palemoon (26.5.0~repack-1) obs; urgency=medium

  * New upstream release:
    Fixes/Changes:
    - Implemented a breaking CSP (content security policy) spec change; when a
      page with CSP is loaded over http, Pale Moon now interprets CSP directives
      to also include https versions of the hosts listed in CSP if a scheme
      (http/https) isn't explicitly listed. This breaks with CSP 1.0 which is
      more restrictive and doesn't allow this cross-protocol access, but is in
      line with CSP 2 where this is allowed.
    - Fixed an issue with the XML parser where it would sometimes end up in an
      unknown state and throw an error (e.g. when specific networking errors
      would occur).
    - Improved the performance of canvas poisoning by explicitly
      parallelizing it.

    Security fixes:
    - Fixed a potentially exploitable crash related to text writing direction.
      (CVE-2016-5280)
    - Made checking for invalid PNG files more strict. Pale Moon will now reject
      more PNG files that have corrupted/invalid data that could otherwise lead
      to potential security issues.
    - Changed the way paletted image frames are allocated so the space is
      cleared before it's used. DiD
    - Fixed a crash in nsNodeUtils::CloneAndAdopt() due to a typo. DiD
    - Fixed several memory safety errors.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 28 Sep 2016 11:44:18 -0700

palemoon (26.4.1~repack-1) obs; urgency=medium

  * New upstream release:
    Changes/fixes:
    - Fixed a crash in the XSS filter.
    - Slightly changed the address bar shading on secure sites to be more subtle
      and easily-blended.
    - Fixed the occurrence of "null" titles in bookmarks dragged from special
     folders.
    - Fixed an error initializing the browser due to trying to restore
      scratchpad data from a stored session when having switched from a version
      with devtools to a version without devtools, and the previous version had
      scratchpad data saved.
    - Fixed some minor issues in scratchpad and gcli devtools.

    Security fixes:
    - Updated the HSTS preload list to a much more updated source list, and
      performing our own checks on validity from now on to have the list be as
      accurate as possible.
    - Disabled Triple-DES cipher suites by default (mitigating SWEET32).

  * Add a "~repack" to the versioning because we have to repack the source.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 23 Sep 2016 17:07:58 -0700

palemoon (26.4.0-1mx150+1) mx; urgency=medium

  * New upstream release:
    - Removed Google Search as a bundled search provider. If desired, you can
      manually install it (or other search engines) after the update by following
      the steps in the Manage Search Engines topic.
    - Fixed the URL API to allow "stringification" of the object per
      specification. This should make a number of websites happy.
    - Added the ES6 string .includes() function in addition to the pre-existing
      .contains() function for  checking if a string contains another string.
      The .contains() function is retained for compatibility with web and
      extension scripts that adhere to the ES6 pre-release specification up to
      and including RC3.
    - Fixed the calculation of standalone SVG embeds width and height, which
      should solve some reported issues with html5 graphs being displayed
      incorrectly.
    - Linux: improved memory allocation.
    - Updated the graphite font library to 1.3.9.
    - Added a blocking rule for F-Secure's 64-bit deepguard library to prevent
      crashes.
    - Updated the SQLite library to 3.13.0.
    - Download= properties of links are now honored from the context menu
      "Save" option.
    - Fixed a crash in the XSS filter.
    - Fixed a crash in the DOM error module.
    - Worked around a crash on Linux
    - Linux: Improved optimization and GCC6 compatibility (Note: compiling with
      GCC 6 is still not recommended and it may or may not work, depending on
      your environment)

    Security fixes:
    - (CVE-2016-5251)Potential URL spoofing in the address bar.
    - (CVE-2016-0718) Context-dependent crash in expat 2.1.0.
    - (CVE-2016-5266) Outgoing dataTransfer items are not properly filtered.
    - Fixed potentially exploitable crash in the array splice implementation.
    - Fixed potentially exploitable crash caused by badly formatted ICO files.
    - (CVE-2016-5254) Heap-use-after-free in nsXULPopupManager::KeyDown

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 19 Aug 2016 13:08:56 -0700

palemoon (26.3.3-1mx150+1) mx; urgency=medium

  * New upstream release:
    - Fixed an additional issue found that could cause menu text on Windows 10
      to be white-on-white (and therefore unreadable).
    - Fixed an issue with news feeds not showing up when embedded in web pages.
    - Removed recently-added parsing of the child-src content security policy
      directive, after some web compatibility issues with it came to light, as
      well as it becoming clear that the CSP spec will see it removed in favor
      of the previous directive for embedded content. This should fix some 
      intermittent issues people have reported on e.g. the main google.com page
      and phpMyAdmin installations.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 01 Jul 2016 12:50:32 -0700

palemoon (26.3.2-1mx150+1) mx; urgency=medium

  * New upstream release:
    - 26.3.2 (2016-06-27) - Windows only
      This release only has pertinent changes for Windows. Other operating
      systems do not need this update.
      Changes/fixes:

     -Fixed a rare issue where the browser would not initialize properly
      (missing bookmarks and menu entries) if certain Windows registry values
      were missing (Windows 8 only).
     -Fixed an issue on Windows 10 where the classic menu bar would become
      unreadable (white on white).
     -Portable only: Switched to non-compressed binaries to prevent issues with
      antivirus packages, to prevent issues with browser run-time operation, and
      to simplify code signing.

