Pale Moon

v33.4.0.1 (2024-10-09)
This is a small update to address two important issues:
Extension compatibility issues with the ghostbuster
(leading to tab handling problems).
Windows 7 compatibility issues in 32-bit builds on some
systems (leading to application UI paint failures/black window).

v33.4.0 (2024-10-08)
This is a development, bugfix and security release.
Changes/fixes:
Introduced the "ghostbuster" concept; this is an automated
internal mechanism to attempt cleanup of particularly problematic web
content after a tab or window is closed. See implementation notes.
Added support for the PROT_MPROTECT security feature on
targets that use it (notably PaX and NetBSD).
Implemented preferences to give the user control over the
Same-Origin Policy (SOP) and CORS preflight. See implementation notes.
Improved buildability on NetBSD and Altivec architectures.
Fixed building issues on Apple Silicon Mac with XCode 16.
Added workarounds for non-standard MSE/WebM/VPx encoding on
YouTube that could cause video buffering and halting issues.
Dev: Changed the default credentials mode for module
scripts from 'omit' to 'same-origin', aligning with mainstream.
Dev: Implemented getTransform and setTransform
with DOMMatrix arguments.
Dev: Implemented ES2023 Hashbang grammar proposal.
(省略されました)

v33.3.1 (2024-09-10)
This is a minor security and bugfix update.
Changes/fixes:
Backed out support for FFmpeg 7.0/libavcodec 61 (Linux) due
to it causing a major regression in WebAudio (broken on all platforms).
This is being worked on to re-land at a later date.
Restricted the NotifyPaintEvent interface to
chrome code only; there is no reason (other than potential
tracking/fingerprinting) to have this accessible from content.
Fixed a potentially exploitable issue in JavaScript (FetchName).
Fixed a code correctness issue in XPConnect when creating
sandboxes. DiD
Added a warning for using externally handled usenet
protocols.
Security issues addressed: CVE-2024-8383 and CVE-2024-8381.
processor with AVX capabilities! Please keep an eye on the forum for

v33.3.0 (2024-08-13)
This is a major development update.
Important
notes with this version:
From this version forward, all 64-bit releases require a
processor with AVX capabilities! Please keep en eye on the forum for
announcements of 64-bit SSE builds by the community if you are on
particularly old or otherwise limited hardware that does not support
AVX.
For Linux users: Starting with this version, our binaries
are built with gcc 11 on a still conservative but more modern build
platform (Oracle Linux 8). As a result, there may be some lib
incompatibilities if you are still running on a particularly old distro
for some reason. While we try to serve as broad of a Linux base as
possible with our binaries, our lowest common denominator will
occasionally shift to newer distros as a result of O.S. life cycles,
compiler capabilities and available libraries.
Changes/fixes:
Implemented the bulk of the CSS "cascade layers" spec (@layer{}).
(省略されました)

v33.2.1 (2024-07-15)
This is a bugfix and security update.
Changes/fixes:
Fixed a crash in CSS grid layout.
Set hidden HTML elements to actually always be hidden.
Updated NSS to 3.90.3.
Updated SQLite to 3.46.0.
Fixed an issue with setting of cookies.
Fixed an issue in Linux IPC code.
Fixed an issue with DNS prefetching (disabled by default).
Security issues addressed: CVE-2024-6611, CVE-2024-6612 DiD and several others
(mostly DiD) that do not
have a CVE number assigned.
Implemented coarser, user-configurable granularity for the

v33.2.0 (2024-06-18)
This is a development, stability and security release.
Note: Mac builds have
switched to Xcode 15 and are now cross-compiled from Apple silicon for
Intel targets. While the resulting builds have been tested on a few
Intel Mac systems, this is a big build change, so please get in touch
through our forum
if you experience any issues with these builds on Mac.
New features:
Implemented the missing parts of the html5 <dialog>
element, including modal handling and custom backdrops.
Implemented courser, user-configurable granularity for the
canvas poisoning anti-fingerprinting measure. See implementation notes.
Implemented new CSS viewport units svw, svh,
svmin, svmax, lvw, lvh,
lvmin, lvmax, dvw, dvh,
dvmin and dvmax.
Implemented new CSS logical viewport units vb,
vi, svb, svi, lvb,
(省略されました)

v32.5.2 (2023-12-22)
This is a bugfix and security update.
Merry Christmas and Happy Holidays to all!
Changes/fixes:
Removed the standard Twitter/X user-agent override because
they decided to block us on it.
Added preferences for the user to control whether or not
the tab page title should be included in the window title or not. In
Private Browsing mode, the default is now to not show the title in the
window. This was done to avoid potential leakage to system logs (e.g.
GNOME shell logs or Windows event logs) of websites visited through the
recorded window title. The new preferences are privacy.exposeContentTitleInWindow
and privacy.exposeContentTitleInWindow.pbm for normal
mode and Private Browsing mode, respectively.
Fixed several crashes in DOM and relating to dynamic
JavaScript module imports.
Removed a restriction on Fetch preflight redirects,
following a spec update.
Improved the handling of web workers if they get aborted
(省略されました)

v32.5.1 (2023-11-28)
This is a minor development and security update.
Important: as of this
version, our beta FreeBSD binaries require at least FreeBSD 13.
Changes/fixes:
Restricted protocol fallback for TLS. Pale Moon no longer
(by default) allows TLS 1.3 to fall back to earlier protocol versions
during the initial handshake.
Reverted the addition of browser.bookmarks.openInTabClosesMenu
due to behavioral issues with menus.
If you desire the intended behavior, please use an extension instead.
We no longer support the data: protocol inside SVG's
<use> statements.
Enabled more validation/error checking for WebGL on Windows
to prevent potential crashes.
Improved secure context checking for iframes.
Fixed the handling of relative paths in URLs starting with
multiple forward slashes.
Security issues addressed: CVE-2023-6204, CVE-2023-6210,
(省略されました)

v32.5.0 (2023-10-31) 
This is a major development and security update. And a Happy Halloween
to everyone who celebrates! 🎃👻🦇
Changes/fixes:
Added an initial implementation of the ReadableStreams API,
improving web compatibility with sites that apparently use this API in
utilitarian fashion.
Added support for transparency in WebM videos for the edge
case of using <video> elements for transparent
animated images. Major caveat: this will massively impact performance
of video playback if an alpha channel is present in the video.
Added support for crypto.randomUUID to allow
website scripting to generate random UUIDs (universally unique
identifiers) through the WebCrypto interface.
By user request, added a preference browser.bookmarks.openInTabClosesMenu
(default true) to allow users to configure if they want
to keep the bookmarks menu open if they open bookmarks from it in a new
tab (by middle-clicking or Ctrl-clicking). The default behavior is to
close the bookmarks menu like any other menu when an option in it is
(省略されました)

v32.4.1 (2023-10-03)
This is a bugfix and security update.
Changes/fixes:
Fixed an issue in BigInt typedArray costructors.
Added some safety checks for Performance Observers.
Fixed JSON BigInt regressions.
Fixed missing BigInt increment/decrement operations.
Added WASM sign extension opcodes.
Fixed an issue with dead Promise wrappers in JavaScript DiD
Fixed an issue with Alternative Services DiD
Fixed an issue with libvpx (address CVE-2023-5217) DiD

v32.4.0.1 (2023-09-14)
This is a point release update to address a critical security
vulnerability.
Changes/fixes:
Fixed a WebP decoder issue (CVE 2023-4863)
v32.4.0 (2023-09-05)
This is a major development update, further improving web compatibility
and fixing bugs.
Changes/fixes:
Implemented the BigInt primitive type for
JavaScript. See implementation notes.
Implemented Big(U)Int64 array support.
Implemented ergonomic brand checks for JavaScript class
fields.
Aligned the Performance API with the Timeline v2 spec.
Aligned the handling of flex/grid percentages resolving
against the parent with other browsers. See implementation notes.
Added or updated several user-agent overrides for
problematic websites.
(省略されました)