2090605 - Update NSS to new version 4c7edf7d0eab60dcdf960b063af650ba70662b32 from 2026-11-06 21:30:18 UTC

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement)

Description

[Update Bot]

This update covers 7 commits. Here are the overall diff statistics, and then the commit information.

---

security/nss/cmd/httpserv/httpserv.c | 6 +-
security/nss/cmd/selfserv/selfserv.c | 4 +
security/nss/cpputil/nss_scoped_ptrs.h | 2 +
security/nss/gtests/certdb_gtest/certdb_gtest.gyp | 1 +
security/nss/gtests/certdb_gtest/crl_unittest.cc | 6 +-
security/nss/gtests/certdb_gtest/manifest.mn | 1 +
security/nss/gtests/certdb_gtest/name_constraints_unittest.cc | 189 ++++++++++
security/nss/gtests/certdb_gtest/smime_profile_unittest.cc | 4 +-
security/nss/gtests/pk11_gtest/pk11_mldsa_unittest.cc | 6 +-
security/nss/gtests/pk11_gtest/pk11_prf_unittest.cc | 52 +-
security/nss/gtests/pk11_gtest/pk11_x25519_unittest.cc | 12 +-
security/nss/gtests/smime_gtest/smime_unittest.cc | 10 +-
security/nss/gtests/ssl_gtest/ssl_misc_unittest.cc | 51 ++
security/nss/gtests/ssl_gtest/tls_agent.cc | 18 +-
security/nss/gtests/util_gtest/util_secasn1e_unittest.cc | 10 +-
security/nss/lib/certdb/genname.c | 114 ++++-
security/nss/lib/softoken/pkcs11.c | 1 +
security/nss/lib/softoken/pkcs11i.h | 47 +-
security/nss/lib/softoken/pkcs11u.c | 1 +
security/nss/lib/ssl/sslimpl.h | 7 -
security/nss/lib/ssl/sslsecur.c | 6 +-
security/nss/lib/ssl/sslsock.c | 13 +-
security/nss/moz.yaml | 4 +-
23 files changed, 417 insertions(+), 148 deletions(-)

---

4c7edf7d0eab60dcdf960b063af650ba70662b32 by Alejandro Pacheco <[e-mail]>

https://github.com/mozilla/nss/commit/4c7edf7d0eab60dcdf960b063af650ba70662b32
Authored: 2026-11-06 21:30:18 +0000
Committed: 2026-11-06 21:30:18 +0000

Bug 2081582 - Require prefix matching for permitted directoryName name constraints. r=jschanck

cert_CompareNameWithConstraints compared a directoryName constraint with
the name RDN by RDN, stopped as soon as either side ran out of RDNs, and
only looked for each constraint attribute in the name RDN. For a permitted
subtree this let in names that are outside it: a name shorter than the
constraint, a name with an RDN that has no attributes, and a name whose RDN
holds attributes besides the constraint's.

For permitted subtrees, match only when the constraint is a prefix of the
name, as RFC 5280 section 4.2.1.10 requires: the name has at least as many
RDNs, and each constraint RDN equals the name RDN at the same position
(CERT_CompareRDN). An empty subject still passes, as before and as the RFC
requires.

Excluded subtrees keep the existing, broader match unchanged: it covers
every name the prefix match covers, so no name that was excluded before is
let through now.

Differential Revision: https://phabricator.services.mozilla.com/D337695

Files Added:

• gtests/certdb_gtest/name_constraints_unittest.cc

Files Modified:

• gtests/certdb_gtest/certdb_gtest.gyp
• gtests/certdb_gtest/manifest.mn
• lib/certdb/genname.c

---

e9833922c512346df75958b5bf1c8b8be035be9e by Anna <[e-mail]>

https://github.com/mozilla/nss/commit/e9833922c512346df75958b5bf1c8b8be035be9e
Authored: 2026-11-06 19:15:38 +0000
Committed: 2026-11-06 19:15:38 +0000

Bug 2089492 - Clean-up: Use scoped pointers in gtests r=nss-reviewers,rrelyea

Differential Revision: https://phabricator.services.mozilla.com/D339863

Files Modified:

• cpputil/nss_scoped_ptrs.h
• gtests/certdb_gtest/crl_unittest.cc
• gtests/certdb_gtest/smime_profile_unittest.cc
• gtests/pk11_gtest/pk11_mldsa_unittest.cc
• gtests/pk11_gtest/pk11_x25519_unittest.cc
• gtests/smime_gtest/smime_unittest.cc
• gtests/ssl_gtest/tls_agent.cc
• gtests/util_gtest/util_secasn1e_unittest.cc

---

032767452af632fcd2d0fc4b9ef4691f74815671 by Anna <[e-mail]>

https://github.com/mozilla/nss/commit/032767452af632fcd2d0fc4b9ef4691f74815671
Authored: 2026-11-06 16:29:29 +0000
Committed: 2026-11-06 16:29:29 +0000

Bug 2075958 - Fix -Wunused-but-set-global errors with clang 23 in httpserv and selfserv r=crypto-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D338788

Files Modified:

• cmd/httpserv/httpserv.c
• cmd/selfserv/selfserv.c

---

e178a42e1f3abdbbee20d2019912ac6d10ca7a01 by John Schanck <[e-mail]>

https://github.com/mozilla/nss/commit/e178a42e1f3abdbbee20d2019912ac6d10ca7a01
Authored: 2026-11-06 16:17:07 +0000
Committed: 2026-11-06 16:17:07 +0000

Bug 2089019 - release assert sftkqueue pointer invariants. r=nss-reviewers,djackson

Differential Revision: https://phabricator.services.mozilla.com/D339620

Files Modified:

• lib/softoken/pkcs11.c
• lib/softoken/pkcs11i.h
• lib/softoken/pkcs11u.c

---

9090d84ebd25092d06417ad9ef5947d9e664a4e8 by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/9090d84ebd25092d06417ad9ef5947d9e664a4e8
Authored: 2026-11-06 14:39:54 +0000
Committed: 2026-11-06 14:39:54 +0000

Bug 2089529 - Destroy the peer certificate and SID in GetResumptionTokenInfoWithFlags when alphSelection fails r=nss-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D339914

Files Modified:

• lib/ssl/sslsock.c

---

bbdacb0c7480c02bea20c98de0cd19ea001fba2e by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/bbdacb0c7480c02bea20c98de0cd19ea001fba2e
Authored: 2026-11-06 13:37:34 +0000
Committed: 2026-11-06 13:37:34 +0000

Bug 1562538 - Remove handshake/handshaking members from SSL sockets r=leggert

Differential Revision: https://phabricator.services.mozilla.com/D339991

Files Modified:

• gtests/ssl_gtest/ssl_misc_unittest.cc
• lib/ssl/sslimpl.h
• lib/ssl/sslsecur.c
• lib/ssl/sslsock.c

---

a4efdf33539427542ae67f65658e3e88db1de6fd by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/a4efdf33539427542ae67f65658e3e88db1de6fd
Authored: 2026-11-06 12:24:36 +0000
Committed: 2026-11-06 12:24:36 +0000

Bug 2088965 - [Coverity 1704719] Reset freed keys in TlsPrfTest::ClearTempVars r=nss-reviewers,keeler

Differential Revision: https://phabricator.services.mozilla.com/D339540

Files Modified:

• gtests/pk11_gtest/pk11_prf_unittest.cc

---

Comment 1

[Update Bot]

I've submitted a try run for this commit: https://treeherder.mozilla.org/jobs?repo=try&revision=ec987c25c20b22ba67f535e6c593fa4e6b6d05ff

Comment 2

[Update Bot]

Attachment: Bug 2090605 - Update NSS to 4c7edf7d0eab60dcdf960b063af650ba70662b32. UPGRADE_NSS_RELEASE

Comment 3

[Update Bot]

The try push is done, we found jobs with unclassified failures.

Needs Close Investigation:

• test-macosx1500-aarch64/opt-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: B8hbrmRVToCIVhlvxyrAfQ, RUM3ylXNTNazzPHjv3T9eA, aZz3FooHQIu9wBzgWiGJbQ, G2n6SylFTT2ra6PcHNpU7g)
• test-macosx1500-aarch64/debug-test-verify-path-11 - 4 of 4 failed on the same (retriggered) task (failed: dZ5XzKLBTT6uhLOgI-15BQ, RxbGhlbeRvG64VGWEggz8A, SK12FUXITcqmGLBBTIjvog, D8gDBLgOStC2yvvLmPzh4g)
• test-windows11-64-25h2/debug-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: OAXs79E_QrahYWTxZ6vedA, fZHKcPRwSqu5_yHIURMSUg, adwLBh2KSHucgZhgjy7-DQ, CsPt0pMCT7m_mlqskRQ4qA)
• test-linux2404-64-tsan/opt-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: ecJS3xNWR1-7jmC5P0-QTg, a2eHMMz0R4mOsb1bRSMGVQ, cDW-kGJ7QBOJKP3sy557Xg, Kuv3rQUUR2C1dgTChLfYdg)
• test-linux2404-64/debug-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: GfUqXLzXQUyh7spnaN9g1g, UC_pWM4dTi-0mL8qBrtoEA, ChOijbAnSoiC2uBtj_1NRA, UD0mj6-5TrqZJ9IeRt70RQ)
• test-macosx1500-aarch64/opt-test-verify-path-10 - 4 of 4 failed on the same (retriggered) task (failed: cUEjo6WCSoGQobgfWzGToQ, WEpGo386TyKEsJXP-hVRmw, EAfM8VQsSiGMni6CAakSTw, Uw3ivOaDQfaWiH2v4Go9lQ)
• test-windows11-32-25h2/debug-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: D9Qx1QqzTuaxssVfOcKItQ, KP3NeBf8SZ-S58p9BJ1_9A, WobU2kZORwqP6Z1ZWYBvjA, UwDrX0i3QHadof_r4ROR8A)
• test-windows11-32-25h2/opt-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: eiACvT9oSCOUocU8BxMzFg, cdAIVmBrRBa2sDjh1ptX8Q, GRwAx7LBTOKeCCDmUE5JdA, a6-pxchFT3apE4uoDGfxoA)
• test-macosx1500-aarch64/debug-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: Mv2EDjPkQ6KCF92Pvkgkrw, N-AE_Z3uQp6gdJlhnWg0Xg, F9yKi0qpRSGvFwQGDijolg, E3Q7_c2GQpyaaiW877aKgA)
• test-linux2404-64/opt-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: PMC310pSTdG73X_PiXiHow, F8RZMsJARXKJ5CkvICULCA, IbN0nUkGQGu3qDyily70Dg, Oluxx3JlQf2ivZyd0B9CIQ)
• test-windows11-64-25h2/opt-test-verify-path-1 - 4 of 4 failed on the same (retriggered) task (failed: JOO2TwC-Qh-3E_JmqTXICg, LnZhUYGLQDe5pjhWwuqA3w, P4GC6aWOSp-HjDL23F6OZw, QHUUmqnmTFOzhFzzFIIImQ)
• test-macosx1500-aarch64/opt-test-verify-path-14 - 3 of 4 failed on the same (retriggered) task (failed: DNG8uhUATo2Azwcfs3eh4w, DqndA6OJRzqgqaFUmGYSOw, Kc2Rc7E3QLWxQaoIDQoaGA)

Known Issues:

• test-windows11-32-25h2/opt-test-verify-path-13 - 2 of 4 failed on the same (retriggered) task (failed: FWUifvEsSKigQY91lePh2A, SDtdD5ajSX-yNY4zHt27Bg)
• test-macosx1500-aarch64/debug-test-verify-path-14 - 2 of 4 failed on the same (retriggered) task (failed: EPGzilE3Qc2YKMEiBWhNRw, L4bCDOS0R8qemV8DIFh4QA)

These failures could mean that the library update changed something and caused
tests to fail. You'll need to review them yourself and decide where to go from here.

In either event, I have done all I can and you will need to take it from here. If you
don't want to land my patch, you can replicate it locally for editing with
./mach vendor security/nss/moz.yaml

When reviewing, please note that this is external code, which needs a full and
careful inspection - not a rubberstamp.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/47f2a88cbab9
https://hg.mozilla.org/integration/autoland/rev/d1b813e0d238
Update NSS to 4c7edf7d0eab60dcdf960b063af650ba70662b32. UPGRADE_NSS_RELEASE r=jschanck

Comment 5

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/d1b813e0d238