    - 26.3.1 (2016-06-25)
      Changes/fixes:

     -Fixed an issue with new tab button theming on dark toolbars.
     -Reverted the useragent identification of Firefox compatibility mode to
      38.9 to avoid  WOFF2 font issues for sites that don't use proper font
      deployment as recommended by the W3C.
     -Added a site-specific override for Google fonts to make sure it always
      works even if not using Firefox compatibility mode. (workaround pending
      for a proper solution on Google's side)
     -Adjusted the "dark color" detection routine to switch text to white at
      higher relative contrast levels. This will more closely match Windows 10's
      "flip point" for different accent colors and is within the recommended
      range determined by the WCAG.

    - 26.3.0 (2016-06-21)
      Changes/fixes:

     -Added detection for dark system themes on Windows 10 and re-worked Windows
      10 specific theming to better integrate into the OS and provide more
      clarity.
     -HTML5 media controls have been reworked to a horizontal volume control on
      all media, including HTML5 audio that was previously without an
      element-control for volume.
     -Default HTML5 media volume preference added as media.default_volume --
      fractional, default 1.0 (=100%).
     -String.prototype.match() and .replace() are now fully spec compliant.
     -NSPR and NSS now correctly no longer enforce IA32 architecture
      compatibility, getting the advantage of SSE2 like the rest of the code.
     -Worked around crashes in the XSS filter when navigating back in history
      due to document fragments.
     -Instated a hard minimum of 10,000 places entries regardless of free disk
      space and total memory to prevent undesired expiration of history. That is
      around 16MB for an average entry size, which should be sane enough even on
      low-memory machines.
     -Fixed a typo in networking code introduced in 26.2.2 that would cause
      issues on some sites due to adding extra forward slashes to the URL.

    - Security fixes:

     -Fixed a number of memory safety hazards and potentially exploitable
      crashes.
     -Fixed CVE-2016-2821 Use-after-free in the mozilla::dom::Element class
     -Fixed netaddr deserialization for AF_UNSPEC and AF_LOCAL.
     -Fixed a memory overrun error in the VP8 encoder. DiD
     -Fixed non-threadsafe re-use of pixman images to prevent potential race
      conditions. DiD
     -Fixed CVE-2016-2825 Partial Same Origin Policy violation

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Mon, 27 Jun 2016 10:51:22 -0700

palemoon (26.2.2-1mx150+1) mx; urgency=medium

  * New upstream bugfix and security release:

    - CSS classes prefixed with "--" no longer stop parsing of the selectors.
    - Several crash fixes.
    - Made GC suppression more aggressive to prevent issues when actually out
      of memory.
    - Fixed a memory safety hazard in jpeg decoding.
    - Fixed a potentially exploitable crash when using bi-directional text.
    - Updated NSS to 3.19.4.2-PM, fixing CVE-2016-1938 among other things.
  * Add Suggested packages gstreamer1.0-libav, gstreamer1.0-plugins-good,
    gstreamer1.0-plugins-bad, gstreamer1.0-plugins-ugly to provide the most 
    comprehensive HTML 5 media playback.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Tue, 10 May 2016 18:26:54 -0700

palemoon (26.2.1-2) mx; urgency=medium

  * Switch to gstreamer 1.0 build-deps.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Sat, 09 Apr 2016 10:58:13 -0700

palemoon (26.2.1-1) mx; urgency=medium

  * New upstream release.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 08 Apr 2016 20:50:19 -0700

palemoon (26.1.1-1mx150+1) mx; urgency=medium

  * Repackaged for MX 15.

 -- Mike Purtell <mandbx@sbcglobal.net>  Sat, 27 Feb 2016 19:41:04 -0800

palemoon (26.1.0-1mx150+1) mx; urgency=medium

  * New security, web compatibility, and bugfix release.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 17 Feb 2016 10:18:12 -0800

palemoon (26.0.3-1mx150+1) mx; urgency=medium

  * Repackaged for MX 15.

 -- Mike Purtell <mandbx@sbcglobal.net>  Sat, 06 Feb 2016 18:02:47 -0800

palemoon (26.0.2-1mx150+1) mx; urgency=medium

  * Repackaged for MX 15.

