Accepting request 1187677 from mozilla:Factory

- Mozilla Firefox 128.0
  https://www.mozilla.org/en-US/firefox/128.0/releasenotes
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames

OBS-URL: https://build.opensuse.org/request/show/1187677
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/MozillaFirefox?expand=0&rev=431

MozillaFirefox.changes

@@ -1,3 +1,50 @@
+-------------------------------------------------------------------
+Mon Jul  8 20:25:10 UTC 2024 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- Mozilla Firefox 128.0
+  https://www.mozilla.org/en-US/firefox/128.0/releasenotes
+  MFSA 2024-29 (bsc#1226316)
+  * CVE-2024-6605 (bmo#1836786)
+    Firefox Android missed activation delay to prevent tapjacking
+  * CVE-2024-6606 (bmo#1902305)
+    Out-of-bounds read in clipboard component
+  * CVE-2024-6607 (bmo#1694513)
+    Leaving pointerlock by pressing the escape key could be
+    prevented
+  * CVE-2024-6608 (bmo#1743329)
+    Cursor could be moved out of the viewport using pointerlock.
+  * CVE-2024-6609 (bmo#1839258)
+    Memory corruption in NSS
+  * CVE-2024-6610 (bmo#1883396)
+    Form validation popups could block exiting full-screen mode
+  * CVE-2024-6600 (bmo#1888340)
+    Memory corruption in WebGL API
+  * CVE-2024-6601 (bmo#1890748)
+    Race condition in permission assignment
+  * CVE-2024-6602 (bmo#1895032)
+    Memory corruption in NSS
+  * CVE-2024-6603 (bmo#1895081)
+    Memory corruption in thread creation
+  * CVE-2024-6611 (bmo#1844827)
+    Incorrect handling of SameSite cookies
+  * CVE-2024-6612 (bmo#1880374)
+    CSP violation leakage when using devtools
+  * CVE-2024-6613 (bmo#1900523)
+    Incorrect listing of stack frames
+  * CVE-2024-6614 (bmo#1902983)
+    Incorrect listing of stack frames
+  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
+    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
+    and Thunderbird 115.13
+  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
+    Memory safety bugs fixed in Firefox 128
+- requires
+  NSS 3.101.1
+  rust >= 1.78
+- update create-tar.sh
+- add wayland upstream fixes (bmo#1907511, bmo#1898476)
+  (mozilla-bmo1898476.patch and mozilla-bmo1907511.patch)
+
 -------------------------------------------------------------------
 Mon Jul  1 09:44:55 UTC 2024 - Andrei Dziahel <develop7@develop7.info>
 

MozillaFirefox.spec

@@ -28,9 +28,9 @@
 # orig_suffix b3
 # major 69
 # mainver %%major.99
-%define major          127
+%define major          128
-%define mainver        %major.0.2
+%define mainver        %major.0
-%define orig_version   127.0.2
+%define orig_version   128.0
 %define orig_suffix    %{nil}
 %define update_channel release
 %define branding       1
@@ -45,7 +45,7 @@
 %bcond_with only_print_mozconfig
 
 # define if ccache should be used or not
-%define useccache     0
+%define useccache     1
 
 # SLE-12 doesn't have this macro
 %{!?_rpmmacrodir: %global _rpmmacrodir %{_rpmconfigdir}/macros.d}
@@ -103,8 +103,8 @@ BuildRequires:  gcc13-c++
 %else
 BuildRequires:  gcc-c++
 %endif
-BuildRequires:  cargo1.76
+BuildRequires:  cargo1.78
-BuildRequires:  rust1.76
+BuildRequires:  rust1.78
 %if 0%{useccache} != 0
 BuildRequires:  ccache
 %endif
@@ -114,7 +114,7 @@ BuildRequires:  libiw-devel
 BuildRequires:  libproxy-devel
 BuildRequires:  makeinfo
 BuildRequires:  mozilla-nspr-devel >= 4.35
-BuildRequires:  mozilla-nss-devel >= 3.100
+BuildRequires:  mozilla-nss-devel >= 3.101.1
 BuildRequires:  nasm >= 2.14
 BuildRequires:  nodejs >= 12.22.12
 %if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
@@ -124,11 +124,14 @@ BuildRequires:  python39
 BuildRequires:  python39-curses
 BuildRequires:  python39-devel
 %else
-%if 0%{?sle_version} >= 150000 && 0%{?sle_version} <= 150600
+%if 0%{?sle_version} > 150000 && 0%{?sle_version} <= 150600
+BuildRequires:  nodejs12 >= 12.22.12
 BuildRequires:  python39
 BuildRequires:  python39-curses
 BuildRequires:  python39-devel
 %else
+# ALP
+BuildRequires:  nodejs >= 12.22.12
 BuildRequires:  python3 >= 3.7
 BuildRequires:  python3-curses
 BuildRequires:  python3-devel
@@ -146,11 +149,7 @@ BuildRequires:  zip
 %if 0%{?suse_version} < 1550
 BuildRequires:  pkgconfig(gconf-2.0) >= 1.2.1
 %endif
-%if (0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000)
+BuildRequires:  clang15-devel
-BuildRequires:  clang6-devel
-%else
-BuildRequires:  clang-devel >= 5
-%endif
 BuildRequires:  pkgconfig(glib-2.0) >= 2.22
 BuildRequires:  pkgconfig(gobject-2.0)
 BuildRequires:  pkgconfig(gtk+-3.0) >= 3.14.0
@@ -196,7 +195,7 @@ Source9:        firefox.js
 Source11:       firefox.1
 Source12:       mozilla-get-app-id
 Source13:       spellcheck.js
-Source14:       https://github.com/openSUSE/firefox-scripts/raw/9b77cf0/create-tar.sh
+Source14:       https://github.com/openSUSE/firefox-scripts/raw/913fab1/create-tar.sh
 Source15:       firefox-appdata.xml
 Source16:       %{name}.changes
 Source17:       firefox-search-provider.ini
@@ -229,6 +228,8 @@ Patch21:        svg-rendering.patch
 Patch22:        mozilla-partial-revert-1768632.patch
 Patch23:        mozilla-rust-disable-future-incompat.patch
 Patch24:        mozilla-bmo1822730.patch
+Patch25:        mozilla-bmo1898476.patch
+Patch26:        mozilla-bmo1907511.patch
 # Firefox/browser
 Patch101:       firefox-kde.patch
 Patch102:       firefox-branded-icons.patch
@@ -580,8 +581,10 @@ grep amazondotcom dist/firefox/browser/omni.ja
 # copy tree into RPM_BUILD_ROOT
 mkdir -p %{buildroot}%{progdir}
 cp -rf $RPM_BUILD_DIR/obj/dist/%{srcname}/* %{buildroot}%{progdir}
+%if %localize
 mkdir -p %{buildroot}%{progdir}/browser/extensions
 cp -rf $RPM_BUILD_DIR/langpacks_artifacts/* %{buildroot}%{progdir}/browser/extensions/
+%endif
 mkdir -p %{buildroot}%{progdir}/distribution/extensions
 mkdir -p %{buildroot}%{progdir}/browser/defaults/preferences/
 # renaming executables (for regular vs. ESR)

