Basilisk Browser (64-bit)

What's new in this version:

Basilisk Browser 2024.10.24 (64-bit)
- Added support for the PROT_MPROTECT security feature on targets that use it (notably PaX and NetBSD)
- Implemented preferences to give the user control over the Same-Origin Policy (SOP) and CORS preflight. See implementation notes.
- Improved buildability on NetBSD and PowerPC architectures with Altivec support
- Fixed building issues on Apple Silicon Mac with XCode 16
- Added workarounds for non-standard MSE/WebM/VPx encoding on YouTube that could cause video buffering and halting issues
- Dev: Changed the default credentials mode for module scripts from 'omit' to 'same-origin', aligning with mainstream
- Dev: Implemented getTransform and setTransform with DOMMatrix arguments
- Dev: Implemented ES2023 Hashbang grammar proposal
- Cleanup some e10s and Reputation Check leftovers in Basilisk frontend code
- Fixed an issue with JavaScript's StructuredClone
- Rejected: CVE-2024-9398 (properly informing the user about attempts to use unhandled protocols by web pages is considered more important than potential determination whether a handler for such a protocol is installed)


Basilisk Browser 2024.09.13 (64-bit)
- Introduced i686/32-bit x86 Linux binaries. These require SSE2 support or later to run. They are built on the same Oracle Linux 8/GCC 11 platform as our x86_64 and aarch64 builds.
- Added option to network preferences to toggle DNS prefetching on/off. Unlike Pale Moon, we will continue to leave this off by default.
- Backed out support for FFmpeg 7.0/libavcodec 61 (Linux) due to it causing a major regression in WebAudio (broken on all platforms). This is being worked on to re-land at a later date.
- Restricted the NotifyPaintEvent interface to chrome code only; there is no reason (other than potential tracking/fingerprinting) to have this accessible from content
- Fixed a potentially exploitable issue in JavaScript (FetchName)
- Fixed a code correctness issue in XPConnect when creating sandboxes
- Added a warning for using externally handled usenet protocols


Basilisk Browser 2024.08.16 (64-bit)
- Added a context menu item when right-clicking a tab to duplicate the tab
- Fixed issues with automated version numbers when building Basilisk on platforms that do not use the GNU date utility such as MacOS, FreeBSD, and Solaris/Illumos
- Implemented GitHub Actions for automated MacOS builds
- Fixed crashes on sites that use WebRTC on MacOS
- Removed migration tools for migrating profiles from other browsers. They were old and outdated and did not work correctly anyway
- Replaced the old unofficial Serpent branding with a new unofficial branding and unofficial logo called Snake
- Enable SSL/TLS pipelining by default
- Updated YouTube user agent overrides. Reinstate Spotify user agent override
- Fixed a crash in CSS grid layout
- Set hidden HTML elements to actually always be hidden
- Updated NSS to 3.90.4
- Updated SQLite to 3.46.0
- Fixed an issue with setting of cookies
- Fixed an issue in Linux IPC code
- Fixed an issue with DNS prefetching (disabled by default)
- Implemented the missing parts of the html5 element, including modal handling and custom backdrops
- Implemented coarser, user-configurable granularity for the canvas poisoning anti-fingerprinting measure. See implementation notes
- Implemented new CSS viewport units svw, svh, svmin, svmax, lvw, lvh, lvmin, lvmax, dvw, dvh, dvmin and dvmax
- Implemented new CSS logical viewport units vb, vi, svb, svi, lvb, lvi, dvb and dvi
- Removed the archaic and wholly outdated FIPS security module code
- Removed the archaic DBM support code for storing of passwords in DBM format files
- Removed the -moz prefix from -moz-fit-content, aligning with the current CSS standard fit-content value
- Updated our build system by adopting parts of the old autoconf 2.13 as maintained code. autoconf 2.13 is no longer a build requirement. If you build from source, you may want to review your dependencies with this change.
- Fixed issues when building with GCC 14.* and Clang 16.*
- Fixed issues with emoji sequence clusters causing incorrect rendering of emoji glyphs in some cases
- Made some arguments to the legacy XPathEvaluator/XPathExpression interfaces optional for web compatibility
- Fixed a crash when reporting JavaScript module exporting errors
- Updated checking of special cookie prefixes to be case-insensitive in accordance with the current RFC 6265 (bis-11+)
- Fixed issues with external protocol handlers
- Fixed an issue where autocomplete pop-ups would stay open in some circumstances.
- Fixed an issue with potentially bad file names being entered by the user to "Save As...".
- Fixed several crashes and race conditions.
- Made the nonce length for http digest auth configurable.
- Fixed various potential issues with font loading, parsing and handling.
- Cleaned up error reporting for workers and normalized error messages.
- Implemented the bulk of the CSS "cascade layers" spec (@layer{}). This implementation is not 100% complete yet, but should satisfy common use of CSS cascade layers on the web.
- Implemented support for Sec-Fetch-* headers, implementing another mechanism to deal with site security. See this part of the spec for a primer on what this does.
- Implemented support for Sec-Fetch-* headers, implementing another mechanism to deal with site security. See this part of the spec for a primer on what this does.
- Basilisk will now block access to the reserved address 0.0.0.0 on non-Windows operating systems. See implementation notes.
- Dev: Aligned rounding behavior and precision ranges of toFixed and related functions with the spec. See implementation notes.
- Dev: Added the navigator.webdriver attribute for web compatibility (always false as we do not support browser automation APIs).
- Re-implemented the Durstenfeld shuffle for plugin enumeration that was unfortunately dropped with one of our past rebases, to strengthen fingerprinting resistance.
- Fixed an issue with character clusters (e.g. for text selection) resulting from a regression surrounding our improvements for emoji handling.
- Fixed an issue with setting DOM color values. DiD
- Slightly improved password form handling, detecting previously unsupported field orders.

Code cleanup:
- Removed unused code related to the (incomplete) FoxEye experiment
- Removed support code for LibAV and (very) old versions of FFmpeg. We require libavcodec 58 or later (FFmpeg 4.0+) from this version forward (Linux).
- Removed click event dispatching code that is no longer relevant
- Cleaned up internal macro use in CSS code (this does not impact any exposed APIs or code)
- Removed the hidden network.dns.disablePrefetchFromHTTPS pref. DNS prefetching should not be treated differently for http and https.


Basilisk Browser 2024.05.11 (64-bit)
- Fixed an issue in v2024.05.01 where the preferences panel was broken


Basilisk Browser 2024.05.01 (64-bit)
- Implemented support for single-use meta tag. This implementation allows use of it without specifying a second meta tag to actually load the linked document which was originally intended for this tag (to hint to a browser it should pre-load the document for fast painting).
- Implemented CSP v3 keywords script-src-elem, script-src-attr, style-src-elem and style-src-attr.
- Added support for Emoji 15.1.
- Implemented webkitURL legacy window alias for URL for web compatibility.
- Implemented CSS shorthands margin-block, margin-inline, padding-block and padding-inline.
- Added support for querying CPU capabilities (SSE2/AVX/AVX2) to the Navigator interface. For privacy reasons this is not exposed to the web, but can be used by extensions.
- Removed site-specific override for Amazon.com due to breakage.
- (Linux only) Pasting URLs to content now by default does not navigate to that URL.
- If content-paste-navigation is enabled (via middlemouse.contentLoadURL), navigation is now restricted to pasting to active body type elements (to prevent unwanted navigation when pasting URLs to input boxes, for example).
- (Linux only) Fixed a build issue when building with a system-supplied cairo library (unsupported).
- Aligned the behavior of internal pointer structures to be more uniform. DiD
- Dev: Aligned canvas Path2D.addPath with the updated spec. It now supports DOMMatrix as opposed to SVGMatrix.
- Removed Stylo (Gecko Rust style system) leftovers from the source tree.
- Added .xrm-ms files to the executable warning list on Windows.
- Added sanity checks on HTTP/2 header sizes.
- Pulled a few fixes from upstream for the OpenType Sanitizer.
- Added a fix to avoid a potential issue when assigning a media data buffer.

Fixed:
- an issue where empty MIME type registrations would break some parts of the UI
- a problem with JS modules preventing ExportEntries from working
- an issue where workers could lock up the browser with SetInterval with an out-of-bounds (too small) value. This is now clamped to 4ms matching the HTML spec.
- a few usability issues with the built-in developer tools
- a potential crash in web workers
- a potential overflow issue in image maps
- an issue with attributes on duplicate html tags
- broken mousewheel scrolling if building with --disable-npapi
- a minor issue with XUL tree display in some circumstances
- a few potential emoji display issues. As usual, it is proven time and time again that emoticons are better :)
- some issues with workers
- an issue with ctrl+c copying in devtools
- crashes when run under WINE because of its lack of support for IDXGIKeyedMutex
- a crash when dealing with a specific (unmaintained) extension
- a potential issue in the JavaScript JIT compiler


Basilisk Browser 2024.02.03 (64-bit)
- Implemented a restricted version of the asynchronous clipboard API (navigator.clipboard). This API is restricted to writing only for obvious security considerations. It supports both plaintext and the standard DataTransfer methods. We did not implement the reinvented wheel concept of ClipboardItem objects.
- Implemented support for SHA-2 (SHA-256/SHA-512/etc.) signatures for OCSP stapled responses
- Implemented PromiseRejectionEvent. Although this is rarely actually used, some common JS libraries (you know who you are!) use it as a feature level canary and start loading (broken!) Promise shims if it is not found, causing compatibility issues and broken websites due to the shims.
- Aligned microtasks and Promises scheduling with the current spec and expected behavior
- We now no longer send click events to top levels of the document hierarchy when using non-primary buttons (use auxclick, instead, to capture these events)
- Greatly improved the performance of box shadows
- Greatly improved the performance of file/data uploads over HTTP/2 (most of the secure websites out there)
- Fixed several issues related to focus and content selection
- Fixed issues with the use of focus-within caused by unexpected processing of DOM events
- Fixed an issue with CSP not behaving as-expected when using importScripts(), and fixed a number of additional CSP-related issues
- Fixed a web compatibility issue with CORS preflights not sending the original request's referrer policy or referrer header
- Fixed a spec compliance issue with StructuredClone
- Fixed a crash due to clamping code introduced for SetInterval and SetTimeout timers
- Fixed crashes when dynamic imports are canceled (e.g. by navigation)
- Changed to now have its .files property be writable following a spec change and recommendation
- We are now requiring and building against the C++17 language standard
- Updated the in-tree ffvpx lib to 6.0
- Added a preference to allow users to completely disable reporting of CSP errors to webmasters. Using this is strongly discouraged as it will provide essential troubleshooting information to webmasters setting up CSP, and does not pose a privacy issue, but for those who really want it, it can now be fully disabled. The preference is security.csp.reporting.enabled.
- Updated the IntersectionObserver interface to now also accept documents for the observer root instead of only HTML elements
- Cleaned up various bits of code surrounding GMP, memory allocation, system libraries, vestigial Android code, freetype2 and developer tools
- Improved efficiency of handling D3D textures
- Added initial and experimental Mac PowerPC and Big Endian support
- Added preferences for the user to control whether or not the tab page title should be included in the window title or not. In Private Browsing mode, the default is now to not show the title in the window. This was done to avoid potential leakage to system logs (e.g. GNOME shell logs or Windows event logs) of websites visited through the recorded window title. The new preferences are privacy.exposeContentTitleInWindow and privacy.exposeContentTitleInWindow.pbm for normal mode and Private Browsing mode, respectively.
- Fixed several crashes in DOM and relating to dynamic JavaScript module imports
- Removed a restriction on Fetch preflight redirects, following a spec update
- Improved the handling of web workers if they get aborted mid-action
- Linux releases on both x86_64 and aarch64 are now built with GCC 11 and Oracle Linux 8
- Linux aarch64 releases are no longer considered to be in beta. Autoupdates will now work for Linux aarch64 builds moving forward
- Linux aarch64 builds are now available with both GTK2 and GTK3
- Refactored easy build shell script to use Oracle Linux 8 and GCC 11
- Refactored easy build shell script to work on both x86_64 and aarch64
- Changed some default Basilisk networking preferences to better respect privacy and security out of the box
- Fixed broken security section in the Page Info window
- Security issues addressed: CVE-2023-6863, CVE-2023-6858, CVE-2024-0746, CVE-2024-0741, CVE-2024-0743 DiD, CVE-2024-0750 DiD, and CVE-2024-0753
- UXP Mozilla security patch summary: 7 fixed, 4 DiD, 1 rejected (which was DiD at best), 34 not applicable


Basilisk Browser 2023.11.09 (64-bit)
This is a minor development and security update:
- Important: as of this version, our beta FreeBSD binaries require at least FreeBSD 13
- We no longer support the data: protocol inside SVG's statements
- Enabled more validation/error checking for WebGL on Windows to prevent potential crashes
- Improved secure context checking for iframes
- Fixed the handling of relative paths in URLs starting with multiple forward slashes
- Linux ARM64 was built with Clang instead of GCC due to issues with GCC on that platform
- UXP Mozilla security patch summary: 3 fixed, 1 DiD, 14 not applicable


Basilisk Browser 2023.11.05 (64-bit)
- Added an initial implementation of the ReadableStreams API, improving web compatibility with sites that apparently use this API in utilitarian fashion
- Added support for transparency in WebM videos for the edge case of using elements for transparent animated images. Major caveat: this will massively impact performance of video playback if an alpha channel is present in the video
- Added support for crypto.randomUUID to allow website scripting to generate random UUIDs (universally unique identifiers) through the WebCrypto interface
- Removed the user-agent override for Netflix, since they have stopped supporting the Silverlight browser plugin. Basilisk no longer has a way to provide Netflix DRM-controlled playback with them dropping it, so there is no longer a reason to try and force compatibility
- Updated the user-agent override for Spotify. While it is possible to use the website with this, it suffers from the same DRM issue and not all media will be playable (only non-encumbered media can be played in Basilisk like podcasts). Your mileage may vary
- Implemented timer nesting and clamping for workers, preventing timer hangs on bad website code
- Improved handling of drawing SVG images on canvases without explicit width or height attributes. We now follow the css-sizing-3 Intrinsic Sizes spec
- Improved performance of our memory allocator
- Updated libvpx to 1.6.1
- Cleaned up and updated some media playback code
- Removed the last vestiges of EME/DRM code from UXP, since this will never be supported in any application building on it due to the media industry's draconic policies around FOSS
- Removed support for DRM from Basilisk as a followup to the EME/DRM removal in UXP
- Removed simd.js, moving actually used SIMD handling to C++
- Removed the use of libav in our source, replacing its supply of FFT with the equivalent from FFMpeg
- Fixed potential type confusion in IonMonkey due to 3-byte opcodes
- Fixed an issue with tooltips persisting even if the browser window would have lost focus
- Fixed PerformanceObserver navigation and resource timing (default disabled for privacy); our implementation now fully passes conformance tests
- Fixed an issue where top-level SVG images would not be correctly clipped by positioned elements, giving the impression of wrong z-ordering as the SVG would overlap other elements
- Dev: Updated setInterval to fall back to 0 if no duration is supplied
- Dev: Updated ResizeObserver to a recent spec change, now returning an array of results for borderBoxSize and contentBoxSize instead of an object
- Dev: Updated Intl.NumberFormat and DefaultNumberOption() to follow spec updates. Most importantly for web compatibility, we now allow the "maximumFractionDigits" option in Intl.NumberFormat to be less than the default minimum fraction digits for the chosen locale, following the general consensus in TC39 around this issue
- Increased leniency (removed upper limit) of GLSL versions as they tend to be fully backwards compatible
- Fixed various crashes
- Added a safeguard to the sec-gpc header (Global Privacy Control) so it cannot be inadvertently overwritten
- Removed the 360 Secure Browser profile migrator from Basilisk
- WebRTC Spec Improvements
- Add ability toggle WebRTC and WebAssembly under Tools->Preferences->Content
- Enable PerformanceObserver by default in Basilisk
and several other issues without a CVE number assigned to them
- UXP Mozilla security patch summary: 6 fixed, 2 DiD, 19 not applicable


Basilisk Browser 2023.10.03 (64-bit)
Added:
- WASM sign extension opcodes
- GTK version to "Help->About" on GTK builds
- some safety checks for Performance Observers

Removed:
- Removed some unused Android/b2g/iOS code from Basilisk
- Removed some obsolete Crash Reporter and Error Reporting code from Basilisk
- Remove some unused code related to Mozilla telemetry from Basilisk
- Remove some unused stub functions from Basilisk
- Remove obsolete prefs related to the previously mentioned code removals from Basilisk
- Rewrite some code in Basilisk to use the text preprocessor at build time instead of AppConstants at run time
- Set Basilisk to always ask where to save files by default

Fixed:
- an issue in BigInt typedArray costructors
- JSON BigInt regressions
- Upgraded usrsctp library to a version over 5 years newer, fixing various security issues and potential bugs in sites using WebRTC DataChannels
- an issue with libvpx encoding
- an issue with dead Promise wrappers in JavaScript
- an issue with Alternative Services


Basilisk Browser 2023.09.15 (64-bit)
- Fixed a WebP decoder issue
- Rebase our PDF.js version on files from the Seamonkey PDF.js addon as well as files ported from Firefox 60.9.0. This upgrades our PDF.js version to 2.3.235, which pulls in almost 3 years of security updates and bugfixes.
- Following the discussion in this forum post, we've introduced GTK2 builds of Basilisk for Linux


Basilisk Browser 2023.09.12 (64-bit)
This is a major development update, further improving web compatibility and fixing bugs:
- Implemented the BigInt primitive type for JavaScript
- Implemented Big(U)Int64 array support
- Implemented ergonomic brand checks for JavaScript class fields
- Aligned the Performance API with the Timeline v2 spec
- Aligned the handling of flex/grid percentages resolving against the parent with other browsers
- Added or updated several user-agent overrides for problematic websites
- Added 2 preferences to allow users to disable CSS animations and transitions
- Improved compatibility with MacOS 14
- Fixed an important, intermittent JavaScript crash related to garbage collection
- Fixed several crashes
- Fixed several debug build related issues
- Fixed an issue building on SunOS related to the spelling library
- Updated PDF.js to 1.6.467 from Firefox 53
- Developer: Added ASan support for building with MSVC
- Developer: Implemented automated builds using GitHub Actions and automated process of mirroring Basilisk to GitHub
- Added the .xll file extension to the executable extensions list
- Security issues addressed: several potential security issues that do not have a CVE number
- UXP Mozilla security patch summary: 1 fixed, 3 DiD, 17 not applicable

Implementation notes:
- The BigInt primitive (base number format) in JavaScript allows JavaScript to handle excessively large integers (whole numbers). This primitive is especially useful for specialized scientific applications that need very large yet accurate numbers, but has seen widespread adoption for an as of yet unknown reason as part of web frameworks, causing general web compatibility issues for Basilisk when scripts expect BigInt support and instead have an error thrown. We have now implemented this primitive for use so we no longer have compatibility issues with these frameworks. It is still unknown why BigInt is in use there and for what. Critical note: BigInt might be tempting to consider for JS-backed cryptography but this is very ill-advised, as BigInt operations are, by their nature, not constant-time and allow timing and side-channel attacks.
- Flex and grid item sizes in percentages would previously be resolved against the parent like other elements, according to a very long-standing practice that stems from the Internet Explorer days. Mainstream browsers have, however, made an exception for flex items and grid items to no longer do this. We have now made the same exception for these types of elements which should solve layout issues on some websites (notably reserving too much space for items, often resulting in very large areas of whitespace or items being pushed out of view).
- Two preferences were added (layout.css.animation.enabled and layout.css.transition.enabled) to allow users to completely disable CSS-based animations and transition effects. This was a request by users as both a performance and accessibility consideration. Please note that in some cases, disabling animations and transitions may have an impact on final web page layout, so you may run into some issues when disabling these animations and transitions as the web pages were designed to use them.


Basilisk Browser 2023.07.18 (64-bit)
- This is a major development update, further improving web compatibility
- Added the (hidden) preference browser.history.menuMaxResults to allow users to control how many history entries are listed in the menu. Setting this to 0 will hide history menu entries altogether, and any positive number configures how many entries the entries are limited to. The default if not defined is 15.
Switched C++ language level used to C++14 on all platforms.

Web compatibility and scripting improvements:
- Implemented geometry .from* static constructors for web compatibility
- Implemented partial support for CSS calc() in color keywords
- Implemented Array "find from last" feature (findLast and findLastIndex)
- Implemented Object.hasOwn(object,property)
- Implemented several additional Intl API methods and functions. This improves web compatibility with sites making use of things like hourCycle, advanced DateTimeFormat, Intl.Locale, and Intl as a constructor.

- Cleaned up some unused code
- Removed support for Mozilla "experiment" type extensions
- Improved the JavaScript garbage collector's sweeping. This should fix a few intermittent crashes and improve performance
- Implemented some structural changes to the source to make future porting easier, and preparing for switching to C++17
- Removed handling of symlinks for directory listings to prevent potential security issues by walking symlinks when uploading. This effectively reverts a change made in Firefox 50 where this functionality was introduced. A case of "Not such a good idea after all" ;-
- Updated the list of extensions on Windows treated as "executable"
- Security issues addressed: CVE-2023-37208
- Made preparations for requiring Authorization in CORS ACAH preflight
- Since no browser honors this part of the spec at the moment this is left disabled until there is consensus among browsers
- Fixed intermittent crashes related to the performance API
- Fixed intermittent issues with JavaScript malfunctioning in chrome scripts (causing faults in the UI and extensions)
- Added ability to specify build version in mozconfig when compiling Basilisk
- UXP Mozilla security patch summary: 2 fixed, 2 rejected, 20 not applicable


Basilisk Browser 2023.06.20 (64-bit)
Fixed:
- Fixed a crash in devtools in some OOM situations
- Fixed crashes when internal script execution was blocked by extensions
- Fixed crashes with WebComponents' ::slotted selector
- Disabled incremental cycle collector by default to avoid performance regressions
- Updated the default override for chase.com to work around issues


Basilisk Browser 2023.05.17 (64-bit)
This updates the UXP/Goanna platform version to 6.2:
- Implemented dynamic module imports. See implementation notes
- Implemented exporting of async functions in modules
- Implemented JavaScript class fields. See implementation notes
- Implemented logical assignment operators ||=, &&= and ??=
- Implemented a solution for websites using the officially deprecated ambiguous window.event. This is disabled by default but can be enabled through about:config's dom.window.event.enabled preference. See implementation notes
- Implemented self.structuredClone()
- Implemented Element.replaceChildren. Once again primarily a web developer note
- Improved Shadow DOM :host matching
- Implemented WebComponents' CSS ::slotted() and related functionality
- Improved page caching in our memory allocator
- Added support for FFmpeg 6.0, especially important for bleeding-edge Linux distros
- Fixed a potential drawing deadlock for images, specifically SVG. This solves a number of hang-on-shutdown scenarios
- Fixed various crashes related to WebComponents and our recent JavaScript work
- Fixed various build-from-source issues on secondary target platforms
- Fixed handling of async (arrow) functions declared inside constructors
- Fixed various small JavaScript conformance issues
- Fixed an issue where JavaScript (only in modules) would not properly create async wrappers
- Updated the DOM Performance API to the current spec (User Timing L3)
- See implementation notes, especially if you intend to use this in web content for critical functionality
- Updated keypress event handling to send keypress events on Ctrl+Enter
- Updated internal JavaScript structures to make future porting easier, as well as improve JavaScript performance
- Updated window handling and styling on Mac
- Updated the Freetype lib to 2.13.0
- Updated the Harfbuzz lib to 7.1.0
- Updated our DNS lookup calls to use inet_ntop() instead of the deprecated inet_ntoa()
- Updated the Fetch API to use the global's base URL instead of the entry document's base URL for spec compliance
- We no longer support the outmoded fontconfig on GTK systems
- We no longer parse or return the body of known-empty responses from servers (content-length of 0, or in case of HEAD or CONNECT methods)
- Implemented scaled font caching on GTK, improving performance
- Fixed a build issue when building for Linux on ARM64 on later distros
- Split out more parts of the browser into separate .dll files on Windows to reduce compiler strain and an oversized xul.dll
- Removed mozilla::AlignedStorage (code cleanup)
- Builds for FreeBSD now use xz for packaging instead of bzip2
- Merged the preference dom.getRootNode.enabled into the dom.webcomponents.enabled pref. See implementation notes
- Fixed a potential DoS issue with JPEG decoding
- Fixed a potential issue in Windows widget code that could lead to crashes
- Disabled potentially hazardous external protocols on Windows
- Added known-problematic .dlls to the internal blocklist
- Security issues addressed: CVE-2023-32209, CVE-2023-32214 and several others that do not have a CVE designation
- UXP Mozilla security patch summary: 4 fixed, 1 rejected, 27 not applicable

Implementation notes:
- JavaScript modules have various methods of being loaded into web page content. One of the later introduced methods is a function-style import() declaration, so-called "dynamic module imports" that has been used by various web frameworks, causing issues for Basilisk resulting in blank pages in most cases (since the websites would not actually use document structure HTML, but rather JavaScript to create content, all from imported modules). This has been a major web compatibility issue lately and we're pleased to announce that this complex bit of machinery has been implemented.
- JavaScript's language specification is continuing to be watered down from a prototyping language towards a more "C-like" hybrid. As part of that effort, JavaScript classes were introduced in ECMAScript 6, and now further expanded in ES2022 with class fields and private class fields/methods, as well as statics. We should have a complete implementation of this now, which constitutes the more important parts of the ES2022 language update.
- The use of the outdated Microsoft Internet Explorer global window.event has been a pervasive web compatibility issue for us, especially since it was officially deprecated and we never implemented this ambiguous and unreliable property that is highly-context sensitive. Websites should use the event as passed into the event handler to get the event source instead. However, since neither Chrome nor Firefox have dropped this and seem to be playing a game of "chicken", it remains in use on the web. To deal with this conflict, we have now implemented the equivalent behind a preference to enable users to (temporarily) use the global window.event while webmasters update their websites. We hope the Google camp will finally drop this one soon so we can be done with this legacy quirk.