 -- Mike Purtell <mandbx@sbcglobal.net>  Thu, 04 Feb 2016 19:31:53 -0800

palemoon (26.0.2-1mcr120+1) mepis; urgency=medium

  * New security and bugfix release.
  * Install extensions directly from /integration folder in source, remove
    debian/distribution.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Thu, 04 Feb 2016 14:02:54 -0800

palemoon (26.0.0-1mcr120+2) mepis; urgency=medium

  * Install addons from debian/distribution, taken from Pale Moon tarball.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Mon, 01 Feb 2016 08:08:54 -0800

palemoon (26.0.0-1mcr120+1) mepis; urgency=medium

  * Add libpulse-dev to build-depends to prevent FTBFS.
  * Add Suggests: gstreamer0.10-ffmpeg to debian/control file.
  * Add Mozilla Public License 2.0 to debian/copyright.
  * debian/mozconfig: use -O2 optimization and remove the jmalloc option, 
    and match what results from about:buildconfig from the official binary.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Tue, 26 Jan 2016 15:43:43 -0800

palemoon (25.8.1-2mcr120+1) mepis; urgency=medium

  * Drop mozconfig.patch; use debian/mozconfig instead.
  * Refresh debian/copyright.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Sun, 06 Dec 2015 13:08:26 -0800

palemoon (25.8.1-1mcr120+1) mepis; urgency=medium

  * A small update to address two important issues:
    - Fix for a crash that could occur at random since the update to 25.8.0.
    - Fix for CSP (Content Security Policy) to be more lenient towards the
      incorrect passing of full URLs with all sorts of parameters in the CSP
      header, leading to misinterpretation of the header and incorrectly
      blocking the loading of content.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Mon, 30 Nov 2015 10:20:18 -0800

palemoon (25.8.0-1mcr120+1) mepis; urgency=medium

  * New bugfix and maintenance release:
     Fixes/changes:
     - Updated LibVPX to 1.4.x to be able to play more kinds of VP9-encoded
       videos.
     - Updated the JPEG decoder library to 1.4.0.
     - Fixed and cleaned up XPCOM timer thread code to avoid intermittent
       issues with events not firing (especially after stand-by).
     - Updated overrides to work around issues with Facebook and Netflix.
     - Fixed an issue where too-old system-supplied NSPR and/or NSS libraries
       would be accepted for use.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 18 Nov 2015 11:52:32 -0800

palemoon (25.7.3-1mcr120+1) mepis; urgency=medium

  * New bugfix and maintenance release:
    - usability update needed due to the fact that Mozilla has shut down their key
      exchange (J-PAKE) server along with the old Sync servers.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 14 Oct 2015 19:40:39 -0700

palemoon (25.7.2-1mcr120+1) mepis; urgency=medium

  * New bugfix and maintenance release:
    - Fixed a critical hang caused by recursive reloads that might happen in 
      iframes if its hash changed.
    - Fixed a critical hang caused by lazy-loading of stylesheets through a
      specific web programming technique as advocated by Google's PageSpeed.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Mon, 05 Oct 2015 15:19:18 -0700

palemoon (25.7.1-1mcr120+1) mepis; urgency=medium

  * New bugfix and maintenance release:

     Fixes/changes:

    - Code cleanup: Removed the majority of remaining telemetry code (including
      the data reporting back-end and health report) to prevent a few issues
      with partially removed code in earlier versions.
    - Fixed a crash due to handling of bogus URIs passed to CSS style filters
      (e.g. whatsapp's web interface).
    - Permitted spec-breaking syntax in Regex character classes, allowing
      ranges that would be permitted per the grammar rules in the spec but not
      necessarily following the syntax rules. This impacts a good number of
      (also higher profile) sites that use invalid ranges in regular
      expressions (e.g. Cisco's networking academy site, Yahoo Fantasy
      Football).
    - Fixed a crash due to the newly introduced WASAPI handling of audio
      channel mapping that doesn't like actual surround hardware setups (e.g.
      playing a video with quadraphonic audio on a 4-speaker setup).
    - Fixed an issue where site-specific dictionary selections would be written
      to content preferences without the user's action, potentially overwriting
      or clearing a previously-chosen dictionary.
    - Added support for drag and drop of local files from sources which use
      text/uri-lists. (Some Linux flavors/file managers)
    - Updated libnestegg to the most current version.
    - Fixed an issue where setting the location to an empty string could cause
      a reload loop.

      Security fixes:

    - Changed the jemalloc poison address to something that is not a NOP-slide.
      DiD
    - Fixed a memory safety hazard in ConvertDialogOptions (CVE-2015-4521)
    - Fixed a buffer overflow/crash hazard in the
      VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE
      (CVE-2015-7179)
    - Fixed an overflow/crash hazard in the XULContentSinkImpl::AddText function
      (CVE-2015-7175)
    - Fixed a stack buffer overread hazard in the ICC v4 profile parser
      (CVE-2015-4504)
    - Fixed an HTMLVideoElement Use-After-Free Remote Code Execution 0-day
      vulnerability (ZDI-CAN-3176) (CVE-2015-4509)
    - Fixed a potentially exploitable crash in nsXBLService::GetBinding
    - Fixed a memory safety hazard in nsAttrAndChildArray::GrowBy
      (CVE-2015-7174)
    - Fixed a memory safety hazard for callers of nsUnicodeToUTF8::GetMaxLength
      (CVE-2015-4522)
    - Fixed a heap buffer overflow/crash hazard caused by invalid WebM headers
      (CVE-2015-4511)

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 30 Sep 2015 12:11:14 -0700

palemoon (25.7.0-1mcr120+1) mepis; urgency=medium

  * New bugfix and maintenance release:
    - Code cleanup: Removed the (otherwise unused) visual event tracer code.
    - Code cleanup: Removed reflow performance tracing code (telemetry).
    - Fixed a key JavaScript bug where defining properties on an object would
      wipe the object.
    - This seems to be a common issue with "modern" libraries that use "define"
      instead of "change" and expecting the other properties on the object to be
      retained, resulting in "x is undefined" errors all over the place if the
      object is wiped.
    - This aligns the behavior with ES6's "Validate and apply property
      descriptor" pseudo-function.
    - Updated the SQLite library to 3.8.11.1.
    - Added support for the element.matches() Web API function.
    - Added support for BASE tag parsing in source view. Previously, when
      viewing the source of a document, clickable links would be incorrect if a
      base path was specified in the document with this tag.
    - Fixed an issue with running timers after the computer would have been put
      to sleep with the browser opened.

     Security fixes:

    - Added protection against potential bugs where our SVG mPositions is out of
      sync with the characters in the DOM. DiD
    - Fixed use-after-free vulnerability in XMLHttpRequest::Open()
      (CVE-2015-4492)
    - Fixed use-after-free vulnerability in the StyleAnimationValue class
      (CVE-2015-4488)
    - Fixed crash or memory corruption in nsTArray (CVE-2015-4489)
    - Fixed crash or memory corruption in nsTSubstring::ReplacePrep
      (CVE-2015-4487)
    - Fixed potential escalation of privileges or crash (out-of-bounds write)
      via a crafted name in MARs (x64 only) -(CVE-2015-4482)
    - Fixed an issue that would allow man-in-the-middle attackers to bypass a
      mixed-content protection mechanism via a feed: URL in a POST request.
      (CVE-2015-4483)
  * Added blurb to postinst script.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Wed, 26 Aug 2015 14:50:58 -0700

palemoon (25.6.0-1mcr120+1) mepis; urgency=medium

  * New upstream release.
  * Add debian README.7z-source to explain how to use the .7z source archive.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 31 Jul 2015 16:40:45 -0700

palemoon (25.5.0-1mx150+1) mx; urgency=medium

  * Rebuild for MX 15.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 26 Jun 2015 14:43:57 -0700

palemoon (25.5.0-1mcr120+1) mepis; urgency=medium

  * New upstream release.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Thu, 11 Jun 2015 14:53:31 -0700

palemoon (25.4.1-1mcr120+1) mepis; urgency=low

  * Bugfix release, rebuild for MEPIS 12.0.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Fri, 01 May 2015 12:47:55 -0700

palemoon (25.3.1-0mcr120+1) mepis; urgency=low

  * Rebuild for MEPIS 12.0.
  * debian/rules: compress deb packages with xz.

 -- Steven Pusser (Stevo) <maintainer@mepiscommunity.org>  Thu, 26 Mar 2015 11:23:26 -0700

palemoon (25.3.1-0~precise1) precise; urgency=low

  * New upstream release

 -- Marián Kadaňka <marian.kadanka@openmailbox.org>  Wed, 25 Mar 2015 20:46:17 +0100

palemoon (25.3.0-0~trusty1) trusty; urgency=low

  * New upstream release

 -- Marián Kadaňka <marian.kadanka@openmailbox.org>  Sat, 14 Mar 2015 12:12:57 +0100

palemoon (25.2.1-0~trusty1) trusty; urgency=low

  * New upstream release

 -- Marián Kadaňka <marian.kadanka@openmailbox.org>  Sun, 01 Feb 2015 16:18:52 +0100

palemoon (24.5.0-0~precise1) precise; urgency=low

  * Initial packaging

 -- Marián Kadaňka <marian.kadanka@openmailbox.org>  Mon, 12 May 2014 20:42:01 +0200