create-tar.sh

@@ -78,9 +78,13 @@ function set_internal_variables() {
 
   SOURCE_TARBALL="$PRODUCT-$VERSION$VERSION_SUFFIX.source.tar.xz"
   PREV_SOURCE_TARBALL="$PRODUCT-$PREV_VERSION$PREV_VERSION_SUFFIX.source.tar.xz"
+  if [ "$PRODUCT" = "thunderbird" ]; then
+    TB_LOCALE_TARBALL="$PRODUCT-$VERSION$VERSION_SUFFIX.strings_all.tar.zst"
+  fi
   FTP_URL="https://ftp.mozilla.org/pub/$PRODUCT/releases/$VERSION$VERSION_SUFFIX/source"
   FTP_CANDIDATES_BASE_URL="https://ftp.mozilla.org/pub/%s/candidates"
   LOCALES_URL="https://product-details.mozilla.org/1.0/l10n"
+  FF_L10N_MONOREPO="https://github.com/mozilla-l10n/firefox-l10n"
   PRODUCT_URL="https://product-details.mozilla.org/1.0"
   ALREADY_EXTRACTED_LOCALES_FILE=0
 }
@@ -134,7 +138,7 @@ function get_source_stamp() {
   local BUILD_JSON=$(curl --silent --fail "$FTP_CANDIDATES_BASE_URL/$FTP_CANDIDATES_JSON_SUFFIX") || return 1;
   local REV=$(echo "$BUILD_JSON" | jq .moz_source_stamp)
   local SOURCE_REPO=$(echo "$BUILD_JSON" | jq .moz_source_repo)
-  local TIMESTAMP=$(echo "$BUILD_JSON" | jq .buildid)
+  TIMESTAMP=$(echo "$BUILD_JSON" | jq .buildid)
   echo "Extending $TAR_STAMP with:"
   echo "RELEASE_REPO=${SOURCE_REPO}"
   echo "RELEASE_TAG=${REV}"
@@ -302,10 +306,18 @@ function check_what_to_do_with_source_tarballs() {
     printf "%-40s: %s\n" "$ff" "$(check_tarball_source $ff)"
   done
 
+  if [ "$PRODUCT" = "thunderbird" ]; then
+    printf "%-40s: %s\n" "$TB_LOCALE_TARBALL" "$(check_tarball_source $TB_LOCALE_TARBALL)"
+  fi
+
   ask_cont_abort_question "Is this ok?" || exit 0
 }
 
 function check_what_to_do_with_locales_tarballs() {
+  if [ -e "$TB_LOCALE_TARBALL" ]; then
+    return;
+  fi
+
   LOCALES_CHANGED=1
 
   extract_locales_file
@@ -364,6 +376,10 @@ function download_upstream_source_tarballs() {
   download_release_or_candidate_file "$SOURCE_TARBALL"
   download_release_or_candidate_file "$SOURCE_TARBALL.asc"
 
+  if [ "$PRODUCT" = "thunderbird" ]; then
+    download_release_or_candidate_file "$TB_LOCALE_TARBALL"
+  fi
+
   # we might have an upstream archive already and can skip the checkout
   if [ -e "$SOURCE_TARBALL" ]; then
     get_source_stamp "$BUILD_ID"
@@ -413,7 +429,7 @@ function clone_and_repackage_sources() {
   # get repo and source stamp
   local REV=$(hg -R . parent --template="{node|short}\n")
   local SOURCE_REPO=$(hg showconfig paths.default 2>/dev/null | head -n1 | sed -e "s/^ssh:/https:/")
-  local TIMESTAMP=$(date +%Y%m%d%H%M%S)
+  TIMESTAMP=$(date +%Y%m%d%H%M%S)
 
   if [ "$PRODUCT" = "thunderbird" ]; then
     pushd comm || exit 1
@@ -447,13 +463,18 @@ function create_locales_tarballs() {
     exit 0
   fi
 
-  if [ "$LOCALES_CHANGED" -ne 0 ]; then
+  if [ -e "$TB_LOCALE_TARBALL" ]; then
-    clone_and_repackage_locales
+    echo "Repackaging upstream lang-tarball."
-  elif [ -f "l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz" ]; then
+    zstd -dcf "$TB_LOCALE_TARBALL" | xz > "l10n-$VERSION$VERSION_SUFFIX.tar.xz"
-    # Locales did not change, but the old tar-ball is in this directory
+  else 
-    # Simply rename it:
+    if [ "$LOCALES_CHANGED" -ne 0 ]; then
-    echo "Moving l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz to l10n-$VERSION$VERSION_SUFFIX.tar.xz"
+      clone_and_repackage_locales
-    mv "l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz" "l10n-$VERSION$VERSION_SUFFIX.tar.xz"
+    elif [ -f "l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz" ]; then
+      # Locales did not change, but the old tar-ball is in this directory
+      # Simply rename it:
+      echo "Moving l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz to l10n-$VERSION$VERSION_SUFFIX.tar.xz"
+      mv "l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz" "l10n-$VERSION$VERSION_SUFFIX.tar.xz"
+    fi
   fi
 }
 
