;	author ryoon;	state Exp;
branches;
next	1.4;
commitid	05TK46JFN4uuHE2H;

1.4
date	2026.10.16.16.36.07;	author ryoon;	state Exp;
branches;
next	1.3;
commitid	OGllP8cSvcoYMIZG;

1.3
date	2026.08.30.10.26.06;	author ryoon;	state Exp;
branches;
next	1.2;
commitid	O8bZQWT6Sy8HfETG;

1.2
date	2026.07.22.15.46.01;	author ryoon;	state Exp;
branches;
next	1.1;
commitid	fczfFPf361cbhFOG;

1.1
date	2026.06.06.14.51.30;	author ryoon;	state Exp;
branches;
next	;
commitid	SvtbqHJcOHZ8sKIG;


desc
@@


1.5
log
@mail/thunderbird: Update to 159.0

Changelog:
159.0:
What's Fixed

fixed
Non-ASCII IMAP tags could exceed server length limits and be rejected

fixed
Zoom Text Only option did not work in the View menu

fixed
Multiple messages were printed even after canceling the print dialog

fixed
Save All and Detach All failed for attachments with invalid filename paths

fixed
First Wrap Long Lines toggle did nothing in View Source

fixed
POP3 NTLM authentication failed because the password was sent incorrectly

fixed
Search Messages menu option was enabled but did not work for saved search
folders

fixed
Quick Find shortcut (/) only worked after Ctrl+F was used once

fixed
Unicode email addresses could hide different Reply-To destinations

fixed
Newsgroups with UTF-8 names could display duplicate or incorrect messages

fixed
View > Folders did nothing in Calendar and Tasks tabs

fixed
Global search results did not display recipients in the To field

fixed
Forwarding malformed MIME messages could omit attachments

fixed
Retry and Save Locally failed after a sent-folder copy error

fixed
Closing an unmodified compose window prompted to save when using Body Text

fixed
MP4 attachments could be truncated when forwarding messages

fixed
Inline images disappeared when editing local or POP messages as new

fixed
EWS/Graph accounts could fail when outgoing server settings were incomplete

fixed
Account Hub Edit Configuration did nothing for Exchange and Graph accounts

fixed
First message filter condition could not be removed even when others existed

fixed
CardDAV address book sync stopped when the server rejected an invalid sync
token

fixed
CardDAV passwords were not saved, causing repeated login prompts after restart

fixed
Thunderbird could hang on startup when restoring IMAP message and PDF tabs

fixed
Malformed message database files could cause excessive CPU usage

fixed
IMAP namespace root folders were inaccessible due to duplicated folder names

fixed
Excessive Microsoft Graph requests caused throttling and delayed message
display

fixed
SMTP addresses with line breaks could inject unintended commands

fixed
POP3 sessions remained active after canceling the password prompt

fixed
Remote content could load in news articles with missing message headers

fixed
RSS feeds could inject arbitrary Message-ID and References headers

fixed
Large ICS calendar files could exhaust memory and freeze Thunderbird

fixed
CalDAV calendars could stop syncing after a network error until restart

fixed
Account Hub failed to discover CalDAV calendars for OAuth2 accounts

fixed
Yearly recurring events with multiple times per day only appeared at the first
time

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-121
#CVE-2026-118174: Displaying a message could load an attacker-chosen URL
through an OpenPGP key attachment
#CVE-2026-118175: Content of other messages could be included when replying to
a crafted message
#CVE-2026-118176: Bypass of remote UNC path restriction in mailbox: URLs
#CVE-2026-118177: Calendar discovery accepted local file and remote network
share locations
#CVE-2026-118178: RSS feed could redirect its subscription to a local file or
network share
#CVE-2026-118179: Request forgery via news: links
#CVE-2026-118180: Matrix homeserver could redirect the chat session to a local
file or network share
#CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component
#CVE-2026-117861: Sandbox escape in the DOM: Navigation component
#CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in
the Networking component
#CVE-2026-117863: Information disclosure due to uninitialized memory in the
Audio/Video component
#CVE-2026-117864: Sandbox escape in the Form Manager component
#CVE-2026-117865: Use-after-free in the JavaScript: GC component
#CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
#CVE-2026-117867: Use-after-free in the Layout component
#CVE-2026-117868: Sandbox escape in the DOM: Networking component
#CVE-2026-117869: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117870: Use-after-free in the JavaScript Engine component
#CVE-2026-117871: Invalid pointer in the Graphics component
#CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component
#CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback
component
#CVE-2026-118005: Use-after-free in the WebRTC: Signaling component
#CVE-2026-117874: Use-after-free in the Internationalization component
#CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow
component
#CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-118006: Privilege escalation due to use-after-free in the WebRTC:
Signaling component
#CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-118007: Use-after-free in the JavaScript: GC component
#CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB
component
#CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component
#CVE-2026-118008: Privilege escalation in the DOM: Navigation component
#CVE-2026-117880: Use-after-free in the XML component
#CVE-2026-118009: Integer overflow, use-after-free in the Graphics: Text
component
#CVE-2026-117881: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117882: Use-after-free in the Layout component
#CVE-2026-117883: Use-after-free in the DOM: HTML Parser component
#CVE-2026-117884: Use-after-free in the Networking component
#CVE-2026-117885: Use-after-free in the Layout: Grid component
#CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component
#CVE-2026-117887: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118010: Use-after-free in the Disability Access APIs component
#CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component
#CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine
component
#CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC:
Networking component
#CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component
#CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling
component
#CVE-2026-117895: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117896: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component
#CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117899: Use-after-free in the Networking: HTTP component
#CVE-2026-117900: Use-after-free in the DOM: Editor component
#CVE-2026-117901: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-117903: Use-after-free in the Audio/Video component
#CVE-2026-117904: Use-after-free in the JavaScript: GC component
#CVE-2026-117905: Use-after-free in the Audio/Video: Playback component
#CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-117907: Use-after-free in the Networking component
#CVE-2026-117908: Use-after-free in the Graphics: ImageLib component
#CVE-2026-117909: Use-after-free in the JavaScript: GC component
#CVE-2026-117910: Invalid pointer in the JavaScript Engine component
#CVE-2026-117911: Use-after-free in the Audio/Video: Playback component
#CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation
component
#CVE-2026-117913: Use-after-free in the SVG component
#CVE-2026-117914: Use-after-free in the SVG component
#CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline
component
#CVE-2026-117916: Use-after-free in the XSLT component
#CVE-2026-117917: Invalid pointer in the Graphics: WebRender component
#CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-117919: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117920: Use-after-free in the DOM: HTML Parser component
#CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component
#CVE-2026-117922: Use-after-free in the Networking: WebSockets component
#CVE-2026-117923: Use-after-free in the Audio/Video component
#CVE-2026-117924: Use-after-free in the XSLT component
#CVE-2026-117925: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117926: Incorrect boundary conditions in the SVG component
#CVE-2026-117927: Use-after-free in the SVG component
#CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation
component
#CVE-2026-117929: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-117931: Use-after-free in the DOM: Events component
#CVE-2026-117932: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component
#CVE-2026-117934: Use-after-free in the Layout component
#CVE-2026-118011: Frame poisoning in the CSS Parsing and Computation component
#CVE-2026-118012: Use-after-free in the DOM: Animation component
#CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-117936: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117937: Invalid pointer in the JavaScript Engine component
#CVE-2026-117938: Use-after-free in the Layout component
#CVE-2026-117939: Use-after-free in the XML component
#CVE-2026-117940: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118013: Use-after-free in the Layout: Images, Video, and HTML Frames
component
#CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component
#CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT
component
#CVE-2026-118014: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-117943: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117944: Use-after-free in the Layout component
#CVE-2026-118015: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117945: Incorrect boundary conditions in the XML component
#CVE-2026-118016: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine
component
#CVE-2026-117947: Use-after-free in the XML component
#CVE-2026-117948: Use-after-free in the SVG component
#CVE-2026-117949: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML
component
#CVE-2026-117951: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117952: Uninitialized memory in the Networking component
#CVE-2026-117953: Use-after-free in the DOM: Core & HTML component
#CVE-2026-118017: Use-after-free in the SVG component
#CVE-2026-117954: Use-after-free in the Layout: Positioned component
#CVE-2026-118019: Race condition, use-after-free in the DOM: File component
#CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-100801: Privilege escalation in the DLL Services component
#CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component
#CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component
#CVE-2026-117958: Site isolation issue in the Networking: HTTP component
#CVE-2026-117959: Site isolation issue in the DOM: Service Workers component
#CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component
#CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts
component
#CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the
Storage: Quota Manager component
#CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers
component
#CVE-2026-117964: Use-after-free in the Panning and Zooming component
#CVE-2026-117965: Same-origin policy bypass in the Address Bar component
#CVE-2026-117966: Site isolation issue in the Networking: HTTP component
#CVE-2026-117967: Mitigation bypass in the DOM: Security component
#CVE-2026-118020: Use-after-free in the Layout component
#CVE-2026-117968: Use-after-free in the DOM: Core & HTML component
#CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-117970: Race condition in the Disability Access APIs component
#CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview
component
#CVE-2026-117972: Use-after-free in the Graphics component
#CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component
#CVE-2026-117973: Use-after-free in the Networking: DNS component
#CVE-2026-117974: Use-after-free in the XML component
#CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics:
WebRender component
#CVE-2026-117976: Site isolation issue in the DOM: Navigation component
#CVE-2026-117977: Other issue in the Console component
#CVE-2026-117978: Incorrect boundary conditions in the Graphics component
#CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender
component
#CVE-2026-117980: Use-after-free in the Graphics component
#CVE-2026-117981: Privilege escalation in the Toolkit component
#CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component
#CVE-2026-117983: Use-after-free in the Graphics component
#CVE-2026-118022: Sandbox escape due to use-after-free in the Disability Access
APIs component
#CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and
Overflow component
#CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics
component
#CVE-2026-117986: Use-after-free in the Graphics component
#CVE-2026-117987: Use-after-free in the Graphics component
#CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
#CVE-2026-117989: Use-after-free in the Graphics component
#CVE-2026-118023: Sandbox escape due to use-after-free in the Graphics:
WebRender component
#CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
#CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts
component
#CVE-2026-117992: Information disclosure in the CSS Parsing and Computation
component
#CVE-2026-117993: Integer overflow in the Graphics: Text component
#CVE-2026-117994: Use-after-free in the JavaScript: GC component
#CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling
component
#CVE-2026-117996: Incorrect boundary conditions in the WebRTC component
#CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component
#CVE-2026-118024: Use-after-free in the Graphics: Text component
#CVE-2026-118025: Other issue in the SVG component
#CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component
#CVE-2026-117999: Race condition in the IPC component
#CVE-2026-118000: Information disclosure in the Networking: HTTP component
#CVE-2026-118002: Information disclosure due to race condition in the
Networking component
#CVE-2026-118003: Information disclosure in the Networking: DNS component
#CVE-2026-118026: Invalid pointer in the JavaScript: GC component
#CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and
Animations component


158.0.1:
What's Fixed

fixed
Dialogs had transparent backgrounds with third party themes

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-114
#CVE-2026-113866: Account password sent unencrypted during Exchange account
setup
#CVE-2026-113867: Stanza injection in XMPP chat
#CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in
POP3 and SMTP NTLM authentication
#CVE-2026-113869: Use-after-free in S/MIME decryption during a security device
password prompt
#CVE-2026-113399: Incorrect boundary conditions in the SVG component
#CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists,
and other State component
#CVE-2026-113400: Uninitialized memory in the Audio/Video: cubeb component
#CVE-2026-113401: Denial-of-service in the PDF Viewer component
@
text
@$NetBSD: patch-python_sites_mach.txt,v 1.6 2026/11/03 16:46:29 ryoon Exp $

* We are offline, so do not try to download from pypi.
  No need to wait a timeout.
* Use pyyaml from vendored unconditionally.

--- python/sites/mach.txt.orig	2026-10-22 17:49:16.000000000 +0000
+++ python/sites/mach.txt
@@@@ -58,15 +58,16 @@@@ pth:xpcom/idl-parser
 pth:xpcom/idl-parser
 # glean-sdk may not be installable if a wheel isn't available
 # and it has to be built from source.
-pypi-optional:glean-sdk==70.2.1:telemetry will not be collected
-pypi-optional:orjson>=3.10:json operations will be slower in various tools
+#pypi-optional:glean-sdk==70.2.1:telemetry will not be collected
+#pypi-optional:orjson>=3.10:json operations will be slower in various tools
 # Mach gracefully handles the case where `psutil` is unavailable.
 # We aren't (yet) able to pin packages in automation, so we have to
 # support down to the oldest locally-installed version (5.4.2).
-pypi-optional:psutil>=5.4.2:telemetry will be missing some data
-pypi-optional:rtoml>=0.11.0:toml operations will be slower in various tools
-pypi-optional:zstandard>=0.11.1,<=0.25.0:zstd archives will not be possible to extract
-vendored-fallback:pyyaml:third_party/python/pyyaml/lib/:faster native loading is disabled
+#pypi-optional:psutil>=5.4.2:telemetry will be missing some data
+#pypi-optional:rtoml>=0.11.0:toml operations will be slower in various tools
+#pypi-optional:zstandard>=0.11.1,<=0.25.0:zstd archives will not be possible to extract
+#vendored-fallback:pyyaml:third_party/python/pyyaml/lib/:faster native loading is disabled
+vendored:third_party/python/pyyaml/lib/
 vendored:third_party/python/ansicon
 vendored:third_party/python/appdirs
 vendored:third_party/python/async_timeout
@


1.4
log
@mail/thunderbird: Update to 158.0

Changelog:
158.0:
What's Changed

changed
Quick filter responsiveness has been improved

changed
ExtensionSettings policy installs add-ons from update_url when install_url not
set

What's Fixed

fixed
Copy Link Location only copied detached attachment filenames instead of full
paths

fixed
Thunderbird could crash while performing a Body search

fixed
Attach File dialog failed to open when the previously used folder was
unavailable

fixed
Troubleshooting falsely reported crash reports were not configured when
available

fixed
Right-clicking inline images zoomed them instead of opening the context menu

fixed
Switching to Unified Folders could leave All Folders enabled and not change
view

fixed
Archived Inbox folders ignored localized names and appeared as "INBOX"

fixed
OpenPGP key management had unlocking, handle leak, and protection state issues

fixed
OpenPGP backup password text could not be copied and context menu was
transparent

fixed
Quick Filter failed to match accented names when searching without accents

fixed
Holding Ctrl+Enter could unintentionally confirm the send prompt and send
duplicates

fixed
Plain-text inline forwards omitted signatures placed below the quote

fixed
Remote content exceptions without a scheme only applied to HTTP, not HTTPS

fixed
Remote content exceptions incorrectly allowed wildcard hostnames like
*.example.com

fixed
Saved CalDAV/CardDAV credentials could be forgotten after restarting
Thunderbird

fixed
CardDAV setup failed without prompting for a password

fixed
CardDAV address book sync failed to fetch newly added contacts

fixed
CardDAV updates could corrupt vCard REV timestamps

fixed
CardDAV discovery could fail on valid multi-status responses with mixed status
codes

fixed
SMTP Kerberos authentication failed on Linux with STARTTLS

fixed
POP accounts repeatedly showed connection errors when Thunderbird started
offline

fixed
Matrix SSO with Save Token disabled reopened the login flow indefinitely

fixed
RSS filtering could lose tags and stall processing of later feed items

fixed
CalDAV password prompts did not identify the username or calendar

fixed
Calendar event edits could fail with localization error in the event dialog

fixed
Updated calendar credentials were not saved from the authentication prompt

fixed
Visual and UX improvements

fixed
Security fixes
 Mozilla Foundation Security Advisory 2026-109
#CVE-2026-110247: Integer overflow in libmime buffer growth could lead to heap
 corruption
#CVE-2026-110249: Denial-of-service in the Exchange email component
#CVE-2026-109704: Privilege escalation in the Application Update component
#CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect
 boundary conditions, use-after-free in the Networking component
#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component
#CVE-2026-109707: Sandbox escape due to use-after-free in the Networking
 component
#CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the
 Networking component
#CVE-2026-109709: Information disclosure, privilege escalation in the Security:
 Process Sandboxing component
#CVE-2026-109710: Use-after-free in the Graphics: Text component
#CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component
#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics
 component
#CVE-2026-109713: Use-after-free in the Crash Reporting component
#CVE-2026-109714: Incorrect boundary conditions in the Layout component
#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine
 component
#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine
 component
#CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-109718: Use-after-free in the XML component
#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL
 component
#CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT
 component
#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component
#CVE-2026-109724: Use-after-free in the DOM: Core & HTML component
#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component
#CVE-2026-109726: Use-after-free in the SVG component
#CVE-2026-109727: Use-after-free in the Audio/Video component
#CVE-2026-109728: Use-after-free in the DOM: Animation component
#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component
#CVE-2026-109730: Integer overflow in the Graphics component
#CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D
 component
#CVE-2026-109732: Use-after-free in the DOM: Streams component
#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2026-106016: Mitigation bypass in the File Handling component
#CVE-2026-109734: Mitigation bypass in the DOM: Security component
#CVE-2026-109735: Use-after-free in the DOM: Animation component
#CVE-2026-109736: Frame poisoning in the Layout component
#CVE-2026-109737: Mitigation bypass in the Enterprise Policies component
#CVE-2026-109738: Use-after-free in the Audio/Video: Playback component
#CVE-2026-109739: Privilege escalation in the WebExtensions component
#CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the
 Widget: Win32 component
#CVE-2026-109741: Use-after-free in the Storage: Bucket File System component
#CVE-2026-109742: Information disclosure in the PDF Viewer component
#CVE-2026-109743: Privilege escalation in the Panning and Zooming component
#CVE-2026-109744: Other issue in the DOM: File component
#CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web
 Serial component
#CVE-2026-109746: Mitigation bypass in the DOM: Security component
#CVE-2026-109747: Other issue in the Address Bar component
#CVE-2026-109748: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-109749: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-109750: Site isolation issue in the DOM: Web Authentication component
#CVE-2026-109751: Information disclosure in the Networking component
#CVE-2026-109752: Use-after-free in the DOM: Workers component
#CVE-2026-109753: Incorrect boundary conditions in the Layout component
#CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component
#CVE-2026-109755: Sandbox escape in the DOM: Content Processes component
#CVE-2026-109756: Privilege escalation in the DOM: Navigation component
#CVE-2026-109757: Sandbox escape due to race condition in the Networking
 component
#CVE-2026-109759: Site isolation issue in the Networking component
#CVE-2026-109760: Mitigation bypass in the Networking: HTTP component
#CVE-2026-109761: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-109762: Incorrect boundary conditions in the SVG component
#CVE-2026-109763: Mitigation bypass in the File Handling component
#CVE-2026-109764: Mitigation bypass in the Enterprise Policies component
#CVE-2026-109765: Race condition, use-after-free in the Graphics: Text
 component
#CVE-2026-109766: Mitigation bypass in the Enterprise Policies component
#CVE-2026-109767: Information disclosure in the Networking component
#CVE-2026-109768: Denial-of-service in the Site Reports component
#CVE-2026-109769: Information disclosure in the Networking: Cache component
#CVE-2026-109770: Spoofing issue in the DOM: Web Serial component
#CVE-2026-109771: Information disclosure in the WebRTC: Networking component
#CVE-2026-109772: Same-origin policy bypass in the DevTools component
#CVE-2026-109773: Denial-of-service in the Sync component
#CVE-2026-109774: Invalid pointer, undefined behavior in the DOM: Notifications
 component
#CVE-2026-109775: Denial-of-service in the WebRTC component
#CVE-2026-109776: Race condition in the XPCOM component
#CVE-2026-109777: Information disclosure in the Storage: IndexedDB component
#CVE-2026-109778: Privilege escalation in the WebExtensions component
#CVE-2026-109779: Race condition in the Networking: DNS component
#CVE-2026-109780: Mitigation bypass in the DOM: Core & HTML component
#CVE-2026-109781: Denial-of-service in the Printing: Output component
@
text
@d1 1
a1 1
$NetBSD: patch-python_sites_mach.txt,v 1.4 2026/08/24 12:51:47 ryoon Exp $
d7 1
a7 1
--- python/sites/mach.txt.orig	2026-10-08 02:24:09.000000000 +0000
d13 1
a13 1
-pypi-optional:glean-sdk==70.2.0:telemetry will not be collected
d15 1
a15 1
+#pypi-optional:glean-sdk==70.2.0:telemetry will not be collected
@


