The release of the web browser Firefox 90 has occurred. Additionally, an update for the long-term support branch 78.12.0 has been prepared. The Firefox 91 branch will soon enter beta testing, with a release scheduled for August 10.
Key innovations:
- The 'Privacy and Security' settings section has added new options for the 'HTTPS Only' mode, which, when enabled, automatically redirects all unencrypted requests to their secure page versions (replacing 'http://' with 'https://'). An interface has been proposed for maintaining an exceptions list, allowing sites on this list to use 'http://' without being forced to switch to 'https://'.
- The implementation of the SmartBlock mechanism has been improved to address issues on sites caused by blocking external scripts in private browsing mode or when enhanced tracking protection is activated (strict mode). SmartBlock automatically replaces tracking scripts with placeholders that ensure the correct loading of the website. Placeholders have been prepared for some popular user tracking scripts listed in Disconnect. The new version includes adaptive blocking of Facebook widgets placed on third-party sites — by default, scripts are blocked, but the blocking is disabled if the user is logged into their Facebook account.
- The built-in FTP protocol implementation has been removed. When attempting to open links with the 'ftp://' protocol identifier, the browser will now attempt to invoke an external application, similar to how 'irc://' and 'tg://' handlers are invoked. The reason for discontinuing FTP support is the protocol's lack of security against modification and interception of transit traffic during MITM attacks. According to Firefox developers, there are no reasons to use FTP instead of HTTPS for resource downloads in modern conditions. Additionally, the FTP support code in Firefox is very old, causing maintenance issues and has a history of revealing many vulnerabilities in the past.
- When saving a page as a PDF (the 'Print to PDF' option), the document now preserves working hyperlinks.
- The 'Open Image in New Tab' button in the context menu has been redesigned to open the image in a background tab (previously, clicking it would immediately switch to a new tab with the image, but now the old tab remains active).
- Work has been done to improve the performance of software rendering in the WebRender compositing system, which uses shaders to perform composite rendering of page elements. For most systems with older graphics cards or problematic graphics drivers, software rendering mode is enabled in the WebRender compositing system (gfx.webrender.software=true in about:config).
- Updates can now be applied in the background for Windows platform builds, even when Firefox is not running.
- Client certificates stored in hardware tokens or operating system certificate stores can now be used for authentication.
- Support has been implemented for the Fetch Metadata HTTP header group (Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, and Sec-Fetch-User), allowing the transmission of additional metadata about the nature of the request (cross-site request, request through an img tag, request initiated without user actions, etc.) for the purpose of implementing server measures to protect against certain types of attacks. For example, it is unlikely that a link to a handler for transferring money would be specified through an img tag, so such requests can be blocked without passing them to the application.
- In JavaScript, support has been added for marking class methods and fields as private, after which access to them will only be available within the class. To mark them, you should prefix the name with a '#': class ClassWithPrivateField { #privateField; static #PRIVATE_STATIC_FIELD; #privateMethod() { return 'hello world'; } }
- A dayPeriod property has been added to the Intl.DateTimeFormat constructor, allowing for the display of approximate times of day (morning, evening, day, night).
- In JavaScript, the at() method has been implemented in Array, String, and TypedArray objects, allowing for relative indexing (the relative position is specified as the array index), including the ability to specify negative values from the end (for example, 'arr.at(-1)' will return the last element of the array).
- Support has been added for legacy WheelEvent properties — WheelEvent.wheelDelta, WheelEvent.wheelDeltaX, and WheelEvent.wheelDeltaY, allowing compatibility to be restored with certain older pages that was lost after the recent overhaul of WheelEvent.
- The createConicGradient() method has been implemented in the Canvas API interface CanvasRenderingContext2D, enabling the creation of gradients formed around a point with specified coordinates (in addition to the previously available linear and radial gradients).
- Support has been added for the 'matrix' URI scheme, which can be used in Navigator.registerProtocolHandler() and protocol_handlers handlers.
- In the web development tools, the panel for tracking network responses has implemented a preview of loaded fonts. server (Response) a preview of fonts being loaded has been implemented.
Source: opennet.ru
