PWAsForFirefox 2.12.2

[filips123]

Changed

• localhost is now treated as secure context (Treat localhost as secure context #514, thanks to @iTrooz).
• Building the extension has been made more reliable.
• Updated dependencies.

Fixed

• A few typos in documentation have been corrected (Fix typo in features description #539, thanks to @Merlin2001).
• Session restore should now be properly disabled (PWAs sometimes crash immediately on first opening, and then work normally after re-opening. #488).

---

This discussion was created from the release PWAsForFirefox 2.12.2.

[cailloumajor]

There is something strange with https://addons.mozilla.org/firefox/addon/pwas-for-firefox/: the version available is 1.4.2.

[filips123]

It seems that all existing versions (except 1.3.2 and 1.4.2 for some reason) were disabled by the Add-ons Review Team. Apparently the extension violates Add-on Policies, because the user must have "the choice to either accept the data collection or uninstall the extension. Right now the user has no other choice than to accept the data collection".

That "data collection" is just collecting the tab URL, which is obviously required to let users install the current website as a PWA. There is no other data collection...

The proposed solution is to provide a button to the license/privacy agreement screen (on the extension setup wizard). I will try to implement this as soon as possible, but it might take some time, because the Add-ons Review Team will probably review the new version to make sure it complies with the policies.

---

Important: Do not install 1.3.2 and 1.4.2 versions of the native program, because they don't work with the latest Firefox versions and contain actual security vulnerabilities. If you can, please just wait until the issue has been resolved and the new version is available.

---

Also, although I agree with the Add-ons Review Team that security and privacy are important for extensions, I don't think the immediate block of almost all versions was really necessary here... The violation seems pretty minor, as the user can already manually uninstall the extension if they do not consent to collecting the tab URL, and no data are collected until the user triggers the PWA installation, and even then, everything is stored in a local file.

In the past, there was already a similar problem (because privacy policy was not displayed directly in the extension), but then they provided me around 14 days to fix the issue before the old version is disabled. This is totally reasonable.

Last week, I also got a review message, because the extension build not is not reproducible, and I also got 14 days to fix the issue. That is partially my fault, because I was building the extension locally, so it seems I messed up versions of some libraries, so the build was not the completely same. And partially is because Parcel bundler (which the extension uses) has a bug that builds are not fully reproducible sometimes. Anyway, starting with 2.12.2, the extension is now built automatically on GitHub Actions, so there is no way versions could differ. There is still a problem with Parcel bundler, but I mentioned that in internal comments for the Add-ons Review Team, that they might need to build it multiple times if the builds differ.

Maybe they now immediately disabled all versions because I've already had an ongoing violation/problem, so I already ran out of warnings?

[filips123]

I've created 2.12.3 with the decline agreement button. I hope that will be enough to comply with policies and will be approved soon. I've also created #556 about this issue.