Package: firejail-profiles Severity: critical Justification: causes serious data loss
Dear Maintainer, debian 13 stable (trixie) and debian 12 oldstable (bookworm) received an update to the firefox-esr package, which introduces a large version bump of firefox from version 140esr to version 153esr. Firefox 153esr requires changes to the profiles distributed in the package firejail-profiles in order to avoid the serious data loss. Firefox 140esr uses the ~/.mozilla directory for user data (passwords, bookmarks, etc.). On upgrades to 153esr, firefox keeps using the ~/.mozilla directory if it exists, so nothing is lost. Firefox 147 introduced a change[1] that makes firefox start using XDG Base Directory Specification. Hence on newly installed debian systems, or newly created user accounts, the ~/.mozilla directory does not exist and firefox starts using the new XDG location ~/.config/mozilla instead of ~/.mozilla and starts saving user data to this new location. This means that firefox starts just fine, but the outdated firejail profile redirects all attempts that would save files to ~/.config/mozilla into a temporary ephemeral location, and all user data is discarded when firefox is closed and the firejail sandbox terminates. The user has no way of knowing that user data is not being saved, because the firejail redirection is transparent to firefox. The necessary changes to avoid this serious data loss are available in the upstream accepted merge request[2]. Please apply those changes to the firejail-profiles package, and create a targetted backport for the firejail-profiles in debian stable (trixie), and if possible let the LTS team know that the changes are necessary for debian oldstable (bookworm) as well. Marking this as critical according to rc policy[3] due to causing serious data loss (passwords saved to firefox password manager, as well as other user data in firefox). [1] https://www.firefox.com/en-US/firefox/147.0/releasenotes/ [2] https://github.com/netblue30/firejail/pull/7061 [3] https://release.debian.org/testing/rc_policy.txt
