Basilisk 2023.11.05 + x64 + Portable

This is a major development and security update:
Added an initial implementation of the ReadableStreams API, improving web compatibility with sites that apparently use this API in utilitarian fashion.
Added support for transparency in WebM videos for the edge case of using <video> elements for transparent animated images. Major caveat: this will massively impact performance of video playback if an alpha channel is present in the video.
Added support for crypto.randomUUID to allow website scripting to generate random UUIDs (universally unique identifiers) through the WebCrypto interface.
Removed the user-agent override for Netflix, since they have stopped supporting the Silverlight browser plugin. Basilisk no longer has a way to provide Netflix DRM-controlled playback with them dropping it, so there is no longer a reason to try and force compatibility.
Updated the user-agent override for Spotify. While it is possible to use the website with this, it suffers from the same DRM issue and not all media will be playable (only non-encumbered media can be played in Basilisk like podcasts). Your mileage may vary.
Implemented timer nesting and clamping for workers, preventing timer hangs on bad website code.
Improved handling of drawing SVG images on canvases without explicit width or height attributes. We now follow the css-sizing-3 Intrinsic Sizes spec.
Improved performance of our memory allocator.
Updated libvpx to 1.6.1.
Cleaned up and updated some media playback code.
Removed the last vestiges of EME/DRM code from UXP, since this will never be supported in any application building on it due to the media industry's draconic policies around FOSS.
Removed support for DRM from Basilisk as a followup to the EME/DRM removal in UXP.
Removed simd.js, moving actually used SIMD handling to C++.
Removed the use of libav in our source, replacing its supply of FFT with the equivalent from FFMpeg.
Fixed potential type confusion in IonMonkey due to 3-byte opcodes.
Fixed an issue with tooltips persisting even if the browser window would have lost focus.
Fixed PerformanceObserver navigation and resource timing (default disabled for privacy); our implementation now fully passes conformance tests.
Fixed an issue where top-level SVG images would not be correctly clipped by positioned elements, giving the impression of wrong z-ordering as the SVG would overlap other elements.
Dev: Updated setInterval to fall back to 0 if no duration is supplied.
Dev: Updated ResizeObserver to a recent spec change, now returning an array of results for borderBoxSize and contentBoxSize instead of an object.
Dev: Updated Intl.NumberFormat and DefaultNumberOption() to follow spec updates. Most importantly for web compatibility, we now allow the "maximumFractionDigits" option in Intl.NumberFormat to be less than the default minimum fraction digits for the chosen locale, following the general consensus in TC39 around this issue.
Increased leniency (removed upper limit) of GLSL versions as they tend to be fully backwards compatible.
Fixed various crashes.
Added a safeguard to the sec-gpc header (Global Privacy Control) so it cannot be inadvertently overwritten.
Removed the 360 Secure Browser profile migrator from Basilisk.
WebRTC Spec Improvements.
Add ability toggle WebRTC and WebAssembly under Tools->Preferences->Content.
Enable PerformanceObserver by default in Basilisk.
Security fixes: addressed CVE-2023-5722, CVE-2023-5723, CVE-2023-5724, CVE-2023-5727 and several other issues without a CVE number assigned to them.
UXP Mozilla security patch summary: 6 fixed, 2 DiD, 19 not applicable.

This is a critical security update.
Fixed a WebP decoder issue (CVE 2023-4863)
Rebase our PDF.js version on files from the Seamonkey PDF.js addon as well as files ported from Firefox 60.9.0. This upgrades our PDF.js version to 2.3.235, which pulls in almost 3 years of security updates and bugfixes.
Following the discussion in this forum post, we've introduced GTK2 builds of Basilisk for Linux.

Implemented the BigInt primitive type for javascript. See implementation notes.
Implemented Big(U)Int64 array support.
Implemented ergonomic brand checks for javascript class fields.
Aligned the Performance API with the Timeline v2 spec.
Aligned the handling of flex/grid percentages resolving against the parent with other browsers. See implementation notes.
Added or updated several user-agent overrides for problematic websites.
Added 2 preferences to allow users to disable CSS animations and transitions. See implementation notes.
Improved compatibility with MacOS 14.
Fixed an important, intermittent javascript crash related to garbage collection.
Fixed several crashes.
Fixed several debug build related issues.
Fixed an issue building on SunOS related to the spelling library.
Updated PDF.js to 1.6.467 from Firefox 53.
Developer: Added ASan support for building with MSVC.
Developer: Implemented automated builds using GitHub Actions and automated process of mirroring Basilisk to GitHub.
Added the .xll file extension to the executable extensions list.
Security issues addressed: several potential security issues that do not have a CVE number. DiD
UXP Mozilla security patch summary: 1 fixed, 3 DiD, 17 not applicable.
Implementation notes
The BigInt primitive (base number format) in javascript allows javascript to handle excessively large integers (whole numbers). This primitive is especially useful for specialized scientific applications that need very large yet accurate numbers, but has seen widespread adoption for an as of yet unknown reason as part of web frameworks, causing general web compatibility issues for Basilisk when scripts expect BigInt support and instead have an error thrown. We have now implemented this primitive for use so we no longer have compatibility issues with these frameworks. It is still unknown why BigInt is in use there and for what. Critical note: BigInt might be tempting to consider for JS-backed cryptography but this is very ill-advised, as BigInt operations are, by their nature, not constant-time and allow timing and side-channel attacks.
Flex and grid item sizes in percentages would previously be resolved against the parent like other elements, according to a very long-standing practice that stems from the Internet Explorer days. Mainstream browsers have, however, made an exception for flex items and grid items to no longer do this. We have now made the same exception for these types of elements which should solve layout issues on some websites (notably reserving too much space for items, often resulting in very large areas of whitespace or items being pushed out of view).
Two preferences were added (layout.css.animation.enabled and layout.css.transition.enabled) to allow users to completely disable CSS-based animations and transition effects. This was a request by users as both a performance and accessibility consideration. Please note that in some cases, disabling animations and transitions may have an impact on final web page layout, so you may run into some issues when disabling these animations and transitions as the web pages were designed to use them.

This is a major development update, further improving web compatibility.
Added the (hidden) preference browser.history.menuMaxResults to allow users to control how many history entries are listed in the menu. Setting this to 0 will hide history menu entries altogether, and any positive number configures how many entries the entries are limited to. The default if not defined is 15.
Switched C++ language level used to C++14 on all platforms.
Web compatibility and scripting improvements:
Implemented geometry .from* static constructors for web compatibility.
Implemented partial support for CSS calc() in color keywords.
Implemented Array "find from last" feature (findLast and findLastIndex).
Implemented Object.hasOwn(object,property).
Implemented several additional Intl API methods and functions. This improves web compatibility with sites making use of things like hourCycle, advanced DateTimeFormat, Intl.Locale, and Intl as a constructor.
Cleaned up some unused code.
Removed support for Mozilla "experiment" type extensions.
Improved the javascript garbage collector's sweeping. This should fix a few intermittent crashes and improve performance.
Implemented some structural changes to the source to make future porting easier, and preparing for switching to C++17.
Removed handling of symlinks for directory listings to prevent potential security issues by walking symlinks when uploading. This effectively reverts a change made in Firefox 50 where this functionality was introduced. A case of "Not such a good idea after all" ;-)
Updated the list of extensions on Windows treated as "executable".
Security issues addressed: CVE-2023-37208.
Made preparations for requiring Authorization in CORS ACAH preflight.
Since no browser honors this part of the spec at the moment this is left disabled until there is consensus among browsers.
Fixed intermittent crashes related to the performance API.
Fixed intermittent issues with javascript malfunctioning in chrome scripts (causing faults in the UI and extensions).
Added ability to specify build version in mozconfig when compiling Basilisk.
UXP Mozilla security patch summary: 2 fixed, 2 rejected, 20 not applicable.

This is a development and security update.

Aligned CSS tab-size with the specification and un-prefixed it.
Updated Brotli library to 1.0.9.
Updated JAR lib code.
Cleaned up HPKP leftovers.
Disabled the DOM filesystem API by default.
Removed Phone Vibrator API.
Fixed an issue where the software uninstaller would not remove the program files it should.
Fixed a devtools crash related to timeline snapshots.
Fixed several data race conditions.
Security issues fixed: CVE-2020-26960, CVE-2020-26951, CVE-2020-26956, CVE-2020-15999 and several memory safety hazards.
Unified XUL Platform Mozilla Security Patch Summary: 5 fixed, 4 defense-in-depth, 3 rejected, 19 not applicable.

This is a standard development and bugfix update.
Implemented support for CSS caret-color.
Implemented support for un-prefixed ::selection CSS pseudo-element styling.
Fixed another potential crashing scenario in ResizeObservers.
Fixed several crashes in the DOM Fetch API.
Fixed a crash in table pagination.
Security issues fixed: CVE-2020-15680 (VG-VD-20-115) and several memory safety hazards.
Unified XUL Platform Mozilla Security Patch Summary: 1 fixed, 2 defense-in-depth, 12 not applicable.