Mozilla-Firefox security update draws in Mozilla-Thunderbird as a dependancy

English Applications
1

Yesterday I updated and got a Mozilla Firefox security update. It is now at 140.1.0esr.

To my amazement it reported that Mozilla-Thunderbird and Mozilla-Thunderbird-translations-common would also be installed as dependencies. Is this a packaging error?

2

@hcvv:

Same here – I use the latest version from the Mozilla OBS Project – at every Update I have to remove (–clean-deps) the “MozillaThunderbird” package –

MozillaThunderbird-translations-common
kmozillahelper
libotr5
MozillaThunderbird

I haven’t bothered to raise a Change Request because, I suspect that the cause is an up-stream push by Mozilla to increase the Thunderbird usage … :upside_down_face:

I use the KDE Plasma Kontact PIM which, unfortunately for Mozilla, is meaning that my mileage is different from that of other human beings on this planet …

3

Which means that you think they are willingly pressing me to install something I did not need now for ~20 years and still not need? That is called “bloat” isn’t it?

4

No, not really –

  • “Bloat” as such is what dairy cows sometimes suffer if they eat too much clover and not enough fibre rich grass …

I tend to view Mozilla’s behaviour as being simply a little bit “pushy” and, not really at all polite …

5

I just ran into this.

I skipped the update, and instead I tabooed Thunderbird, so that it would not be installed.

I then tried again. This time, zypper presented a conflict resolution interaction. It listed 26 possible solutions. And 23 of those possible solutions were to remove the lock so that Thunderbird could be installed.

The main alternative seemed to be the first possible solution, which was to remove “kmozilla-helper”. So I went with that. Everything updated, and Thunderbird was not installed.

It looks as if this was really all about “kmozilla-helper”.

1 Like
6

Yes, the action that made kmozillahelper superfluous created a lot of havoc.

When you read the reactions on the bug reports (those about the file-picker and those about the dependency) they are still working on a solution that will make things run smoothely. But I guess that removing kmozillahelper oneself will cure a lot of problems. But I am not sure that the setting done to redress the file-picker is then not needed.

We will see.

1 Like
7

This seemed so familiar. :thinking: There we go:

Sorry, only the German forum.

1 Like
8

I added it to my bug report because I had the same problem with an ESR-FX.
https://bugzilla.suse.com/show_bug.cgi?id=1233272#c7

1 Like
9

On this Leap 15.6 machine with Mozilla Firefox installed from the Mozilla OBS Project, the package “kmozillahelper” isn’t installed.

  • Whenever Mozilla Firefox is updated, the update also installs Mozilla Thunderbird …
1 Like
10

Interesting.

I’ve manage to avoid Thunderbird. But perhaps that’s because I have turned of recommends by setting:

solver.onlyRequires = true

in “/etc/zypp/zypp.conf”.

11

@nrickert:

And, in my case –

##
## Whether only required packages are installed.
##
## Recommended packages, will not be regarded.
##
## Valid values: boolean
## Default value: false
##
# solver.onlyRequires = false

BTW, I’ve now checked this system with –

 # LANG=C zypper install-new-recommends --details --dry-run
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following 7 NEW packages are going to be installed:
 . 
 . 
 . 
  kmozillahelper                             
    5.0.6-bp156.2.3.1     x86_64  Update repository of openSUSE Backports                     
    openSUSE
 . 
 . 
7 new packages to install.

Package download size:   329.1 KiB

Package install size change:
              |     719.5 KiB  required by packages that will be installed
   719.5 KiB  |  -      0 B    released by packages that will be removed

Backend:  classic_rpmtrans --dry-run
Continue? [y/n/v/...? shows all options] (y): 

Checking for file conflicts: (1 skipped) .........................................................................[done]
Warning: 7 packages had to be excluded from file conflicts check because they are not yet downloaded.

    Note: Checking for file conflicts requires not installed packages to be downloaded in advance in
    order to access their file lists. See option '--download-in-advance / --dry-run --download-only'
    in the zypper manual page for details.

 #

IOW, if, I were to pull in all 7 missing recommended packages, “kmozillahelper” would also be installed …

  • Oh, very well then – just for fun … :smiling_imp:
12

Just did my weekly update. There was kmozillahelper in the updates. After updating I was able to remove mozilla-thunderbird without hassle.

1 Like
13

Possible solution:

Install xdg-desktop-portal.
Then uninstall & lock (taboo) kmozillahelper.

Beware: 1226112 – Supersede kmozillahelper by xdg-desktop-portal integration

xdg-desktop-portal requires an implementation to also be installed for it to work.

Here’s the list (packages):

xdg-desktop-portal-cosmic
xdg-desktop-portal-gnome
xdg-desktop-portal-gtk
xdg-desktop-portal-hyprland
xdg-desktop-portal-kde6
xdg-desktop-portal-lxqt
xdg-desktop-portal-pantheon
xdg-desktop-portal-wlr

xdg-desktop-portal-kde for KDE 5 (Leap 15.6).

1 Like
14

This morning there was an update for the MozillaFirefox package in the Mozilla OBS Project to version 141.0.2-lp156.1.1.

  1. I installed the kmozillahelper package 2 days ago with “zypper install-new-recommends”.
  2. This morning Firefox update didn’t pull in the Mozilla Thunderbird package.

Maybe, someone quietly changed something … :upside_down_face:

15

https://bugzilla.opensuse.org/show_bug.cgi?id=1247369#c7

After some discussion with Martin we agreed that just removing the dependency from kmozillahelper is the best and easiest option for now. I submitted the change to 15.6 and SP7.

16

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.