Release notes
These release notes are summaries of the most important changes for public releases.
Published 2023-05-17
This is another important, major development update.
With this version we should have restored web compatibility with the majority of reported problematic websites. If you were previously running into websites being problematic in Basilisk, it may be a good idea to try them again with this release.
Special thanks to Job Bautista, martok, dbsoft, FranklinDM and Travis, and all other UXP contributors for continuing their hard work making this a reality!
This updates the UXP/Goanna platform version to 6.2.
- Implemented dynamic module imports. See implementation notes.
- Implemented exporting of async functions in modules.
- Implemented JavaScript class fields. See implementation notes.
- Implemented logical assignment operators
||=, &&= and ??=.
- Implemented a solution for websites using the officially deprecated ambiguous
window.event. This is disabled by default but can be enabled through about:config's dom.window.event.enabled preference. See implementation notes.
- Implemented
self.structuredClone()
- Implemented
Element.replaceChildren. Once again primarily a web developer note.
- Improved Shadow DOM
:host matching.
- Implemented WebComponents' CSS
::slotted() and related functionality.
- Improved page caching in our memory allocator.
- Added support for FFmpeg 6.0, especially important for bleeding-edge Linux distros.
- Fixed a potential drawing deadlock for images, specifically SVG. This solves a number of hang-on-shutdown scenarios.
- Fixed various crashes related to WebComponents and our recent JavaScript work.
- Fixed various build-from-source issues on secondary target platforms.
- Fixed handling of async (arrow) functions declared inside constructors.
- Fixed various small JavaScript conformance issues.
- Fixed an issue where JavaScript (only in modules) would not properly create async wrappers.
- Updated the DOM Performance API to the current spec (User Timing L3).
See implementation notes, especially if you intend to use this in web content for critical functionality.
- Updated keypress event handling to send keypress events on Ctrl+Enter.
- Updated internal JavaScript structures to make future porting easier, as well as improve JavaScript performance.
- Updated window handling and styling on Mac.
- Updated the Freetype lib to 2.13.0.
- Updated the Harfbuzz lib to 7.1.0.
- Updated our DNS lookup calls to use
inet_ntop() instead of the deprecated inet_ntoa().
- Updated the Fetch API to use the global's base URL instead of the entry document's base URL for spec compliance.
- We no longer support the outmoded
fontconfig on GTK systems.
- We no longer parse or return the body of known-empty responses from servers (content-length of 0, or in case of HEAD or CONNECT methods).
- Implemented scaled font caching on GTK, improving performance.
- Fixed a build issue when building for Linux on ARM64 on later distros.
- Split out more parts of the browser into separate .dll files on Windows to reduce compiler strain and an oversized xul.dll
- Removed mozilla::AlignedStorage (code cleanup).
- Builds for FreeBSD now use xz for packaging instead of bzip2.
- Merged the preference
dom.getRootNode.enabled into the dom.webcomponents.enabled pref. See implementation notes.
- Fixed a potential DoS issue with JPEG decoding.
- Fixed a potential issue in Windows widget code that could lead to crashes.
- Disabled potentially hazardous external protocols on Windows.
- Added known-problematic .dlls to the internal blocklist.
- Security issues addressed: CVE-2023-32209, CVE-2023-32214 and several others that do not have a CVE designation.
- UXP Mozilla security patch summary: 4 fixed, 1 rejected, 27 not applicable.
Implementation notes
- JavaScript modules have various methods of being loaded
into web page content. One of the later introduced methods is a
function-style import() declaration, so-called "dynamic module imports"
that has been used by various web frameworks, causing issues for Basilisk resulting in blank pages in most cases (since the websites would
not actually use document structure HTML, but rather JavaScript to
create content, all from imported modules). This has been a major web
compatibility issue lately and we're pleased to announce that this
complex bit of machinery has been implemented.
- JavaScript's language specification is continuing to be
watered down from a prototyping language towards a more "C-like"
hybrid. As part of that effort, JavaScript classes were introduced in
ECMAScript 6, and now further expanded in ES2022 with class fields and
private class fields/methods, as well as statics. We should have a
complete implementation of this now, which constitutes the more
important parts of the ES2022 language update.
