Pale Moon v28.10.0 Released (2020-06-05) Release Notes Download Spoiler: Changes v28.10.0 28.10.0 Changes/fixes: Implemented URLSearchParams' sort() function Implemented ES2020 globalThis for web compatibility Improved our WebM media parser to be more tolerant to different encoding styles. Improved our MP3 media parser to be more tolerant to different encoding styles and particularly tiny files/stream chunks. Improved performance of table drawing for more corner cases Changed the way images without a src are handled in page layouts to align with the Chrome-pushed spec. Added modern MIPS support Split out the ICU data file from xul.dll on Windows Fixed a regression in WebAudio channel handling due to a landed security fix. Fixed a regression preventing scripting from properly disabling input controls Fixed an issue with border radius sometimes not being honored in tables Fixed some build issues in non-standard configurations. Removed more telemetry code Removed the in-browser speech recognition engine and API Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface. Changed handling of braille blanks in the ui (CVE-2020-12409) DiD Mitigated a potential timing attack against DSA keys in NSS (CVE-2020-12399) Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 1 defense-in-depth, 8 not applicable.
Pale Moon version 28.11.0 has been released. (2020-07-14) The update is a development, bugfix and security update. Linux versions will follow shortly. The update includes DiD ("Defense-in-Depth") updates. A DiD update is s a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered. Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window. Click About Pale Moon and Check for Updates. More Info http://www.palemoon.org/releasenotes.shtml
Does anyone know how to go back to previous version? He took a bunch of add-ons away no workie anymore
To remove the warning you need to make changes in the extensions: https://forum.palemoon.org/viewtopic.php?f=19&t=16785
Pale Moon v28.12.0 Released (2020-08-04) Release Notes Download Spoiler: Changes v28.12.0 28.12.0 Changes/fixes: Added controls for WASM to the browser's preferences, and enabled by default. Enabled various arbitrarily-disabled CSS functions. Added the use of basic path descriptors (i.e. polygon) to css clip paths. Implemented multithreaded request signal handling for the Abort API. Please see implementation notes below. Updated the included US-English dictionary, adding approximately 2500 additional words. Removed the DOM battery API. This was already disabled for privacy reasons for a long while. Fixed an erroneous warning displayed on toolkit-only add-ons like supplied dictionaries. Fixed an issue with the sessionstore tab load preference. Improved the generation of the names of downloaded files to prevent confusion. (CVE-2020-15658) Fixed a code issue with base64 encoding of data. Fixed 2 safety hazards in JavaScript. (One being CVE-2020-15656) DiD Fixed a spec compliance issue with regards to the cross-origin loading of scripts. (CVE-2020-15652) Improved the loading of a system DLL on Windows, preventing low-risk hijacking potential. (CVE-2020-15657) See implementation notes. Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 defense-in-depth, 15 not applicable. Implementation notes: In 28.11.0, we introduced the Abort API as new code. The implementation of it still had an issue where especially web workers would not always see the availability of abort signals on fetch requests while AbortSignal was implemented in the browser. This effectively made some websites (especially those using a particular polyfill for the Abort API that would detect the need to polyfill by way of Request.signal) throw errors that were fine before. We offered users a workaround by temporarily disabling the AbortController in the browser by way of a preference (dom.abortController.enabled). v28.12.0 fixes the multi-threaded handling of signals, which should solve these problems. As such, the workaround is no longer needed and upon upgrade the preference will be reset to enable AbortControllers again. DLL-hijacking on Windows would only be possible if a malicious actor already either gained administrative access to the program's installation folder or otherwise have unrestricted access to the program folder (by having it installed in local application folders inside the user's profile space or other insecure program locations). In that case the system is already compromised and any executable can be replaced, so having dll loading hijacked would be the least of your concerns (i.e. the main program .exe could also be replaced/infected in that case).
Pale Moon v28.13.0 Released (2020-09-04) Release Notes Download Spoiler: Changes v28.13.0 v28.13.0 (2020-09-04) This is a compatibility, bugfix and security update. Special thanks to our new code contributors this cycle (you know who you are)! Changes/fixes: Updated the included site-specific user-agent overrides for a number of websites that need them. Rewritten the browser's padlock code to use more modern APIs and provide more accurate security status indication. Now also with localized tooltips! Fixed a missing close button on the undo prompt after removing a thumbnail from the QuickDial new tab page. Fixed an issue with the alternative stylesheet menu in the browser's UI not working. Implemented the use of intrinsic aspect ratios for images to improve layout during load and page positioning. Added a preference to the use of node.getRootNode and disabled by default. See implementation notes. Added CSS -webkit-appearance as an alias for -moz-appearance to improve compatibility with websites that only try to use Chrome-specific keywords to style standard form elements. Updated the SQLite library to 3.33.0. Reinstated precise floating point precision model in JavaScript for those alternate builders who foolishly try to use the inaccurate "fast" model. Improved spec compliance of modular JavaScript use (ECMAScript modules). Changed media errors to be a more generic response, and added a preference (media.sourceErrorDetails.enabled) to enable detailed error reporting of media errors for debugging purposes. Previously, detailed errors were provided by default which could lead to privacy issues. Improved code stability of the AbortController implementation. Fixed a race condition in the secure connection library (NSS). Security issues fixed: CVE-2020-15664, CVE-2020-15666, CVE-2020-15667, CVE-2020-15668 and CVE-2020-15669. Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 1 defense-in-depth, 1 rejected, 9 not applicable. Implementation notes: In 28.11.0 we introduced node.getRootNode because some websites would fail with an error if this function was not present. Unfortunately, this caused problems with other sites that (incorrectly) assume Google WebComponents are available when this utility function is present (feature detection gone wrong). While it is considered by some to be part of the Google WebComponents implementation, it actually has utility value outside of that use. Because of the problems caused, we've added a preference and disabled it by default, fixing these kinds of websites. When needed, you can re-enable this function with dom.getRootNode.enabled This should improve web compatibility by default yet still allow users to enable this function for websites that use its utility but do not use WebComponents.
Pale Moon v28.14.0 Released (2020-09-29) Website (GitHub) Release Notes Download Spoiler: Changes v28.14.0 v28.14.0 (2020-09-29) This is a development and security update. Updated the browser identity code for website security to more clearly indicate website status. A detailed explanation is available on the forum and beyond the scope of these release notes. Updated unofficial branding to be more generic and more clearly separate unofficial builds from Pale Moon as a product. Please note that this goes hand in hand with an update of our redistribution license, and from this point forward any "New Moon" products are to be considered separate, and not unofficial Pale Moon builds or in any way related to or affiliated with Pale Moon, despite the similarity in name. Added a preference (signon.startup.prompt) to give users the option to ask for the Master Password the moment the application starts (before the main window opens). This allows a workaround for getting multiple Master Password prompts if individual components need access to the password store at the same time. Changed the way download sources are displayed to always use the actual domain downloads are from. In some situations the browser would previously display the domain of the referring page in an inconsistent fashion. Implemented the ES2019 Object.fromEntries() utility function. Implemented the CSS flow-root keyword. (Re-)implemented percentage-based CSS opacity values according to the updated spec. Implemented the last few missing bits for a standards-compliant implementation of JavaScript modules.(preloading, resource: scheme, etc.) Implemented the ResizeObserver DOM API. Fixed a null crash on some websites using CSS clip paths. Updated script handling inside SVGs to only run scripts if they are enabled and permitted, avoiding a potential XSS pitfall. Fixed several memory safety hazards and crashes. Updated the MediaQueryList interface to the updated spec. It now inherits from EventTarget and implements AddEventListener/RemoveEventListener in addition to AddListener/RemoveListener and should improve web compatibility for some sites. Removed support for the archaic and non-standard <marquee> element. Removed some leftovers from the discontinued plugin update checker service. Removed some internal HPKP implementation leftovers. Cleaned up the Windows widget code to reduce potentially vulnerable direct-dll loads. Security issues fixed: CVE-2020-15676 and CVE-2020-15677 Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 1 defense-in-depth, 7 not applicable.
Every time I check other browsers (which now is essentially FF and Chrome-based) I understand why I use Pale Moon
Pale Moon v28.16.0 Released (2020-11-24) Website Release Notes Download Spoiler: Changes v28.16.0 Changes/fixes: Aligned CSS tab-size with the specification and un-prefixed it. Updated Brotli library to 1.0.9. Updated JAR lib code. Optimized UI code, resulting in smaller downloads and less space consumed on disk. Changed the default Firefox Compatibility version number to 68.0 (since versions ending in .9 makes some frameworks unhappy, refusing access to users) Cleaned up HPKP leftovers. Disabled the DOM filesystem API by default. Removed Phone Vibrator API. Fixed an issue where the software uninstaller would not remove the program files it should. Fixed a devtools crash related to timeline snapshots. Fixed an issue in Skia that could cause unsafe memory access. DiD Fixed several data race conditions. DiD Fixed an XSS vulnerability where scripts could be executed when pasting data into on-line editors. Linux: Fixed an overflow issue in freetype. Security issues addressed: CVE-2020-26960, CVE-2020-26951, CVE-2020-26956, CVE-2020-15999 and several others that do not have a CVE designation. Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 4 defense-in-depth, 3 rejected, 20 not applicable. Implementation notes: Windows binaries should all be properly code-signed again. The uninstaller issue might only appear if you have not used the internal updater to update the browser after installation. The DOM Filesystem and dir picker APIs are, in practice, not used on websites. We've disabled these web-exposed APIs because they are not entirely without potential risk, and intend to remove them in a future version unless there is a demonstrable need to keep them as optional (unsupported) APIs in the platform. One of the rejected security patches deals with entering a single word in the address bar. Standard browser behavior in that situation is for browsers to do a normal network lookup of that word in case it is a LAN machine name (other browsers also do this) which may "leak" your entered search term to the LAN. If you want to avoid this, please always use the search box for entering web searches, as it's unambiguous what to do with single words in that case.
Pale Moon v28.17.0 Released (2020-12-18) Website Release Notes Download Spoiler: Changes v28.17.0 Changes/fixes: Changed the way dates and times are formatted in the UI to properly adhere to the user's regional settings in the O.S. Re-enabled the DOM Filesystem API for web compatibility. Moved the global user-agent override to the networking component. See implementation notes. Worked around crashes and run-time issues with module scripts. See implementation notes. Fixed a website layout issue with table-styled elements potentially overlapping when placed inside a flexbox. Fixed some code logic issues with websockets. Fixed a regression when waking the computer from standby causing high CPU usage in some uncommon situations. Updated the list of prohibited ports the browser can use. See implementation notes. Updated root certificates. Windows: Changed the way downloaded files without an extension are handled. See implementation notes. Mac-beta: Improved version detection of MacOS including Big Sur. Security issues addressed: CVE-2020-26978 and CVE-2020-35112. Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 1 deferred to the next release, 16 not applicable. Implementation notes: The global user-agent override was moved to the networking component where it is actually implemented. The new preference name is network.http.useragent.global_override. Please note that using a blanket override is normally (very) counterproductive and does not, in fact, help much with privacy. It would also override the compatibility modes (Native/Gecko/Firefox) in Pale Moon. As such, the browser will now warn you if the user-agent is globally overridden (in preferences) and allow you to easily reset that override and re-enable the various compatibility modes. Module scripting caused some persistent and very hard to track browser crashes that we've narrowed down to a specific optimization in the JavaScript JIT (Just-In-Time) compiler (IonMonkey). This optimization is now disabled by default but if you need that little extra performance (usually only noticed in very optimized code or some benchmarks) then you can re-enable it, trading in stability, by setting the new preference javascript.options.ion.inlining to true. Prohibited ports: Pale Moon maintains a blacklist of ports the browser may normally not connect to on servers, to mitigate abusive web scripting employing your browser as an attack bot on servers (e.g. by connecting to mail servers or what not), NAT slipstreaming, and similar security issues. To more thoroughly prevent known abusable ports on servers, this list was extended with a number of additional default ports for various non-http protocols. Downloaded files without a file extension: When a file without an extension is downloaded, we will now open the download folder where you may choose to take any specific action manually, instead of trying to execute it as a program or through an associated program.
Pale Moon v29.00.0 Released (2021-02-02) Website Release Notes Download Spoiler: Changes v29.00.0 New additions: Implemented Intl.PluralRules API for JavaScript. Added a frequently-requested preference (browser.tabs.allowTabDetach) to disable "tearing off" of tabs (meaning dragging them outside of the tab bar resulting in them being made into their own window). Added FLAC as a recognized filetype-by-extension. Implemented basic support for the scrollbar-width CSS keyword. See implementation notes. Added preliminary support for modern FreeBSD builds. Selectively enabled core features of the DOM Animations API. Enabled AV1 video support by default (previously built but not enabled in releases). Added support for pointer events. Added support for the SVG transform-box property. Added support for the inputmode property for forms to enable context-sensitive display of soft keyboards. Enabled shutting down of the file I/O worker when idle for a while (resource optimization). Enabled blocking of auto-play of media in the background by default. We now offer official GTK3 builds for Linux alongside the GTK2 builds. Partial (and as of yet, not acceptably functional) implementation of Google WebComponents. See implementation notes. Changes/fixes: Updated NSPR to 4.29. Updated NSS to 3.59. Disabled legacy database format for storage of certificates and passwords. See implementation notes. Updated several site-specific user-agent overrides for web compatibility. Improved styling of the "find in page" bar to avoid unreadable text on some system themes. Removed a large chunk of Android-specific code. Split gkmedias.dll back out from xul.dll. Cleaned up a number of redundant and obsolete code paths. Fixed a regression with the Performance API. Fixed an initialization issue in the browser when users would force-disable certain types of caching. Fixed a crash when attempting to save a file from FTP that could be displayed in the browser. Fixed the root cause of an issue with JavaScript module loading causing crashes. See implementation notes. Fixed a rare initialization issue for the print preview window causing it to not display. Fixed a crash on Mac when text input was not secure. Disabled the Storage Manager API by default. Disabled the <menuitem> html tag by default. If you still need this, you can re-enable it with the preference dom.menuitem.enabled in about:config. Fixed a memory safety issue related to XUL trees (CVE-2021-23962). Implemented several defense-in-depth measures to improve stability and future security. Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 6 DiD, 1 already implemented, 1 deferred to the next release, 24 not applicable. Implementation notes: We've implemented basic support for the scrollbar-width CSS keyword. The most important setting used with increasing frequency on the web is scrollbar-width: none effectively disabling scrollbars while not affecting overflow behavior when content would overflow its designated space (normally that would result in scrollbars being added to access the hidden content). This support for none is complete. A different setting for this keyword is thin. While this is implemented, it is currently reliant on the underlying system theme for widgets on various operating systems and (especially on Linux) may have little or no effect depending on the widget theme you are using, resulting in standard-sized scrollbars (the same as auto, the default for this keyword). The legacy database format for storing security certificates and passwords (dbm, a Berkeley-derived format) is no longer built and as a result the browser will no longer be able to convert the old format (cert8.db and key3.db) to the current format which is SQL-based. Please see our document on profile migration for pointers on upgrading very old profiles that have not had this migration occur yet. We tracked down (thanks, jarman!) the issue that had us forced to disable the inlining of code optimization in our JIT compiler for JavaScript (IonMonkey) in our previous version by default, to prevent crashes with module scripts (see release notes of 28.17.0). As a result we've been able to reclaim our temporary loss in performance of the browser while solving the crashes caused by this optimization. We've implemented a good chunk of Google WebComponents (CustomElements and Shadow DOM). The incomplete code is behind a preference (dom.webcomponents.enabled) and it is strongly suggested you do not touch it unless you plan on helping us implement the remainder of this fundamentally-web-altering spec. Please do not expect that this preference is a magic wand to make Google and it's puppy sites suddenly work in "modern" (mind the quotes) ways or without help (e.g. polyfills). While we've ticked a lot of the boxes already for a working implementation, this specification is kind of special in that it is all-or-nothing because it is not an extension or evolution of existing technology, but rather an attempt at redefining how websites work and are structured (with plenty of critical feedback because of that) at the most fundamental level.
Pale Moon 29.1.0 Released (2021-03-02) Website Release Notes Download Spoiler: Changes v29.1.0 v29.1.0 (2021-03-02) This is a development, bugfix and security update. New features: Language packs for the following newly-supported languages: Arabic (ar) Chinese Traditional (zh-TW) Croatian (hr) Danish (da) Finnish (fi) Galician (gl) Indonesian (id) Icelandic (is) Japanese (ja) Romanian (ro) Serbian (cyrillic) (sr) Slovenian (sl) Thai (th) Implemented String.prototype.replaceAll(). Implemented JSON superset proposal. Implemented well-formed JSON stringify. Implemented numeric separators in JavaScript. Changes/fixes: Updated timezone data to 2021a. Updated the wording and inclusion of more select license blocks in about:license. Updated some site-specific user-agent overrides for web compatibility. Updated the lz4 library for performance and security updates. Improved performance of JSON stringify. Further improved support for building on FreeBSD. Fixed a regression where changes to useragent compatibility required a restart to take effect. Fixed a regression where AES-GCM in WebCrypto ("subtle" crypto API) wasn't working. This could make certain login procedures fail to work. Fixed a full browser deadlock when page scripting would flood browsing history with rapid location state changes. Disabled AV1 codec use by default again since our implementation has significant streaming issues (particularly audio) that needs further work. Added required interaction with file/folder open dialog boxes on html file input elements on some operating systems to avoid malicious content tricking users into uploading sensitive files unintentionally (related to CVE-2021-23956). Added a font sanity check to avoid triggering a potential vulnerability on unpatched Windows operating systems (related to CVE-2021-24093). Security issues addressed: CVE-2021-23974, CVE-2021-23973 and several memory safety hazards that don't have CVE numbers. Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 2 DiD, 19 not applicable.
Pale Moon 29.2.0 Released (2021-04-27) Website Release Notes Download Spoiler: Changes 29.2.0 v29.2.0 (2021-04-27) Starting with this version, we will no longer be supporting unmaintained legacy Firefox extensions that are not updated for/targeting Pale Moon directly. Please see this forum post for details. Changes/fixes: When opening tabs from the History side bar, Pale Moon will now warn you about the action if it would result in opening many tabs at once. Pale Moon now offers "Open All in Tabs" on bookmark folders even if there is only one sub-item in it, for UI consistency. Added media format controls in the Content category of Preferences. Added controls for preferred color scheme. See implementation notes. Updated several site-specific user-agent overrides for web compatibility. Removed the ability to accept Firefox IDs for extension installation. Removed conditional Macintosh code from the application front-end. Updated the AV1 reference library to 2.0. Cleaned up more Android code from the platform. Updated the embedded emoji font to cater to even more race-dependent profession emoji. Fixed an overflow in clip paths, potentially causing them to be rendered incorrectly. Added CSS values smooth, high-quality and pixelated to the image-rendering keyword. Implemented Intl.NumberFormat.formatToParts() to allow deconstruction of localized number formats by scripts. Reinstated the dom.details_element.enabled preference and fixed a rendering issue with summary/details html elements. Fixed an issue with CSP .nonce attributes on elements. Security issues addressed: CVE-2021-29946 DiD and CVE-2021-23994 DiD . Unified XUL Platform Mozilla Security Patch Summary: 2 DiD, 14 not applicable. Implementation notes: This version adds support for the prefers-color-scheme CSS keyword. This keyword is a media query keyword that indicates to websites whether your content styling preference is "light" or "dark". Unlike other browsers where this will be tied to your system color scheme and determined automatically (which might be a point on which you can be fingerprinted, so this would be a privacy concern), we've decided to give the user control through Preferences -> Content -> Colors where you will find a new control to indicate your user preference (it defaults to "light" for everyone). While this control also gives you the option to disable this feature and effectively not support the keyword, be aware that this might cause issues on some websites that do not provide styling for "unspecified" color scheme preferences. In the future we may add an "automatic" option similar to other browsers in case you regularly switch your system application style from light to dark and v.v.
