3 ms·

Can anyone confirm if 73.0b3 includes the same fix? Their "what's new" link in the beta's About window doesn't track with the beta release cycle. There's no re

Can anyone confirm if 73.0b3 includes the same fix? Their "what's new" link in the beta's About window doesn't track with the beta release cycle. There's no revision listed, so I think the notes are for 73.0b1 still? At any rate, there's no mention of any security fixes. https://www.mozilla.org/en-US/firefox/73.0beta/releasenotes/ https://www.mozilla.org/en-US/firefox/73.0beta/releasenotes/

bhauer 7y ago
I sure hope so since 73.0b3 is the most recent available version of Developer Edition. It's odd to not have any messaging about the non-mainstream editions.
- wlesieutre 7y ago
  The 73.0b3 release tag is 18 hours ago, compared to that "What's new" page dated 1/7, so it does appear to be newer. See my reply to myself above; as far as I can tell the beta has the same changes (though I didn't manage to fumble my way to the specific commit that fixed it, or whatever the analogous term is for mercurial). Their developer edition "What's new" page seems more about marketing upcoming changes before they land in the mainline release than anything else. I'd like to assume they're always on top of getting the same fixes into developer versions at the same time, but since they don't actually tell us anywhere I always feel like I have to check.
wlesieutre 7y ago
I don't know my way around Firefox's source control at all, but I tried to do some digging. My first thought was to look through the changelogs on recent release tags, but there's no mention of the CVE that I can find in any of them. I did find these changes in 72 which look related to the bug: https://hg.mozilla.org/releases/mozilla-release/rev/8260da04c9b13f7c0e9cc6984a75e689b5fcb8c8 https://hg.mozilla.org/releases/mozilla-release/rev/8260da04... And poking at one of those referenced files in the beta channel looks like it has the same changes: https://hg.mozilla.org/releases/mozilla-beta/file/tip/js/src/jit/MIR.h https://hg.mozilla.org/releases/mozilla-beta/file/tip/js/src... So I think we're good on beta channel?
- dblohm7 7y ago
  Even security fixes run the Nightly -> Beta -> Release gauntlet, so yes, Beta is fixed.
sandyarmstrong 7y ago
I asked on Twitter if 73.0b2 had the fix and was told that it did, so we should be good!
- wlesieutre 7y ago
  Thanks! I don't really do twitter, but maybe I should! Pretty quick turnaround there.
rebelwebmaster 7y ago
Looks like they've been updated now to mention that the fix was included in beta 2. I guess they're reading this thread :)

bhauer 7y ago

I sure hope so since 73.0b3 is the most recent available version of Developer Edition. It's odd to not have any messaging about the non-mainstream editions.

wlesieutre 7y ago
The 73.0b3 release tag is 18 hours ago, compared to that "What's new" page dated 1/7, so it does appear to be newer. See my reply to myself above; as far as I can tell the beta has the same changes (though I didn't manage to fumble my way to the specific commit that fixed it, or whatever the analogous term is for mercurial). Their developer edition "What's new" page seems more about marketing upcoming changes before they land in the mainline release than anything else. I'd like to assume they're always on top of getting the same fixes into developer versions at the same time, but since they don't actually tell us anywhere I always feel like I have to check.

wlesieutre 7y ago

I don't know my way around Firefox's source control at all, but I tried to do some digging. My first thought was to look through the changelogs on recent release tags, but there's no mention of the CVE that I can find in any of them. I did find these changes in 72 which look related to the bug: https://hg.mozilla.org/releases/mozilla-release/rev/8260da04c9b13f7c0e9cc6984a75e689b5fcb8c8 https://hg.mozilla.org/releases/mozilla-release/rev/8260da04... And poking at one of those referenced files in the beta channel looks like it has the same changes: https://hg.mozilla.org/releases/mozilla-beta/file/tip/js/src/jit/MIR.h https://hg.mozilla.org/releases/mozilla-beta/file/tip/js/src... So I think we're good on beta channel?

dblohm7 7y ago
Even security fixes run the Nightly -> Beta -> Release gauntlet, so yes, Beta is fixed.

sandyarmstrong 7y ago

I asked on Twitter if 73.0b2 had the fix and was told that it did, so we should be good!

wlesieutre 7y ago
Thanks! I don't really do twitter, but maybe I should! Pretty quick turnaround there.

rebelwebmaster 7y ago

Looks like they've been updated now to mention that the fix was included in beta 2. I guess they're reading this thread :)