Welcome to the July 2026 report from the Reproducible Builds project!

In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.

If you are interested in contributing to the project, please visit the Contribute page on our website.

In this month’s report, we cover:

1. Tool development
2. Distribution work
3. Three new scholarly papers
4. Patches
5. Misc news

---

Tool development

diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made the following changes, including preparing and uploading versions 324, 325 and 326 to Debian:

• Fix tests to work with zipdetails 4.0008. (#1141359)
• Bump debhelper compatibility level to 13. […]
• Update copyright years. […]

In addition, Paul Spooren made changes to allow trailing garbage in Gzip files […] and Vagrant Cascadian added an external tool reference for the pedump binary to use the mono package under GNU Guix. […]

disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into system calls to reliably flush out reproducibility issues. This month, Christelle Gloor added the option to sort by ctime as returned by the lstat(2) syscall. […], which Chris Lamb uploaded whilst bumping the Standards-Version to version 4.7.4 […]. Bernhard Wiedemann also updated disorderfs to version 0.7.0 in openSUSE.

Yet again, there were a number of improvements made to our website this month as well. For example, Chris Lamb, by request of Digital Ocean, changed the target of a referral link so that they can manage incoming referrers […] and pushed a number of changes to the Tools page […].

Distribution work

In Debian this month, 32 reviews of Debian packages were added, 26 were updated and a total of 21 were removed this month, adding to our extensive knowledge about identified issues.

A number of issue types were added by Chris Lamb, including:

• python_towncrier_build_date […][…]
• log_files_installed_in_package […]
• fontforge_varies_by_timezone […][…]

Chris also added a further note for the build_date_in_manpage_generated_by_spf13_cobra issue. […]

In addition, there is a new page showing verification rebuilds of OpenWrt APK packages and firmware images, powered by rebuilderd:

Three new scholarly papers

Yan Li, Nan Jiang, Qihang Zhou, Shaowen Xu, Yamin Xie and Xiaoqi Jia of the Chinese Academy of Sciences published a paper titled VCAligner: Aligning Source Distribution Versions with Upstream Git Commits to Secure Supply Chain:

We present VCAligner, a content-based alignment methodology that constructs inverted indexes over VCS histories to precisely map released artifacts to their originating commits, independent of fragile version tags. We evaluated VCAligner on a dataset of 2,984 verifiable PyPI packages derived from the 4,000 most-downloaded projects linked to public GitHub upstreams. Our results reveal a critical weakness in conventional tag-based heuristics: while they appear effective on 85% of the dataset, the residual 15% failure rate generates a catastrophic downstream audit workload of over 10.3 million commits. In contrast, VCAligner reduces this burden by two orders of magnitude (≈ 158×), bounding the total workload to under 65,000 commits. Furthermore, we provide the large-scale characterization of “Packaging Noise,” classifying artifact divergence into structural additions (Path Phantoms) and content mutations (Blob Phantoms), thereby isolating the distinct attack surfaces of malicious injection and code tampering.

Jens Dietrich and Spencer Sun from the Victoria University of Wellington together with Tim W. White and Behnaz Hassanshahi from Oracle Inc pre-published their paper No Snake Oil: Verifying Python Package Builds (PDF):

Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent. Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPI wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively.

Denise Nanni, Julien Malka, Stefano Zacchiroli and Théo Zimmermann from Télécom Paris together with Gabriele D’Angelo from the University of Bologna pre-published their paper Understanding Build Reproducibility in the F-Droid Ecosystem (PDF), which was accepted at the 2026 ACM Conference on Reproducibility and Replicability:

The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app publishing time. However, F-Droid offers no guarantee that app reproducibility will continue to hold in the future. As software ecosystems evolve, reproducibility may degrade, with potential negative consequences for software preservation and security. We present the first empirical study of build reproducibility in the F-Droid app ecosystem. Analyzing historical reproducibility logs, we find that the overall bitwise reproducibility rate has been steadily increasing over time (as new versions of apps are published). We then evaluate how reproducibility holds in time for fixed app versions, by attempting to rebuild 18 904 app versions that F-Droid had previously confirmed bitwise reproducible, published between September 2018 and February 2026, achieving an 83% rebuild success rate, and identify missing dependencies as the dominant cause of failure, accounting for 76% of non-rebuildable cases. Among successfully rebuilt apps, 94% are also bitwise reproducible-i.e., they still yield bitwise identical artifacts upon rebuild. Together, these results show that while bitwise reproducibility largely holds for apps that can be rebuilt, rebuildability itself is highly sensitive to temporal decay.

Patches

The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:

• openSUSE monthly

• Arnout Engelen:

  • ivy
  • pekko-grpc
  • sbt-ivy
  • scala

• Bernhard M. Wiedemann:

  • angelfish
  • cpython
  • efl
  • erlang+ex_doc
  • eww/glib-macros
  • intel-graphics-compiler
  • java-11-openjdk
  • java-17-openjdk
  • java-1_8_0-openjdk
  • java-21-openjdk
  • mono-core
  • nasm/rav1e
  • python-langsmith
  • zathura*
  • zig0.15

• Chris Lamb:

  • #1141505 filed against golang-github-tidwall-wal.
  • #1141506 filed against lightproof.
  • #1141582 filed against libslow5lib.
  • #1141687 filed against siso.
  • #1141841 filed against grout.
  • #1142126 filed against libpsl.
  • #1142492 filed against node-grunt-contrib-internal.
  • #1142495 filed against fontforge.
  • #1142496 filed against spopt.
  • #1142887 filed against go-dlib.
  • #1143147 filed against towncrier.

• Jochen Sprickerhof:

  • #1141412 filed against python-sphinx-chango.
  • #1141553 filed against gasnet.
  • #1141577 filed against yubihsm-connector.
  • #1141663 filed against dh-fortran.
  • #1142000 filed against watcher.
  • #1142001 filed against rakudo.
  • #1142128 filed against kf6-breeze-icons.
  • #1142141 filed against oxygen-icons.
  • #1142256 filed against gnu-apl.
  • #1142513 filed against barvinok.
  • #1143169 filed against ecbuild.

Misc news

On our mailing list this month, Colin Winter of Markovian Protocol wrote to our mailing list on the topic of Reproducible verification for retained logs:

Reproducible builds remove trust in the builder: anyone re-derives the same artifact from the same source, byte for byte. The same shape applies one layer over, to a retained record. Most record-keeping regimes (the EU AI Act’s Article 12 logging is the current example) require that events be recorded and logs retained, but not that a retained log be verifiable, by a party who was not present, as unaltered and existing when claimed. That leaves an integrity obligation resting on trusting the party being audited.

(Full thread)

Finally, if you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:

• IRC: #reproducible-builds on irc.oftc.net.

• Mastodon: @reproducible_builds@fosstodon.org

• Mailing list: rb-general@lists.reproducible-builds.org

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. iDeal OS, an MX Linux-based desktop distribution with focus on privacy and security, has been updated to version 2026.08.08. This release replaces Firefox with Waterfox as the new default web browser: "2026.08.08 - iDeal OS 4.4. The release of iDeal OS 4.4 is a major upgrade on the....

Apple is planning to reintroduce its striking ceramic Apple Watch casing as soon as this year, Bloomberg's Mark Gurman reports.


Writing in his "Power On" newsletter, Gurman explained that the ceramic case option is expected to return either this year or in 2027. Apple first introduced a ceramic Apple Watch Edition with the Series 2 in September 2016, replacing the original gold Edition model and bringing the line's price down from thousands of dollars to a comparatively modest $1,249.

The white ceramic finish, made from a compressed zirconia and alumina powder polished with a diamond slurry, was marketed as being four times as hard as stainless steel. Apple expanded the material a year later with a gray ceramic option alongside the Series 3, but the Edition line disappeared entirely for the Series 4 in 2018, with Apple dropping ceramic and offering no high-end case option at all that year.

The white ceramic finish returned for the Series 5 in 2019 alongside an all-new titanium option, before Apple discontinued it for good when the Series 6 launched in 2020. The material has been absent from the Apple Watch lineup for six years since. It has since become one of the more sought after finishes among collectors on the resale market.

Beyond the reintroduction of the ceramic casing option, the upcoming Apple Watch Series 12 and Apple Watch Ultra 4 will apparently continue "the trend of modest upgrades," with "under-the-hood improvements" including a meaningful increase in performance. This likely refers to the introduction of a new chip. The previous two Apple Watch generations have featured the same S10 chip, which is effectively unchanged from the previous S9 chip introduced in 2023.

Gurman added that this year's new Apple Watch models will also offer new color and band options, alongside a number of new health and fitness-related upgrades. The Apple Watch Series 12 and Apple Watch Ultra 4 are expected to be introduced alongside the iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and first foldable iPhone next month.
This article, "Ceramic Case Could Return With Apple Watch Series 12" first appeared on MacRumors.com

Discuss this article in our forums

Apple is already making plans for its third-generation foldable iPhone, with launch expected as early as 2028, according to Bloomberg's Mark Gurman.


Writing in his latest "Power On" newsletter, Gurman said the first foldable iPhone is about to get what he called the device's first "truly revolutionary design change" this year, and that Apple already has a roadmap extending two generations beyond it. A second-generation model is planned for 2027, Gurman says, with a third version following as early as 2028.

The third-generation foldable will apparently feature slightly larger displays on both the inside and the outside compared to its predecessors, though he did not provide specific screen sizes. The first foldable iPhone is expected to launch with a 7.8-inch inner display and a 5.5-inch cover display, so any increase would build on those dimensions. This is the first report to lay out plans for a third-generation model, extending Apple's foldable roadmap a year beyond where it previously stood.

The first foldable iPhone is expected to arrive this year with an ultra-thin design, Touch ID instead of Face ID, the A20 chip, C2 modem, and the moniker "iPhone Ultra," at a price around or above $2,000. The second-generation foldable, meanwhile, is reported to have already received the go-ahead for development, according to the Weibo leaker known as "Digital Chat Station," who said the "‌iPhone Ultra‌ 2" project has been formally approved and will likely reuse the first-generation model's display. That model is expected to launch in fall 2027 alongside the 20th-anniversary iPhone.



This article, "Foldable 'iPhone Ultra 3' Rumored to Feature Larger Displays" first appeared on MacRumors.com

Discuss this article in our forums

Apple is re-evaluating the Apple Watch lineup and considering a host of radical new designs, according to Bloomberg's Mark Gurman.


In today's edition of his "Power On" newsletter, Gurman compared plans for the Apple Watch's evolution to the "revolutionary design change" that the foldable iPhone represents. It will be "something that transforms the product for a new era." Apple's industrial design team has reportedly been "exploring a broader rethink of its smartwatches" for some time, with several directions under evaluation.

The company is apparently taking the resurgence of fitness bands without screens and smart rings seriously. As a result, the company is considering new Apple Watch-style devices with no display, as well as new Apple Watches with different types of screen and various new sizes.

Apple has also contemplated giving the Apple Watch a round display, but Gurman cautioned that such a device is unlikely to be released. The company has also considered introducing new premium variants designed to sit above the Ultra and Hermès models, alongside even more affordable options in addition to the Apple Watch SE.

The company has not yet settled on a direction for the product line, but it is said to be "determined to reinvent the lineup in response to growing competition." It also plans to make its wearables more AI-focused, with ambitious long-term plans to revamp the Health app.

Gurman believes that the Apple Watch revamp "could be as significant as the iPhone's transformation from a slab design into a foldable device." Apple purportedly hopes to reinvigorate its Wearables, Home and Accessories segment, which has struggled to generate growth over recent years.
This article, "Apple Watch Rethink Could See Debut of Round Model, Screenless Fitness Tracker, and More" first appeared on MacRumors.com

Discuss this article in our forums

New images of camera protector accessories for the "iPhone Ultra" suggest Apple's first foldable iPhone will launch in silver and dark blue finishes.


Leaker Sonny Dickson yesterday shared images of two third-party camera protectors designed to fit over the ‌iPhone Ultra‌'s camera bump, with one in silver and one in a dark blue finish. Dickson has a track record of accurate accessory and dummy model leaks, including his early look at this year's iPhone 18 Pro colors.

The images back up a May report that cited a Macworld supply chain source describing a classic silver and white model alongside an indigo option similar to the iPhone 17 Pro's Deep Blue finish. A silver finish was separately described as the first "confirmed" color in June, and a report the same week suggested the darker option might not be black. Dickson's accessories now offer the clearest visual confirmation yet of that silver and dark blue offering.



The restrained approach stands in contrast to the iPhone 18 Pro, which is rumored to add a Dark Cherry finish and a Light Blue option alongside Silver this year. A black option for the Pro models was also rumored initially, though a subsequent report suggested Apple decided not to include it this year.

The leaked accessories also clearly show the widely rumored design of the camera plateau on the back of the foldable iPhone, featuring two horizontally arranged lenses alongside a pill-shaped flash and a LiDAR scanner. The foldable ‌iPhone Ultra‌ is expected to be announced alongside the ‌iPhone 18 Pro‌ and ‌iPhone 18 Pro‌ Max next month.
This article, "Foldable 'iPhone Ultra' Rumored to Come in These Two Colors" first appeared on MacRumors.com

Discuss this article in our forums

Amazon this weekend is taking $50 off Wi-Fi models of Apple's 11th generation iPad. Prices start at $399.00 for the 128GB Wi-Fi iPad, down from $449.00. This is a match of the best price we've seen on the iPad since Apple's price hikes in June.

Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Additionally, Amazon has the 256GB Wi-Fi iPad for $499.00 ($50 off) and the 512GB Wi-Fi iPad for $699.00 ($50 off). Free delivery estimates are placed around August 13 for most of these iPad models, but Prime members should be able to get same-day delivery in many locations.





If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.

---

This article, "Score the A16 iPad for Its Best Price Since June's Hike" first appeared on MacRumors.com

Discuss this article in our forums

Apple's annual September iPhone event is just about a month away, and things are going to be a little bit different this year with Apple moving to a split launch for the iPhone 18 lineup, so make sure you're up to date on everything we may see at the event.


This week also saw word that Apple is experiencing shortages of the MacBook Air due to the ongoing memory crunch, while the software side saw a significant issue with iCloud Private Relay disclosed and progress from Apple on a cross-platform clipboard, so read on below for all of the details!

Top Stories

Everything Apple Is Expected to Announce in September

Apple is going to announce at least five new devices next month at its annual iPhone-centric event, though it's possible we'll also get devices that were waiting on Siri AI, so check out our overview of what we might see. There's even a late-breaking wild card in the form of camera-equipped AirPods, which were previously thought to be a 2027 launch.


Apple is gearing up for the big iPhone event, which should take place in the first half of September with Apple currently holding a lottery for its U.S. retail employees to come to Apple Park and help staff the event.

iPhone 18 Pro Models Could Be Up to $300 More Expensive, Says Analyst

Following recent price increases across the Mac and iPad lineups, most observers are expecting the iPhone lineup to follow suit as part of next month's launch of new models. It remains unknown just how much iPhone prices will increase compared to current models, but analyst Jeff Pu believes the iPhone 18 Pro and Pro Max could see increases of $250–$300 due to component shortages.


Apple is reportedly still scrambling to secure sufficient memory supplies for the upcoming iPhone models, and the company reportedly has around $1 billion worth of unpackaged processors sitting idle as they wait for their accompanying memory chips. The issues could lead to shortages of the new iPhone models at launch.

MacBook Air Experiencing 'Major' Shortage Despite $200 Price Increase

Despite receiving a price increase in June, the MacBook Air is currently experiencing a "major" shortage, according to Bloomberg's Mark Gurman.


"Retail store sources say Apple is struggling to keep the laptop in stock and that shipments of new units are more constrained than they can ever recall," he said.

In the U.S., the MacBook Air is facing a 2–6 week delivery estimate on Apple's online store, with configurations with higher amounts of RAM delayed the longest.

Bigger Displays Rumored for Next Year's iPhone Models

Apple is prototyping a second new iPhone display, this one measuring around 6.4 inches, that could be destined for the 20th anniversary iPhone, according to a Chinese leaker.


In a recent post on Weibo, the leaker known as "Digital Chat Station" said Apple is currently sampling two new display panels. One measures roughly 6.4 inches and has a chance of being used in the "‌iPhone 20 Pro‌," while the other is the approximately 7-inch panel previously reported for the larger ‌"iPhone 20 Pro Max‌." (Even though next year's models should be in the iPhone 19 family, many expect Apple to jump to iPhone 20 or iPhone XX in recognition of the device's anniversary.)

Apple is planning a significant revamp of its pro iPhone models in 2027, with more of an all-glass design that wraps the display around all four edges of the device, a smaller display cutout, and more.

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Apple's paid Safari protection feature that promises to keep your IP address masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.


‌iCloud‌ Private Relay is a service included with paid ‌iCloud‌+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.

Apple Plans iPhone-to-Windows Copy and Paste in EU After Microsoft Request

Apple is working on a new feature that will support cross-device copy and paste between iOS devices and Windows PCs. Microsoft asked for the feature using Apple's EU interoperability request system for developers, which Apple implemented to comply with the Digital Markets Act. Apple began evaluating the request in March, and on June 26, proposed a project plan.


Apple says introducing cross-device copy and paste is a significant engineering effort, with work expected to be complete by fall 2027. It will be shipped first in a developer beta for testing ahead of a public release. If the feature is added toward the end of fall 2027, it could be early 2028 before the public gets access.

It is likely that cross-device copy and paste will be limited to iPhone and Windows users in the European Union, though it is possible Apple could implement it worldwide.

MacRumors Newsletter

Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view.

So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!
This article, "Top Stories: Apple's September Announcements, MacBook Air Shortages, and More" first appeared on MacRumors.com

Discuss this article in our forums

Anthropic has updated Claude Code so that separate coding sessions can message each other directly, removing the need to manually copy context between Terminal windows.


The company shipped the feature in Claude Code version 2.1.224, released on Friday for macOS and Linux. Two new tools power it: ListAgents, which finds other active sessions running on the Mac, and SendMessage, which delivers the message. A session that receives one shows it as a labeled card with a link back to the sender.

According to Anthropic's documentation, only text passes between sessions, not conversation history, files, or permissions. One session can warn another when a change breaks something it depends on, or pass along an answer another session is waiting on, and Anthropic says an incoming message can't approve a permission request or change a session's settings on its own.



The feature sits alongside Claude Code's existing subagents and Agent Teams tools, but connects sessions a user is already running separately on their Mac rather than ones Claude spawns and manages itself. Messages between sessions on the same Mac stay local and never reach Anthropic's servers. Between different machines, messaging works only as a reply through Remote Control, the feature that connects a Mac terminal to the Claude apps for iOS and Android.

Cross session messaging requires macOS or Linux with Claude Code 2.1.224 or later and isn't available on Windows. It was released alongside 31 other changes in the same release, including a new claude self-hosted-runner command for Team and Enterprise plans.
This article, "Claude Code Adds Cross-Session Messaging on macOS" first appeared on MacRumors.com

Discuss this article in our forums

Apple could raise iPhone 17 prices as soon as Monday, August 10, according to a new rumor, well before the wider round of increases expected with next month's iPhone 18 Pro launch.


Weibo leaker "Fixed Focus Digital" said in a post yesterday that rumors are circulating about an ‌iPhone 17‌ price change taking effect on August 10. The leaker was noncommittal about whether prices will actually move, though the post claimed with more certainty that Apple has called off plans to raise production capacity on some lines from 15% to 30%. It's not clear from the post which components or products that capacity change refers to.

Apple raised prices on Macs, iPads, and most other devices in June, citing soaring memory and storage costs, but left the iPhone, Apple Watch, AirPods, Studio Display, and accessories untouched. Apple's next round of pricing changes is widely rumored to center on the ‌iPhone 18 Pro‌.

Apple is expected to launch the ‌iPhone 18 Pro‌, ‌iPhone 18 Pro‌ Max, and its first foldable iPhone next month, with the standard iPhone 18 and iPhone 18e not arriving until spring 2027. The ‌iPhone 17‌ is set to remain Apple's mainstream option well into next year, which could give Apple sufficient reason to adjust its pricing independently of the new lineup.

If Apple does raise ‌iPhone 17‌ prices this Monday, it remains to be seen whether the increase would apply across the whole lineup, including the iPhone 17e ($599), ‌iPhone 17‌ ($799), iPhone Air ($999), iPhone 17 Pro ($1,099), and ‌iPhone 17 Pro‌ Max ($1,199), or whether only select models will be affected.
This article, "iPhone 17 Prices Could Rise as Soon as Monday, Rumor Claims" first appeared on MacRumors.com

Discuss this article in our forums

This post is an unpublished review for Subscription Bombing • Email under Attack

One of the most important inputs one can have when designing a response strategy against a security attack is a good characterization. This article describes a relatively newly described attack mode (subscription bombing), hypothetizes on the motivations that can lie behind it, and presents some countermeasures that can be taken by different actors to reduce its impact.

At its core, suscription bombing is a classical reflection attack: it uses a third party service so that the answer to a relatively simple request is amplified and results in a distributed denial of service (DDoS) for the victim. And, as with most DDoS attacks, its effectivity lies in that there is not much a person can do against traffic coming from seemingly random different providers all around the world.

The core differentiatof for subscription bombing is that the attack’s victim is not a network port, but an individual’s e-mail address. The attacker builds a database of service providers that allow interested users to sign up for newsletter on their activities, or a mailing list, or even just to create a new account on a given Web system. This action will generate a (seemingly legitimate) confirmation mail sent to the victim. But the attacker scripts together hundreds of thousands of such request, creating a deluge of confirmation mails sent to the unsuspecting victim.

The authors explain the goals an attacker might pursue by performing this kind of attack. They suppose this can be due to harassment (a disgruntled employee being denied a salary raise, a political adversary, or even a romantic ex-partner wanting to inconvenience the victim’s use of their e-mail). More worryingly, the attack can be used as a distraction: by sending a high volume of mails in a controlled timeframe, the attacker can reduce the probability of the victim noticing a specific attack warning them of, i.e., financial fraud, unwanted purchases, or break-in attempts into their accounts. Attacks targetting mailboxes at private mail servers can also lead to overloading an account’s limit, causing it to reject mails after the attack is delivered and before the folder is cleaned. And it can also pave the way for follow-up, targetted deception attacks, where the attackers call the victim pretending to be the company’s IT department, and get them to install a remote desktop monitoring and management tool, with which they can effectively seize control of the victim’s data.

To do this, they present a study they made over 24 cases of victims, from which 47,970 total e-mails were received between October and December 2024, with individual attacks receiving between 81 and 3,387 e-mails per hour, from where they presented several descriptive analysis.

The authors explored cyber criminal’s offers on underground websites, comparing flooding services and pricing schemes.

Finally, mitigation strategies are discussed. Mitigation is quite problematic, as none of the mail servers is acting in either a hostile way or lacking permissions — they are performing just the task they should. The authors suggest four mitigation strategies for mail server operators to reduce the burden on their users, although none of them is easily automatizab (rate-limit the number of emails a given inbox can receive from previously unseen senders; educate users about this kind of attacks; group similar newsletter or account reset mails during active attacks; and automatically unsubscribe or bounce newsletter messages when a surge is detected). They also recommend newsletter providers and services accepting the unrestricted creation of user accounts to provide some hardening to increase the effort wrongdoers need to spend to abuse their services, such as requiring CAPTCHAs or requiring users to take several steps before requesting a subscription, although they recognize this adds friction to the process providers are most interested in providing; filtering and triaging known-good and known-bad domains, although this is hard to implement on a preemptive fashion, and adhering to easy unsubscription standards, such as easily identifiable headers with which mass unsubscription could be performed more easily victims, instead of hunting for the right places to click, potentially even in mails written in an unknown language.

The described problem is interesting, and properly tackling it can be a game changer for many users who will suffer this kind of abuse, and the article is easy to read and soundly supports its claims.

OpenAI today said it is "pausing" activities involving its upcoming AI model Astra, because its cyber capabilities are potentially too dangerous. OpenAI says its newest internal evaluations show "significant advancements in agentic coding and cybersecurity," and it cannot rule out "critical cyber capabilities." Prior OpenAI models, including GPT–5.6 Sol, were labeled as "High."


Astra triggers stricter guidelines in OpenAI's "Preparedness Framework." The guidelines call for caution when developing frontier AI capabilities that create risks of severe harm, and the cybersecurity portion of the framework says OpenAI will implement extra safeguards for models that "create new risks of scaled cyberattacks and vulnerability exploitation."

The "Critical" threshold Astra may have hit is defined by an ability to identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel strategies for cyberattacks.

OpenAI says it is increasing its safeguards and security controls before deploying Astra, including limiting work on the model until new safeguards are in place. The company plans to use isolated testing environments with restricted network and tool access, along with adding sandboxed execution and more monitoring capabilities. OpenAI says it will work with relevant government agencies and AI safety organizations to test Astra.

"We're committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity," writes OpenAI.

Astra wasn't formally announced, but OpenAI shared details on its next major model in a recent post outlining its mathematical advancements. Astra solved 10 open problems in math and theoretical computer science for around $2,000 (in Sol API rates).

Advancements in AI are changing cybersecurity for major tech companies like Apple by unearthing an unprecedented number of bugs. Apple recently limited its bug bounty program submissions because it is having trouble handling the volume.

Models like Claude Mythos are able to suss out critical vulnerabilities, and Apple is one of Anthropic's Mythos partners. Mythos is limited to select companies because in addition to finding vulnerabilities, it has the potential to exploit them.

OpenAI made headlines in July because GPT–5.6 Sol and a "more capable pre-release model" (not Astra) autonomously hacked Hugging Face during internal benchmark testing. Anthropic found Claude had done something similar. Meta this week said it too had an AI model hack another company during a cybersecurity evaluation.
This article, "OpenAI Delays Next Major AI Model 'Astra' Over Critical Hacking Concerns" first appeared on MacRumors.com

Discuss this article in our forums

After 326 days, iOS 26 has received its first jailbreak, thanks to the developers behind the popular Dopamine jailbreak.

Lars Fröder, better known as opa334, today released Dopamine 3.0, which adds support for a number of newer firmware versions, including iOS 26.0 and iOS 26.0.1 on devices with A12 or A13 chips.

Another major addition in today's release is support for all devices running iOS 16.5.1 through iOS 17.3.1, significantly expanding the range of devices and software versions compatible with Dopamine.