1.3
log
@mail/thunderbird: Update to 154.0

Changelog:
154.0:
What's New

new
Preview functionality for attachments on macOS

new
CMS message with AuthEnvelopedData can be decrypted properly in Thunderbird

new
Global search results can open in list view by default with new setting

new
"Copy To" folder context menu added for message/rfc822 attachments

new
Optional system tray mode that hides Thunderbird when the last window closes

new
Support for dragging message/rfc822 type MIME attachments to folder tree

new
Microsoft Graph enabled for Microsoft 365

What's Fixed

fixed
Remote content warnings appeared despite sender block exceptions being applied

fixed
Collapsed saved-search folders did not deselect their subfolders

fixed
Server-designated special folder flags could be removed until restart

fixed
Messages could render excessive trailing blank lines

fixed
Copying a message subject included the "Subject:" label in copied text

fixed
Moving IMAP folders to Local Folders could delete messages after copy failures

fixed
7-bit clean unobtrusive signature payloads were unnecessarily base64 encoded

fixed
DisablePasswordReveal policy failed to prevent revealing saved passwords

fixed
Account setup tried local-part usernames before full email addresses

fixed
Read-only CardDAV address books were incorrectly treated as writable

fixed
Autoscroll icon was missing directional arrows in scrollable messages

fixed
Blank 1970-dated messages could appear from incomplete message file copies

fixed
Opening drafts or templates with invalid quoted-printable data could crash
Thunderbird

fixed
Thunderbird could crash when inserting a message header into database cache

fixed
IMAP repeatedly notified for messages already read on another device

fixed
Dragging EWS search folders to Trash caused Thunderbird to crash

fixed
Folder compaction displayed incorrect disk space recovery estimates

fixed
Custom OAuth settings for EWS account overwrote original account's settings

fixed
Thunderbird could crash when going offline with an active IMAP IDLE connection

fixed
Thunderbird could crash while running online mail search

fixed
Exchange accounts could show repeated false login failures during
authentication

fixed
Expired newsgroup articles showed an insecure "click here" purge link

fixed
IMAP attachments appeared empty after messages were moved by filters

fixed
Default special-folder names could reference nonexistent server folders

fixed
Thunderbird macOS fell back to Software WebRender after GPU process launch
failures

fixed
New RSS subscriptions used updated dates instead of published dates

fixed
Calendar sort order was not preserved across Thunderbird restarts

fixed
"All calendars are disabled" banner reappeared after enabling a calendar

fixed
Dismissed CalDAV reminders could permanently stop future event notifications

fixed
Read-only CardDAV calendars were incorrectly treated as writable

fixed
CalDAV sync failed when server responses used UTF-16 encoding

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-78
#CVE-2026-75874: Sandbox escape in the Remote Settings Client component
#CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
#CVE-2026-74935: Privilege escalation in the DOM: Networking component
#CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
#CVE-2026-74937: Use-after-free in the JavaScript: GC component
#CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
#CVE-2026-74939: Privilege escalation in the DOM: Navigation component
#CVE-2026-74940: Use-after-free in the Graphics: Text component
#CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
#CVE-2026-74942: Privilege escalation in the Remote Settings Client component
#CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
#CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
#CVE-2026-74945: Information disclosure in the Graphics: Text component
#CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in
 the Graphics: CanvasWebGL component
#CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics
 component
#CVE-2026-74948: Information disclosure in the Graphics component
#CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics:
 Canvas2D component
#CVE-2026-74950: Privilege escalation in the Downloads API component
#CVE-2026-74952: Privilege escalation in the Application Update component
#CVE-2026-74953: Privilege escalation in the Networking: Cookies component
#CVE-2026-74954: Information disclosure due to side-channel in the Storage:
 Cache API component
#CVE-2026-74955: Privilege escalation in the Request Handling component
#CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers
 component
#CVE-2026-74957: Mitigation bypass in the Safe Browsing component
#CVE-2026-74958: Information disclosure in the WebRTC component
#CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
#CVE-2026-74960: Site isolation issue in the WebExtensions component
#CVE-2026-74961: Side-channel in the Web Audio component
#CVE-2026-74962: Site isolation issue in the Networking: Cookies component
#CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component
#CVE-2026-74964: Integer overflow in the Graphics component
#CVE-2026-74965: Privilege escalation in the Shell Integration component
#CVE-2026-74966: Information disclosure in the Form Autofill component
#CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback
 component
#CVE-2026-74968: Site isolation issue in the Graphics: WebRender component
#CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
#CVE-2026-74970: Site isolation issue in the Graphics component
#CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling
 component
#CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions
 component
#CVE-2026-74973: Race condition, use-after-free in the Graphics component
#CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
#CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component
#CVE-2026-74977: Integer overflow in the Graphics component
#CVE-2026-74978: Clickjacking issue in the Widget component
#CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
#CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component
#CVE-2026-74982: Denial-of-service in the Widget component
#CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component
#CVE-2026-74984: Race condition in the JavaScript Engine component
#CVE-2026-74985: Privilege escalation in the Enterprise Policies component
#CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation
 component
#CVE-2026-74987: Internally found bugs fixed in Thunderbird ESR 140.14,
 Thunderbird ESR 153.1 and Thunderbird 154
#CVE-2026-74988: Internally found bugs fixed in Thunderbird ESR 153.1 and
 Thunderbird 154
#CVE-2026-74989: Internally found bugs fixed in Thunderbird 154
#CVE-2026-74990: Internally found bugs fixed in Thunderbird ESR 140.14,
 Thunderbird ESR 153.1 and Thunderbird 154
@
text
@d1 1
a1 1
$NetBSD$
d7 1
a7 1
--- python/sites/mach.txt.orig	2026-08-14 13:12:29.655766457 +0000
d13 1
a13 1
-pypi-optional:glean-sdk==68.0.1:telemetry will not be collected
d15 1
a15 1
+#pypi-optional:glean-sdk==68.0.1:telemetry will not be collected
@


1.2
log
@mail/thunderbird: Update to 152.0.1

Changelog:
152.0.1:
What's Fixed

fixed
Reply All button was missing for some EWS messages with multiple recipients

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-63
#CVE-2026-57962: Denial-of-service via malicious LDAP address-book server
#CVE-2026-57963: Chat UI manipulation by injection


