Pale Moon Version 32.2.0 Released with Security Updates

[Corrine]

Pale Moon has been updated to version 32.2.0. This is a major development and security update.

Changes/Fixes:

• Implemented dynamic module imports. See implementation notes.
• Implemented exporting of async functions in modules.
• Implemented JavaScript class fields. See implementation notes.
• Implemented logical assignment operators ||=, &&= and ??=.
• Implemented a solution for websites using the officially deprecated ambiguous window.event. This is disabled by default but can be enabled through about:config's dom.window.event.enabled preference. See implementation notes.
• Implemented self.structuredClone() (this may be very obscure to anyone except web developers. Apologies ;-) )
• Implemented Element.replaceChildren. Once again primarily a web developer note.
• Improved Shadow DOM :host matching.
• Implemented WebComponents' CSS ::slotted() and related functionality.
• Improved page caching in our memory allocator.
• Added support for FFmpeg 6.0, especially important for bleeding-edge Linux distros.
• Fixed a potential drawing deadlock for images, specifically SVG. This solves a number of hang-on-shutdown scenarios.
• Fixed various crashes related to WebComponents and our recent JavaScript work.
• Fixed various build-from-source issues on secondary target platforms.
• Fixed various small browser front-end scripting issues that could lead to errors or broken functionality.
• Fixed handling of async (arrow) functions declared inside constructors.
• Fixed various small JavaScript conformance issues.
• Fixed an issue where JavaScript (only in modules) would not properly create async wrappers.
• Updated the DOM Performance API to the current spec (User Timing L3). See implementation notes, especially if you intend to use this in web content for critical functionality.
• Updated keypress event handling to send keypress events on Ctrl+Enter.
• Updated internal JavaScript structures to make future porting easier, as well as improve JavaScript performance.
• Updated window handling and styling on Mac.
• Updated the Freetype lib to 2.13.0.
• Updated the Harfbuzz lib to 7.1.0.
• Updated our DNS lookup calls to use inet_ntoa() instead of the deprecated inet_ntop().
• Updated the Fetch API to use the global's base URL instead of the entry document's base URL for spec compliance.
• We no longer support the outmoded fontconfig on GTK systems.
• We no longer parse or return the body of known-empty responses from servers (content-length of 0, or in case of HEAD or CONNECT methods).
• Implemented scaled font caching on GTK, improving performance.
• Fixed a build issue when building for Linux on ARM64 on later distros.
• Split out more parts of the browser into separate .dll files on Windows to reduce compiler strain and an oversized xul.dll
• Removed mozilla::AlignedStorage (code cleanup).
• Builds for FreeBSD now use xz for packaging instead of bzip2. By request, we now also offer GTK2 builds for FreeBSD.
• Merged the preference dom.getRootNode.enabled into the dom.webcomponents.enabled pref. See implementation notes.
• Fixed a potential DoS issue with JPEG decoding.
• Fixed a potential issue in Windows widget code that could lead to crashes.
• Disabled potentially hazardous external protocols on Windows.
• Added known-problematic .dlls to the internal blocklist.
• Security issues addressed: CVE-2023-32209, CVE-2023-32214 and several others that do not have a CVE designation.
• UXP Mozilla security patch summary: 4 fixed, 1 rejected, 27 not applicable.

Notes:

See the referenced Release Notes for a long list of Implementation Notes.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads. To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window. Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle