Pale Moon (32-bit) 歷史版本列表
更新時間：2020-01-13
更新細節：
What's new in this version:
Changes/fixes:
- Fixed a sampling issue in libsoundtouch (DiD)
- Fixed an issue with a new upcoming Windows 10 feature not honoring Private Browsing mode by default (DiD)
- Fixed several stability and memory safety hazards. (DiD)
- Fixed an issue where files could inadvertently be executed with the designated file type handler instead of opened
- Fixed an issue with the JavaScript JIT compiler that could lead to exploitable crashes. (CVE-2019-17026) actively exploited
- Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 7 DiD, 12 not applicable
更新時間：2019-12-17
更新細節：
更新時間：2019-12-10
更新細節：
What's new in this version:
New features:
- Added support for modern Solaris operating systems like Illumos
- Implemented position:sticky for table parts - You can now use CSS to e.g. stick table headers so they don't scroll off the screen
- Enabled basic implementation of module type scripting. While not fully spec compliant (yet), this will fix the few web compatibility issues with sites that rely on this feature without fallback (e.g. the Chromium bugtracker)
- Implemented Promise.prototype.finally()
- Implemented Regular Expression lookbehind
- Implemented Regular Expression /s flag (dotAll support)
- Implemented String.prototype.matchAll (regex)
- Added Ekoru to the list of default search engines. This is a Bing-backed search engine that donates the majority of its revenue to various charities that support the planet and animals. An environment-supporting alternative to Ecosia if you don't want to support Google in the process
Changes/fixes:
- Changed the way tables are rendered to fix a number of spec compliance issues and allow relative positioning of table parts
- Now building against the Windows 10 SDK 10.0.17763.132 for increased compatibility with Windows 10 and improved Spectre mitigation
- Removed the unused DiskSpaceWatcher component
- Updated cairo code
- Updated SQLite to 3.30.1
- Updated the Brotli library to 1.0.7
- Updated the woff2 library to 1.0.2
- Updated the OpenType Sanitizer to 8.0.0
- Updated the Javascript math library for precision and performance fixes
- Updated the embedded Emoji font to Mozilla's COLR-mapped twemoji 0.5.0 (Twemoji 12.1.3), to support Emoji 12
- Improved CSS grid rendering
- Changed packaging for archives to use 7z/xz instead of zip/bz2
- Made the second argument of (DOM/CSS) insertRule() optional for (Chrome) web compatibility
- Removed the non-standard object.prototype.watch()/unwatch() functions. Please note that this may affect some extensions; those will need to be updated to no longer use these non-standard functions
- Fixed the status bar module to work around an issue with relying on watch()/unwatch()
- Fixed a build failure in the libcubeb sndio module
- Fixed a small oversight in the release branch that would potentially still mark jnlp files as executable
- Fixed the certificate retrieval logic in the certificate exception dialog
- Fixed an issue with add-ons potentially getting confused during add-on updates due to cached scripts
- Fixed a crash due to unnecessary reparenting calls in layout
- Reinstated the mentioning of the number of accelerated/total windows in Troubleshooting Information, for completeness
- Moved the embedded font for Emoji from application to platform so all UXP applications can easily benefit from it
- Cleaned up the jemalloc code: Removed dead/unused code, removed conditionals around "always on" code, and made the allocator VLA-free
- Fixed an oversight in the release branch still marking "jnlp" (Java Web Start) as executable
Security-related fixes:
- Removed the silent fallback to insecure install locations on Windows
- Pale Moon will no longer by default install into unprotected program locations (this was a regression in v28)
- If your operating system account does not have the necessary privileges, you need to manually select an accessible folder to install into. This is important to prevent malware from modifying installed programs in well-known but otherwise unprotected installation locations
- Added a preference for, and disabled, the confirmation prompt for URL authentication (prevents evil traps)
- Disabled the use of HPKP by default due to the inherent risks involved with this feature. A preference was added to completely disable header processing, and using preloaded pins is effectively disabled. Please note that this is automatically disabled by default for everyone, regardless of your previous setting for this feature, and it is strongly recommended you keep this feature disabled. HPKP will eventually be removed (overall Internet concensus)
- Fixed a potential issue when interacting with plugins
- Fixed a potential crash scenario when reading PAC configuration
- Fixed a potential issue with text selection painting
- Fixed an issue with element references not being properly updated
- Fixed an issue with incorrect saving of web pages as text
- Fixed a potential issue with clipboard handling
- Fixed a potential issue with attaching the debugger to web workers
- Updated NSS to 3.41.4 to address CVE-2019-11756 and CVE-2019-11745
- Unified XUL Platform Mozilla Security Patch Summary: 2 fixed, 8 DiD, 16 not applicable
更新時間：2019-10-30
更新細節：
What's new in this version:
Changes and fixes:
- Disabled the use of ICC color profiles for images on Linux by default
- Updated timezone data for internationalization functions
- Fixed the option to use hardware acceleration over RDP for Windows 8.1 and 10
- Fixed an issue with inner window navigation potentially leaking
- Fixed a startup crash caused by Qihoo 360 Safeguard/360 Total Security
- Ported some expat parser fixes from upstream
- Ported several NSS upstream fixes to our build
- Aligned handling of U+0000 in the html5 parser with expectations
- Added size checks to WebGL data buffering
- Fixed build issues with newer glibc versions