- The use of the outdated Microsoft Internet Explorer global
window.event
has been a pervasive web compatibility issue for us, especially since
it was officially deprecated and we never implemented this ambiguous
and unreliable property that is highly-context sensitive. Websites
should use the event as passed into the event handler to get the event
source instead. However, since neither Chrome nor Firefox have dropped
this and seem to be playing a game of "chicken", it remains in use on
the web. To deal with this conflict, we have now implemented the
equivalent behind a preference to enable users to (temporarily) use the
global window.event while webmasters update their
websites. We hope the Google camp will finally drop this one soon so we
can be done with this legacy quirk.
- The DOM Performance API was updated to the User Timing
level 3 spec. It should be critically noted that the DOM Performance
API was never designed to be used as a matter of course on published
content, and was designed only for page performance analysis use by web
designers. Of course, as part of making dev tools available to the web,
a lot of abuse ensued because of the accurate navigation and timing
measurements that this API can provide (looking at you, Google!).
Because of tight integration with web content analysis, the older spec
implementation we had was causing issues and actually breaking some
services, so we updated it, but with a few important key differences:
- In Basilisk, we keep navigation timing disabled because
it's a notable privacy issue for the data it can gather (exact
navigational events and timings). If you're a web dev and need these
timing measurements, you can enable them with
dom.enable_performance_navigation_timing.
- Our implementation, contrary to the spec, does not allow
unlimited recording of performance events (effectively logging every
page event!) which can also rapidly eat up memory. Instead we enforce a
sane default quota that should be roomy enough for all legitimate use,
but prevents runaway resource use or extensive logging of user actions.
- If the set quota is reached, a warning will be printed in
the console and the recorded performance events will be thrown away. If
you (foolishly) rely on Performance API events for your web application
to function, be aware this may cause compatibility issues as the API
was, again, not designed to be used in such a fashion. For event
handling, there are much better alternatives available which do not
involve extensive recording of user data or relying on a developer tool
API.
- We've historically implemented the DOM
getRootNode
function
as it was being used in the wild as a standalone function, however its
main intent has always been to be a helper function part of Shadow
DOM/WebComponents. As such we have now merged the preference into the
WebComponents preference, enabling and disabling it along with the rest
of our WebComponents implementation.
Published 2023-05-01
This is a bugfix and security release.
Note: macOS, Linux aarch64, and FreeBSD beta builds will identify as 2023.04.30
- Fixed a crash in CompareDocumentPosition with Shadow DOM.
- Fixed a crash with display:contents styling.
- Added a preference to disable the TLS 1.3 protocol downgrade sentinel (see implementation notes).
- Changed the way large clipboard copy/paste operations are handled, improving privacy (see implementation notes).
- Improved filename safety when saving files to prevent potential environment leaks (bis).
- Improved sanity checks of MIME type headers.
- Security issues addressed: CVE-2023-29545 and CVE-2023-29539.
- UXP Mozilla security patch summary: 2 fixed, 1 rejected, 49 not applicable.
Implementation notes
- Some proxies and middleware boxes improperly handle the TLS
1.3 protocol handshake causing an insecure downgrade to TLS 1.2. With
our recent update of NSS, Basilisk no longer allows this kind of
protocol downgrade when trying to establish a TLS 1.3 connection to a
server. The resulting error is ssl_error_rx_malformed_server_hello with
an inability to connect to the server. To enable users to still connect
to the servers or devices in question, we've added an option to switch
off the downgrade sentinel. To switch it off as a temporary workaround,
set security.tls.hello_downgrade_check to false.
- If copy and paste operations to/from the browser are
performed, Basilisk writes clipboard contents to disk in a temporary
cache file if the copy/paste amount is particularly large, to avoid
using large amounts of memory to hold this data. The average
paste/clipboard size doesn't tend to hit this limit in which case it is
just held in memory.
Previously, these cache files, while in the O.S. temporary file
location (%TEMP% or /tmp), would not be consistently cleaned up,
potentially causing privacy issues if persisted. This was changed to
using auto-cleaning anonymous temp files, improving user privacy and
relying less on the O.S. or user performing cleanup of temporary file
storage. Thanks to Sandra for pointing this out and providing the patch.
Published 2023-04-05
This is a major update which introduces WebComponents support among other things. Thank you to all of the UXP contributors who worked to make this possible.
Basilisk is now available in beta for macOS and FreeBSD
- Shadow DOM and CustomElements, collectively making up WebComponents, have been enabled by default which should bring much broader web compatibility to the browser for many a site that uses web 2.0+ frameworks. See implementation notes.
- Tab titles in the browser now fade if they are too long instead of using ellipses, to provide a little more readable space to page titles. Note that this may require some updates to tab extensions or themes.
- A number of site-specific overrides have been updated or removed because they are no longer necessary or current with the platform developments in terms of web compatibility. We could use your help evaluating the ones that are still there; see the issue on the Pale Moon repo.
- Updated our promises and async function implementation to the current spec.
- Implemented
Promise.any()
- Fixed several crashes related to regular expression code.
- Improved regular expression object handling so it can be properly garbage collected.
- Fixed some VP8 video playback.
- Fixed an issue where the caret (text cursor) would sometimes not be properly visible.
- Updated the embedded emoji font.
- Implemented the
:is() and :where() CSS pseudo-classes.
- Implemented complex selectors for the
:not() CSS pseudo-class.
- Implemented the
inset CSS shorthand property.
- Implemented the
env() environment variable CSS function. See implementation notes.
- Implemented handling for RGB encoded video playback (instead of just YUV).
- Implemented handling for full-range videos (0-255 luminance levels) giving better video playback quality.
- Removed the WebP image decoder pref. See implementation notes.
- Enabled the Web text-to-speech API by default (only supported on some operating systems).
- Updated NSPR to 4.35 and NSS to 3.79.4
- Cleaned up unused "tracking protection" plumbing. See implementation notes.
- Cleaned up URI Classifier plumbing (Google SafeBrowsing leftover).
- Fixed several intermittent and difficult-to-trace crashes.
- Improved content type security of
jar: channels. DiD
- Improved JavaScript JIT code generation safety. DiD
- Fixed potential crash scenarios in the graphics subsystem. DiD
- Improved filename safety when saving files to prevent potential environment leaks.
- Introduced Basilisk beta builds for FreeBSD, aarch64 Linux, ARM macOS, and Intel macOS. (thanks dbsoft!)
- Security issues addressed: CVE-2023-25751, CVE-2023-28163 and several others that do not have a CVE.
- UXP Mozilla security patch summary: 1 fixed, 4 DiD, 14 not applicable.
Published 2023-03-07
This is a bugfix update.
- Revert tab title fading feature that was added in v2023.03.04. Caused various issues with tab titles and addons such as Tab Mix Plus.
Published 2023-03-05
This is a bugfix and security update.
- Fixed a crash in the new regular expression code.
- Added
{Extended_Pictographic} unicode property escape to regular expressions.
- Fixed a regression in regular expressions for literal parsing of invalid ranges.
- Updated NSS to pick up fixes.
- Security issues addressed: CVE-2023-25733 DiD, CVE-2023-25739 DiD and CVE-2023-0767.
- UXP Mozilla security patch summary: 1 fixed, 2 DiD, 14 not applicable.
Published 2023-01-26
This is a new milestone release.
Primary focus for this milestone is web compatibility, in particular Regular Expression extensions, standards compliance issues and further JPEG-XL support.
This milestone now offers full coverage of the ECMAScript 2016-2020 JavaScript specifications, with the exception of BigInt primitives.
Special thanks to Martok, Job Bautista and FranklinDM without whom this milestone would not have been possible.
Most important changes:
- Implemented Regular Expression named capture groups.
- Implemented Regular Expression unicode property escapes.
- Re-implemented Regular Expression lookaround/lookbehind (without crashing this time ;) ).
- Implemented progressive decoding for JPEG-XL.
- Implemented animation for JPEG-XL.
- Renamed CSS
offset-* properties to inset-* to align with the latest spec and the web.
- Fixed CSS inheritance and padding issues in some cases.
- Aligned parsing of incorrectly duplicated HSTS headers with expected behavior (discard all but the first one).
- Implemented a method to avoid memory exhaustion in case of (very) large resolution animated images.
- Updated the JPEG-XL and Highway libraries to a recent, stable version.
- Cleaned up some unused CSS prefixing code.
- Improved the ability to link on *nix operating systems with other linkers than gcc's default.
- Stability improvements (potential crash fixes).
- Security issues addressed: CVE-2023-23598, CVE-2023-23599 and several others that do not have a CVE number.
- UXP Mozilla security patch summary: 4 fixed, 2 DiD, 19 not applicable.
Published 2023-01-08
This is a major development, bugfix and security release.
- Added support for the JPEG-XL image format.
- Implemented regular expressions lookaround/lookbehind.
- Aligned CORS header parsing with the updated spec. See implementation notes.
- We no longer fire keypress events for non-printable keys. See implementation notes.
- Added support for MacOS 13 "Ventura" in the platform, primarily benefitting White Star.
- Fixed potentially problematic thread locking code on *nix platforms.
- Fixed some small issues in the display and operation of the Web Developer tools.
- Removed unused but performance-impacting panning and tab animation measuring code. (telemetry leftovers)
- Improved code for SunOS builds.
- Updated Internationalization data for time zones.
- Fixed a buffer overflow for Mac builds.
- Fixed an issue with plugins not receiving keypress events properly.
- Added some extra sanity checks to our zip/jar/xpi reader to avoid issues with corrupt archives.
- Aligned cookie checks with RFC 6265 bis. See implementation notes.
- Removed obsolete code in Windows widgets that could cause potential issues with long paths and file names on supported versions.
- Fixed several crashes.
- Security issues addressed: CVE-2022-45411, CVE-2022-46876, CVE-2022-46874 and several others that do not have a CVE number
- UXP Mozilla security patch summary: 6 fixed, 1 DiD, 1 deferred, 45 not applicable.
Implementation notes
- RFC 6265 has been worked on with draft changes describing how cookies are actually being handled in the real world, in the bis versions of the RFC. While these changes have not yet been finalized, browsers in general do adhere to the latest available bis version of this RFC. Specifically, the long-standing exceptions for cookie names and values have been formalized, e.g. having quoted values. Our behavior has changed in that we now once again accept Tab characters (0x09) which is the one excluded control character from the range that is otherwise forbidden. We also no longer apply these checks exclusively to those in http headers, and any way of setting cookies must now adhere to the valid range. Cookies that fail these range checks for valid characters will be ignored.
- CORS support has been updated to the current spec. Most importantly, Basilisk now accepts wildcard entries ("*") for the CORS statements Access-Control-Expose-Headers, Access-Control-Allow-Headers and Access-Control-Allow-Method. Note that wildcards are ignored (according to the spec) when credentials are passed.
- Basilisk will no longer fire the keypress events in content when the key pressed is a non-printable key. This is in response to issues where webmasters would use rudimentary and naïve input-restricting scripts in onkeypress handlers that would not take into account editing keys or navigation keys, causing issues for users trying to enter data into forms (and e.g. finding they could no longer use backspace, cursor keys or tab). This aligns our behavior with other browsers for web compatibility, although it should be considered a website error expecting not all keypresses to be intercepted in keypress events.
Published 2022-11-05
This is a security and compatibility update.
Note: The Basilisk branding has been removed from the Basilisk repository.
- Added detection suport for the newly-released MacOS 13 (Ventura).
- Fixed a potential heap Use-After-Free risk in Expat. (CVE-2022-40674) DiD
- Fixed potentially undefined behavior in our thread locking code. DiD
- Fixed a potentially exploitable crash in the refresh driver.
- Fixed potentially undefined behavior when base-64 decoding. DiD
- Implemented a texture size cap for WebGL to prevent potential issues with some graphics drivers. DiD
- Updated site-specific overrides to address issues with ZoHo.
- UXP Mozilla security patch summary: 1 fixed, 2 DiD, 6 not applicable.
Published 2022-09-28
This is a major development, bugfix and security release.
Note: The default serch engines have changed. Please verify that your configuration still uses your preferred search engine.
- Implemented
.at(index) JavaScript method on built-in indexables (Array, String, TypedArray).
- Implemented the use of EventSource in workers.
- Enabled the sending of the Origin: header by default on same-origin requests.
- Changed how Basilisk is built. We have made build system changes to reduce build times and pressure on the linker on all platforms. Note that Basilisk is not yet built with Visual Studio 2022. This change will be done in the next release.
- Changed how Basilisk handles standalone wave audio files (.wav). See implementation notes.
- Improved string normalization.
- Updated the handling of CSS "supports" to now accept unparenthesized strings (spec update).
- Fixed various issues when building for Mac OS X.
- Fixed various C++ standard conformance issues in the source code.
- Fixed several issues building on SunOS and Linux with various configurations and gcc versions.
- Fixed an issue with regular expressions'
dotAll syntax and usage. See implementation notes.
- Switched custom hash map to
std::unordered_map where prudent.
- Cleaned up and updated IPC thread locking code.
- Removed spacing for accessibility focus rings in form controls to align styling of them with expected metrics.
- Removed the unnecessary control module for building with non-standard configurations of the platform.
- Removed the
-moz prefix from min-content and max-content CSS keywords where it was still in use.
- Updated the search engines included with Basilisk. Basilisk now includes the same search engines as Pale Moon.
- Fix issue where PDF.js was completely broken in the previous release.
- Fixed an important stability and performance issue related to hardware acceleration.
- Implemented Global Privacy Control in the Basilisk settings.
- Fix issue where the 32-bit Windows installer would not execute on 32-bit Windows systems.
- Remove Mozilla related default bookmarks. Update default bookmarks.
- Update compatmode override for Firefox to 102.0.
- Update user agent overrides to improve compatibility with Facebook.
- Security fixes: CVE-2022-40956 and CVE-2022-40958.
- UXP Mozilla security patch summary: 2 fixed, 11 not applicable.
Published 2022-08-06
This is a major update.
Very Important: This is the first public release from the Basilisk Development team. As such, the vendor name in the application has changed. This means the profile directory has changed. See here for more info.
You will have to perform a manual update if you are currently running Basilisk 2022.01.27 as it was compiled without an updater.
Note: Many things have changed since 2022.01.27 and 2022.08.06. We've tried to note all changes here but it is very likely something was missed.
- Fixed several application crash scenarios. DiD
- Fixed a number of thread locking/mutex issues. DiD
- Fixed a leak of content types due to inconsistent error reporting. (CVE-2022-22760)
- Fixed an issue with iframe sandboxing not being properly applied. (CVE-2022-22759)
- Fixed a potential leak of bookmarks from the exported bookmarks file if it included a malicious bookmarklet.
- Fixed an issue with drag-and-drop. (CVE-2022-22756)
- Fixed a potential crash due to truncated WAV files.
- Fixed a memory safety issue with XSLT. (CVE-2022-26485)
- Fixed a potential crash issue on bing.com.
- Fixed some thread locking issues. DiD
- Worked around a Mesa driver bug that could cause crashes.
- Fixed a potential resource access issue in devtools. DiD
- Security issues with CVEs addressed: CVE-2022-1097, CVE-2022-28285 (DiD) and CVE-2022-28283 (DiD).
- Implemented Global Privacy Control, taking the place of the unenforceable "DNT" (Do Not Track) signal. Through GPC, you indicate to websites that you do not want them to share or sell your data.
- Implemented "optional chaining" (thanks, FranklinDM!).
- Implemented setBaseAndExtent for text selections.
- Implemented queueMicroTask() "pseudo-promise" callbacks.
- Implemented accepting unit-less values for rootMargin in Intersection observers for web compatibility, making it act more like CSS margin as one would expect.
- Improvements to CSS grid and flexbox rendering and display following spec changes and improving web compatibility.
- Improved performance of parallel web workers in JavaScript.
- Improved display of cursive scripts (on Windows). Good-bye Comic Sans!
- Updated various in-tree libraries.
- Added support for extended VPx codec strings in media delivery via MSE (RFC-6381).
- Fixed a long-time regression where the browser would no longer honor old-style body and iframe body margins when indicated in the HTML tags directly instead of CSS. This improves compatibility with particularly old and/or archived websites.
- Fixed several crashes and stability issues.
- Removed all Google SafeBrowsing/URLClassifier service code.
- Restored Mac OS X code and buildability in the platform.
- Removed the non-standard ArchiveReader DOM API that was only ever a prototype implementation.
- Removed most of the last vestiges of the invasive Mozilla Telemetry code from the platform. This potentially improves performance on some systems.
- Removed leftover Electrolysis controls that could sometimes trick parts of the browser into starting in a (very broken) multi-process mode due to some plumbing for it still being present, if users would try to force the issue with preferences. Obviously, this was a footgun for power users.
- Removed more Android/Fennec code (on-going effort to clean up our code).
- Removed the Marionette automated testing framework.
- Security issues addressed: CVE-2022-29915, CVE-2022-29911, and several issues that do not have a CVE number.
- Implemented "nullish coalescing operator" (thanks, FranklinDM!) for web compatibility.
- Fixed various crash scenarios in XPCOM.
- Fixed an important stability and performance issue related to hardware acceleration.
- Fixed a long-standing issue where dynamic datalist updates for
<select> and similar elements wouldn't properly update the option list.
- Disabled broken links to MDN articles in developer tools.
- Updated media support to include support for libavcodec 59/FFmpeg 5.0 for MP4 playback on Linux (thanks, Travis!)
- Enabled the date picker for
<input type=date>. See implementation notes.
- Re-enabled the use of FIPS mode for NSS. See implementation notes.
- Improved memory handling and memory safety in the JavaScript engine, further reducing current and future crash scenarios.
- Improved memory handling in the graphics subsystem of Goanna.
- Updated FFvpx to v4.2.7
- Slightly reduced strictness of media checking for improved compatibility with questionable "gif" video encoders used on major websites.
- Cleaned up the way file pickers (file open/save/save as dialogs) are handled on Windows.
- Restored the gMultiProcessBrowser property of the browser for Firefox extension compatibility. See implementation notes.
- Improved the way data is transferred to and from canvases to prevent memory safety issues.
- Reduced blocking severity for some extensions that were marked hard blockers for GRE (but aren't for UXP).
- Security issues addressed: CVE-2022-31739, CVE-2022-31741, and other security issues that do not have a CVE number.
- Updated the list of blocked external protocol handlers to combat abuse of OS-supplied services on Windows.
- Fixed a potential issue with revoked site certificates when connecting through a proxy.
- Updated site-specific user agent overrides to work around bad sniffing practices of dropbox and vimeo.
- Security issues addressed: CVE-2022-34478, CVE-2022-34476, CVE-2022-34480 DiD, CVE-2022-34472, CVE-2022-34475 DiD, CVE-2022-34473 DiD, CVE-2022-34481 and a memory safety issue that doesn't have a CVE number.
- Implemented CSS white-space: break-spaces for web compatibility.
- Implemented Intl.RelativeTimeFormat for web compatibility.
- Implemented "Origin header CSRF mitigation". This is still disabled by default to investigate potential issues with CloudFlare-backed sites.
- Implemented support for async generator methods in JavaScript.
- Added preliminary support for building on Apple Silicon like M1/M2 SoC.
- Added support for building with Visual Studio 2022.
- Improved the handling of CSS "sticky" elements in tables.
- Improved stack size limits on all platforms. See implementation notes.
- Updated function.toString handling to align with the updated JavaScript spec. This should improve web compatibility.
- Updated Unicode support to Unicode v11, and updated the ICU library accordingly. Building without ICU is no longer supported.
- Updated many in-tree third-party libraries to pick up various performance and stability improvements.
- Updated site-specific user-agent overrides to work around issues with Google fonts, Citi bank (again!) and MeWe.
- Removed some leftover (and unused) telemetry code in the platform and front-end.
- Fixed an issue with VP9 video playback on Windows on some systems.
- Fixed an issue with the add-ons manager not properly handling empty update URLs.
- Fixed a major performance regression on *nix based systems due to incorrect thread handling.
- Fixed volume handling when building with the sndio audio back-end.
- Cleaned up some unnecessary code from the source tree for unused build back-ends, Firefox marketplace "apps", and the rather ridiculous moz://a protocol handler.
- Updated NSS to 3.52.8 to pick up several defense-in-depth security fixes.
- Basilisk profile directory changed to reflect vendor change in application.
- Restore ability to build Basilisk on Mac OS X.
- Removal of telemetry code from Basilisk.
- UXP Mozilla security patch summary: 11 fixed, 14 Did, 4 rejected, 91 not applicable
Old Releases
Releases notes from releases by Moonchild Productions can be found here.
