Pale Moon

[ashwin]

Pale Moon 27.6.1

This is a minor bugfix release to address some pressing issues people have reported.

Changes/fixes:

• Fixed a regression with new windows (opening two windows from the command-line or file association, focus issues on new windows, not loading the home page in a new window, etc.)
  
• Aligned XHR with the currect spec to allow withCredentials.
  
• Fixed an input element focus issue within handlers.
  
• Fixed the processing of all-padding HTTP/2 frames to prevent rare HTTP/2 hangups.
  
• Updated CitiBank override to work around their login issues.
  
• Updated Netflix override to a community-supplied one that seems to satisfy their arbitrary restrictions better.
  

http://www.palemoon.org/releasenotes.shtml

[harlan4096]

Pale Moon 28.3.0 released:

Pale Moon 28.3.0, a new version of the desktop web browser, was released on January 15, 2019. The new Pale Moon version is a major release; it includes security fixes and protective features, support for new features such as AV1 for video playback, and bugfixes.

Existing users may use the built-in update check to download and install the new version. Just select Pale Moon > Help > About Pale Moon, and click on Check for Updates to run a check for new versions.

Pale Moon 28.3.0 should be returned so that it can be downloaded and installed on the system. The new version is available as a direct download on the project's website as well; users who run the portable version find its download listed there as well.

Full info: https://www.ghacks.net/2019/01/18/pale-m...-released/

[Deep900]

I like the UI of Pale Moon, but for security I still prefer Chrome (because of the advanced security features). Thanks for sharing the update guys!

[harlan4096]

Pale Moon 28.5.0:

v28.5.0 (2019-04-30)
This is a major development and bugfix update.

Changes/fixes:

Redesigned the about box.
Added "Check for updates" menu entries to the AppMenu and classic menu (since the About box redesign no longer has application update in it).
Restored the app.update.url.override pref for AUS testing/override.
Added "Loop" control to html5 video.
Fixed a crash with frames (e.g. when using Tile Tabs).
Fixed an issue with textarea placeholders (spec compliance).
Removed the Windows Maintenance Service one last time.
Improved http basic auth DoS heuristics.
Fixed an issue on big-endian machines (e.g. PPC64/linux).
Removed e10s code from widgets.
Preffed the various http "Accept" headers and aligned with the Fetch spec (except for image requests).
Aligned URLSearchParams with the spec.
Updated several site-specific UA overrides.
Fixed "Yet Another special case of a flex frame being the absolute containing block"™
Fixed border drawing when the tab bar is hidden.
Pref-controlled and disabled the use of unboxed plain objects in JavaScript's JIT compiler.
Improved handling of interrupted connections through proxies and pseudo-VPN extensions.
Removed contextual identity.
Updated the 7zip installer stub to a much more recent code version.
Fixed an issue with applying percentages to 0 in layout sizes.
Fixed an issue with calculating linear sums in JS JITed code.
Added default value feature to get*Pref() preference functions.
Fixed an issue that would occasionally overwrite the new tab custom URL.
Updated the SQLite library to 3.27.2
Killed the crashreporter toolkit files and exception handler hooks.
Fixed an issue with a missing border on the tab bar when on the bottom.
Fixed a crash with badly-formatted SVG files.
Showed the robots to the exit after squatting in the browser for decades.
JavaScript: Implemented TC39 toString() revision proposal.
Rearchitectured the JavaScript front-end parser to provide better and more logical parsing of JS code.
Removed support code and leftovers for unsupported SunOS, AIX, BEOS, HPUX and OS/2 operating systems.
Fixed a scrollbar arrow issue on OS X.
Removed all Firefox Accounts code.
Made the CSS parser more robust and aligned url() behavior with the CSS3 spec in case of bad input.
Fixed an issue with blocklist updates not actually dynamically applying due to a wrong URL.
Updated the embedded emoji font to the TweMoji v11.4.0 equivalent.
Fixed an issue with async/deferred scripts preventing page loads from completing.
 

Download

[Deep900]

v28.8.0 (2019-12-10)
This is a major development release. Many things have been improved, some landmark features have been added/enabled, and many libraries have been updated for added stability and performance. We hope you are as happy with this progress as we are!

All the best wishes for the Holidays to everyone!