- Fixed build issues for ARM targets
- Worked around a gcc9 compiler issue that would prevent building with it
- Sec bug fixes: CVE-2019-15903, CVE-2019-11757, CVE-2019-11763 and several potentially exploitable crashes and memory safety hazards that don't have a CVE number
- Unified XUL Platform Mozilla Security Patch Summary: 6 fixed, 6 DiD, 1 rejected, 24 not applicable
更新時間：2019-10-23
更新細節：
What's new in this version:
- WebVR is now working with Android 10
- Dragging folders onto the Pano2VR app/Droplets is now fixed for macOS Catalina
- Skin Videos are handled correctly in WebVR
- Skin: Negative number for any of the Element Angle skin actions
- In the Tour Map, the radar beam line now goes through the entire beam rather than just through the front for easier alignment
- A Point Hotspot can now be locked regardless if it has location data or not
- Toggle the locked state of any element in the Viewer by holding Shift and clicking the element
更新時間：2019-10-01
更新細節：
What's new in this version:
New:
- WebVR with native stereo support
- Custom hotspot images
- Panotour pro import
- Integrated web server now includes a secure option (HTTPS)
- Distance placeholders in hotspots
- Raw CSS: You can mix units for position and size of skin elements
- Significant improvements to the Google Street View upload
Changes:
- Fixed an issue where the SVG buttons
- Pinned video will now play as expected on MS Edge
- Request access added for the gyroscope in iOS 13
更新時間：2019-09-13
更新細節：
What's new in this version:
Changes/fixes:
- Fixed an issue where saving a webpage to disk would sometimes drop tags from the document
- Fixed an issue with click-to-play plugin content throwing up a blank notification
- Fixed an issue in the renderer where region intersections would sometimes return the wrong result
- This fixes a regression caused by the fix for CVE-2016-5252.
- Fixed security issues: CVE-2019-11744, CVE-2019-11752, CVE-2019-11737, CVE-2019-11746, CVE-2019-11750, CVE-2019-11747 and CVE-2019-11738.
- Unified XUL Platform Mozilla Security Patch Summary: 7 fixed, 1 DiD, 1 already covered, 22 not applicable
更新時間：2019-08-29
更新細節：
What's new in this version:
Changes and fixes:
- Landed a large JavaScript parser tune-up, which as a targeted goal brings our ES6 stringification fully in line with the ES2018 revision for classes, and implements rest/spread parameters for object literals
- Fixed a crash with the tuned-up parser code when certain error messages were triggered
- Aligned browser behavior with mainstream regarding inner window behavior when domain is manipulated
- Improved performance dealing with frame properties
- Improved performance for handling html5 strings
- Improved performance of image content loading
- Fixed potential type confusion in array joins
- Fixed an issue on some pages causing high CPU usage when wrongly specifying plugin content
- Fixed an issue with the add-ons manager "discover" pane if no network connection is present
- Fixed an issue with bookmark/history search results offering context menu options that would be invalid without a selection
- Fixed the devtools JSON viewer and enabled it by default
- Fixed searching from about:home not working for search plugins using the POST method
- Fixed an issue with the checkboxes for location bar preferences
- Fixed SVG alignment issues if SVG-containing elements fall on odd pixel sizes, causing blurry display of especially small SVGs like icons/glyphs
- SVGs will now always be pixel-snapped to provide expected crisp display
- Fixed precompilation of Sync client modules when packaging. This also removes the redundant services.sync.enabled pref
- Added support for matroska containers and h264-based webm video formats
- Added support for AAC audio in matroska and webm video formats
- Added support for spaces in the Mac package and application name
- Added an exception to the unique file origin policy for font types
- Added native file picker support for xdg on Linux
- Updated the default bookmark icons
- Updated the SQLite lib to 3.29.0
- Removed e10s information from about:troubleshooting
- Removed hotfix leftovers
- Removed the WebIDE developer tool
- Removed conditional build-time disabling of the Pale Moon status bar code
- Removed "Delete this page" and "Forget about this site" links from live bookmarks (since they make no sense on feeds)
- Removed the Financial Times' polyfill user-agent override since they updated their detection to work with Pale Moon
更新時間：2019-07-25
更新細節：
What's new in this version:
Changes and fixes:
- Improved handling of FTP resource loading (allow save-as and cater to some FTP-based browsing)
- Added a preference (security.block_ftp_subresources) to allow users to completely bypass the blocking of FTP subresources if required for their environment, if the improvements made in this release do not suffice
- Added blocking of authentication-locked cross-origin image subresources by default to prevent spurious auth prompts
- A preference (network.auth.subresource-http-img-XO-auth) was added to allow users to bypass this blocking if required for their environment
- Changed the behavior of file: URIs to treat each URI as a unique origin. This prevents cross-file access from scripting.
A preference (security.fileuri.unique_origin) was added to allow users to relax this restriction if required for their environment
- Implemented a revised version of http2PushedStream to address some thread safety issues
- Aligned browser behavior with mainstream regarding inner window behavior when domain is manipulated
- Backed out a 28.5.* patch for causing multiple issues in the UI and web content
- Updated NSS to 3.41.2 (custom) to pick up several upstream fixes
- Fixed a type confusion issue in JavaScript Arrays
- Added a fix for cross-thread access of Necko
- Added a port safety check for Alternative Services
更新時間：2019-07-25
更新細節：
What's new in this version:
- Fix for Google Streetview places search