@@ -480,10 +501,6 @@ function clone_and_repackage_locales() {
     FF_L10N_BASE="l10n_ff"
   fi
 
-  test ! -d $FF_L10N_BASE && mkdir $FF_L10N_BASE
-  # No-op, if we are building FF:
-  test ! -d $FINAL_L10N_BASE && mkdir $FINAL_L10N_BASE
-
   # This is only relevant for Thunderbird-builds
   # Here, the relevant directories we need to copy from FF and from TB
   # are specified in a python-file in the tarball
@@ -492,33 +509,42 @@ function clone_and_repackage_locales() {
   tb_locale_template=$(get_locales_directories "COMM_STRINGS_PATTERNS")
 
   echo "Fetching Browser locales..."
-  jq -r 'to_entries[]| "\(.key) \(.value|.revision)"' "$FF_LOCALE_FILE" | \
+  if [ -d "$FF_L10N_BASE/.git" ]; then
-    while read -r locale changeset ; do
+    pushd "$FF_L10N_BASE/" || exit 1
-      case $locale in
+    git fetch -a || exit 1
-        ja-JP-mac|en-US)
+    popd || exit 1
-          ;;
+  else
-        *)
+    git clone "$FF_L10N_MONOREPO" "$FF_L10N_BASE" || exit 1
-          echo "reading changeset information for $locale"
+  fi
-          echo "fetching $locale changeset $changeset ..."
+  # Currently all locales show the same changeset-hash, as they moved to a monorepo. We just take the first one.
-          if [ -d "$FF_L10N_BASE/$locale/.hg" ]; then
+  changeset=$(jq -r 'to_entries[0]| "\(.key) \(.value|.revision)"' "$FF_LOCALE_FILE" | cut -d " " -f 2)
-            pushd "$FF_L10N_BASE/$locale" || exit 1
+  [ "$RELEASE_TAG" == "default" ] || git -C "$FF_L10N_BASE/" switch --detach "$changeset" || exit 1
-            hg pull || exit 1
-            popd || exit 1
-          else
-            hg clone "https://hg.mozilla.org/l10n-central/$locale" "$FF_L10N_BASE/$locale" || exit 1
-          fi
-          [ "$RELEASE_TAG" == "default" ] || hg -R "$FF_L10N_BASE/$locale" up -C -r "$changeset" || exit 1
 
-          # If we are doing TB, we have to merge both l10n-repos
+  # No-op, if we are building FF:
-          if [ "$PRODUCT" = "thunderbird" ] && test -d "$TB_L10N_BASE/$locale/" ; then
+  test ! -d $FINAL_L10N_BASE && mkdir $FINAL_L10N_BASE
+
+  # If we are doing TB, we have to merge both l10n-repos
+  if [ "$PRODUCT" = "thunderbird" ] && test -d "$TB_L10N_BASE/$locale/" ; then
+    jq -r 'to_entries[]| "\(.key) \(.value|.revision)"' "$FF_LOCALE_FILE" | \
+      while read -r locale changeset ; do
+        case $locale in
+          ja-JP-mac|en-US)
+            ;;
+          *)
             create_and_copy_locales "$locale" "$FF_L10N_BASE" "$ff_locale_template" "$FINAL_L10N_BASE"
             create_and_copy_locales "$locale" "$TB_L10N_BASE" "$tb_locale_template" "$FINAL_L10N_BASE"
-          fi
+            ;;
-          ;;
+        esac
-      esac
+      done
-    done
+  fi
+
   echo "creating l10n archive..."
   local TAR_FLAGS="--exclude-vcs"
+  # For reproducable tarballs
+  # Convert TIMESTAMP to ISO-format, so tar can understand it, then set mtime to it
+  local MTIME=$(python3 -c "from datetime import datetime; print(datetime.strptime(${TIMESTAMP}, '%Y%m%d%H%M%S').isoformat())")
+  TAR_FLAGS="$TAR_FLAGS --sort=name --format=posix --pax-option=delete=atime,delete=ctime,exthdr.name=%d/PaxHeaders/%f --numeric-owner --owner=0 --group=0 --mode=go+u,go-w --clamp-mtime --mtime=$MTIME"
+
   if [ "$PRODUCT" = "thunderbird" ]; then
     TAR_FLAGS="$TAR_FLAGS --exclude=suite"
   fi
@@ -537,6 +563,13 @@ function clean_up_old_tarballs() {
           rm "l10n-$PREV_VERSION$PREV_VERSION_SUFFIX.tar.xz"
       fi
   fi
+  # If we downloaded the upstream zstd-tarball and repackaged it, remove it now
+  if [ -f "$TB_LOCALE_TARBALL" ] && [ -f "l10n-$VERSION$VERSION_SUFFIX.tar.xz" ]; then 
+      echo ""
+      echo "Deleting old sources tarball $TB_LOCALE_TARBALL"
+      ask_cont_abort_question "Is this ok?" || exit 0
+      rm "$TB_LOCALE_TARBALL"
+  fi
 }
 
 main "$@"

firefox-127.0.2.source.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:0b7b2a8c3def52fcab13c48769645d0e963902ee916e4f3d2a0098796e73e3e8
-size 554998504

firefox-127.0.2.source.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEErdcHlHlwDcrf3VM34207E/PZMnQFAmZ53acACgkQ4207E/PZ
-MnTIVA/+JGtp43X/EziTH0m8xTRrLKE9v7EoVTC88Tl8zOuEyVj+vEKyHmKTHB3n
-Fg+J+BmD/xZU9Tw3g03XehmkC9qqVyNyDq7iCFt/NryHKcpu3DXZQvMjyAsWEwTy
-++648rOs5sXujRt9gl90cZC1Zrk23f5dvImNUOGharwnkmQtb3z1iH0n97jd70kB
-pkb63/NAvLK1KGv381H0BPqDM91lYggQ9fgbsz40TjqZAOaai8oXXvr7On5wWjX0
-8e4f7hmqEFR+z9I2Pv7j4R9V5RJBPDO4CxYqMWMiZlx8GLLheo21kql0oCJXmFtg
-9HlXwL/0w3LqxuZJ5emmNYnYytmykCQFpL6n4gRi7c8otgMr8jr4JMb+bjwiWQab
-xv/ubvZJtD/xvsDAcnDpAsDk7LziKQWLYUI4KX6lqZ/TpyaqCcwXwKOoUwU5oe+L
-h7R2Nk5+YXvr8S0OTGRbcyoN0RGvpQnc8AQXSDVKwDUDAL9/YlxKVHqTl7zVA/H5
-5trNcVNOz/NGrAhKjWa5ChHCG0b2000/DXsk3fOT13RCdv+hPOpkD2VTpYoGdcem
-NfFRNIfT579MTDWkrVzeQBZ0vdp9X8rIDhzt53Cg5h9xDMot6hSzACLQPVwKcVx9
-vU9qmv5iY9qPzMrWgtvNan9ZR/oeKwnZlB3oeJpfLZNKMJuABtk=
-=qm9q
------END PGP SIGNATURE-----

firefox-128.0.source.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:65271ffefb235ea1e162a081f2074a0f06fce27b2f613f573c126ba8eef95172
+size 560761840

firefox-128.0.source.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEErdcHlHlwDcrf3VM34207E/PZMnQFAmaG12gACgkQ4207E/PZ
+MnQ/1xAAzvCP0A4oOfbmmtnOA1QQ5NvUCETU6BGo4oAy3LhYM66ZThKG9KF5A9g2
+GVQx+19W0Z5BNtgGLxzujWLxPTsxUdgCF65RekrN6AQlTtvXvLBn5WaExK4pHCIT
+R14RaPumLPCZwL0HaEo4NvZr48AXXOFm9pvgQ4ZhWf2tfRpm1qNp1UIAY2jtGna7
+o4tVBEHcydqF6BLrmHf5gbKrifW1nL75SBFVoBNESRocdTFENt9RMQgifwqX/f0d
+vJ+Osu2gd/J4thwailXNIy9TGdW1lEi5TgS3UdNmNpZVYb73JnhcfwyIjI9g93NZ
+wKbcu/9PEJjNe8XnADA6ULr8Nth6zxfsJhdz60AVoaP6mGApPGx6M1ezW8b7YxcI
+FxJ2/qv5ExKiXENlISYI+cih/VWuN8nKPtWyCb2whFeAEnNmIlCs+j6hN/c8haZS
+iQdThG5EqmjCQJyz3AufhULfTmINJk/ABYdpitHfj5EDfe9ggxANRkLvJEZ1ZZTP
+85bGWlCMg8Tq6/CWHTWvJvytQCHrQci+M/y/4pneaBLXzv3p8Q5e1OOuxzuGA7rB
+yAW5DnCTK+4wdfgHzmJL4Rjom0PeJZBVHJEljqV1THbTrs4MWuNFJLu2lXNDmAbx
+Ty1ZAqK4HliEDRh6r70sZY/ecg+UzSyIGqlDzu7RBOjtg4A15vo=
+=wybs
+-----END PGP SIGNATURE-----

l10n-127.0.2.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:68c4f9dc1ae31acaf51cde83abafad3f308211c260b398b2ac58e390344a4119
-size 31787988

l10n-128.0.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:dbeeef6964b694c3c9d905856eb02e0ce3a13ce2047d09b5541b5e45f2ed8c1b
+size 34286352

mozilla-bmo1504834-part1.patch

@@ -1,11 +1,16 @@
 # HG changeset patch
-# Parent  9fcbd287056a40084b1e679f787bf683b291f323
+# Parent  125a78208d2cef58191a0328ffe894dd14c6b146
 Taken from https://bugzilla.mozilla.org/show_bug.cgi?id=1504834
 
 diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
 --- a/gfx/2d/DrawTargetSkia.cpp
 +++ b/gfx/2d/DrawTargetSkia.cpp
-@@ -156,7 +156,8 @@ static IntRect CalculateSurfaceBounds(co
+@@ -151,17 +151,18 @@ static IntRect CalculateSurfaceBounds(co
+   if (!sampledBounds.ToIntRect(&bounds)) {
+     return surfaceBounds;
+   }
+ 
+   return surfaceBounds.Intersect(bounds);
  }
  
  static const int kARGBAlphaOffset =
@@ -15,10 +20,20 @@ diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
  
  static bool VerifyRGBXFormat(uint8_t* aData, const IntSize& aSize,
                               const int32_t aStride, SurfaceFormat aFormat) {
+   if (aFormat != SurfaceFormat::B8G8R8X8 || aSize.IsEmpty()) {
+     return true;
+   }
+   // We should've initialized the data to be opaque already
+   // On debug builds, verify that this is actually true.
 diff --git a/gfx/2d/Types.h b/gfx/2d/Types.h
 --- a/gfx/2d/Types.h
 +++ b/gfx/2d/Types.h
-@@ -89,18 +89,11 @@ enum class SurfaceFormat : int8_t {
+@@ -84,28 +84,21 @@ enum class SurfaceFormat : int8_t {
+   YUV422,  // Single plane YUV 4:2:2 interleaved as Y`0 Cb Y`1 Cr.
+   HSV,
+   Lab,
+   Depth,
+ 
    // This represents the unknown format.
    UNKNOWN,  // TODO: Replace uses with Maybe<SurfaceFormat>.
  
