Package: release.debian.org Control: affects -1 + src:mozjs128 X-Debbugs-Cc: mozjs128@packages.debian.org User: release.debian.org@packages.debian.org Usertags: unblock Please unblock package mozjs128 or consider it as a stable update for Debian 13.1 [ Reason ] New bugfix release [ Impact ] mozjs128 is the SpiderMonkey JavaScript engine from Firefox ESR 128. There were no changes in 128.12, but 3 security fixes in 128.13: https://www.mozilla.org/en-US/security/advisories/mfsa2025-58/ https://github.com/mozilla-firefox/firefox/commits/esr128/js mozjs128 is only used by gjs (for GNOME Shell and several GNOME apps) and cjs (for Cinnamon). Practically, I am not aware of any Firefox CVEs ever being used to attack the desktop via gjs or cjs. Notably, debian-security-support says about mozjs128 "Not covered by security support, only suitable for trusted content". Therefore, updates for mozjs* are handled via regular updates. https://salsa.debian.org/debian/debian-security-support/-/blob/master/security-support.deb13#L30 [ Tests ] mozjs128 has a trivial autopkgtest which is passing I also completed manual testing of all gjs apps as described at https://wiki.ubuntu.com/DesktopTeam/TestPlans/gjs [ Risks ] mozjs128 is a key package for both GNOME and Cinnamon. Mozilla does a good job of doing monthly releases with minimal, mostly security related fixes for the ESR series. One time a few years ago, a mozjs update broke the gnome-weather app which was fixed with a simple rebuild of the app. [ Checklist ] [✔️] all changes are documented in the d/changelog [✔️] I reviewed all changes and I approve them [✔️] attach debdiff against the package in testing [ Other info ] There is only one more scheduled 128.x release before the 128 series reaches End of Life. https://whattrainisitnow.com/calendar/ unblock mozjs128/128.13.0-1 Thank you, Jeremy Bícha
Attachment:
mozjs128_128.13.0-1.debdiff
Description: Binary data