Bug#1109951: unblock: mozjs128/128.13.0-1

[Jeremy Bicha]

Package: release.debian.org
Control: affects -1 + src:mozjs128
X-Debbugs-Cc: mozjs128 at packages.debian.org
User: release.debian.org at packages.debian.org
Usertags: unblock

Please unblock package mozjs128
or consider it as a stable update for Debian 13.1

[ Reason ]
New bugfix release

[ Impact ]
mozjs128 is the SpiderMonkey JavaScript engine from Firefox ESR 128.

There were no changes in 128.12, but 3 security fixes in 128.13:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-58/
https://github.com/mozilla-firefox/firefox/commits/esr128/js

mozjs128 is only used by gjs (for GNOME Shell and several GNOME apps)
and cjs (for Cinnamon). Practically, I am not aware of any Firefox
CVEs ever being used to attack the desktop via gjs or cjs. Notably,
debian-security-support says about mozjs128 "Not covered by security
support, only suitable for trusted content". Therefore, updates for
mozjs* are handled via regular updates.

https://salsa.debian.org/debian/debian-security-support/-/blob/master/security-support.deb13#L30

[ Tests ]
mozjs128 has a trivial autopkgtest which is passing

I also completed manual testing of all gjs apps as described at
https://wiki.ubuntu.com/DesktopTeam/TestPlans/gjs

[ Risks ]
mozjs128 is a key package for both GNOME and Cinnamon. Mozilla does a
good job of doing monthly releases with minimal, mostly security
related fixes for the ESR series.

One time a few years ago, a mozjs update broke the gnome-weather app
which was fixed with a simple rebuild of the app.

[ Checklist ]
  [✔️] all changes are documented in the d/changelog
  [✔️] I reviewed all changes and I approve them
  [✔️] attach debdiff against the package in testing

[ Other info ]
There is only one more scheduled 128.x release before the 128 series
reaches End of Life.

https://whattrainisitnow.com/calendar/

unblock mozjs128/128.13.0-1

Thank you,
Jeremy Bícha
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mozjs128_128.13.0-1.debdiff
Type: application/octet-stream
Size: 8936 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20250727/218a3fa4/attachment-0001.obj>