152.0:
What's New

new
SecurityDevices enabled in enterprise policies

new
One-click account setup for Thundermail accounts

What's Changed

changed
Use 'Add' instead of 'New' for account, calendar, address book creation buttons

changed
GMail OAuth updated to use PKCE

changed
Mail server hostname also checked when detecting address books and calendars

changed
Updated about:rights to replace local with hosted url

changed
'Hide completed tasks' now also hides cancelled tasks

What's Fixed

fixed
New mail alerts appeared on wrong monitor in three-monitor setup

fixed
Spam messages triggered new mail notifications before being moved to Spam
folder

fixed
Filtered IMAP or NNTP subscriptions were lost after closing Subscribe dialog

fixed
'Download Headers' dialog for newsgroups failed to open

fixed
Messages nested deeper than 255 levels disappeared from threading view

fixed
Performing Delete followed by Undo on thread parent message could corrupt view

fixed
Single messages still appeared collapsible after thread members were deleted

fixed
Updated threads remained misordered until folder refresh or resort

fixed
Non-threaded subject sorting separated 'RE:' replies from original messages

fixed
BCC recipients were included in signed email headers

fixed
Filter search on Body missed draft messages containing German umlauts

fixed
Thunderbird could crash during local message search

fixed
Blocked file warning showed without 'Unblock File' button in compose window

fixed
Forwarding/Redirecting Exchange messages failed with NS_ERROR_OUT_OF_MEMORY

fixed
Compose window closed early and send progress dialog hung after NNTP failure

fixed
Compose window stayed open after sending when mailnews.sendInBackground set

fixed
Microsoft OAuth2 failed when HTTPS localhost redirect was not intercepted

fixed
Pasting contact photos stopped working when photo button had focus

fixed
Filter dialog lacked focus ring and had poorly distinguishable buttons

fixed
Subfolder kept stale accessibility unread count after unread messages were
deleted

fixed
'Edit as New Message' and inline 'Forward' not possible with PGP-signed
messages

fixed
Various MIME improvements

fixed
EWS messages could go missing from folder view

fixed
IMAP "Show only subscribed folders" could not be changed without restart

fixed
Unable to delete more than 1000 messages at a time on Microsoft 365

fixed
EWS folders in Trash were moved to Trash again instead of being hard deleted

fixed
IMAP notifications repeated for emails read on another device after sleep wake

fixed
POP3 deadlocked when server went silent without closing socket

fixed
Calendar acceptance no longer distinguished between single occurrence and
series

fixed
Transparent popups on macOS made calendar event editing difficult

fixed
Duplicate attendees were added to invitations instead of being filtered out

fixed
Task percentage complete was not preserved separately from status in tooltips

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-60
#CVE-2026-12289: Privilege escalation in the Graphics: WebRender component
#CVE-2026-12290: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12291: Use-after-free in the Networking: HTTP component
#CVE-2026-12292: Incorrect boundary conditions in the Web Audio component
#CVE-2026-12293: Use-after-free in the Graphics: WebGPU component
#CVE-2026-12294: Sandbox escape in the DOM: Workers component
#CVE-2026-12295: Sandbox escape in the DOM: Navigation component
#CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component
#CVE-2026-12297: Sandbox escape due to incorrect boundary conditions in the
 Networking component
#CVE-2026-12298: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12299: JIT miscompilation in the DOM: Core & HTML component
#CVE-2026-12300: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12301: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12302: Mitigation bypass in the DOM: Security component
#CVE-2026-12303: Information disclosure due to incorrect boundary conditions in
#CVE-2026-12304: Same-origin policy bypass in the Networking: Cookies component
#CVE-2026-12305: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12306: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12307: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12308: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12309: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12310: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12311: Information disclosure, sandbox escape in the Security:
 Process Sandboxing component
#CVE-2026-12312: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12313: Information disclosure, sandbox escape in the Security:
 Process Sandboxing component
#CVE-2026-12314: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12315: Mitigation bypass in the DOM: Security component
#CVE-2026-12316: Mitigation bypass in the DOM: Security component
#CVE-2026-12317: Memory safety bug fixed in Thunderbird 152
#CVE-2026-12318: Incorrect boundary conditions in the Libraries component in
 NSS
#CVE-2026-12319: Denial-of-service in the Audio/Video: Playback component
#CVE-2026-12320: Information disclosure in the Password Manager component
#CVE-2026-12321: JIT miscompilation in the JavaScript: WebAssembly component
#CVE-2026-12322: Clickjacking issue in the Widget: Gtk component
#CVE-2026-12323: Spoofing issue in the DOM: Core & HTML component
#CVE-2026-12324: Incorrect boundary conditions in the Graphics: CanvasWebGL
 component
#CVE-2026-12325: Denial-of-service in the Graphics: ImageLib component
#CVE-2026-12326: Memory safety bugs fixed in Firefox 152 and Thunderbird 152
#CVE-2026-12327: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird
 ESR 140.12, Firefox 152 and Thunderbird 152
#CVE-2026-12328: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR
 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
@
text
@d1 1
a1 1
$NetBSD: patch-python_sites_mach.txt,v 1.2 2026/05/30 17:06:09 ryoon Exp $
d7 1
a7 1
--- python/sites/mach.txt.orig	2026-06-15 11:44:55.169043237 +0000
d13 1
a13 1
-pypi-optional:glean-sdk==67.3.2:telemetry will not be collected
d15 1
a15 1
+#pypi-optional:glean-sdk==67.3.2:telemetry will not be collected
@