The DOM Performance API was updated to the User Timing level 3 spec. It should be critically noted that the DOM Performance API was never designed to be used as a matter of course on published content, and was designed only for page performance analysis use by web designers. Of course, as part of making dev tools available to the web, a lot of abuse ensued because of the accurate navigation and timing measurements that this API can provide (looking at you, Google!). Because of tight integration with web content analysis, the older spec implementation we had was causing issues and actually breaking some services, so we updated it, but with a few important key differences:
- In Basilisk, we keep navigation timing disabled because it's a notable privacy issue for the data it can gather (exact navigational events and timings). If you're a web dev and need these timing measurements, you can enable them with dom.enable_performance_navigation_timing.
- Our implementation, contrary to the spec, does not allow unlimited recording of performance events (effectively logging every page event!) which can also rapidly eat up memory. Instead we enforce a sane default quota that should be roomy enough for all legitimate use, but prevents runaway resource use or extensive logging of user actions.
- If the set quota is reached, a warning will be printed in the console and the recorded performance events will be thrown away. If you (foolishly) rely on Performance API events for your web application to function, be aware this may cause compatibility issues as the API was, again, not designed to be used in such a fashion. For event handling, there are much better alternatives available which do not involve extensive recording of user data or relying on a developer tool API.

- We've historically implemented the DOM getRootNode function as it was being used in the wild as a standalone function, however its main intent has always been to be a helper function part of Shadow DOM/WebComponents. As such we have now merged the preference into the WebComponents preference, enabling and disabling it along with the rest of our WebComponents implementation.


Basilisk Browser 2023.05.01 (64-bit)
- This is a bugfix and security release
- Note: macOS, Linux aarch64, and FreeBSD beta builds will identify as 2023.04.30
- Fixed a crash in CompareDocumentPosition with Shadow DOM
- Fixed a crash with display:contents styling
- Added a preference to disable the TLS 1.3 protocol downgrade sentinel (see implementation notes)
- Changed the way large clipboard copy/paste operations are handled, improving privacy (see implementation notes)
- Improved filename safety when saving files to prevent potential environment leaks (bis).
- Improved sanity checks of MIME type headers
- UXP Mozilla security patch summary: 2 fixed, 1 rejected, 49 not applicable

Implementation notes:
- Some proxies and middleware boxes improperly handle the TLS 1.3 protocol handshake causing an insecure downgrade to TLS 1.2. With our recent update of NSS, Basilisk no longer allows this kind of protocol downgrade when trying to establish a TLS 1.3 connection to a server. The resulting error is ssl_error_rx_malformed_server_hello with an inability to connect to the server. To enable users to still connect to the servers or devices in question, we've added an option to switch off the downgrade sentinel. To switch it off as a temporary workaround, set security.tls.hello_downgrade_check to false.
- If copy and paste operations to/from the browser are performed, Basilisk writes clipboard contents to disk in a temporary cache file if the copy/paste amount is particularly large, to avoid using large amounts of memory to hold this data. The average paste/clipboard size doesn't tend to hit this limit in which case it is just held in memory.
- Previously, these cache files, while in the O.S. temporary file location (%TEMP% or /tmp), would not be consistently cleaned up, potentially causing privacy issues if persisted. This was changed to using auto-cleaning anonymous temp files, improving user privacy and relying less on the O.S. or user performing cleanup of temporary file storage. Thanks to Sandra for pointing this out and providing the patch.


Basilisk Browser 2023.04.04 (64-bit)
This is a major update which introduces WebComponents support among other things:
- Basilisk is now available in beta for macOS and FreeBSD
- Shadow DOM and CustomElements, collectively making up WebComponents, have been enabled by default which should bring much broader web compatibility to the browser for many a site that uses web 2.0+ frameworks. See implementation notes.
- Tab titles in the browser now fade if they are too long instead of using ellipses, to provide a little more readable space to page titles. Note that this may require some updates to tab extensions or themes.
- A number of site-specific overrides have been updated or removed because they are no longer necessary or current with the platform developments in terms of web compatibility. We could use your help evaluating the ones that are still there; see the issue on the Pale Moon repo.
- Updated our promises and async function implementation to the current spec
- Implemented Promise.any()
- Fixed several crashes related to regular expression code
- Improved regular expression object handling so it can be properly garbage collected
- Fixed some VP8 video playback
- Fixed an issue where the caret (text cursor) would sometimes not be properly visible
- Updated the embedded emoji font
- Implemented the :is() and :where() CSS pseudo-classes
- Implemented complex selectors for the :not() CSS pseudo-class
- Implemented the inset CSS shorthand property
- Implemented the env() environment variable CSS function. See implementation notes
- Implemented handling for RGB encoded video playback (instead of just YUV)
- Implemented handling for full-range videos (0-255 luminance levels) giving better video playback quality
- Removed the WebP image decoder pref. See implementation notes
- Enabled the Web text-to-speech API by default (only supported on some operating systems)
- Updated NSPR to 4.35 and NSS to 3.79.4
- Cleaned up unused "tracking protection" plumbing. See implementation notes
- Cleaned up URI Classifier plumbing (Google SafeBrowsing leftover)
- Fixed several intermittent and difficult-to-trace crashes
- Improved content type security of jar: channels
- Improved JavaScript JIT code generation safety
- Fixed potential crash scenarios in the graphics subsystem
- Improved filename safety when saving files to prevent potential environment leaks
- Introduced Basilisk beta builds for FreeBSD, aarch64 Linux, ARM macOS, and Intel macOS
- Security issues addressed: CVE-2023-25751, CVE-2023-28163 and several others that do not have a CVE
- UXP Mozilla security patch summary: 1 fixed, 4 DiD, 14 not applicable


Basilisk Browser 2023.03.07 (64-bit)
Fixed:
- Revert tab title fading feature that was added in v2023.03.04. Caused various issues with tab titles and addons such as Tab Mix Plus.