A full breakdown of supported devices and iOS versions can be found on AppleDB, a database that tracks jailbreak compatibility.
This article, "iOS 26 Gets First Jailbreak Thanks to Dopamine" first appeared on MacRumors.com

Discuss this article in our forums

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Titalcruise E.A. has announced the release of TitalcruiseOS 5.4, a major update of the project's Debian-based Linux distribution designed primarily for system administrators, developers and power users. Developed in Argentina, it is localised into the Spanish language. The English translation of the original announcement provides the release information:....

According to various reports from sources such as Bloomberg's Mark Gurman and Macworld's Filipe Espósito, Apple is planning to release up to three new products with "Ultra" branding between late 2026 and early 2027.


The long-rumored foldable iPhone is expected to be called the "iPhone Ultra." Rumored features include a 7.7-inch inner display, a 5.3-inch outer display, two rear cameras, one front camera, a Touch ID power button instead of Face ID, and more. The device's large inner screen will be ideal for watching videos and multitasking.

Apple is expected to release the "iPhone Ultra" this September, alongside the iPhone 18 Pro and iPhone 18 Pro Max. In the U.S., it has been estimated that the device will have a starting price of anywhere from $1,999 to $2,499.

"AirPods Ultra" are reportedly set to be released as early as this year — it would be fitting for them to be unveiled alongside the "iPhone Ultra" this September.


"AirPods Ultra" are essentially rumored to be AirPods Pro with tiny infrared cameras that serve as eyes for Siri. The cameras will help to enhance the Visual Intelligence feature on the iPhone 15 Pro and newer, and a small LED light on the earbuds will indicate when the cameras are active, according to Gurman's reporting.

On iOS 27, Visual Intelligence is accessible through the Camera app via a new "Siri" mode. "AirPods Ultra" would provide a more hands-free experience.

"The idea is to let users ask questions about an item they might be looking at," he said. If someone is looking at ingredients on their kitchen countertop, for example, they could ask Siri for dinner ideas.

Last month, Apple's code for the second iOS 27 developer beta seemingly hinted at AirPods with cameras, so a launch could be fast approaching.


Finally, Apple is reportedly planning a "MacBook Ultra" with an OLED display that doubles as a touch screen. Other rumored features include M5 Pro and M5 Max chips, a Dynamic Island, a thinner design compared to the latest MacBook Pro models, and potentially even an Apple-designed C2 modem for built-in 5G/LTE cellular connectivity.

Apple plans to release this new MacBook by early 2027, according to Gurman.

All in all, Apple is expected to release an iPhone Ultra, AirPods Ultra, and a MacBook Ultra over the course of the next six to seven months or so.
This article, "Apple Rumored to Launch Three New 'Ultra' Products by Early Next Year" first appeared on MacRumors.com

Discuss this article in our forums

This past May, we shared our vision for the future of Firefox. Starting today, you can try out the next design evolution of Firefox in Nightly.

It’s still Firefox, now with a more cohesive look and feel across tabs, menus, panels, and other browser surfaces. You’ll notice softer tab shapes, a warmer color palette, updated icons, and – after hearing from many of you – the return of Compact Mode and new theme options to make Firefox your own.

Many of you have already spotted pieces of the new design in Nightly over the past few months. Now they’re coming together into one complete  experience.

You’ll continue to see updates over the coming weeks as we polish the new Firefox design before it reaches Firefox users more broadly later this year. As you browse, we’re especially interested in any visual or functional issues you encounter.

Keep an eye out for things like:

• Icons, spacing, and alignment
• Themes and personalization
• Different window sizes and display scaling
• Keyboard navigation
• Screen readers and other accessibility features
• Different languages and layouts

Found a bug?

If something doesn’t look or behave as expected, please file a bug in Bugzilla.

When possible, include:

• Steps to reproduce the issue
• Screenshots or screen recordings
• Your operating system and Nightly version

If you have broader thoughts or questions about your experience, join the discussion on Mozilla Connect.

Thanks for using Nightly and helping us improve Firefox. Every bug report helps us identify issues and continue refining the new Firefox design before it reaches Firefox users more broadly later this year.

Highlights

• Dao added a new Eyedropper quick action! Check it out by typing “color” or “eyedropper” in the URL bar (Bug 1803575) on Nightly.

• Henrik Skupin released geckodriver 0.37.0, which includes support for several new APIs and various bug fixes. See the release page for details.
• Starting from Firefox 153, access to local file: URLs is being restricted by default.
  • Extensions now require an explicit “Access local files on your computer” permission, separate from broad host permissions, that users must grant.
  • Extensions can call the extension.isAllowedFileSchemeAccess() API to determine whether they have been granted access to file: URLs (Bug 2034168).

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• :Vincent
• Chris Vander Linden
• DrSeed
• Khalid AlHaddad
• Sam Johnson

New contributors (🌟 = first patch)

• Francis :mckenfra: tld service for webextensions
• any1here: about:preferences#privacy is broken with MOZ_DATA_REPORTING false
• pullmana8: Fix protocol/Actor.js to throw an Error instead of an Actor
• RAN1: Firefox Crashes on Quit When Running Two Browsers With Separate Profiles

Project Updates

Accessibility

• Morgan added a new accessibility-specific, front-end review skill to mozilla central! 🎉 You can read about it, and learn how to use it in the accessibility review source docs.

Add-ons / Web Extensions

Addon Manager & about:addons

• Migrated addon-page-header and addon-card action buttons to the reusable moz-button web component as part of the ongoing Nova restyling of about:addons – Bug 2042200 / Bug 2042204
• Extended moz-page-nav-button with a forwarded title property to fix an accessibility issue where the component lacked a label in collapsed state; Landed in Firefox 153, and uplifted to Firefox 152 for about:settings which was already riding the 152 release train – Bug 2040971
• Fixed a shutdown-timing bug where a pending GMP update-check timer could fire after XPCOMShutdownThreads started, causing a pref write assertion; Fixed in Firefox 153 – Bug 2043803

WebExtensions Framework

• Fixed MV2 content scripts incorrectly injecting into guarded hosts because MozDocumentMatcher::MatchesURI was not consulting CheckGuarded when mCheckPermissions was false; Fixed in Firefox 153 – Bug 2041393
• Added support for accessing ObservableArray attributes (such as adoptedStyleSheets) from XrayWrappers and extension content scripts, unblocking extensions that rely on this Web API; Fixed in Firefox 153 – Bug 1751346
• Wired runtime_blocked_hosts and runtime_allowed_hosts enterprise policy settings through ExtensionSettings to allow administrators to restrict extension host permissions on managed devices, starting in Firefox 153 – Bug 1805205
  • Thanks to Mike Kaply for implementing this enterprise policy enhancement.

WebExtension APIs

• Fixed promiseTabWhenReady blocking indefinitely on discarded tabs, preventing cleanup of associated resources and potentially causing memory leaks; Fixed in Firefox 153 – Bug 1653876
• Fixed webNavigation.onCommitted being dispatched twice for cross-origin iframes loaded under Fission, caused by a redundant OnStateChange trigger firing in addition to OnLocationChange; Fixed in Firefox 153 – Bug 1750196

DevTools

• Chris Vander Linden made the Search input component shared as we plan to use it in the Netmonitor as well (#2019260, #2027580, #2027582)
• pullmana8 improved error management in the DevTools protocol (#2031735)
• Chris H-C :chutten removed Legacy Telemetry devtools instrumentation (#2039650)
• :glob ✱ fixed an issue in the Inspector where the swatch color for variable in @starting-style rule could have the wrong color (#2016778)
• Nicolas Chevobbe [:nchevobbe] exposed heading level more clearly in the accessibility tree (#1588784) and in the accessibility highlighter (#2044904)

• Julian Descottes [:jdescottes] migrated the markup view to HTML (from XHTML) to fix an issue when editing the markup (CodeMirror 6 does not support XHTML) (#2028058)
• Nicolas Chevobbe [:nchevobbe] fixed an issue in Netmonitor search where it could appear the the search stalled (#2042405)
• Hubert Boma Manilla (:bomsy) added more connection information (ECH, Delegated Credentials, OCSP, Private DNS, …) in Netmonitor Security tab (#2036404)

WebDriver

• Khalid AlHaddad improved the window manipulation commands in Marionette and WebDriver BiDi to allow individual window geometry properties, such as x, y, width, and height, to be adjusted independently.
• Khalid AlHaddad updated our codebase to use constants instead of hardcoded strings for all our session data types.
• Alexandra Borovova updated the “emulation.setLocaleOverride” command to also apply a locale emulation in dedicated and shared workers.
• Alexandra Borovova fixed a regression when there would be no “script.realmCreated” events after the cross-origin navigation.

Search and Urlbar

• Dharma updated context search actions to trigger search instead of entering search mode @ 1945080
• Daisuke and Drew worked on a lot of Nova updates, including ensuring Nova is tested @ 2041255, 2030183, 2019168, 2044849, 2033583
• Moritz has worked on several refactorings to allow the urlbar to be used in content @ 2039828, 2039298, 2041280
• Middle click paste replaces content was fixed by Moritz @ 2042893
• Michel added feature to show registrable domain on desktop after its implementation on mobile @ 1986161

Highlights

• Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
• Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.
  • You can try it out on this Instagram reel in Nightly

• A note to WebExtension authors – as part of a planned deprecation announced last month, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 – Bug 2015559
• Nicolas Chevobbe [:nchevobbe] added support and debugging for modern attr()(which is enabled on Nightly) (#2014751)

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Sam Johnson
• Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

• Immaculate Atim: Switch to using an array instead of an object string for browser.backup.enabled_on.profiles
• liz: Screenshots overlay visible on both splitview browsers
• 🌟 Rahman Mahmutović [:r_m]: Can’t change content in box model in inspector for box-sizing:border-box elements
• Takeru Mitsumori: Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html
• 🌟 Freya Arbjerg [:freyacodes]: Blackboxed columns are ignored
•  tom.passarelli: tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767

WebExtensions Framework

• Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
• Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054
  • Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.

WebExtension APIs

• Fixed handling of <all_urls> as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

• Rahman Mahmutović [:r_m] made it possible to edit width/height in the box model section of the Layout panel (#1717176)
• Sebastian Zartner [:sebo] improved toggling tools driving in-page highlighters (e.g. the Measuring) (#1262773)
• Sebastian Zartner [:sebo] added a setting to control visibility of HTML comments in the markup view (#1455294)
• Freya Arbjerg [:freyacodes] fixed an issue in script blackboxing (#2036767)
• Alexandre Poirot [:ochameau] replaced custom preference to log RDP messages with MOZ_LOG (#1622857)
• Alexandre Poirot [:ochameau] fixed retrieval of garbage collected script text content (#1758454)

WebDriver

• Sameem updated the “Take Element Screenshot” command from WebDriver Classic to crop screenshots of elements which exceed the viewport. This aligns with the specification and avoids errors when attempting to capture huge elements.
• Alexandra Borovova updated the events for new top-level browsing contexts: we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used. This is required to align with the expected per-spec behavior.
• Henrik Skupin landed a patch allowing geckodriver to gracefully shut down Firefox when geckodriver itself is terminated.
• Hiroyuki Ikezoe disabled Firefox’s “scroll axis lock” feature so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.

Lint, Docs and Workflow

• Added a rule to prevent new uses of Preferences.sys.mjs.
• The browser environment globals within ESLint have now been updated. These include Sanitizer, VideoFrame and a few other new ones.
• Temporal, and some other definitions have been added to TypeScript.

New Tab Page

• Much has happened in the last 2 weeks! Here’s a full bug list, and here are some highlights.
• Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (2033592) — prevents accidental list creation and improves the Lists UI reliability.
• Maxx Crawford fixed Weather widget small card layout issues with opt-in location options and an error message displayed, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.
• Reem Hamoui added key dates state to the Sports widget, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.
• Scott Downe added a manage widgets option to the New Tab nova widgets context menu, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.
• Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see Newtab widget base component.
• Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see Convert widget expansion handling to shared widget expansion.
• Nina Pypchenko [:nina-py] updated the Sports widget to populate the “follow teams” state from the /teams endpoint, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.
• Scott Downe moved widget menu items within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.
• Dre fixed a World Clock city search bug for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.
• Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see Newtab small weather widget size change doesn’t always work.
• Nina Pypchenko [:nina-py] added a group stage section to match highlights in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.
• Dre fixed the small world clock widget not expanding to large while editing clocks so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.
• Maxx Crawford added WCW OMC message strings so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.
• Reem Hamoui added a “View all” button and a list view for the results tab at medium widget size so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.
• Maxx Crawford added WCW “Watch Live” stream strings to the Sports widget strings bundle so the widget can surface a localized “Watch Live” CTA for applicable events.
• Dre restored VoiceOver reachability for Edit/Remove in World Clock on macOS so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.
• Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (2041033).
• Mike Conley added New Tab jest tests to the node tests Tier 1 CI job Run newtab jest tests as part of node tests Tier 1 job to catch regressions earlier in CI
• Irene Ni shipped multiple visual fixes for the Sports widget Sports widget – various visual fixes (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.

Picture-in-Picture

• kpatenio adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably, especially when selecting videos from the YouTube search page.
• Thanks to Sylvestre for patching some bugs to prevent some spurious console errors!
• Niklas fixed captions on autopip videos failing to sync with the origin videos.

Performance Tools (aka Firefox Profiler)

• Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.
  • https://www.npmjs.com/package/@firefox-devtools/profiler-cli
  • You can install it with npm install -g @firefox-devtools/profiler-cli@latest

Search and Urlbar

Nova UI refresh

• Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.
• 2019154, 2019152, 2041501, 2040532

Suggest

• Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
• 2040561, 2039753, 2035614, 2038843

Adaptive autofill

• James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
• 2040819, 2037177

Quick actions

• Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
• Caleb added Calculator support for certain unicode operators.
• 2023169, 1928635, 1923383, 2033861

Multi Context Address Bar

• Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
• 2039297, 2036095, 2039844, 2037933, 2030050

Other

• Marco, Drew and Daisuke fixed several intermittent test failures.
• 2038510, 2023908, 2011584, 1938142, 1971091

Search

• Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
• Caleb fixed multiple documentation issues and added a test covering searches from a private window.
• 1904613, 2035878, 2037942, 2033545, 2005724

Places

• Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
• Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
• 2039534, 1505800, 2008829, 2029541, 2035084

Highlights

• James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
• Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!

• Controls for the Memories feature can now be set during Smart Window onboarding

 

• We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, completing the deprecation
  • NOTE: The blog post published at WebExtensions API changes in Firefox 149-152 provides to extensions developers more details about this deprecation and links to the related MDN docs.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Amin Amir
• Pranjali Srivastava
• Sam Johnson

New contributors (🌟 = first patch)

•  🌟:23rd: Regression: The new swipe-to-navigation indicator stucks for a moment, when deciding not to navigate the other page
• 🌟Akeem Omosanya: Remove commented-out code in SearchService.sys.mjs
• Amin Amir:
  • 🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
  • Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
• 🌟Sahaj: Suggest the default target language for translation after changing the detected source language
• 🌟JIANG Zhirui: Breakpad build failed on Windows using VS2026 due to removal of stdext
•  John Iweh: Add “Open in New Tab” and “Open in New Container Tab” options to the context menu for Tabs from Other Devices
• Jak: Bookmarks and History – should respect the “When you open a link, image or media in a new tab, switch to it immediately” setting
• 🌟Andy [:rgbcmy]: Autoplayed next video should also be PIP
•  konyhéa: “Escape” key should collapse the expanded on hover sidebar launcher even if hover is still active.
•  Pranjali Srivastava:
  • Remove icon property from sidebar extensions
  • Show language-agnostic SelectTranslations context menu item when the source and target languages are the same

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by Bug 1532724, fix shipping in Firefox 152) – Bug 1595158

WebExtensions Framework

• Fixed access to web-accessible resources declared with <all_urls> from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 – Bug 2033905

WebExtension APIs

• Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs – Bug 2029092

DevTools

• Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
  • added support for remote debugging (#2014064, #2016121)
  • made sure that calls to History.replaceState are reflected in the UI (#2037359)
• Julian Descottes [:jdescottes] fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (#2030260)
• Nicolas Chevobbe [:nchevobbe] fixed the image preview tooltip for relative URLs images in constructed stylesheet (#2035503)
• Julian Descottes [:jdescottes] reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (#2026228)

WebDriver

• Amin Amir cleaned up an incorrect variable assignment in our browsingContext module.
• Logan Rosen updated stale references and broken links in our documentation about Marionette.
• Sameem improved the Marionette and WebDriver BiDi screenshot commands to enforce maximum allowed dimensions.
• Leo McArdle fixed the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”.
• Henrik Skupin fixed an issue in Marionette where WebDriver:Navigate and WebDriver:Refresh did not handle errors when the underlying navigation failed.
• Henrik Skupin improved geckodriver to detect an early Firefox exit during startup on Android, avoiding up to 60 seconds of unnecessary connection attempts.
• Henrik Skupin updated the geckodriver CI build job to produce a universal macOS binary supporting both x64 and aarch64.

Lint, Docs and Workflow

• Sylvestre ported some linters (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words & more) to Rust to help improve the runtime of the code review bot.
• Dale has been working on migration to moz-src for customkeys, dom/quota and odom/geolocation
  • https://arewemozsrcyet.com/

New Tab Page

• We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
  • We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.
• Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.
• Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!

Search and Urlbar

• Nova (URL Bar Design Refresh)
  • Drew and Daisuke continued their work on Nova styling for the Address bar (input and view).
• Search and Suggest
  • Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to update the localization string for scheduled games and another to show both teams’ icons in suggestions. Drew also landed and uplifted a fix for rich search suggestion icons being forced into a square aspect ratio.
  • Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.
• Settings Redesign (SRD)
  • Stephanie landed a test to ensure search suggestion settings are hidden when quicksuggest is disabled, as well as a patch to resolve TypeScript issues in search.mjs, and is adding test coverage to confirm removed search engines are not displayed in the default engines dropdown.
• General URL Bar and Component Updates
  • Daisuke landed implementation of the context menu on URL bar results, and a fix to show the loading URL in the URL bar when starting up with a homepage.
    • Marco is working on several tasks, including a PDF download / focus stealing issue and allowing arrays to be bound in Sqlite.sys.mjs. Marco also worked on fixes related to Places, such as avoiding replacing the favicons database if it is not corrupt.
  • Standard8 finalized the URL bar test manifest split. Standard8 also upgraded us to TypeScript 6.
  • Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (Bug 2032973), which was also uplifted. Moritz also simplified search mode switcher item activation in tests, and made it so that the unified search button popup closes when installing an open search engine.

Smart Window

• natural language starting with tab close/undo 2035343 with expandable action log 2031508

• assistant rendering feedback up/down 2032994 and markdown table 2027029
• nova styling blur 2027877 and suggestions 2026823
• accessibility screen reader 2028676 and keyboard focus 2037565
• optimize conversation starters extra requests 2030005 and caching 2033430

Storybook/Reusable Components/Acorn Design System

• Nova token updates occasionally, focused on SRD

UX Fundamentals

• Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – 2035942

Settings Redesign

• Settings redesign is being tested and will hopefully go out in Firefox 152!

Highlights

• The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
  • This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
  • You will be able to manage this feature in Settings under Sync (for now)
    • 
  • You can read more about the feature here
• As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
• Adaptive autofill has been enabled on Nightly.
  • Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
    • If you run into issues or have feedback, you can file a bug here!
• Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
  • dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
  • it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom
  • 

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Amin Amir
• aoia7rz7l
• Chukwuka Rosemary
• DrSeed
• Frédéric Wang Nélar
• japandi
• John Iweh
• jonathancabera
• Josh Aas
• Keji Bakare
• kofoworola shonuyi
• konyhéa
• liz
• Mathew Hodson
• Okhuomon Ajayi
• Oluwatobi
• ROSHAAN
• Sam Johnson

New contributors (🌟 = first patch)

•  Anthony Mclamb: Disable the legacy Edge migrator
•  Amin Amir
  • 🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
  • Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
  • 🌟 Amine Zroual: Omitted maxResults property not handled correctly in getRecentlyClosed
• any1here: install_sig_alt_stack incorrectly checks mmap’s return value
• 🌟 Armin Ulrich: Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument
• japandi
  • Cannot remove amazon.com from top sites list
  • The height of the pinned tabs area should be responsive to the number of pins
  • Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations
• Nathan Johnson [:narjoDev]: Remove browser.display.use_system_colors pref
• DrSeed
  • Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting
  • The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again
• Keji Bakare:
  • Split view’s focus-outline is clipped on the right side of left tab
  • White space on the right side of left panel in split view
• 🌟 gotyaoi: Reload toolbar button is active on about:newtab
• Itoro James: [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it
• John Iweh: The notification dot is not displayed if the tab is in a Split View
• 🌟 John Iweh: sidebar-shown attribute remains when sidebar.revamp is false
• 🌟 jonathancabera:
  • The Move tab to Split View option is also displayed for the tabs that are within the Split View
  • A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled
  • Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode
• Aloys: Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67
• liz:
  • Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View
  • Button accessible name does not convey its function: missing topic context (Settings dialog > Topics dialog > buttons Following/Unfollow/Blocked/Unblock)
• Mary cathline: Tab Group Label does not respect touch density in vertical tab bar
• 🌟 Brandon Lucier: Popups opened with window.open give window type normal instead of popup
• karan68: [dialog] New Shortcut dialog needs a label/accessible name
• 🌟 Vector: Button does not programmatically indicate that it opens a dialog (Recent activity section > story card > ••• disclosure > Delete from History button)
• 🌟 Osoble: Update font size and weight for synced tabs device name headers in Firefox View
• konyhéa:
  • Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js
  • Check all second paramaters for TestUtils.waitForCondition in Fx View test files
  • Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.
• Noble Chinonso: #shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled
• Pranjali Srivastava: Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)
• Okhuomon Ajayi:
  • More spacing is needed between the tab note icon and the close icon on the tab
  • The tabs in vertical mode collapsed state are positioned differently in Split View
  • Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled
  • Vertical split view tabs can be too big or small when tabs are overflowing
• 🌟 Rishan: Fix duplicated arrow function in browser_history_sidebar.js
• Chukwuka Rosemary:
  • “Forget About This Site” context menu option missing from Firefox View history
  • Long strings are not displayed properly on the about:opentabs page search filed
  • Add test for Forget This Site option in Fxview history context menu.
• ROSHAAN:
  • 🌟Tab note background colour is incorrect for default light theme
  •  [win/linux] The splitter between content areas does not match Figma spec
  • Fix typo in OpenInTabsUtils.confirmOpenInTabs()
• Sameeksha: Disclosure button expanded/collapsed state not programmatically defined (Customize button)
• kofoworola shonuyi:
  • 🌟Actually hide or remove sidebar-shown attribute when in fullscreen.
  • Add a test for checking sidebar-shown attribute in fullscreen mode
• 🌟 Sayd Mateen: Page URL is displayed as tab name when page’s contains about:reader?</a></p> <p>

• Oluwatobi:
  • Unable to delete selected history entries from sidebar
  • Incorrect Sidebar button state/tooltip hover text
  • The city name heading level doesn’t follow the correct heading level order
• Nishchay [:nish]: Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)

 

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014
  • NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes

WebExtensions Framework

• Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173
  • Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!
• Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329
  • Thanks to Simon Farre for promptly investigating and fixing this recent regression!

WebExtension APIs

• Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125
  • Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!

DevTools

• Artem Manushenkov fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (#1983408)
• Andrea Marchesini [:baku] fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (#2031299)
• Julian Descottes [:jdescottes] fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (#2028930)
• Nicolas Chevobbe [:nchevobbe] improved @container tooltip so it show the value of variables used in style()(#2030239), has enough contrast in dark mode (#2033782) and contains a link to select the container (#2031688)
  • 
• Hubert Boma Manilla (:bomsy) is making good progress on migrating the Console to CodeMirror 6 (#2032758, #2026569)

Fluent

• We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!
• 

Migration Improvements

• Thanks to dao for fixing a recent alignment issue in the migration wizard dropdown
• Thanks to volunteer contributor Anthony Mclamb for his patch that disables the legacy EdgeHTML Edge migrator! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.

New Tab Page

• Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th
  • It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.
• Maxx Crawford enabled Nova designs for New Tab, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.
• Maxx Crawford fixed the Nova content feed to render the intended four‑column layout by correcting CSS grid breakpoints.
• Maxx Crawford resolved a first‑load failure in the Weather widget by fixing init order and fetch timing, eliminating the “Oops” error.
• Maxx Crawford synchronized the Weather toggle between about:preferences#home and the panel via the shared showWeather pref to prevent desync.
• Maxx Crawford updated Nova grid focus order to align tab flow with visual order for keyboard users.
• Maxx Crawford fixed critical UI issues in Lists and Timer widgets covering overflow, controls, and layout stability.
• Maxx Crawford guarded document.dir access in Nova render paths to avoid startup cache worker errors and improve startup stability.
• Rolf added a new normalization method for the inferred interest vector to stabilize topic relevance across sessions.
• Rolf prevented unnecessary content refreshes during Pocket New Tab experiments, reducing jank and bandwidth.
• Sameeksha defined the Customize button’s expanded/collapsed state programmatically using aria-expanded for better a11y.
• liz clarified follow/unfollow/blocked button names with topic context so screen readers announce clear actions.
• Vector marked the Delete from History control as opening a dialog via aria-haspopup=dialog for assistive tech.
• Scott Downe fixed a regression that flipped the Wallpapers pref off, restoring user selections.
• Irene Ni corrected privacy link color and focus styles for contrast and keyboard visibility.
• Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
• Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
• Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
• Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
• Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
• Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
• Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
• Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.
• Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
• Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
• Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
• Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
• Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
• Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
• Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
• Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.

Search and Urlbar

• Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
• Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
• Work also continues on the new Nova layouts.

Smart Window

• uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect
  • jump to bottom of conversation 2028692
  • stop streaming button 2029204
  • back/forward navigation from assistant 2029229
  • dark mode for various chips 2024499
• search engine switching from smart bar 2021973
• Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

• Dustin converted moz-breadcrumb-group variables into JSON design tokens Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens
• Dustin converted moz-box-* variables into JSON design tokens Bug 2029180 – Convert moz-box-* variables into JSON design tokens
• Dustin converted moz-promo variables to JSON design tokens Bug 2029190 – Convert moz-promo variables into JSON design tokens
• Dustin converted moz-reorderable-list variables to JSON design tokens Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens
• Dustin converted moz-visual-picker variables to JSON design tokens Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens
• Dustin updated browser-shared.css so it passes use-design-tokens Bug 2022985 – Update browser-shared.css so it passes use-design-tokens
• Dustin updated popup.css so it passes use-design-tokens Bug 2022979 – Update popup.css so it passes use-design-tokens
• Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  Bug 1955325 – Create opacity tokens
• Jon converted toolbar design tokens to JSON Bug 2017970 – Convert toolbar design tokens to json
• Anna fixed moz-select with panel-list drop-down size inconsistency Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened
• Anna fixed issue with the disabled state of moz-radio component Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled
• Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically

UX Fundamentals

• The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
• In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

• Tim converted settings related to Accessibility page to config-based pane Bug 1968116 – Convert settings related to Accessibility page to config-based settings
• Benjamin converted Privacy & Security page to the config-based pane Bug 1968112 – Convert settings related to Privacy & Security page to config-based settings
• Finn integrated Firefox Labs page into setting-pane config Bug 2021047 – Integrate Firefox Labs page into setting-pane config
• Anna converted Firefox Updates section to config-based prefs Bug 1990961 – Convert Firefox Updates section to config-based prefs
• Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings Bug 2015093 – Add a moz-promo to welcome users to the redesign
  • 
• Anna added possibility to search for actions in the redesigned “Applications” section Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section
• Anna fixed the Settings navbar layout breakage

The redesign of Firefox Settings is now enabled by default in Nightly! With this change, we are making it easier for people to customize Firefox and discover the controls that matter most to them. The redesign improves navigation and organization, updates labels and descriptions, and uses a new underlying architecture that will make Settings easier to update over time.

Firefox Settings have grown a lot over the years. Our research showed that some areas had become crowded and more difficult to navigate, and that important controls could be hard to discover. Some terminology and layouts had also become inconsistent over time. Internally, the existing structure also made Settings harder to maintain and evolve over time.

Here are some of the changes you’ll notice:

• More pages within Settings, with less content per page
• Clearer grouping and better flow between related controls
• Improved labels and helper text
• Consistent use of our design system throughout

While the organization of Settings has changed, all your existing choices and preferences remain in place. You can always use the search bar to jump straight to what you’re looking for.

We plan to ship the redesign to the Release channel in Firefox 152. You will continue to see changes in Nightly, and we welcome feedback, especially in Mozilla Connect.

Customization has long been a core part of Firefox, and this redesign is intended to continue improving how people discover and manage their browser settings. We appreciate all of the feedback from the community so far on this project and look forward to refining the experience with your input!

Highlights

• Import attributes will be supported for WebExtensions, starting in Firefox 150!
  • This allows WebExtension authors to import CSS module scripts and JSON into their JavaScript modules.
  • Examples:
    • import sheet from ‘./styles.css’ assert { type: ‘css’ };
    • import schema from “./policies-schema.json” with { type: “json” };
• The Web Serial API is now available for testing in Firefox Nightly!
  • See https://fosstodon.org/@balloob/116398481380578311 for more details on how to test this our yourself.
• Dharma created a new quick action for Firefox Library
  • You can test this out in Firefox Nightly 151 by typing “library” in the URL bar

• Alexandre Poirot [:ochameau] Enabled the JS Tracer DevTool by default on Nightly
  • Read up on how to use the JS Tracer to analyze JavaScript usage on the web here

Friends of the Firefox team

Resolved bugs (excluding employees)

Volunteers that fixed more than one bug

• Chris Vander Linden
• Chukwuka Rosemary
• DrSeed
• EJiro Oghenekome
• Frédéric Wang Nélar
• Itoro James
• japandi
• John Iweh
• jonathancabera
• Josh Aas
• Justin Peter
• Keji Bakare
• kofoworola shonuyi
• konyhéa
• Noble Chinonso
• Okhuomon Ajayi
• Oluwatobi
• Pranjali Srivastava
• ROSHAAN
• Sameeksha

New contributors (🌟 = first patch)

• 🌟 Ben: UI issue in AST locale in Responsive design mode > (open Device picker) > Edit List… > Add Custom Device
• Brian Tsoi [:btsoi]: Create a badram checking library
• 🌟 Chidimma Okoloigwe: Port over tests in browser/base/content/test/sidebar
• japandi:
  • 🌟Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations
  • The height of the pinned tabs area should be responsive to the number of pins
  • Tab notes should not be saved when input contains only spaces
• Nathan Johnson [:narjoDev]: Remove browser.display.use_system_colors pref
• DrSeed:
  • 🌟Remove the defaultLauncherVisible Nimbus variable
  • Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting
  • The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again
• EJiro Oghenekome:
  • 🌟Tests required for view>sidebar menu items
  • Remove old sidebar icons no longer and replace with new.
  • Rename SidebarController.initializeUIState() and SidebarState.loadInitialState()
• Keji Bakare:
  • 🌟 Hide “Open Link in Split View” menu option for pinned tabs
  • The right tab name and icon slightly move when the Split View is selected
  • Split view’s focus-outline is clipped on the right side of left tab
• 🌟 gotyaoi: Reload toolbar button is active on about:newtab
• 🌟 Hailia: Copied profile edit page heading should enclose profile name in quotes
• geppy: Rename –theme-graphs-* CSS variables
• Itoro James:
  • 🌟 [FxMS Docs] Document the feature callout anchor selector’s ::%shadow% token
  • [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it
• John Iweh:
  • 🌟 The notification dot is not displayed if the tab is in a Split View
  • sidebar-shown attribute remains when sidebar.revamp is false
• jonathancabera:
  • 🌟 A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled
  • Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode
• Aloys: Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67
• Mary cathline: Tab Group Label does not respect touch density in vertical tab bar
• 🌟 Brandon Lucier: Popups opened with window.open give window type normal instead of popup
• karan68: [dialog] New Shortcut dialog needs a label/accessible name
• 🌟 Osoble: Update font size and weight for synced tabs device name headers in Firefox View
• konyhéa:
  • 🌟 don’t restrict the sidebar width so much (to better support non-English locales)
  • Add hairline separators between synced tabs device lists on the Recent Browsing page in Fx View
  • Firefox View breakpoint for collapsing the sidebar triggers too late
  • Split view does not show colored outline when used as a group target during dragging
• Noble Chinonso:
  • 🌟 Add the ‘command’ property to the SidebarStateProps definition
  • Timestamp not displayed for items under “Tabs from other devices” in Firefox View Next tab
  • Move tab to Start/ End options are enabled and not working, even if the Split View tab is already at start/en,d and the other view is focused
  • Mismatched closing tag in syncedtabs-tab-list.mjs itemTemplate
  • Do not capitilize “tagName” returned from “WebDriver:GetElementTagName” command
  • #shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled
• Knot False: Remove nsIScriptableUnicodeConverter from services/common/utils.js
• Pranjali Srivastava:
  • 🌟Remove virtualizer pref
  • Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)
  • In the about:opentabs page the containers icons have no padding on the right side while hovered
• Okhuomon Ajayi:
  • More spacing is needed between the tab note icon and the close icon on the tab
  • Split view container and vertical tabs are misaligned when resizing the sidebar down
  • Vertical split view tabs can be too big or small when tabs are overflowing
• 🌟 Rishan: Fix duplicated arrow function in browser_history_sidebar.js
• Chukwuka Rosemary:
  • 🌟 Remove the max-history-rows pref used in Fx View
  • “Forget About This Site” context menu option missing from Firefox View history
  • Long strings are not displayed properly on the about:opentabs page search filed
  • Add test for Forget This Site option in Fxview history context menu.
• ROSHAAN:
  • 🌟 Tab note background colour is incorrect for default light theme
  • [win/linux] The splitter between content areas does not match Figma spec
  • Fix typo in OpenInTabsUtils.confirmOpenInTabs()
• Sameeksha:
  • 🌟 Remove redundant lazy pref getters in SidebarPinsPromo
  • Dialog lacks accessible name (Recent activity section > ••• disclosure > Delete from History dialog)
• kofoworola shonuyi:
  • Actually hide or remove sidebar-shown attribute when in fullscreen.
  • <sidebar-main> has “sidebar-ongoing-animations” set but never removed
  • Add a test for checking sidebar-shown attribute in fullscreen mode
• 🌟 Sayd Mateen: Page URL is displayed as tab name when page’s <title> contains about:reader?
• Oluwatobi:
  • 🌟 Remove the IE importer and tests
  • Unable to delete selected history entries from sidebar
  • The city name heading level doesn’t follow the correct heading level order

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• Removed obsolete migration logic that forced distribution language packs to be reinstalled when upgrading from Firefox versions older than 67 – Bug 2000797
  • Thanks to Aloys for contributing the changes needed to cleanup this old XPIProvider migration logic

WebExtensions Framework

• Fixed a regression where WebRTC permission popups were queued and suppressed while an extension popup was open – Bug 1982832

WebExtension APIs

• Fixed an edge case where tabs.move would revert splitview tabs order while moving splitview tab to a new window  – Bug 2028832
• Fixed windows API reporting window type normal instead of popup for windows opened via window.open() – Bug 2030631
  • Thanks to Brandon Lucier for contributing this small but very much appreciated fix to the windows WebExtensions API!

DevTools

• Nicolas Chevobbe [:nchevobbe] added support for multi-conditions @container rules in the Inspector (#2023125), add specific style for unmatched conditions (#2030236)

• Nicolas Chevobbe [:nchevobbe] added container-name in the @container tooltip (#2030731)

WebDriver

• Henrik Skupin fixed a bug in the WebDriver BiDi session.new command where an empty proxy object was returned in the capabilities when no proxy was requested, even though that is not valid according to the CDDL.
• Henrik Skupin landed support for browser.setClientWindowState, originally started by Dan and continued by Liam DeBeasi, with final fixes and improvements completed after earlier contributors were unable to continue.
• Alexandra Borovova improved the “text” field of the “log.entryAdded” event to better align with Firefox DevTools behavior and Google Chrome WebDriver BiDi implementation.

Lint, Docs and Workflow

• A problem with the ESLint-build builder has been resolved. This had meant that the valid-ci-uses and valid-services-property rules were not being run.
• Work is ongoing to get various css files passing the use-design-tokens rules.

New Tab Page

• You can preview Nova on the New Tab browser.newtabpage.activity-stream.nova.enabled to true, and then opening a few tabs.
  • The browser.nova.enabled pref was just introduced to turn on the Nova design tokens. That’s still very much a work in progress.

Picture-in-Picture

• aoia7rz7l for added PiP wrapper captions support to various public Invidious instances
• chutten removed all legacy PiP telemetry
• sfarre is working on PiP API support and has a patch up integrating it nicely with our native implementation

Search and Urlbar

Search

• Mandy updated the search-config-v2 schema for partnerCodes (2027191)
• Florian fixed a high frequency intermittent test failure in the search code (2009494)
• Standard8 fixed a bug with duplicate keywords for search engines, so that we now prefer the default search engine (2024714)

Nova

• mconley made a rounder search input for about:newtab and about:privatebrowsing (2027144)
• Drew is continuing his work on making Nova updates to the urlbar  (2026859)

New searchbar

• Moritz and Dao continue re-implementing the search bar using urlbar modules  (2027749, 2027578, 2002834, 2025904, 2027565)

Urlbar

• Dharma also fixed a quick action telemetry error (1955058)
• James has been working on Adaptive History for Autofill Improvements (2019695, 2019695, 2021079, 2019719, 2021036, 2028730, 2021039, 2019626)
• Gijs landed a patch so that we use aria-notify instead of A11yUtils.announce for UrlbarView’s “special” announcements (2026753)
• Dale added a tooltip to engines in the unified search panel (2028668)
• Drew has been working on sports suggestions (2025052)
• James fixed a bug where persisted search was not working for Fx versions prior to 148 (2025933)

Smart Window

• preparing for 150 mvp with various uplifts from 151
• telemetry: assistant 2024869, input/suggestions 2009615, MLtelemetry 2019772, settings 2009612
• security: spotlighting 2020807, url ledger 2023001
• polish: autoopen sidebar pref 2029686, memories strings 2029262, report issues link 2029257
• bugs: keeping conversations when switching windows 2026239, switching tabs 2023284, transition fullpage to sidebar 2024781
• a11y: ask button state 2015485, smartbar announce 2016758

Storybook/Reusable Components/Acorn Design System

• From more than two weeks ago (sorry I wasn’t here and forget if they were shared):
  • Finn converted the Settings page nav to match Firefox View/new design Bug 1867385
  • Mark S imported the initial Nova design from Figma Bug 2021477
    • Currently behind browser.design-tokens.nova but moving to browser.nova.enabled today most likely
  • Mark S created an Icon Directory in Storybook – Bug 1990228
• Mark Striemer added breadcrumbs to sub-panes in Settings
• Anna Kulyk fixed arrow keys not working with panel-list variant of moz-select with separators
• Mark Kennedy fixed an display issue with the Applications view not updating when cancelling the Use other option
• Finn Terdal fixed some page navigation issues:page nav leaves a large gap when it first collapses to icon-only, sub-pane content being clipped by sticky search bar, reintroduced the vertical border next to static sidebar in prefers-reduced-motion
• Jules Simplicio landed a UI polish pass for the Settings Redesign with spacing, focus-ring, and contrast tweaks across subpanes, improving readability and target sizes.
  • This also updated some global styling for card, message bar, text input border radiuses/colors and the moz-promo component got a refactor with better support for image styling by default
• Hanna Jones updated copy and illustrations for the Account and sync page, so it’s ready for SRD release
• Osmond Arnesto converted urlbar variables to design tokens, preparing for JSON conversion and Nova import from Figma
• Jon Oliver converted tab variables into design tokens, and set them up in JSON for Nova import from Figma
• Jules Simplicio has been updating variable names in the Figma Nova Components/Styles files so our design token naming is consistent between Figma and central (so we can run our import script for more Nova automation)

UX Fundamentals

• Felt Privacy error pages now support more NSS errors instead of falling through to the legacy page. Updated introductory text for the denied-port-access error. – 2024150
• Fixed a test in browser_aboutCertError.js that was failing on Linux opt standalone and removed the platform skip. – 2028651
• Added clock skew detection to the Felt Privacy error pages. When a certificate error is caused by a wrong system clock, the Felt Privacy error pages now show the same dedicated clock-skew message that the legacy error pages had, and helps guide users to correct their system time. – 2025049
• ​​Fixed misaligned bullet points in the “What can you do?” section of Felt Privacy network error pages, restoring correct visual indentation for that list. – 2028632

Highlights

• The VPN feature is rolling out to users in the United States, the United Kingdom, Germany and France! Read more about it here.
  • And here’s more information about it on SUMO 
    • 
• Split View is now available for users on Firefox 149! Read more about it here.
  • 
• Improvements to tabs.move() split views support: extensions can now swap tabs within a split view, and passing a list of tabs that explicitly separates split-view members will properly unsplit the view to honor the requested ordering – Bug 2016762 / Bug 2022549
• Jeremy added the ability to copy all URLs from multi-selected tabs 1984362 – Share -> “Copy link” for multiselected tabs should copy all the tabs’ information
• Alexandre Poirot [:ochameau] improved performance of the Inspector Rules view by supporting incremental updates, making some perf test 2 times faster (#2018538)
  • perf compare results
• The Tab Notes feature is now live in Firefox 149 in Firefox Labs! We have a few tweaks and fixes coming in Firefox 150 and 151, but we’re mostly collecting feedback from users.
  • 

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Chris Vander Linden
• EJiro Oghenekome
• Keji Bakare
• konyhéa
• Noble Chinonso
• Pranjali Srivastava
• Sameeksha

New contributors (🌟 = first patch)

• 🌟Ben
  • Bug 1705177 – Don’t use fixed width for Add Device Save/Cancel buttons. R?nchevobbe!
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1705177
• 🌟Chidimma Okoloigwe
  • Bug 1901274 – Port over tests from browser/base/content/test/sidebar to browser/components/sidebar
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1901274
• Japandi
  • Bug 2015071 – Do not save tab note when input contains only whitespace. R?sthompson
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2015071
• 🌟DrSeed
  • Bug 1982888 – Remove obsolete sidebar Nimbus var r=nsharpley,sfoster
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1982888
• 🌟EJiro Oghenekome
  • Bug 1910902 – Update sidebar icons and references to use collapsed versions. r=nsharpley
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1910902
  • Bug 1938466 – Add tests for View &gt; Sidebar menu items and checked state. r=jsudiaman
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1938466
  • Bug 1952061 – Refactor sidebar state management: rename loadInitialState to loadCurrentState and update related references. r=nsharpley
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1952061
• 🌟Keji Bakare
  • Bug 2006572 – fix  right tab name and icon shift when the Split View is selected
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2006572
  • Bug 2025287 – Hide “Open Link in Split View” menu option for pinned tabs.
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2025287
• 🌟Hailia
  • Bug 2016934 – Update copied profile header with typographic quotes r?jhirsch
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2016934
• geppy
  • Bug 1767617 – Rename –theme-graphs-* CSS variables r?nchevobbe
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1767617
• 🌟Itoro James
  • Bug 1936929 – Document the ::%shadow% and ::%document% anchor selector tokens r?nsharpley,hanna_a
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1936929
• 🌟konyhéa
  • Bug 1856191 – don’t restrict the sidebar width so much (better support non-English locales)
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1856191
• konyhéa
  • Bug 1876108 – add hairline separator between synced tabs device lists in firefox view
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1876108
  • Bug 1891970 – Update firefoxview breakpoint to 950px
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1891970
  • Bug 2014334 – add outline to tab-split-view-wrapper when used as a drag group target
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2014334
• 🌟Noble Chinonso
  • Bug 1945835 – Add timestamp display to synced tabs list
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1945835
  • Bug 1953621 – Fix command property type in SidebarStateProps from boolean to string
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1953621
  • Bug 2019235 – Disable Move to Start/End for split view tabs based on tab position
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2019235
  • Bug 2025701 – Fix mismatched closing tag in syncedtabs-tab-list.mjs itemTemplate
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2025701
• Knot False
  • Bug 1773932 – Remove nsIScriptableUnicodeConverter from services/common/utils.sys.mjs. r=skhamis,markh
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1773932
• 🌟Pranjali Srivastava
  • Bug 1874155 Remove browser.firefox-view
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1874155
  • Bug 2009917 – Added proper spacing
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2009917
• 🌟Chukwuka Rosemary
  • Bug 1846829 – Remove the max-history-rows pref used in Fx View
    • https://bugzilla.mozilla.org/show_bug.cgi?id=1846829
• 🌟Sameeksha
  • Bug 2008178 – Add accessible name to ConfirmDialog using aria-labelledby. r=thecount
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2008178
  • Bug 2021421 – Remove redundant lazy preference getters in sidebar-pins-promo.mjs
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2021421
• kofoworola shonuyi
  • Bug 2019901 : Remove sidebar-ongoing-animations attribute from sidebarMain after animation reset.
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2019901
• 🌟Oluwatobi
  • Bug 2019936 – Remove preference configuration for the IE importer feature. r=nsharpley,kcochrane,mconley
    • https://bugzilla.mozilla.org/show_bug.cgi?id=2019936

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• Fixed a long-standing issue where extension paths stored in extensions.json (and addonStartup.json.lz4) became incorrect after restoring a Firefox profile to a different location and causing all previously installed add-ons to fail to load  – Bug 1429838

DevTools

• geppy renamed some of our CSS variables to be more explicit (#1767617)
• Sebastian Zartner [:sebo] move the :visited pseudo-class to element-specific section in the Inspector pseudo-class (:hov) panel (#2017985)
• Ben improved the RDM “Add Custom Device” form by making sure it worked for any kind of locale (#1705177)
• Chris Vander Linden continued his work to migrate files to use actual private fields (#2022400, #2022402, #2022403, #2022405, #2022406, #2022407)
• Dana Keeler (she/her) [:keeler] added a distinct icon to Netmonitor requests when a request uses a certificate issued by a third-party root (#2022693)
  • 
  • https://snipboard.io/QtwV2R.jpg
• Nicolas Chevobbe [:nchevobbe] added a <global> node on objects which are not from the top-level debugged page (it’s always visible in the browser console/browser toolbox) (#1962343)
  • 
  • https://snipboard.io/uJg2vN.jpg
• Nicolas Chevobbe [:nchevobbe] added possible anchor names to the autocomplete for the position-anchor property, as well as for the anchor() and anchor-size() functions (#1903278, #2023114, #2023576)
  • 
  • https://snipboard.io/t6QUBF.jpg
• Nicolas Chevobbe [:nchevobbe] added proper autocomplete (including things like interpolation/color space) for linear-gradient() (and repeating-linear-gradient())  (#2025761)
  • 
  • https://snipboard.io/1LNp26.jpg
• Leo McArdle [:leo] fixed an issue in the Inspector Fonts panel Weight input (#1578023), and made sure we properly round displayed values (#1465026, #1578022, #2013940)
• Nicolas Chevobbe [:nchevobbe] made the animation speed drop down to be always visible in the animations panel (#1995485)
  • it now impacts all the animations in the page, not only the ones in the subtree of the selected node
• Julian Descottes [:jdescottes] fixed frequent DevTools crashes by avoiding to access properties on remote proxy windows in various places (#2026134)

WebDriver

• Khalid AlHaddad refactored the WebDriver BiDi tests by moving the “wait_for_bidi_events” helper to a fixture.
• Henrik Skupin splitted fixtures and helpers for WebDriver classic and BiDi into protocol-specific folders and improved Marionette’s window manipulation logic for Wayland headless/headful jobs.
• Henrik Skupin added support for “altitudeAngle” and “azimuthAngle” in pointer actions of subtype “touch” to both Marionette and WebDriver BiDi.
• Julian Descottes fixed browsingContext.reload to properly reload iframes and simulate more accurately a user-initiated reload.
• Alexandra Borovova updated “log.entryAdded” events to include top-most frame of the stacktrace for all types of Console APIs.
• Alexandra Borovova updated the handling of shutdown requests to make sure that all active downloads are canceled before to not block the actual browser shutdown.

Lint, Docs and Workflow

• Globals handling within VS Code (and maybe other editors) has been improved to avoid caching globals when the source file for the globals has been updated.
  • The main impact of this is that when changing globals in head.js files, VS Code’S ESLint reporting will see the changes when you have the test files open that use the head.js file.

New Tab Page

• Irene Ni updated the Shortcuts UI to Nova, refreshing about:newtab shortcuts with the new design system and improved focus states.
• Irene Ni made it possible to increase shortcuts row count from 8 to 10 for Nova, which will let users pin two more sites per row without scrolling.
• Hanna Alemu built the UI code for asrouter-newtab-message, enabling ASRouter-driven new tab messages controlled via remote config.
• Dre fixed some New Tab keyboard navigation bugs, restoring predictable Tab/Arrow traversal across tiles, cards, and the customization controls.
• Nathan Barrett fixed a persistence bug where Weather, Shortcuts, and Recommended Stories couldn’t be disabled after restart while New Tab was focused, ensuring section toggles reliably save and apply across restarts.
• Sameeksha added an accessible name to the ‘Delete from History’ dialog in Recent Activity, allowing screen readers to announce the dialog title and purpose.
• Maxx Crawford labeled the Detailed view menu button for accessibility, making the control discoverable to assistive tech.
• Maxx Crawford made the ‘See full forecast’ link keyboard-focusable in Detailed view, improving navigation without a mouse.
• Reem Hamoui conveyed high/low temperatures to screen readers in the Detailed view, exposing key weather info non-visually.
• Reem Hamoui added alternative text for hourly forecast graphics, enabling meaningful announcements instead of unlabeled images.
• Maxx Crawford fixed fluent-dom handling so a br element is preserved in newtab-topsites-add-shortcut-label, restoring the intended line break in the Add Shortcut label.

Search and Urlbar

• Dao and Moritz worked on follow ups and fixed several bugs related to the new search bar implementation, which shipped in Fx 149 (2026248, 2023611, 2025746, 2022159, 2022809, 2023656, 2023141)
• Mandy added a new `hasBeenUsed` attribute to search engines to enable better messaging system targeting (2024078)
• Mandy also added a new telemetry category for when search mode is activated via a feature callout (2018806)
• Drew and Daisuke are continuing their work on making Nova updates to the urlbar (2019165)
• Dale fixed two bugs related to the new Unified Trust Panel (2019928, 2013044)
• Florian used Claude to fix intermittent bugs related to urlbar and search telemetry (2009767, 2024301)
• James fixed a high frequency intermittent test failure in the urlbar code (2001962)
• Marco fixed a high frequency intermittent test failure in the places database code (1981199)

Tab Groups

DJ is adding the ability to copy all URLs from the tabs in a tab group 1984338 – Add a way to share/send/copy all tabs urls from a given tab group

Highlights

• Thanks to overholt, macOS Nightly now has support for sharing the current tab’s URL via QR Code (Right-click tab, Share > Generate QR Code). This is held to Nightly for now.
  • 
• Scott Downe fixed an issue where newtab background GIFs could max out RAM while idle in the background by throttling animated background decoding on backgrounded tabs. This fix is going out in Firefox 150.
• Special thanks to volunteer contributor 1justinpeter who just added speed unit conversion support to the AwesomeBar!
  • You can try it in Nightly – try 1000 km/h to m/s
    • 
  • This is tentatively slated to go out in Firefox 150
• New Tab Sections have been enabled by default in Canada!
  • 

Friends of the Firefox team

Resolved bugs (excluding employees)

Volunteers that fixed more than one bug

• Chris Vander Linden
• Itiel
• Justin Peter
• Khalid AlHaddad
• Mauro V [:cheff]
• Sam Johnson
• Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

•  Mohammed Abdullah: screenshot command crops image after 10000px height
•  Jocsan: Profile delete page title should enclose profile name in quotes
• 🌟 karan68: [dialog] ‘X’ icon buttons are missing labels
•  Knot False: Replace KeywordUtils use of nsIScriptableUnicodeConverter with Services.textToSubURI.ConvertAndEscape
• 🌟 Pushkar Singh: Remove unused devtools.inspector.remote pref
• 🌟 MUTHUSRIHEMADHARSHINI: Card images do not have an alt attribute
•  Sukhmeet[:sukh]: firefox forgets open tabs depending on window close order
• 🌟 Alex Reisner: Create a preference to disable the drag-and-drop method of creating tab groups
• 🌟 torrenceb90: Remove unused devtools.target-switching.server.enabled pref
• 🌟 baris: Button does not programmatically indicate that it opens a dialog (Customize button)

Project Updates

Add-ons / Web Extensions

WebExtensions Framework

• Fixed a structuredClone regression in the MV2 userScripts sandbox, bringing it in line with the fix already applied to content scripts and MV3 userScripts sandboxes, fix applied in Nightly 150 and uplifted to Beta 149 – Bug 2020773
• Fixed a tab crash triggered by calling Document.parseHTMLUnsafe() from a browser extension content script (due to an assertion failure hit because parseHTMLUnsafe was wrongly trying to create a document that belongs to the expanded privileged principal that originated the call). The changes applied is now making sure parseHTMLUnsafe will use the webpage document’s principal (and prevent the crash as a side effect of that) – Bug 1912587
• Fixed a regression where the load event on about:blank iframes would not fire when a content script injected a style element (regressed in Firefox 148 as a side effect of the changes applied by Bug 543435, fix landed in Nightly 140 and uplifted to Beta 149 and Release 148) – Bug 2020300
  • Thanks to Vincent Villa for promptly investigating and fixing this regression!