New features:
Added support for modern Solaris operating systems like Illumos (thanks Athenian200!).
Implemented position : sticky for table parts - You can now use CSS to e.g. stick table headers so they don't scroll off the screen!
Enabled basic implementation of module type scripting. While not fully spec compliant (yet), this will fix the few web compatibility issues with sites that rely on this feature without fallback (e.g. the Chromium bugtracker).
Implemented Promise.prototype.finally() (ES2018).
Implemented Regular Expression lookbehind (ES2018).
Implemented Regular Expression /s flag (dotAll support) (ES2018).
Implemented String.prototype.matchAll (regex) (ES2020).
Added Ekoru to the list of default search engines. This is a Bing-backed search engine that donates the majority of its revenue to various charities that support the planet and animals. An environment-supporting alternative to Ecosia if you don't want to support Google in the process.
Changes/fixes:
Changed the way tables are rendered to fix a number of spec compliance issues and allow relative positioning of table parts.
Now building against the Windows 10 SDK 10.0.17763.132 for increased compatibility with Windows 10 and improved Spectre mitigation.
Removed the unused DiskSpaceWatcher component.
Updated cairo code.
Updated SQLite to 3.30.1.
Updated the Brotli library to 1.0.7.
Updated the woff2 library to 1.0.2.
Updated the OpenType Sanitizer to 8.0.0.
Updated the Javascript math library for precision and performance fixes.
Updated the embedded Emoji font to Mozilla's COLR-mapped twemoji 0.5.0 (Twemoji 12.1.3), to support Emoji 12.
Improved CSS grid rendering.
Changed packaging for archives to use 7z/xz instead of zip/bz2.
Made the second argument of (DOM/CSS) insertRule() optional for (Chrome) web compatibility.
Removed the non-standard object.prototype.watch()/unwatch() functions. Please note that this may affect some extensions; those will need to be updated to no longer use these non-standard functions.
Fixed the status bar module to work around an issue with relying on watch()/unwatch().
Fixed a build failure in the libcubeb sndio module.
Fixed a small oversight in the release branch that would potentially still mark "jnlp" (Java Web Start) files as executable.
Fixed the certificate retrieval logic in the certificate exception dialog.
Fixed an issue with add-ons potentially getting confused during add-on updates due to cached scripts.
Fixed a crash due to unnecessary reparenting calls in layout.
Reinstated the mentioning of the number of accelerated/total windows in Troubleshooting Information, for completeness.
Moved the embedded font for Emoji from application to platform so all UXP applications can easily benefit from it (thanks Tobin!).
Cleaned up the jemalloc code: Removed dead/unused code, removed conditionals around "always on" code, and made the allocator VLA-free.
Security-related fixes:
Removed the silent fallback to insecure install locations on Windows.
Pale Moon will no longer by default install into unprotected program locations (this was a regression in v28).
If your operating system account does not have the necessary privileges, you need to manually select an accessible folder to install into. This is important to prevent malware from modifying installed programs in well-known but otherwise unprotected installation locations.
Added a preference for, and disabled, the confirmation prompt for URL authentication (prevents evil traps).
Disabled the use of HPKP by default due to the inherent risks involved with this feature. A preference was added to completely disable header processing, and using preloaded pins is effectively disabled. Please note that this is automatically disabled by default for everyone, regardless of your previous setting for this feature, and it is strongly recommended you keep this feature disabled. HPKP will eventually be removed (overall Internet concensus).
Fixed a potential issue when interacting with plugins. (DiD)
Fixed a potential crash scenario when reading PAC configuration. (DiD)
Fixed a potential issue with text selection painting. (DiD)
Fixed an issue with element references not being properly updated. (DiD)
Fixed an issue with incorrect saving of web pages as text. (DiD)
Fixed a potential issue with clipboard handling. (DiD)
Fixed a potential issue with attaching the debugger to web workers. (DiD)
Updated NSS to 3.41.4 to address CVE-2019-11756 and CVE-2019-11745.
Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 8 DiD, 16 not applicable.

https://www.palemoon.org/releasenotes.shtml

[Deep900]

v28.8.1 (2020-01-11)
This is an important security and stability release. Please update your browser to this version as soon as possible.

Changes/fixes:
Fixed a sampling issue in libsoundtouch (DiD)
Fixed an issue with a new upcoming Windows 10 feature not honoring Private Browsing mode by default (DiD)
Fixed several stability and memory safety hazards. (DiD)
Fixed an issue where files could inadvertently be executed with the designated file type handler instead of opened. (CVE-2019-17019)
Fixed an issue with the JavaScript JIT compiler that could lead to exploitable crashes. (CVE-2019-17026) actively exploited
Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 7 DiD, 12 not applicable.

https://www.palemoon.org/releasenotes.shtml