@@ -40,10 +55,20 @@ diff --git a/gfx/2d/Types.h b/gfx/2d/Types.h
  
    // The following values are OS and endian-independent synonyms.
    //
+   // TODO(aosmond): When everything blocking bug 1581828 has been resolved, we
+   // can make this use R8B8G8A8 and R8B8G8X8 for non-Windows platforms.
+   OS_RGBA = A8R8G8B8_UINT32,
+   OS_RGBX = X8R8G8B8_UINT32
+ };
 diff --git a/gfx/skia/skia/modules/skcms/skcms.cc b/gfx/skia/skia/modules/skcms/skcms.cc
 --- a/gfx/skia/skia/modules/skcms/skcms.cc
 +++ b/gfx/skia/skia/modules/skcms/skcms.cc
-@@ -30,6 +30,8 @@
+@@ -26,16 +26,18 @@
+         // it'd be a lot slower.  But we want all those headers included so we
+         // can use their features after runtime checks later.
+         #include <smmintrin.h>
+         #include <avxintrin.h>
+         #include <avx2intrin.h>
          #include <avx512fintrin.h>
          #include <avx512dqintrin.h>
      #endif
@@ -51,8 +76,18 @@ diff --git a/gfx/skia/skia/modules/skcms/skcms.cc b/gfx/skia/skia/modules/skcms/
 +    #define SKCMS_PORTABLE
  #endif
  
- static bool runtime_cpu_detection = true;
+ using namespace skcms_private;
-@@ -324,20 +326,28 @@ enum {
+ 
+ static bool sAllowRuntimeCPUDetection = true;
+ 
+ void skcms_DisableRuntimeCPUDetection() {
+     sAllowRuntimeCPUDetection = false;
+@@ -319,30 +321,38 @@ enum {
+     skcms_Signature_sf32 = 0x73663332,
+     // XYZ is also a PCS signature, so it's defined in skcms.h
+     // skcms_Signature_XYZ = 0x58595A20,
+ };
+ 
  static uint16_t read_big_u16(const uint8_t* ptr) {
      uint16_t be;
      memcpy(&be, ptr, sizeof(be));
@@ -87,3 +122,8 @@ diff --git a/gfx/skia/skia/modules/skcms/skcms.cc b/gfx/skia/skia/modules/skcms/
  #endif
  }
  
+ static int32_t read_big_i32(const uint8_t* ptr) {
+     return (int32_t)read_big_u32(ptr);
+ }
+ 
+ static float read_big_fixed(const uint8_t* ptr) {

