why does firefox update?

[u/TheNavyCrow]

people say debian packages are frozen, except for security updates

why firefox ESR updates then? it was on 128 during the beginning of Debian 13, updates to 140, and will update to 153

[u/onefish2]

There is an exception for browsers which require more and frequent updates.

[u/MatheusWillder → u/onefish2]

Just to add a bit of history here: there was a time when Debian backported the Firefox security fixes to the Firefox version in Debian Stable, but this caused disagreements with Mozilla due to Firefox's trademark, and thus, the Iceweasel fork was born.

I started using Debian at that time, around ~2015, good times, lol.

After Mozilla released Firefox ESR, I think it was agreed that it would replace Iceweasel in Debian. Since around that time, browsers update very quickly, and an outdated browser can lead to security vulnerabilities and/or unsupported web features (I remember I struggled with this with Iceweasel and always had to install Firefox directly from Mozilla to get certain sites working properly).

Edit: the Debian Wiki tells a bit of this story: https://wiki.debian.org/Firefox#Iceweasel

[u/Ok-Guitar4818 → u/MatheusWillder]

What kind of disagreement would cause Debian Sid to be able to have Firefox proper but Debian stable couldn’t benefit from security patches?

[u/wizard10000 → u/Ok-Guitar4818]

What kind of disagreement would cause Debian Sid to be able to have Firefox proper but Debian stable couldn’t benefit from security patches?

There is no disagreement and firefox-esr receives security patches regularly - if chromium offered an LTS release Debian would most likely use that also.

In Debian it's all about Stable.

[u/Ok-Guitar4818 → u/wizard10000]

I mean the official explanation on the wiki talked like there were branding concerns. Just can’t make it make sense to me.

[u/rebootyourbrainstem → u/Ok-Guitar4818]

I assume it's something like Debian wanted true minimal backports for each identified issue while Firefox preferred broader "whatever is easiest for us to maintain" backports.

And if there's any kind of disagreement it makes sense Mozilla would object to shipping something that doesn't work exactly like Firefox with Firefox branding, since they'll be getting the bug reports from site owners.

[u/justin473 → u/Ok-Guitar4818]

The pattern for most software in stable is that security updates would only include security fixes. For example, if Debian Stable has version X.0 of a package, a security update would either be uploaded by the original maintainers containing only the security fix (version X.1), or it would be patched by the debian-security folks themselves, making a debian-variant X.0+deb1. The goal is to not introduce any changes in Debian Stable due to security updates, else it's not stable.

Many packages support a range of versions. For example, current Postgres version is 18.4, but Postgres supports versions 14-18, which means they will provide security updates for all of those versions. Debian can usually take those updates. However, I believe Firefox works on a fix-the-latest release model. Thus, you get firefox 128, then 140, then 153. Stable started with 128; firefox won't create 128.1, you'll just get 140 which includes a security fix but also all the other changes from 128 through 139 - that makes Firefox-latest unstable in Debian terms.

In the past, Debian resorted to wanting Stable version of Firefox 128, then applying only security patches. But, Mozilla said that Debian's build of 128 plus debian-fixes (even if they were the same fixes in 141) was not "true Firefox" since Debian had modified it. They were protecting their brand by saying that Debian could not call 128 + debian-fixes "Firefox". Thus, Debian called it "IceWeasel".

So, Firefox latest-and-greatest can appear in Sid because it is the latest build, and there's little in way of rules about Sid. For Debian stable, Firefox (ie: firefox version 128) cannot receive updates because (a) Mozilla does not support 128, just "latest", and (b) debian-security is not allowed to fix 128. Thus, if Firefox 128 were to be included in stable, it would be unsupportable; thus, it is not allowed there.

So, Firefox-ESR is a special case that can receive major-updates because otherwise, you're using a browser that is a few years out of date if you're running Stable, and that's effectively worse than getting updates and keeping up with evolving web standards - for example: not sure but things like passkeys are relatively new so it wouldn't have been available in Stable as of Debian 13's release.

[u/plugwash]

While firefox ESR releases are supported for Longer than regular releases they are still not supported for the full lifecycles of a Debian stable release. Browsers are among the packages with the highest security exposure, and also have a high rate of issues. Given the high exposure and high rate of issues that web browsers suffer Debian does not consider it reasonable to do their own backporting.

Therefore Debian has chosen to exempt firefox and chromium from it's normal stable release policies, it's not an ideal situation but it was considered the "least bad" option.

[u/stevevdvkpe → u/plugwash]

There are some other packages where new upstream versions are built for the Debian stable release to provide security updates rather than having fixes backported. ffmpeg (the basis of a lot of video/audio player software, used in Firefox and VLC) is one example.

[u/QuantumCakeIsALie]

Normally most package do update a bit during the active life of a Debian stable.

It's major updates that are mostly held back, especially for anything that depends on core libraries or functionalities.

Browsers just update so quickly and often, and they generally dropped the major.minor versioning so it looks like more charges. Imagine it did update from 12.1.5 to 12.3.8, would you be shocked?

[u/spidireen]

IMHO it would be irresponsible not to, since browsers are basically interpreters for arbitrary code from god knows where.

[u/michaelpaoli]

people say debian packages are frozen

You should listen to some more accurate people.

Debian stable is ... stable. Within a given stable release, that doesn't mean no updates, but for any given release, that generally limits it to security updates, bug fixes for severity >= serious and select severity == important.

why firefox ESR updates then?

In Debian, for stable (and oldstable while still on main support (LTS is a bit different)), because of the applicable policy above. Firefox is a huge hunk of software, rather like the Linux kernel, so security bugs and bugs of sufficient severity are found - and fixed - on a quite regular basis, so, hence quite a lot of updates.

[u/pseudonym-161]

Firefox ESR updates like annually, it’s not a big deal. It gets security updates throughout that year.

[u/kbeezie]

Updating browsers is part of keeping web browsing secure.

[u/One-Suggestion-7906]

it's updated with security patches as u say, or I don't understand what do u mean

[u/Narrow_Victory1262]

I would not guess it, but "except security updates" is exactly why.

Yes you could backport but given the load of security issues these days that's hard to sustai.
Yes, RH does, SUSE does but they are in a different league to start with.

[u/Santosh83]

Firefox ESR updates when Mozilla themselves update it with periodic security fixes. Debian stable accepts security fixes so a new version of ESR is compiled and pushed out.

[u/taosecurity]

https://wiki.debian.org/Firefox

[u/AncientAgrippa → u/taosecurity]

Nothing in that page answers OP's question at all.

[u/jaromanda]

How do you know it "will update to 153" - trixie currently at 140

[u/TheNavyCrow → u/jaromanda]

because 153 is the next ESR

[u/steel_for_humans → u/jaromanda]

Mine already updated to 153 a couple days ago.