Pale Moon Version 31.2.0 Released

            

Pale Moon has been updated to version 31.2.0.  This is a major bugfix and development update.

Linux versions will follow shortly.

Changes/Fixes:

• Implemented CSS white-space: break-spaces for web compatibility.
• Implemented Intl.RelativeTimeFormat for web compatibility.
• Implemented "Origin header CSRF mitigation". This is still disabled by default to investigate potential issues with CloudFlare-backed sites.
• Implemented support for async generator methods in JavaScript.
• Added preliminary support for building on Apple Silicon like M1/M2 SoC.
• Added support for building with Visual Studio 2022.
• Improved the handling of CSS "sticky" elements in tables.
• Improved stack size limits on all platforms. See implementation notes.
  
• Updated function.toString handling to align with the updated JavaScript spec. This should improve web compatibility.
• Updated Unicode support to Unicode v11, and updated the ICU library accordingly. Building without ICU is no longer supported.
  
• Updated many in-tree third-party libraries to pick up various performance and stability improvements.
  
• Updated site-specific user-agent overrides to work around issues with Google fonts, Citi bank (again!) and MeWe.
• Removed some leftover (and unused) telemetry code in the platform and front-end.
• Fixed an issue with VP9 video playback on Windows on some systems.
• Fixed an issue with the add-ons manager not properly handling empty update URLs.
  
• Fixed a major performance regression on *nix based systems due to incorrect thread handling.
• Fixed volume handling when building with the sndio audio back-end.
• Pale Moon no longer applies content security policies to documents that are explicitly loaded as data documents or to images. See implementation notes.
  
• Cleaned up some unnecessary code from the source tree for unused build back-ends, Firefox marketplace "apps", and the rather ridiculous moz://a protocol handler.
• Updated NSS to 3.52.8 to pick up several defense-in-depth security fixes.
• UXP Mozilla security patch summary: 3 DiD, 12 not applicable.

*DiD This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

**Rejected security patches: This means that patches were theoretically applicable to our code but considered undesirable, which could be due to unwanted changes in behavior, known regressions caused by the patches, or unnecessary risks for stability, security or privacy.

Implementation notes:

• Prior to this version, Pale Moon would apply Content Security Policies (CSPs) to all requests made to servers that would respond with a policy header, as one would expect for strict use of CSPs as-intended. Unfortunately, Chrome has been less strict in applying these policies and specifically excluded applying these policies to images and "data documents". As a result, web compatibility became a problem for non-Google browsers with webmasters being oblivious about their overzealous CSPs deployed on websites, causing images (especially SVG) and data to not load or load properly. To align with mainstream browser behavior and improve web compatibility on misconfigured websites, we are now no longer applying CSPs to images or documents explicitly loaded as arbitrary data.
• We've adjusted default per-thread stack sizes in the platform to be more generous on all platforms. This allows the browser to render more deeply nested visual elements in web pages and the new limit matches the capabilities of mainstream browsers as a result. Please note that some custom builds may need to adjust their linker's stack sizes on some operating systems to come to a stable and usable build with this change since the new Goanna rendering depth requires this larger stack size to not run out of memory. The default per-thread stack size is now 2 MB with the exception of 32-bit Windows builds where 1.5 MB is used to go easy on its limited address space. Custom Linux builds with system-default small stack sizes should adjust their build configuration accordingly.

Pale Moon includes both 32- and 64-bit versions for Windows:  Pale Moon for Windows downloads.

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...