Basilisk Browser 2023.03.04 (64-bit)
- Fixed a crash in the new regular expression code
- Added {Extended_Pictographic} unicode property escape to regular expressions
- Fixed a regression in regular expressions for literal parsing of invalid ranges
- Updated NSS to pick up fixes
- Security issues addressed: CVE-2023-25733 DiD, CVE-2023-25739 DiD and CVE-2023-0767
- UXP Mozilla security patch summary: 1 fixed, 2 DiD, 14 not applicable


Basilisk Browser 2023.01.26 (64-bit)
- Primary focus for this milestone is web compatibility, in particular Regular Expression extensions, standards compliance issues and further JPEG-XL support
- This milestone now offers full coverage of the ECMAScript 2016-2020 JavaScript specifications, with the exception of BigInt primitives

Most important changes:
- Implemented Regular Expression named capture groups
- Implemented Regular Expression unicode property escapes
- Re-implemented Regular Expression lookaround/lookbehind (without crashing this time ;) )
- Implemented progressive decoding for JPEG-XL
- Implemented animation for JPEG-XL
- Renamed CSS offset-* properties to inset-* to align with the latest spec and the web
- Fixed CSS inheritance and padding issues in some cases
- Aligned parsing of incorrectly duplicated HSTS headers with expected behavior (discard all but the first one)
- Implemented a method to avoid memory exhaustion in case of (very) large resolution animated images
- Updated the JPEG-XL and Highway libraries to a recent, stable version
- Cleaned up some unused CSS prefixing code
- Improved the ability to link on *nix operating systems with other linkers than gcc's default
- Stability improvements (potential crash fixes)
- Security issues addressed: CVE-2023-23598, CVE-2023-23599 and several others that do not have a CVE number
- UXP Mozilla security patch summary: 4 fixed, 2 DiD, 19 not applicable


Basilisk Browser 2023.01.07 (64-bit)
This is a major development, bugfix and security release:
- Added support for the JPEG-XL image format
- Implemented regular expressions lookaround/lookbehind
- Aligned CORS header parsing with the updated spec. See implementation notes
- We no longer fire keypress events for non-printable keys. See implementation notes
- Added support for MacOS 13 "Ventura" in the platform, primarily benefitting White Star
- Fixed potentially problematic thread locking code on *nix platforms
- Fixed some small issues in the display and operation of the Web Developer tools
- Removed unused but performance-impacting panning and tab animation measuring code. (telemetry leftovers
- Improved code for SunOS builds
- Updated Internationalization data for time zones
- Fixed a buffer overflow for Mac builds
- Fixed an issue with plugins not receiving keypress events properly
- Added some extra sanity checks to our zip/jar/xpi reader to avoid issues with corrupt archives
- Aligned cookie checks with RFC 6265 bis. See implementation notes
- Removed obsolete code in Windows widgets that could cause potential issues with long paths and file names on supported versions
- Fixed several crashes
- Security issues addressed: CVE-2022-45411, CVE-2022-46876, CVE-2022-46874 and several others that do not have a CVE numbe
- UXP Mozilla security patch summary: 6 fixed, 1 DiD, 1 deferred, 45 not applicable

Implementation notes:
- RFC 6265 has been worked on with draft changes describing how cookies are actually being handled in the real world, in the bis versions of the RFC. While these changes have not yet been finalized, browsers in general do adhere to the latest available bis version of this RFC. Specifically, the long-standing exceptions for cookie names and values have been formalized, e.g. having quoted values. Our behavior has changed in that we now once again accept Tab characters (0x09) which is the one excluded control character from the range that is otherwise forbidden. We also no longer apply these checks exclusively to those in http headers, and any way of setting cookies must now adhere to the valid range. Cookies that fail these range checks for valid characters will be ignored.
- CORS support has been updated to the current spec. Most importantly, Basilisk now accepts wildcard entries ("*") for the CORS statements Access-Control-Expose-Headers, Access-Control-Allow-Headers and Access-Control-Allow-Method. Note that wildcards are ignored (according to the spec) when credentials are passed.
- Basilisk will no longer fire the keypress events in content when the key pressed is a non-printable key. This is in response to issues where webmasters would use rudimentary and naïve input-restricting scripts in onkeypress handlers that would not take into account editing keys or navigation keys, causing issues for users trying to enter data into forms (and e.g. finding they could no longer use backspace, cursor keys or tab). This aligns our behavior with other browsers for web compatibility, although it should be considered a website error expecting not all keypresses to be intercepted in keypress events.


Basilisk Browser 2022.11.04 (64-bit)
Fixed:
- a potential heap Use-After-Free risk in Expat
- potentially undefined behavior in our thread locking code
- a potentially exploitable crash in the refresh driver
- potentially undefined behavior when base-64 decoding

- Added detection suport for the newly-released MacOS 13 (Ventura)
- Implemented a texture size cap for WebGL to prevent potential issues with some graphics drivers
- Updated site-specific overrides to address issues with ZoHo
- UXP Mozilla security patch summary: 1 fixed, 2 DiD, 6 not applicable


Basilisk Browser 2022.09.28 (64-bit)
This is a major development, bugfix and security release:
- Note: The default serch engines have changed. Please verify that your configuration still uses your preferred search engine.
- Implemented .at(index) JavaScript method on built-in indexables (Array, String, TypedArray)
- Implemented the use of EventSource in workers
- Enabled the sending of the Origin: header by default on same-origin requests
- Changed how Basilisk is built. We have made build system changes to reduce build times and pressure on the linker on all platforms. Note that Basilisk is not yet built with Visual Studio 2022. This change will be done in the next release
- Changed how Basilisk handles standalone wave audio files (.wav). See implementation notes
- Improved string normalization
- Updated the handling of CSS "supports" to now accept unparenthesized strings (spec update)
- Updated the handling of flex containers in web pages for web compatibility
- Fixed various issues when building for Mac OS X
- Fixed various C++ standard conformance issues in the source code
- Fixed several issues building on SunOS and Linux with various configurations and gcc versions
- Fixed an issue with regular expressions' dotAll syntax and usage. See implementation notes
- Switched custom hash map to std::unordered_map where prudent
- Cleaned up and updated IPC thread locking code
- Removed spacing for accessibility focus rings in form controls to align styling of them with expected metrics
- Removed the unnecessary control module for building with non-standard configurations of the platform
- Removed the -moz prefix from min-content and max-content CSS keywords where it was still in use
- Updated the search engines included with Basilisk. Basilisk now includes the same search engines as Pale Moon
- Fix issue where PDF.js was completely broken in the previous release
- Fixed an important stability and performance issue related to hardware acceleration
- Implemented Global Privacy Control in the Basilisk settings
- Fix issue where the 32-bit Windows installer would not execute on 32-bit Windows systems
- Remove Mozilla related default bookmarks. Update default bookmarks
- Update compatmode override for Firefox to 102.0
- Update user agent overrides to improve compatibility with Facebook
- Security fixes: CVE-2022-40956 and CVE-2022-40958
- UXP Mozilla security patch summary: 2 fixed, 11 not applicable


Basilisk Browser 2022.08.06 (64-bit)
This is a major update:
- Very Important: This is the first public release from the Basilisk Development team. As such, the vendor name in the application has changed. This means the profile directory has changed. See here for more info. You will have to perform a manual update if you are currently running Basilisk 2022.01.27 as it was compiled without an updater.
Note: Many things have changed since 2022.01.27 and 2022.08.06. We've tried to note all changes here but it is very likely something was missed:
- Fixed several application crash scenarios
- Fixed a number of thread locking/mutex issues
- Fixed a leak of content types due to inconsistent error reporting
- Fixed an issue with iframe sandboxing not being properly applied
- Fixed a potential leak of bookmarks from the exported bookmarks file if it included a malicious bookmarklet.
- Fixed an issue with drag-and-drop
- Fixed a potential crash due to truncated WAV files.
- Fixed a memory safety issue with XSLT
- Fixed a potential crash issue on bing.com.
- Fixed some thread locking issues
- Worked around a Mesa driver bug that could cause crashes
- Fixed a potential resource access issue in devtools
- Security issues with CVEs addressed: CVE-2022-1097, CVE-2022-28285 (DiD) and CVE-2022-28283 (DiD).
- Implemented Global Privacy Control, taking the place of the unenforceable "DNT" (Do Not Track) signal. Through GPC, you indicate to websites that you do not want them to share or sell your data.
- Implemented "optional chaining"
- Implemented setBaseAndExtent for text selections
- Implemented queueMicroTask() "pseudo-promise" callbacks
- Implemented accepting unit-less values for rootMargin in Intersection observers for web compatibility, making it act more like CSS margin as one would expect
- Improvements to CSS grid and flexbox rendering and display following spec changes and improving web compatibility
- Improved performance of parallel web workers in JavaScript
- Improved display of cursive scripts (on Windows). Good-bye Comic Sans!
- Updated various in-tree libraries
- Added support for extended VPx codec strings in media delivery via MSE (RFC-6381).
- Fixed a long-time regression where the browser would no longer honor old-style body and iframe body margins when indicated in the HTML tags directly instead of CSS. This improves compatibility with particularly old and/or archived websites.
- Fixed several crashes and stability issues
- Removed all Google SafeBrowsing/URLClassifier service code
- Restored Mac OS X code and buildability in the platform
- Removed the non-standard ArchiveReader DOM API that was only ever a prototype implementation
- Removed most of the last vestiges of the invasive Mozilla Telemetry code from the platform. This potentially improves performance on some systems.
- Removed leftover Electrolysis controls that could sometimes trick parts of the browser into starting in a (very broken) multi-process mode due to some plumbing for it still being present, if users would try to force the issue with preferences. Obviously, this was a footgun for power users.
- Removed more Android/Fennec code (on-going effort to clean up our code).
- Removed the Marionette automated testing framework.
- Security issues addressed: CVE-2022-29915, CVE-2022-29911, and several issues that do not have a CVE number.
- Implemented "nullish coalescing operator" for web compatibility.
- Fixed various crash scenarios in XPCOM.
- Fixed an important stability and performance issue related to hardware acceleration.
- Fixed a long-standing issue where dynamic datalist updates for