WebExtension APIs

• As part of followups related to the work to allow action.openPopup calls without user activation, action.openPopup() will reject the requests when another panel, context menu, doorhanger, or notification is already open in the window – Bug 2022281
• As part of followups to the work in support of the splitView mode support introduced in the tabs API, tabs.move() has been tweaked to correctly return all specified tabs moved in a split view – Bug 2022372

Addon Manager & about:addons

• Fixed a rendering regression where the context menu on about:addons cards would appear with a transparent background at non-default zoom levels – Bug 2006926
  • Thanks to Botond Ballo for investigating and fixing this small rendering regression!

DevTools

• Chris Vander Linden moved the SearchInFileBar component to a shared folder in (#2019256, #2020518)
• Chris Vander Linden made a few Netmonitor file use proper private properties (#2021639, #2021640, #2021641, #2021642, #2021643, #2021644, #2021645)
• Mohammed Abdullah refactored screenshot dimension handling to use shared logic from ScreenshotsUtils.sys.mjs (#1942439)
• Lorenz A fixed an issue in the Flexbox Layout pane regarding base size when flex-basis was set from the flex shorthand (#1939289)
• Oriol Brufau [:Oriol] improved one of our object test (#2021445)
• Sebastian Zartner [:sebo] added a new Element-specific pseudo-classes section in the pseudo-class panel and added support for the new :open pseudo class (#2014442)
  • 
• Simon Farre [:sfarre] made it so Reporting API requests are now visible in Netmonitor (#2013043)
• Leo McArdle [:leo] fixed the Network request panel so it would show POST data even before the request was finished (#2014623)
• Leo McArdle [:leo] fixed a couple issues with the Inspector Fonts panel inputs (#2013910, #2013904)
• Julian Descottes [:jdescottes] updated the device list in Responsive Device Mode to include recent phones and tablets (#1982802)

WebDriver

• Khalid AlHaddad contributed over the past two weeks by adding a test for correct viewport dimensions on new top-level browsing contexts, improving WebDriver tests with global asyncio markers and a timeout multiplier for a better stability of slow running builds, and introducing a fixture to remove webextensions installed during a test. Thank’s a lot!
• James Teh added Marionette-prefixed commands to query extended accessibility properties and traverse the accessibility tree using UUID-identified nodes.
• Jonathan Moss updated the marionette-integration test manifest files so all tests now run as part of the OS integration CI jobs.
• Alexandra Borovova fixed a regression when prompts opened with WebDriver Classic were automatically closed by default when the `moz:debuggerAddress` capability was passed, which is still a common pattern for Selenium.
• Alexandra Borovova fixed the download events that were triggered by the requests with the `Content-Dispostion` header opened in the new tab to be linked to a navigation.
• Alexandra Borovova updated the logic to not send the “log.entryAdded” events for console APIs that don’t use the printer (e.g., `console.time` or `console.clear`).
• Henrik Skupin fixed an issue in the browsingContext.locateNodes command where the root element was not returned when using a CSS selector.
• Henrik Skupin simplified the logic for Marionette commands managing window state, size, and position to improve stability.
• Julian Descottes fixed the support of non-utf8 headers for various network module commands.
• Julian Descottes fixed a bug with keepalive requests which could still be sent after setting the network conditions to “offline”.
• Julian Descottes fixed a race condition which could lead parallel calls to browsingContext.setViewport to timeout.

Lint, Docs and Workflow

• Mossop has replaced most instances of ContentTask.spawn with SpecialPowers.spawn.
  • There is a lint rule to prevent further uses.
  • Feel free to help clean up existing uses if you have any.
• https://arewemozsrcyet.com/ is live and in the middle of being moved to a mozilla repo, bugs / comments can go to https://bugzilla.mozilla.org/show_bug.cgi?id=2014746
  • 

New Tab Page

• Luca Greco fixed an issue where the new tab page was broken for users who had moved their profile to a new directory. Special shout-out to Scott for driving that one over the line and getting the fix uplifted to Beta!
• baris updated a button so that it indicated that it opens a dialog (Customize button) by adding aria-haspopup=”dialog” and focus management so screen readers announce the Personalize dialog correctly.
• Maxx Crawford added the first version of a refined grid system for Nova, introducing column-based container queries and CSS tokens for more consistent responsive New Tab layouts. This is currently off by default.
• Maxx Crawford updated Widgets components to use parent grid columns so cards align to the new Nova grid across breakpoints without layout jumps.
• Mike Conley enabled the pref to communicate with MARS over OHTTP by default so New Tab network calls use OHTTP by default, reducing IP exposure for all channels. This was already enabled on Beta and Release via Nimbus, but this patch is the pref flip that will ride the trains.
• Mike Conley added a train-hoppable asrouter-newtab-message external component for inline messaging to let us update New Tab inline messages via Remote Settings without a full Firefox update. The OMC team will take over building out the actual UI for the new message surface.
• Nathan Barrett landed sections layout support for Nova, to refine section spacing and ordering using the new grid for a cleaner, denser above-the-fold.
• Maxx Crawford fixed “Weather data is not available right now message” begin shown on the Weather widget by correcting gating so the Weather widget fetches and renders data reliably on v150.
• Maxx Crawford resolved an issue where experiments could accidentally override weather preferences set by the user
• Nina Pypchenko [:nina-py] aligned the newtab devtools button to match the Personalize button to improve visual consistency and discoverability of the DevTools toggle.

Search

• Marco worked on replacing ContentTask.spawn in various tests @ 2023131, 2023134
• Dale worked on several TrustPanel UX fixes @ 2017369, 2017376
• Daisuke fixed issue with SwitchTab results with no title @ 2020341
• Moritz worked on several telemetry issues relating to the new search bar 2021927
• Moritz fixed the unified search button having no focus border @ 2023656
• Dao added support for middle clicking to search in the unified search menu @ 2011220

Smart Window

• “Beta” badges 2017667
  • 
• Added AI Controls integration, supporting the blocked state (2010599)
  • 
• Added more user choice with split memory generation (2017428)
  • 
• Added chat search in Firefox View (2009070)
• Follow-up prompts now persist across tab switches (2019696)
• Conversation starter prompts now update with the foregrounded tab (2013657)
• Current tab context is now removable (2018802)
• Keyboard fixes for smartbar input (2019556 2017939 2015090)
• Show sign in button in chat if signed out (2015720)

Storybook/Reusable Components/Acorn Design System

• Tim Giles fixed some issues with panel-list using popover:
  • A macOS issue where keyboard events went to the wrong <moz-select>Bug 2017668
  • Scrolling now dismisses an open panel-listBug 2018563
• akulyk updated the panel-list variant of moz-select to use role=”combobox”, improving screen reader semantics and keyboard navigation consistency.
• Dustin Whisman updated the moz- widgets CSS to pass use-design-tokens:
  • panel-list, moz-input-*, moz-select, moz-toggle, moz-visual-picker, moz-message-bar, moz-five-star, and moz-reorderable-list
• Dustin Whisman updated some design token names for consistency (Bug 2013342):
  • –font-size-heading-* now a font-size variant (was –heading-font-size)
  • –card-border-color, –card-box-shadow, –card-box-shadow-hover, –popup-box-shadow, –tab-box-shadow (were nested as variants previously and now are under their component name)

UX Fundamentals

• Added keyboard autofocus to the “Try Again” button in Felt Privacy error pages so users who land on an error page can immediately press enter to retry. (2021447)
• Added keyboard access keys to the three primary error page buttons: G (Go Back), T (Try Again), and P (Proceed to Site). (404501)
• In progress: refactoring net error illustrations into a shared object and adding alt text so assistive technology can read out meaningful descriptions. (2022033)
• In progress: adding improved messaging to the file-not-found error page. (2018850)
• In progress: restoring the error page for Work Offline mode so users see messaging that accurately reflects that they’re in Offline mode, not that there’s a network problem. (

Debian LTS/ELTS

This was my hundred-forty-fifth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

During my allocated time I uploaded or worked on:

• [DSA 6402-1] hplip security update to fix two CVEs in Trixie related to privilege escalation and/or arbitrary code execution. I sent the debdiff to the security team, which resulted in this DSA.
• [#1142351] trixie-pu of libnfs has been uploaded.
• [DLA 4689-1] libnfs security update to fix one CVE in Bookworm and Bullseye related to an integer overflow.
• [DLA 4699-1] hplip security update to fix two CVEs in Bookworm and Bullseye related to privilege escalation and/or arbitrary code execution.
• [ELA-1775-1] libnfs gimp security update to fix one CVE in Buster and Stretch related to an integer overflow.
• [ELA-1784-1] hplip security update to fix two CVEs in Buster and Stretch related to privilege escalation and/or arbitrary code execution.

Unfortunately the number of assigned hours was rather low this month. So besides doing some days of FD at the end of the month, where I also had to process a new package list for ELTS, and a review of the rsync package (prepared by Sylvain), not much happened here.

Debian Printing

This month I uploaded a new upstream versions:

• … hplip to unstable.
• … foomatic-db to unstable.

Besides the package upload, I also took care of some older bugs of hplip.

This work is generously funded by Freexian!

Debian Lomiri

This month I continued the upload of lomiri packages with new upstream versions. Thanks to the help of my other colleagues, this project could be finished now.

This work is generously funded by Fre(i)e Software GmbH!

Debian Astro

This month I uploaded a new upstream version or a bugfix version of:

• … fxload to unstable.
• … indi-orion-ssg3 to unstable.
• … calceph to unstable (sponsored upload).

Debian IoT

Unfortunately I had no time to work in this category this month.

Debian Mobcom

This month I uploaded a new upstream version or a bugfix version of:

• … libgsm to unstable.
• … libosmocore to unstable.
• … libosmo-cc to unstable.

Next month I intend to upload new upstream versions of all Osmocom packages. As far as I can tell, these uploads will happen without soname changes. I like that :-).

misc

This month I uploaded a new upstream version or a bugfix version of:

• … usb-modeswitch to unstable.
• … ta-lib to unstable.
• … lua-geoip to unstable.
• … lua-systemd to unstable.
• … displaylink-driver to unstable.
• … nuspell to unstable.

The iPhone Air reaches one year on sale next month, and Apple is now closer to launching its successor than it is to the original's debut. On this week's episode of The MacRumors Show, we discuss what's next for the device.


The first-generation model has had a difficult run. A KeyBanc Capital Markets survey found virtually no demand for the device within weeks of its September 2025 launch, supply chain analyst Ming-Chi Kuo reported that suppliers were asked to cut capacity by more than 80% between launch and early 2026, and Luxshare and Foxconn both wound down production, leaving the phone believed to be entirely out of manufacture. Apple discounted it heavily in March, and SellCell data put its ten-week depreciation at 44.3% on average, against 34.6% for the iPhone 17 series. The Weibo leaker known as "Digital Chat Station" said in May that the device had barely surpassed 700,000 activations even after multiple rounds of price cuts.

A single rear camera left a $999 phone looking less capable than the cheaper ‌iPhone 17‌, which has two, and the absence of the iPhone 17 Pro's vapor chamber cooling means the Air runs warmer under load. It also lacks stereo speakers. Battery life falls short of a full day for many users, mitigated in part by the dedicated MagSafe battery accessory Apple sells alongside it. With the ‌iPhone 17 Pro‌ starting at $1,099, the Air occupies a $100 gap that gave buyers little reason to stop there.

Almost every change rumored for the second-generation model targets one of those points. Bloomberg reported in June that Apple will add an Ultra Wide lens alongside the existing 48-megapixel Fusion camera, and that the dual-lens design has reached advanced testing with the same exterior as the current model save for the extra lens.

Almost everything other than the battery sits inside the ‌iPhone Air‌'s camera plateau, and Apple has reportedly asked suppliers for an ultra-thin Face ID module to free up space. The company also plans to adopt Samsung's CoE display technology, which is thinner and brighter than the current panel and debuts first on the foldable iPhone. Digital Chat Station expects a 3,500mAh battery, up from 3,149mAh, and The Information reported that Apple wants the device to be lighter and to gain vapor chamber cooling despite the added hardware.

