changelog v135, v136, v137, v138

[Thorin-Oakenpants]

🟩 v138

FF138 release notes
FF138 for developers
FF138 security advisories

There was nothing to add from 138

🟩 v137

FF137 release notes
FF137 for developers
FF137 security advisories

see #1957 - one deprecated inactive pref, will land in next PR

🟩 v136

FF136 release notes
FF136 for developers
FF136 security advisories

see #1950 - one new RFP pref added as inactive, will land in next PR

---

🟩 v135

FF134 release notes | for developers | security advisories
FF135 release notes | for developers | security advisories

---

CHANGELOG

• all changes
• ToDo diffs: FF133-FF134 | FF134-FF135
• v135 PR is at v135 #1929

---

There was nothing to add from 134 or 135

These changes all stem from 1888466 in 136 and sanitizing choices

• the migration in FF128 merged items to simply things
• feedback from users was they wanted "history" separate from "forms"
• so for all three dialogs (clearHistory, clearOnShutdown_v2, clearSiteData) we have another migration
• for each the *historyFormDataAndDownloads pref migrates to the relevant prefs below
• whilst I was at it, I cleaned up all the legacy sanitizing prefs as it was section 2800 was getting messy and confusing

⭐ 136 is here (don't ever wait for arkenfox before updating Firefox!) so my bad, sue me, I should have had this out before FF136 stable was released. Suggest y'all check/update your sanitizing overrides: make sure to open each dialog to ensure migration

• new in user.js v135
  • these prefs are added in FF136
  • not entirely sure about the v2.downloads pref, it doesn't seem to be controlled by the UI

user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true);
user_pref("privacy.clearHistory.formdata", true);
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true);
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true);
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true);
user_pref("privacy.clearSiteData.formdata", true);

• removed inactive in user.js v135
  • legacy sanitizing prefs that we've always had inactive and at defaults
    • legacy because in FF128 you should have migrated to the new prefs
    • cpd to clearHistory migration may have required you to open the clear history dialog: see comments in 9bba578

   // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false]
   // user_pref("privacy.cpd.downloads", true); // not used: controlled by another pref
   // user_pref("privacy.cpd.openWindows", false);
   // user_pref("privacy.cpd.passwords", false);
   // user_pref("privacy.cpd.siteSettings", false);

• made inactive in user.js v135 (and moved to 6050 for prefsCleaner)
  • legacy sanitizing prefs: see above

   // user_pref("privacy.clearOnShutdown.cache", "");
   // user_pref("privacy.clearOnShutdown.cookies", "");
   // user_pref("privacy.clearOnShutdown.downloads", "");
   // user_pref("privacy.clearOnShutdown.formdata", "");
   // user_pref("privacy.clearOnShutdown.history", "");
   // user_pref("privacy.clearOnShutdown.offlineApps", "");
   // user_pref("privacy.clearOnShutdown.sessions", "");
   // user_pref("privacy.cpd.cache", "");
   // user_pref("privacy.cpd.cookies", "");
   // user_pref("privacy.cpd.formdata", "");
   // user_pref("privacy.cpd.history", "");
   // user_pref("privacy.cpd.offlineApps", "");
   // user_pref("privacy.cpd.sessions", "");

---

NOTE: the STATs section excludes the new 8500 TELEMETRY section

• that section has 14 prefs moved into it
• these prefs have bearing on web sites and the numbers are quite meaningless

 STATS v135: up to and including section 4500, minus the parrots
 =========
    total: 168
 inactive:  46
      n/a    3 (v2 migration sanitizing prefs)
           ---
   active: 119
  default:  19 (at least)
      n/a:   2 (of the three prefs in 0202, only one will apply)
           ---
  flipped:  98 (at most)

ALL HAIL PANTS

[Tiagoquix]

/* 0335: disable Firefox Home (Activity Stream) telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);

Why weren't these telemetry-related prefs also moved with the others to section 8500?

Also, regarding the new sanitize prefs, I assume you just updated it to the same values as before for the new prefs?
If so, is it safe to migrate while in version 135.0.1 or should I wait version 136? (My Linux distro hasn't updated to it yet.)

[Thorin-Oakenpants]

You can't migrate until 136 because the code wasn't added until then - see comments in 9bba578

but you can add all your pref overrides and get rid of the legacy crap before then

So likely steps

• 135 you update your overrides and user.js to v136
  • the new prefs have no relevance
• you update to 136
  • the new prefs still have no relevance until the migration (FF code) takes place
  • the migration for at least some dialogs requires you to open them
  • the new prefs may not match your overrides because it's a migration and I can't check everything
• open/close Firefox and everything should now be in sync

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

[Thorin-Oakenpants]

I assume you just updated it to the same values as before for the new prefs

Yes. On shutdown, AF has always sanitized everything except site settings and passwords. For manual sanitizing AF (at least since site exceptions were added in I think FF102 ) also excludes cookies and site data since that doesn't respect the site exception (and we wouldn't want users to go ctrl-shift-del and hit enter and lose all their logins)