1.1
log
@mail/thunderbird: Update to 151.0.1

Changelog:
151.0.1:
Fixed
Forwarding/Redirecting Exchange messages failed with NS_ERROR_OUT_OF_MEMORY

151.0:
What's New
new
Enable Thundermail OAuth sign-in with account auto-configuration

new
Enable users to override OAuth provider details for EWS accounts

new
Tasks can be sorted by created or modified date

What's Changed
changed
Reinstated default application check when Thunderbird starts

changed
OpenPGP public key no longer attached by default in signed-only messages

What's Fixed
fixed
Thunderbird could crash when processing message headers

fixed
Thunderbird could crash on startup

fixed
Calendar view tabs were not properly keyboard accessible

fixed
Thunderbird could crash when processing new incoming messages

fixed
On macOS, dragging attachments out of Thunderbird created multiple copies

fixed
Cancelling a newsgroup posting was not possible

fixed
Some IMAP emails showed current time instead of correct received date

fixed
Search result count was missing when using 'Find in Message' or Ctrl+F

fixed
Search results showed older irrelevant emails before newer exact matches

fixed
Reply with selected text lost formatting for HTML messages containing </pre>

fixed
Multipart/related attachments were not preserved when editing or forwarding

fixed
Forwarded malformed MIME email had empty body and extra attachment

fixed
OWL add-on description was not visible in Account Hub for non-en-US locales

fixed
Account Hub prompted for password after OAuth login, causing Outlook setup
failure

fixed
Auto-discovered Account Hub values were not preserved for manual editing

fixed

Account Hub links for encryption and signature opened the wrong account

fixed
Virtual folders did not update correctly for filtered POP3 messages

fixed
Thunderbird could crash in spam filtering

fixed
Using thunderbird -compose with double quotes made last email address invalid

fixed
With auto-mark-read disabled, large mail still marked as read during load delay

fixed
It was not possible to create date-only all-day tasks

fixed
Task context menu (right-click) had several disabled menu items

fixed
'Current Tasks' view showed past and finished tasks instead of only unfinished

fixed
Visual and UX improvements

fixed
Security fixes

Security fixes:
Mozilla Foundation Security Advisory 2026-50
#CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs
 component
#CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component
#CVE-2026-8948: Same-origin policy bypass in the DOM: Networking component
#CVE-2026-8949: Integer overflow in the Widget: Win32 component
#CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component
#CVE-2026-8952: Privilege escalation in the Application Update component
#CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access
 APIs component
#CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/
 Video component
#CVE-2026-8955: Privilege escalation in the DOM: Workers component
#CVE-2026-8956: Integer overflow in the Networking: JAR component
#CVE-2026-8957: Privilege escalation in the Enterprise Policies component
#CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process
 Sandboxing component
#CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the
 Widget: Win32 component
#CVE-2026-8960: Spoofing issue in WebExtensions
#CVE-2026-8961: Spoofing issue in the Form Autofill component
#CVE-2026-8962: Mitigation bypass in the DOM: Security component
#CVE-2026-8963: Spoofing issue in the Web Speech component
#CVE-2026-8964: Spoofing issue in the Popup Blocker component
#CVE-2026-8965: Information disclosure in the DOM: Security component
#CVE-2026-8966: Information disclosure in the IP Protection component
#CVE-2026-8967: Information disclosure in the Graphics: WebGPU component
#CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video:
 Web Codecs component
#CVE-2026-8969: Mitigation bypass in the DOM: Security component
#CVE-2026-8970: Privilege escalation in the Security component
#CVE-2026-8971: Same-origin policy bypass in the Networking: JAR component
#CVE-2026-8972: Privilege escalation in the WebRTC: Audio/Video component
#CVE-2026-8973: Memory safety bugs fixed in Thunderbird 151
#CVE-2026-8974: Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird
 151
#CVE-2026-8975: Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird
 151
@
text
@d1 1
a1 1
$NetBSD$
d7 1
a7 1
--- python/sites/mach.txt.orig	2026-05-13 13:12:50.000000000 +0000
d13 1
a13 1
-pypi-optional:glean-sdk==67.2.0:telemetry will not be collected
d15 1
a15 1
+#pypi-optional:glean-sdk==67.2.0:telemetry will not be collected
@