The device will also likely feature the A20 Pro chip, binned in some form like its predecessor, along with Apple's second-generation N2 wireless networking chip, the C2 modem, and 12GB of RAM, unchanged from the current model. Externally, little is expected to change beyond the additional rear camera, but Pu expects a slightly smaller Dynamic Island, in line with the wider iPhone 18 lineup. A lavender color option could replace Sky Blue.

Pricing is the biggest open question. The Information reported that Apple is considering a lower price for the second model, but the surrounding lineup is moving too. Pu expects the iPhone 18 Pro and Pro Max to cost $250 to $300 more than the current Pro models owing to 2nm silicon and memory costs, and the foldable iPhone is rumored to start somewhere between roughly $2,000 and $2,500. A widened gap between the Air and the Pro tier could change the calculation that undermined the original, particularly once the camera disparity with the standard iPhone disappears.

The leaker "Fixed Focus Digital" claimed in April that Apple will push through at least two generations of the device no matter how poorly it sells, a position consistent with Bloomberg's Mark Gurman, who expects the Air 2 in spring 2027 alongside the standard iPhone 18 and iPhone 18e. Nikkei Asia reported in January that no second-generation Air was expected before 2027 at the earliest.

Apple's confidence in the fall lineup appears to be growing in the meantime. The company reportedly told suppliers to prepare roughly 10 million foldable iPhones this year, up from an earlier forecast of seven to eight million, and has booked parts for around 80 million smartphones in the second half of 2026. Samsung, meanwhile, says the Galaxy Z Fold 8, Z Fold 8 Ultra, and Z Flip 8 drew 1.44 million pre-orders in South Korea across seven days, a company record, with the redesigned Z Fold 8 accounting for close to half of them.

The ‌iPhone 18 Pro‌, ‌iPhone 18 Pro‌ Max, and foldable iPhone are expected in September, and Apple has already begun preparing for the event, opening a lottery for U.S. retail employees to staff it. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips.



You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player.



If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion about the iOS 27 beta, talking through our experiences with Siri AI, Liquid Glass refinements, and more.

Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie.

‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.
This article, "The MacRumors Show: iPhone Air 2 - What Changes After a Difficult First Year" first appeared on MacRumors.com

Discuss this article in our forums

Apple has told a federal court that it hasn't heard from Jon Prosser's legal team in a month, as discovery drags on in its trade secret lawsuit against the leaker.


In a joint status report filed on Wednesday in the Northern District of California, Apple's attorneys said they had made repeated attempts to reach Prosser's counsel about outstanding discovery issues without success. From the filing:

Apple and Mr. Prosser have worked to advance this case through limited discovery. Mr. Prosser provided documents and communications to Apple, and sat for a deposition on June 16, 2026. Unfortunately, Apple last heard from Mr. Prosser's counsel on July 6th, 2026, despite repeated attempts to communicate and follow up on outstanding discovery issues. There still appear to be deficiencies in Mr. Prosser's productions, and Apple has notified Mr. Prosser's counsel of those issues.

Shortly before the report was filed, Prosser's attorney told Apple's legal team that the delay likely stems from Prosser welcoming his second child and attending to the newborn's care. The attorney indicated he would find dates for Prosser to provide the remaining discovery materials.

Co-defendant Michael Ramacciotti, who Apple says accessed the confidential device at the center of the case, has continued cooperating throughout the case. He agreed to supplement his interrogatory responses and sit for a second deposition.

Apple sued Prosser and Ramacciotti in July 2025, accusing them of misappropriating trade secrets tied to then-unreleased iOS 26 software, including the Liquid Glass redesign, by accessing a development iPhone belonging to Apple engineer Ethan Lipnik.

Ramacciotti cooperated with the case from the outset, but Prosser initially missed several deadlines to respond, leading the court to enter a default against him in October 2025 that barred him from contesting Apple's allegations. Prosser's attorney successfully petitioned to have that default set aside in June 2026, and Prosser filed a formal answer in the case on July 2. In it, he admitted joining a FaceTime call in which Ramacciotti showed him unreleased iOS features running on the development device, but denied that what he saw constituted trade secrets and denied knowing the device belonged to Lipnik.

Apple is seeking damages as well as a permanent injunction barring Prosser from disclosing its trade secrets again. Such an order could stop him from covering unreleased Apple products at all, which forms a significant part of his YouTube channel. Ramacciotti's second deposition is set for September, and all three parties expect to file another status update with the court on October 7.
This article, "Apple Flags Discovery Delays in Its Lawsuit Against Jon Prosser" first appeared on MacRumors.com

Discuss this article in our forums

On Saturday 25 July 2026, the annual Debian Developers and Contributors Conference came to a close. Over 270 attendees representing 35 countries from around the world came together for a combined 90 events (including some which took place during the DebCamp) including more than 27 Talks, 21 Short Talks, 29 Birds of a Feather sessions ("BoF" – informal meeting between developers and users), 8 workshops, and activities in support of furthering our distribution and free software, learning from our mentors and peers, building our community, and having a bit of fun.

The conference was preceded by the annual DebCamp hacking session held 13 through 19 July where Debian Developers and Contributors convened to focus on their individual Debian-related projects or work in team sprints geared toward in-person collaboration in developing Debian.

As has been the case for several years, a special effort has been made to welcome newcomers and help them become familiar with Debian and DebConf by organizing a sprint "New Contributors Onboarding" every day of Debcamp, followed more informally by mentorship during DebConf. Half a dozen new contributors joined the sessions and learned about Debian, free software, packaging and much more.

This year, a week-long DebCamp session was dedicated to auditing, patching, and modernizing the Go ecosystem in Debian and enable the transition triggered by the recent upload of dh-golang enabling GO111MODULE=on by default in Experimental.

In order to make the conference more accessible for local participants, a local language track was included in the schedule for talks in Spanish, as was done at DebConf19 in Brazil.

The actual Debian Developers Conference started on Monday 20 July 2026.

In addition to the traditional "Bits from the DPL" talk, the continuous key-signing party, lightning talks, and the announcement of next year's DebConf27, there were several update sessions shared by internal projects and teams.

Many of the hosted discussion sessions were presented by our technical core teams with the usual and useful "Meet the Technical Committee", three talks about Linux Kernel, early boot and improving Debian’s kernel and installer support for Chromebooks, and about twenty BoFs and talks about Debian packaging policy, Debian infrastructure, security and privacy.

This year, and echoing ongoing discussions within the Free Software community, Artificial Intelligence and Age Verification have been the subject of several talks. The Python, Perl, Ruby, Go, and Rust programming language teams also shared updates on their work and efforts.

More than 17 BoFs and talks about community, diversity, and local outreach highlighted the work of various teams involved in not just the technical but also the social aspect of our community

The schedule was updated each day with planned and ad hoc activities introduced by attendees over the course of the conference. Several traditional activities took place: a poetry performance, the traditional Cheese and Wine party, the Group Photos, and the Day Trip.

For those who were not able to attend, most of the talks and sessions were broadcasted live and recorded. One can find the seventy hours of recorded videos available via the conference schedule, or alternatively through this link.

Almost all of the sessions facilitated remote participation via IRC and Matrix messaging apps or online collaborative text documents which allowed remote attendees to "be in the room" and ask questions or share comments with the speaker or assembled audience. DebConf26 saw over 341 T-shirts, a day trip, and up to 130 meals planned per day.

All of these events, activities, conversations, and streams coupled with our love, interest, and participation in Debian and F/OSS certainly made this conference an overall success both here in Santa Fe, Argentina and online around the world.

The DebConf26 website will remain active for archival purposes and will continue to offer links to the presentations and videos of talks and events.

Next year, DebConf27 will be held in Asahikawa, Hokkaido, Japan, from Sunday September 5th to Saturday September 11th, 2027. As tradition follows before the next DebConf the local organizers in Japan will start the conference activities with DebCamp with a particular focus on individual and team work towards improving the distribution.

DebConf is committed to a safe and welcome environment for all participants. See the web page about the Code of Conduct on the DebConf26 website for more details on this.

Debian thanks the commitment of numerous sponsors to support DebConf26, particularly our Platinum Sponsors: Infomaniak, and Proxmox, and our Gold Sponsors : Freexian, and Viridien.

We also wish to thank our Video and Infrastructure teams, the DebConf26 and DebConf committees, our host nation of Argentina, and each and every person who helped contribute to this event and to Debian overall. Thank you all for your work in helping Debian continue to be "The Universal Operating System".

See you next year!

About Debian

The Debian Project was founded in 1993 by Ian Murdock to be a truly free community project. Since then the project has grown to be one of the largest and most influential Open Source projects. Thousands of volunteers from all over the world work together to create and maintain Debian software. Available in 70 languages, and supporting a huge range of computer types, Debian calls itself the universal operating system.

About DebConf

DebConf is the Debian Project's developer conference. In addition to a full schedule of technical, social and policy talks, DebConf provides an opportunity for developers, contributors and other interested people to meet in person and work together more closely. It has taken place annually since 2000 in locations as varied as Scotland, Bosnia and Herzegovina, India, Korea, France. More information about DebConf is available from https://debconf.org/.

About Infomaniak

Infomaniak is an independent, employee-owned Swiss technology company that designs, develops, and operates its own cloud infrastructure and digital services entirely in Switzerland. With over 300 employees — more than 70% engineers and developers — the company reinvests all profits into R&D. Its public cloud is built on OpenStack, with managed Kubernetes, Database as a Service, object storage, and sovereign AI services accessible via OpenAI-compatible APIs, all running on its own Swiss infrastructure. Infomaniak also develops a sovereign collaborative suite — messaging, email, storage, online office tools, videoconferencing, and a built-in AI assistant — developed in-house and as a privacy-respecting solution to proprietary platforms. Open source is central to how Infomaniak operates. Its latest data center (D4) runs on 100% renewable energy and uses no traditional cooling: all the heat generated by its servers is captured and fed into Geneva's district heating network, supplying up to 6,000 homes in winter and hot water year-round. The entire project has been documented and open-sourced at d4project.org.

About Proxmox

Proxmox develops powerful, yet easy-to-use open-source server solutions. The comprehensive open-source ecosystem is designed to manage divers IT landscapes, from single servers to large-scale distributed data centers. Our unified platform integrates server virtualization, easy backup, and rock-solid email security ensuring seamless interoperability across the entire portfolio. With the Proxmox Datacenter Manager, the ecosystem also offers a "single pane of glass" for centralized management across different locations. Since 2005, all Proxmox solutions have been built on the rock-solid Debian platform. We are proud to return to DebConf26 as a sponsor because the Debian community provides the foundation that makes our work possible. We believe in keeping IT simple, open, and under your control.

Contact Information

For further information, please visit the DebConf26 web page at https://debconf26.debconf.org/ or send mail to press@debian.org.

Back in 2020, we committed to Manifest Version 3 (MV3) as the future direction of the Chromium extensions platform. Since then, we've worked with developers, listened to feedback, and continued evolving Microsoft Edge toward a more secure and performant extensions foundation. Today, we're announcing the next phase of that journey. With 95% of the top MV2 extensions on the Edge Add-ons website already moved to MV3, the ecosystem has made meaningful progress. Beginning in August 2026, Microsoft Edge will start the consumer transition away from Manifest Version 2 (MV2) extensions and toward MV3. Our goal is to complete the consumer transition by the end of 2026, with enterprise deprecation following in early 2027.

The ecosystem is ready for the next step

This is a significant milestone for the extensions community, and one we have approached deliberately. Microsoft Edge continued to support MV2 extensions so developers, enterprises, and users who depend on specific extensions had more time to adapt. The move to MV3 has come a long way. MV3 offers security and performance improvements over MV2, and developers across the ecosystem have done the work to modernize their extensions. To put some numbers around the progress the ecosystem has made, there are only 58 MV2-based extensions in the Edge Add-ons website with any meaningful usage. Of these, only three don't have a publicly available MV3-based extension already available. Developers and users have spoken: the vast majority of extensions of all types—from password managers to VPNs to ad-blockers—have successfully transitioned to MV3 with no loss of customer functionality. We're committed to working with all developers with MV2-based extensions to smoothly move their users to MV3 extensions.

What to expect next

Starting in August 2026, a subset of users with MV2 extensions installed will begin to see notices on the Manage Extensions page (edge://extensions) and on Microsoft Edge Add-ons product detail pages. The very few developers with an MV2 extension will see a similar notice in Microsoft Partner Center, along with a direct outreach from our team to help them complete the migration. Over the next few months, MV2 extensions will be gradually turned off by default. Users will be notified in advance and directed to recommended MV3 versions where available. These changes will start in the Canary, Dev, and Beta channels and gradually broaden to Stable in the following months, with the goal of completing the consumer transition by the end of 2026. Managed devices will not be affected during the consumer rollout. Enterprise deprecation will follow in early 2027. We will keep the community updated on the status of the rollout on a regular cadence.

What developers should do now

For developers who still maintain MV2 extensions, now is the time to complete the move to MV3. Ship an MV3 version of your extension and submit the update through Microsoft Partner Center. The Migrate an extension from Manifest Version 2 to V3 guide outlines the required changes. This progress only works because of the developers who have already moved their extensions to MV3 and shared feedback along the way. Thank you for your partnership and continued support in improving Microsoft Edge. If you run into questions during your migration, please reach out to the Microsoft Edge extensions team. We're happy to help.