[Thorin-Oakenpants]

Why weren't these telemetry-related prefs also moved with the others to section 8500?

those 2 telemetry prefs not in 8500 .. IDK if i missed them (unlikely) or because it doesn't matter as we disable AS

Ahh, I know. Because the 8500 section header is explaining that FF telemetry is not a privacy or security concern. Activity stream I can't really say that because it's entangled with pocket etc

[icpantsparti2]

[Thorin-Oakenpants]

Also, all you mac and linux RFP users ... all hail me for getting this over the line after 3 years or so ... and also give a wave (no hailing) to @PieroV for the patch

user.js/user.js

Lines 732 to 734 in 3d76c74

	1333651 - spoof User Agent & Navigator API
	JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux
	HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof

edit: i know this is v135 but FF136 has been released .. so start hailing

[x9cf9w73cv7y]

You should put a warning in the update. The update deleted my browser history and my open tabs, although I switched off the deletion via override. Thanks for nothing.

[Thorin-Oakenpants]

how am I supposed to put in any warning - I already added the info in the release notes?

For the record - the migration code from Firefox should preserve what you set and/or override in the v2 settings (AFAICT). Even if it didn't and it read that the new pref is already set (and you said your overwrote it with your value) - it won't take affect until you close (for sanitize on close) or do it manually (when you clear site data, or clear history)

I said you need to 1) add overrides to suit and 2 open the dialogs to make sure the migration happens and to check your values

There is nothing more I could do (except have gotten this out before v136 and even that may not have helped some people) - the defaults in AF are to sanitize

Not blaming you - but do you have a backup and if not why not? Session restore (open tabs) is not a backup and shouldn't be treated as one.

[Tiagoquix]

but you can add all your pref overrides and get rid of the legacy crap before then

I'm not sure, as this is not clear to me. I guess it's safer for me to keep the legacy crap and only update the user.js only after updating to Firefox 136 then?

I see that you removed the legacy prefs in user.js v135. Do the new prefs already exist in 135 to make it safer for them to be removed before installing version 136?

BTW, WDYM by "It pays to open each dialog to ensure the migration happens."? Which dialogs?

[Thorin-Oakenpants]

You should put a warning in the update. The update deleted my browser history and my open tabs, although I switched off the deletion via override. Thanks for nothing.

This doesn't make sense to me. The migration updates using your v2 pref from FF128. Meanwhile the user js sets the v3 prefs for FF136+ as per your override. If the migration says, oh this is user modified lets not touch it (IDK if it does this), then the value would be as per your override. So arkenfox's default is not used, it literally can't be used, you overrode it.

So blame the migration code or maybe your override is not correct. I did say to open the dialog and check

edit: knew it

• see https://old.reddit.com/r/firefox/comments/1j5rsua/headsup_to_check_your_history_settings_after_the/
• i sanitize everything on my beta and nightly and the migration there didn't match over the last few cycles: it unchecked shit
• that's really bad if can't respect existing choices and wipes history and/or site data

[theltalpha]

So blame the migration code or maybe your override is not correct. I did say to open the dialog and check

Hi, could you please clarify which dialogs you are referring here to?

[Thorin-Oakenpants]

user.js/user.js

Line 626 in 3d76c74

* [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/

user.js/user.js

Line 655 in 3d76c74

* [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/

user.js/user.js

Line 667 in 3d76c74

* [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/

[shadow-absorber]

user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.spoof_english", 2);


/* override recipe: enable session restore ***/
user_pref("browser.startup.page", 3); // 0102
  // user_pref("browser.privatebrowsing.autostart", false); // 0110 required if you had it set as true
  // user_pref("browser.sessionstore.privacy_level", 0); // 1003 optional to restore cookies/formdata
user_pref("privacy.clearOnShutdown.history", false); // 2811 FF127 or lower
user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", false); // 2811 FF128+

// 2820 optional to match when you use settings>Cookies and Site Data>Clear Data
  // user_pref("privacy.clearSiteData.historyFormDataAndDownloads", false); // FF128+

// 2830 optional to match when you use Ctrl-Shift-Del (settings>History>Custom Settings>Clear History)
  // user_pref("privacy.cpd.history", false); // FF127 or lower
  // user_pref("privacy.clearHistory.historyFormDataAndDownloads", false); // FF128+

this is shadows useroveride and an image of the parrot message.... can't figure out what to change to keep the browsing history between each restart... kinda miffed it nuked shadows tab list that they had setup... but not a super big deal just want a working way to keep the tabs open with history between reboots

[shadow-absorber]

and figured it out:

// heavy resist fingerprinting
user_pref("privacy.resistFingerprinting", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("privacy.spoof_english", 2);

// keep tabs and history between reboots 
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", false);
user_pref("privacy.clearHistory.formdata", true);
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", false);
user_pref("privacy.clearOnShutdown_v2.downloads", true);
user_pref("privacy.clearOnShutdown_v2.formdata", true);
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", false);
user_pref("privacy.clearSiteData.formdata", true);

and it works again