mozilla-bmo1898476.patch

@@ -0,0 +1,401 @@
+
+# HG changeset patch
+# User stransky <stransky@redhat.com>
+# Date 1720609192 0
+# Node ID f9323daf7abeb19f69ac5762a0a442c0dc15636e
+# Parent  5afadee4e18fc5779d789d9371a3d2d67a29d1da
+Bug 1898476 [Wayland] Move MozContainerSurfaceLock from MozContainerWayland to MozContainerSurfaceLock module r=emilio
+
+Differential Revision: https://phabricator.services.mozilla.com/D214883
+
+diff --git a/widget/gtk/MozContainerSurfaceLock.cpp b/widget/gtk/MozContainerSurfaceLock.cpp
+new file mode 100644
+--- /dev/null
++++ b/widget/gtk/MozContainerSurfaceLock.cpp
+@@ -0,0 +1,31 @@
++/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "MozContainerSurfaceLock.h"
++#include "MozContainer.h"
++#include "WidgetUtilsGtk.h"
++
++using namespace mozilla::widget;
++
++MozContainerSurfaceLock::MozContainerSurfaceLock(MozContainer* aContainer) {
++#ifdef MOZ_WAYLAND
++  mContainer = aContainer;
++  if (GdkIsWaylandDisplay()) {
++    // mSurface can be nullptr if we lock hidden MozContainer and
++    // that's correct, MozContainer is still locked.
++    mSurface = moz_container_wayland_surface_lock(aContainer);
++  }
++#endif
++}
++
++MozContainerSurfaceLock::~MozContainerSurfaceLock() {
++#ifdef MOZ_WAYLAND
++  if (GdkIsWaylandDisplay()) {
++    moz_container_wayland_surface_unlock(mContainer, &mSurface);
++  }
++#endif
++}
++
++struct wl_surface* MozContainerSurfaceLock::GetSurface() { return mSurface; }
+diff --git a/widget/gtk/MozContainerSurfaceLock.h b/widget/gtk/MozContainerSurfaceLock.h
+new file mode 100644
+--- /dev/null
++++ b/widget/gtk/MozContainerSurfaceLock.h
+@@ -0,0 +1,28 @@
++/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#ifndef widget_gtk_MozContainerSurfaceLock_h
++#define widget_gtk_MozContainerSurfaceLock_h
++
++struct wl_surface;
++struct _MozContainer;
++typedef struct _MozContainer MozContainer;
++
++class MozContainerSurfaceLock {
++ public:
++  explicit MozContainerSurfaceLock(MozContainer* aContainer);
++  ~MozContainerSurfaceLock();
++
++  // wl_surface can be nullptr if we lock hidden MozContainer.
++  struct wl_surface* GetSurface();
++
++ private:
++#ifdef MOZ_WAYLAND
++  MozContainer* mContainer = nullptr;
++#endif
++  struct wl_surface* mSurface = nullptr;
++};
++
++#endif  // widget_gtk_MozContainerSurfaceLock_h
+diff --git a/widget/gtk/MozContainerWayland.cpp b/widget/gtk/MozContainerWayland.cpp
+--- a/widget/gtk/MozContainerWayland.cpp
++++ b/widget/gtk/MozContainerWayland.cpp
+@@ -82,33 +82,16 @@ using namespace mozilla;
+ using namespace mozilla::widget;
+ 
+ static bool moz_container_wayland_surface_create_locked(
+     const MutexAutoLock& aProofOfLock, MozContainer* container);
+ static void moz_container_wayland_set_opaque_region_locked(
+     const MutexAutoLock& aProofOfLock, MozContainer* container,
+     const LayoutDeviceIntRegion&);
+ 
+-// Lock mozcontainer and get wayland surface of it. You need to pair with
+-// moz_container_wayland_surface_unlock() even
+-// if moz_container_wayland_surface_lock() fails and returns nullptr.
+-static struct wl_surface* moz_container_wayland_surface_lock(
+-    MozContainer* container);
+-static void moz_container_wayland_surface_unlock(MozContainer* container,
+-                                                 struct wl_surface** surface);
+-
+-MozContainerSurfaceLock::MozContainerSurfaceLock(MozContainer* aContainer) {
+-  mContainer = aContainer;
+-  mSurface = moz_container_wayland_surface_lock(aContainer);
+-}
+-MozContainerSurfaceLock::~MozContainerSurfaceLock() {
+-  moz_container_wayland_surface_unlock(mContainer, &mSurface);
+-}
+-struct wl_surface* MozContainerSurfaceLock::GetSurface() { return mSurface; }
+-
+ // Invalidate gtk wl_surface to commit changes to wl_subsurface.
+ // wl_subsurface changes are effective when parent surface is commited.
+ static void moz_container_wayland_invalidate(MozContainer* container) {
+   LOGWAYLAND("moz_container_wayland_invalidate [%p]\n",
+              (void*)moz_container_get_nsWindow(container));
+ 
+   GdkWindow* window = gtk_widget_get_window(GTK_WIDGET(container));
+   if (!window) {
+diff --git a/widget/gtk/MozContainerWayland.h b/widget/gtk/MozContainerWayland.h
+--- a/widget/gtk/MozContainerWayland.h
++++ b/widget/gtk/MozContainerWayland.h
+@@ -8,16 +8,17 @@
+ #ifndef __MOZ_CONTAINER_WAYLAND_H__
+ #define __MOZ_CONTAINER_WAYLAND_H__
+ 
+ #include <gtk/gtk.h>
+ #include <functional>
+ #include <vector>
+ #include "mozilla/Mutex.h"
+ #include "WindowSurface.h"
++#include "MozContainerSurfaceLock.h"
+ 
+ /*
+  * MozContainer
+  *
+  * This class serves three purposes in the nsIWidget implementation.
+  *
+  *   - It provides objects to receive signals from GTK for events on native
+  *     windows.
+@@ -56,25 +57,22 @@ struct MozContainerWayland {
+   mozilla::Mutex container_lock{"MozContainerWayland::container_lock"};
+ };
+ 
+ struct _MozContainer;
+ struct _MozContainerClass;
+ typedef struct _MozContainer MozContainer;
+ typedef struct _MozContainerClass MozContainerClass;
+ 
+-class MozContainerSurfaceLock {
+-  MozContainer* mContainer;
+-  struct wl_surface* mSurface;
+-
+- public:
+-  explicit MozContainerSurfaceLock(MozContainer* aContainer);
+-  ~MozContainerSurfaceLock();
+-  struct wl_surface* GetSurface();
+-};
++// Lock mozcontainer and get wayland surface of it. You need to pair with
++// moz_container_wayland_surface_unlock() even
++// if moz_container_wayland_surface_lock() fails and returns nullptr.
++struct wl_surface* moz_container_wayland_surface_lock(MozContainer* container);
++void moz_container_wayland_surface_unlock(MozContainer* container,
++                                          struct wl_surface** surface);
+ 
+ void moz_container_wayland_map(GtkWidget*);
+ gboolean moz_container_wayland_map_event(GtkWidget*, GdkEventAny*);
+ void moz_container_wayland_size_allocate(GtkWidget*, GtkAllocation*);
+ void moz_container_wayland_unmap(GtkWidget*);
+ 
+ struct wl_egl_window* moz_container_wayland_get_egl_window(
+     MozContainer* container, double scale);
+diff --git a/widget/gtk/moz.build b/widget/gtk/moz.build
+--- a/widget/gtk/moz.build
++++ b/widget/gtk/moz.build
+@@ -28,16 +28,17 @@ if CONFIG["MOZ_WAYLAND"]:
+ if CONFIG["MOZ_ENABLE_VAAPI"]:
+     DIRS += ["vaapitest"]
+ 
+ if CONFIG["MOZ_ENABLE_V4L2"]:
+     DIRS += ["v4l2test"]
+ 
+ EXPORTS += [
+     "MozContainer.h",
++    "MozContainerSurfaceLock.h",
+     "nsGTKToolkit.h",
+     "nsGtkUtils.h",
+     "nsImageToPixbuf.h",
+ ]
+ 
+ EXPORTS.mozilla += [
+     "GfxInfo.h",
+     "GfxInfoUtils.h",
+@@ -66,16 +67,17 @@ UNIFIED_SOURCES += [
+     "DMABufLibWrapper.cpp",
+     "DMABufSurface.cpp",
