Firefox 102 ESR

[sphumphr]

Hey,
I was wondering if/when the latest Firefox ESR version is going to be added to PMP?
https://www.mozilla.org/en-US/firefox/102.0esr/releasenotes/

It was released on the 28th of last month.

thanks!

[case]

Same question here.

We just failed (incorrectly in my opinion) our Cyber Essential submission, because we are still running Firefox ESR 91.11.0, so am keen to see this updated.

[AlkHacNar]

I had the same problem as I tried to update manualy. If you click on download the latest ESR version, it downloads the 91.x, not 102.x . So I think it's a problem of mozilla. You still can donwload the 102.x, but you must search for it specificaly.

[Eddie78701]

When Mozilla flips over to a new ESR release they generally wait to make the new release the default one.

My previous patching tool didn't approve the new ESR release to replace the prior ESR release until about a month before it went end of life.  The goal with ESR is stability so I welcome the slower cadence that gives me security updates without the bugs of the Rapid Release model which I do not like at all.

[Andrew Jimenez (Patch My PC)]

Eddie is correct here. This question comes up quite a bit, so I am going to include my reply from a recent email:

The version of Firefox ESR in our catalog at this time is still up-to-date, it should contain the same security fixes that were added in version 102. The next ESR release will be 102,

The current version of Firefox ESR in our catalog is 91.13 released on 8/23/2022
https://www.mozilla.org/en-US/firefox/91.13.0/releasenotes/
Security Vulnerabilities fixed in Firefox ESR 91.13 — Mozilla

The current 102 release of ESR is 102.2 also released on 8/23/2022
Security Vulnerabilities fixed in Firefox ESR 102.2 — Mozilla

Patch My PC will be moving to Firefox ESR 102 upon the release of ESR 102.3 on 9/20/2022

I compared the list and 102 does indeed have 2 extra fixes over 91.13, however the only High criticality vulnerability that is fixed in 102 that is not fixed in 91.13  (CVE-2022-38477) is fixing a bug that only existed in the 102 and greater branch. The other, low impact CVE does not mention the versions affected.

Firefox keeps 2 versions of ESR alive for 3 point releases when they have a major ESR release, the older version is more stable, and this gives Mozilla time to stabilize the newer ESR release. Mozilla still provides the same vulnerability patches to both versions while they are both supported. Patch My PC has decided to stick with the more stable ESR, as we assume customers that choose the ESR release are doing so for the stability benefits.

We do not intend to add the newer ESR release at this time as it would significantly increase the number of Firefox updates in our catalog, it would also introduce complicated applicability considerations.