Updates 11/22/22 - PaleMoon

PaleMoon v31.4.0 (2022-11-22)

This is a major development update, adding JPEG-XL image support among other things.

Changes/fixes:

• Added support for the JPEG-XL image format.
• Implemented regular expressions lookaround/lookbehind.
• Aligned CORS header parsing with the updated spec. See implementation notes.
• We no longer fire keypress events for non-printable keys. See implementation notes.
• Added support for MacOS 13 "Ventura" in the platform, primarily benefitting White Star.
• Fixed potentially problematic thread locking code on *nix platforms.
• Fixed some small issues in the display and operation of the Web Developer tools.
• Removed unused but performance-impacting panning and tab animation measuring code. (telemetry leftovers)
• Improved code for SunOS builds.
• Updated Internationalization data for time zones.
• Fixed a buffer overflow for Mac builds.
• Security issues addressed: CVE-2022-45411 and potential issues without a CVE number.
• UXP Mozilla security patch summary: 2 fixed, 1 DiD, 1 deferred, 25 not applicable.

Implementation notes:

• CORS support has been updated to the current spec. Most importantly, Pale Moon now accepts wildcard entries ("*") for the CORS statements Access-Control-Expose-Headers, Access-Control-Allow-Headers and Access-Control-Allow-Method. Note that wildcards are ignored (according to the spec) when credentials are passed.
• Pale Moon will no longer fire the keypress events in content when the key pressed is a non-printable key. This is in response to issues where webmasters would use rudimentary and naïve input-restricting scripts in onkeypress handlers that would not take into account editing keys or navigation keys, causing issues for users trying to enter data into forms (and e.g. finding they could no longer use backspace, cursor keys or tab). This aligns our behavior with other browsers for web compatibility, although it should be considered a website error expecting not all keypresses to be intercepted in keypress events.