+     "GfxInfo.cpp",
+     "gtk3drawing.cpp",
+     "GtkCompositorWidget.cpp",
+     "IMContextWrapper.cpp",
+     "InProcessGtkCompositorWidget.cpp",
+     "MozContainer.cpp",
++    "MozContainerSurfaceLock.cpp",
+     "MPRISServiceHandler.cpp",
+     "NativeKeyBindings.cpp",
+     "NativeMenuGtk.cpp",
+     "NativeMenuSupport.cpp",
+     "nsApplicationChooser.cpp",
+     "nsAppShell.cpp",
+     "nsBidiKeyboard.cpp",
+     "nsClipboard.cpp",
+@@ -109,16 +111,17 @@ if CONFIG["MOZ_WAYLAND"]:
+     UNIFIED_SOURCES += [
+         "MozContainerWayland.cpp",
+         "nsClipboardWayland.cpp",
+         "nsWaylandDisplay.cpp",
+         "WaylandBuffer.cpp",
+         "WindowSurfaceWaylandMultiBuffer.cpp",
+     ]
+     EXPORTS.mozilla.widget += [
++        "MozContainerSurfaceLock.h",
+         "MozContainerWayland.h",
+         "nsWaylandDisplay.h",
+         "WaylandBuffer.h",
+     ]
+ 
+ if CONFIG["MOZ_X11"]:
+     UNIFIED_SOURCES += [
+         "nsClipboardX11.cpp",
+
+
+# HG changeset patch
+# User stransky <stransky@redhat.com>
+# Date 1720609193 0
+# Node ID a264ff9e9f6f87ca0520a884b29c4be90001533e
+# Parent  f9323daf7abeb19f69ac5762a0a442c0dc15636e
+Bug 1898476 [Wayland] Provide surface lock by GtkCompositorWidget r=emilio
+
+Depends on D214883
+
+Differential Revision: https://phabricator.services.mozilla.com/D214884
+
+diff --git a/widget/gtk/GtkCompositorWidget.cpp b/widget/gtk/GtkCompositorWidget.cpp
+--- a/widget/gtk/GtkCompositorWidget.cpp
++++ b/widget/gtk/GtkCompositorWidget.cpp
+@@ -206,10 +206,14 @@ void GtkCompositorWidget::SetRenderingSu
+ }
+ 
+ #ifdef MOZ_LOGGING
+ bool GtkCompositorWidget::IsPopup() {
+   return mWidget ? mWidget->IsPopup() : false;
+ }
+ #endif
+ 
++UniquePtr<MozContainerSurfaceLock> GtkCompositorWidget::LockSurface() {
++  return mWidget->LockSurface();
++}
++
+ }  // namespace widget
+ }  // namespace mozilla
+diff --git a/widget/gtk/GtkCompositorWidget.h b/widget/gtk/GtkCompositorWidget.h
+--- a/widget/gtk/GtkCompositorWidget.h
++++ b/widget/gtk/GtkCompositorWidget.h
+@@ -5,16 +5,18 @@
+ 
+ #ifndef widget_gtk_GtkCompositorWidget_h
+ #define widget_gtk_GtkCompositorWidget_h
+ 
+ #include "GLDefs.h"
+ #include "mozilla/DataMutex.h"
+ #include "mozilla/widget/CompositorWidget.h"
+ #include "WindowSurfaceProvider.h"
++#include "mozilla/UniquePtr.h"
++#include "MozContainerSurfaceLock.h"
+ 
+ class nsIWidget;
+ class nsWindow;
+ 
+ namespace mozilla {
+ 
+ namespace layers {
+ class NativeLayerRootWayland;
+@@ -91,16 +93,18 @@ class GtkCompositorWidget : public Compo
+   RefPtr<mozilla::layers::NativeLayerRoot> GetNativeLayerRoot() override;
+ #endif
+ 
+   // PlatformCompositorWidgetDelegate Overrides
+ 
+   void NotifyClientSizeChanged(const LayoutDeviceIntSize& aClientSize) override;
+   GtkCompositorWidget* AsGtkCompositorWidget() override { return this; }
+ 
++  UniquePtr<MozContainerSurfaceLock> LockSurface();
++
+  private:
+ #if defined(MOZ_WAYLAND)
+   void ConfigureWaylandBackend();
+ #endif
+ #if defined(MOZ_X11)
+   void ConfigureX11Backend(Window aXWindow, bool aShaped);
+ #endif
+ #ifdef MOZ_LOGGING
+diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
+--- a/widget/gtk/nsWindow.cpp
++++ b/widget/gtk/nsWindow.cpp
+@@ -10271,8 +10271,15 @@ void nsWindow::SetDragSource(GdkDragCont
+   mSourceDragContext = aSourceDragContext;
+   if (IsPopup() &&
+       (widget::GdkIsWaylandDisplay() || widget::IsXWaylandProtocol())) {
+     if (auto* menuPopupFrame = GetMenuPopupFrame(GetFrame())) {
+       menuPopupFrame->SetIsDragSource(!!aSourceDragContext);
+     }
+   }
+ }
++
++UniquePtr<MozContainerSurfaceLock> nsWindow::LockSurface() {
++  if (mIsDestroyed) {
++    return nullptr;
++  }
++  return MakeUnique<MozContainerSurfaceLock>(mContainer);
++}
+diff --git a/widget/gtk/nsWindow.h b/widget/gtk/nsWindow.h
+--- a/widget/gtk/nsWindow.h
++++ b/widget/gtk/nsWindow.h
+@@ -8,16 +8,17 @@
+ #ifndef __nsWindow_h__
+ #define __nsWindow_h__
+ 
+ #include <gdk/gdk.h>
+ #include <gtk/gtk.h>
+ 
+ #include "CompositorWidget.h"
+ #include "MozContainer.h"
++#include "MozContainerSurfaceLock.h"
+ #include "VsyncSource.h"
+ #include "mozilla/EventForwards.h"
+ #include "mozilla/Maybe.h"
+ #include "mozilla/RefPtr.h"
+ #include "mozilla/TouchEvents.h"
+ #include "mozilla/UniquePtr.h"
+ #include "mozilla/RWLock.h"
+ #include "mozilla/widget/WindowSurface.h"
+@@ -416,16 +417,18 @@ class nsWindow final : public nsBaseWidg
+   static bool TitlebarUseShapeMask();
+   bool IsRemoteContent() { return HasRemoteContent(); }
+   void NativeMoveResizeWaylandPopupCallback(const GdkRectangle* aFinalSize,
+                                             bool aFlippedX, bool aFlippedY);
+   static bool IsToplevelWindowTransparent();
+ 
+   static nsWindow* GetFocusedWindow();
+ 
++  mozilla::UniquePtr<MozContainerSurfaceLock> LockSurface();
++
+ #ifdef MOZ_WAYLAND
+   // Use xdg-activation protocol to transfer focus from gFocusWindow to aWindow.
+   static void TransferFocusToWaylandWindow(nsWindow* aWindow);
+   void FocusWaylandWindow(const char* aTokenID);
+ 
+   bool GetCSDDecorationOffset(int* aDx, int* aDy);
+   bool SetEGLNativeWindowSize(const LayoutDeviceIntSize& aEGLWindowSize);
+   void WaylandDragWorkaround(GdkEventButton* aEvent);
+
+
+# HG changeset patch
+# User stransky <stransky@redhat.com>
+# Date 1720609193 0
+# Node ID eb230ecdf8eb26a9ed340873b58fe7b71f94f8e8
+# Parent  a264ff9e9f6f87ca0520a884b29c4be90001533e
+Bug 1898476 [Wayland] Lock Wayland surface before Swap buffers in RenderCompositorEGL r=emilio
+
+Depends on D214884
+
+Differential Revision: https://phabricator.services.mozilla.com/D214885
+
+diff --git a/gfx/webrender_bindings/RenderCompositorEGL.cpp b/gfx/webrender_bindings/RenderCompositorEGL.cpp
+--- a/gfx/webrender_bindings/RenderCompositorEGL.cpp
++++ b/gfx/webrender_bindings/RenderCompositorEGL.cpp
+@@ -149,16 +149,26 @@ RenderedFrameId RenderCompositorEGL::End
+       const auto width = right - left;
+       const auto height = bottom - top;
+ 
+       bufferInvalid.OrWith(
+           gfx::IntRect(left, (GetBufferSize().height - bottom), width, height));
+     }
+     gl()->SetDamage(bufferInvalid);
+   }
++
++#ifdef MOZ_WIDGET_GTK
++  // Rendering on Wayland has to be atomic (buffer attach + commit) and
++  // wayland surface is also used by main thread so lock it before
++  // we paint at SwapBuffers().
++  UniquePtr<MozContainerSurfaceLock> lock;
++  if (auto* gtkWidget = mWidget->AsGTK()) {
++    lock = gtkWidget->LockSurface();
++  }
++#endif
+   gl()->SwapBuffers();
+   return frameId;
+ }
+ 
+ void RenderCompositorEGL::Pause() { DestroyEGLSurface(); }
+ 
+ bool RenderCompositorEGL::Resume() {
+   if (kIsAndroid) {
+

mozilla-bmo1907511.patch

@@ -0,0 +1,29 @@
+
+# HG changeset patch
+# User stransky <stransky@redhat.com>
+# Date 1720807971 0
+# Node ID d8a0164db5db7090fd7549b03dd0391f7151649c
+# Parent  e243955016ffa880296b8d82cf531887dfb3ac22
+Bug 1907511 [Linux/X11] Check mWindow at GtkCompositorWidget::LockSurface() r=emilio
+
+Differential Revision: https://phabricator.services.mozilla.com/D216380
+
+diff --git a/widget/gtk/GtkCompositorWidget.cpp b/widget/gtk/GtkCompositorWidget.cpp
+--- a/widget/gtk/GtkCompositorWidget.cpp
++++ b/widget/gtk/GtkCompositorWidget.cpp
+@@ -207,13 +207,13 @@ void GtkCompositorWidget::SetRenderingSu
+ 
+ #ifdef MOZ_LOGGING
+ bool GtkCompositorWidget::IsPopup() {
+   return mWidget ? mWidget->IsPopup() : false;
+ }
+ #endif
+ 
+ UniquePtr<MozContainerSurfaceLock> GtkCompositorWidget::LockSurface() {
+-  return mWidget->LockSurface();
++  return mWidget ? mWidget->LockSurface() : nullptr;
+ }
+ 
+ }  // namespace widget
+ }  // namespace mozilla
+

mozilla-rust-disable-future-incompat.patch

@@ -1,21 +1,16 @@
 # HG changeset patch
-# Parent  8c5b7b10f09b8cd6a8a6e0e29b92ec88cec6d4ce
+# Parent  83a5e219b271976ee9dfa46b74ecc1c1c6d49f94
 
-diff --git a/Cargo.toml b/Cargo.toml
+Index: firefox-128.0/Cargo.toml
---- a/Cargo.toml
+===================================================================
-+++ b/Cargo.toml
+--- firefox-128.0.orig/Cargo.toml
-@@ -238,8 +238,14 @@ mio_0_8 = { package = "mio", git = "http
++++ firefox-128.0/Cargo.toml
+@@ -236,3 +236,8 @@ mio_0_8 = { package = "mio", git = "http
  # Patch `gpu-descriptor` 0.3.0 to remove unnecessary `allocator-api2` dep.:
  # Still waiting for the now-merged <https://github.com/zakarumych/gpu-descriptor/pull/40> to be released.
  gpu-descriptor = { git = "https://github.com/zakarumych/gpu-descriptor", rev = "7b71a4e47c81903ad75e2c53deb5ab1310f6ff4d" }
- 
- # Patch mio 0.6 to use winapi 0.3 and miow 0.3, getting rid of winapi 0.2.
- # There is not going to be new version of mio 0.6, mio now being >= 0.7.11.
- [patch.crates-io.mio]
- path = "third_party/rust/mio-0.6.23"
 +
 +# Package code v0.1.4 uses code "that will be rejected by a future version of Rust"
 +# Shut up such messages for now to make the build succeed
 +[future-incompat-report]
 +frequency = "never"
-+

tar_stamps

@@ -1,10 +1,10 @@
 PRODUCT="firefox"
 CHANNEL="release"
-VERSION="127.0.2"
+VERSION="128.0"
 VERSION_SUFFIX=""
-PREV_VERSION="127.0.1"
+PREV_VERSION="127.0.2"
 PREV_VERSION_SUFFIX=""
 #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation
 RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-release"
-RELEASE_TAG="c7bfb1e800e25153412ab2b70836fcbb090ba99e"
+RELEASE_TAG="14b32d530926c66251f10fe2410184f7cc7de839"
-RELEASE_TIMESTAMP="20240624183754"
+RELEASE_TIMESTAMP="20240704121409"