Repository navigation
⛐ It's the "Tag, you're not it" release!
🔄 Updated to Firefox ESR 153.5.0.
Pure upstream sync; no ducksteps-side changes this round.
🏷️ This one shipped a little late on purpose. Mozilla's release automation stamped the official 153.5.0 "release" tag on the wrong commit (a newer one that already had 153.6.0-bound code in it), so building from that tag would have given a mislabeled Frankenbuild. I held off until Mozilla fixed the tag, then built from the correct revision. Details in Bug 2081230 (the automation bug that caused it) and Bug 2081250 (the tag cleanup).
🛡️ Addressed 61 CVEs from Mozilla Foundation Security Advisory 2026-108 (October 13, 2026). This one's a pure upstream sync: I didn't touch anything on the ducksteps side, so everything in here is Mozilla's work flowing through the build. That work is 61 security fixes in total: 29 high, 26 moderate, and 6 low. It's a big pile, but nothing in it jumps out as a headline-grabber, just a lot of ordinary hardening. The practical advice is the usual one: update, restart, and carry on with your day.
✅ SHA512:
ducksteps.153.5.0.AVX512.Setup.exe
7c6b865faedf516adf4800308d7cc467961b724a4aafa51a847cdf22ffe46537653a80238dc858ab4dc2a296f573e8199a6ef51d46a96440d18ef09573ee9275
ducksteps.153.5.0.AVX512.Standalone.7z
2e1db7db92fbc161259fc127f8f86352059f6e8cab951859d965efb587e35d984c50534988943d844a63931ce70ca795d770cb7f5f3480f35c3da7deef7a5c9b
ducksteps.153.5.0.Legacy.Setup.exe
65be637f1850acac03c79b573b70a33db37086ed43a0e81680e1d9b9fbc40d74434d544fd05a2eb528fcd3fcaf5377eae1c54e0851809502b518579b62a5615a
ducksteps.153.5.0.Legacy.Standalone.7z
22edb29db1a2d4cac75a91ebc3304a1481a5fcb12433786897f26ae6c5c8d507421432c0706ba04fb5630515de3bfaccfd5bf4393cfc066f40208a32526fe935
🚨 VirusTotal Results:
ducksteps.153.5.0.AVX512.Setup.exe
ducksteps.153.5.0.AVX512.Standalone.7z