Bug 2560025

We currently have Firefox 157.0 in F45 stable:

Sat Oct  3 00:17:28 2026 firefox-157.0-1.fc45 tagged into f45 by bodhi [still active]

current upstream is 158.0.1, which is in updates-testing - https://bodhi.fedoraproject.org/updates/FEDORA-2026-0848d84b80

It depends on nss 3.131.0 , which is also stuck in testing because of the freeze - https://bodhi.fedoraproject.org/updates/FEDORA-2026-98737a8fcd

158.0 and 158.1 both include security fixes:

https://www.mozilla.org/en-CA/security/advisories/mfsa2026-106/ (158.0)
https://www.mozilla.org/en-CA/security/advisories/mfsa2026-111/ (158.0.1)

At least one of these, CVE-2026-109705 , is rated Important by Red Hat:

https://access.redhat.com/security/cve/cve-2026-109705

I didn't bother checking all of them, there are probably more.

Thus I'm proposing this as a Final blocker per criterion "The release must contain no known security bugs of 'important' or higher impact according to the Red Hat severity classification scale which cannot be satisfactorily resolved by a package update (e.g. issues during installation)." Browser bugs cannot be entirely resolved by an update because Firefox is used to run the webUI installer on some images, and of course users may well run the browser from the live image or before their first update.

A wrinkle here is that 158.0 and 158.0.1 both have a bug that breaks Amazon Prime Video. The fix landed in the 159 stream and the upstream issue is marked WONTFIX for the 158 series - https://bugzilla.mozilla.org/show_bug.cgi?id=2080876 .

I think the security fixes outweigh the inconvenience of broken Prime Video, though.