Update cycle term of Firefox

English Applications
1

Hi
One Q

How many times a month does Firefox update for tumbleweed?
When will they update to Firefox 87?

2

Hi
If you check openSUSE Factory requests and search for Firefox, I see it was submitted 4 days ago…

3

Thank you for your comment.
I’m new to tumbleweed so I still don’t understand.

Firefox is still ver.86 in the tumbleweed repository.
Mozilla raised ver. To 87 on March 23rd.
I run sudo zypper dup every day and it’s a waste of work.
Is Firefox’s update in Tumbleweed so laid-back?

4

Hi
No, until it’s accepted, then it’s staged for a release in the hopefully next snapshot, packages in openSUSE Factory are held until openQA testing is finished then released…

You will see a forum notification as to when the next snapshot is released, follow that link to see what is changing, or follow the Factory Mailing list.

5

I will take a look at it for a while.

Thank you again.:wink:

6

If you want Firefox/Thunderbird updates sooner than they would otherwise appear in TW you could add the ‘mozilla’ repository:

https://download.opensuse.org/repositories/mozilla/openSUSE_Tumbleweed/

7

Thanks for the additional information.
I see, that’s what it is.
Using tumbleweed means that I have to do it myself as an early response to the vulnerability.

8

Hi
No, if it’s deemed serious enough then it will get released via the update repository without waiting for a snapshot.

9

That’s good news.
However, I’m worried that this recently discovered OpenSSL vulnerability hasn’t been updated yet.
https://www.openssl.org/news/secadv/20210325.txt

It was announced on March 25th.
The OpennSSL patch didn’t come, and the replacement version didn’t come either.
Is this deemed serious enough?

10

Hi
As you can see the openSUSE security folks see it before it’s public…

https://bugzilla.opensuse.org/show_bug.cgi?id=CVE-2021-3450

The fix was submitted 4 days ago to openSUSE Factory;

I suspect it will be out in the next snapshot.

11

Thank you for the detailed information.
If the openSUSE security folks know it before it’s public.
I want to get update at the same time as the public.:slight_smile:

12

Hi
If deemed important enough, they have the ability to push to the update channel, since that has not occurred you should be fine :wink: