Dear Maintainer,

debian 13 stable (trixie) and debian 12 oldstable (bookworm) received an
update to the firefox-esr package, which introduces a large version bump
of firefox from version 140esr to version 153esr.

Firefox 153esr requires changes to the profiles distributed in the
package firejail-profiles in order to avoid the serious data loss.

Firefox 140esr uses the ~/.mozilla directory for user data (passwords,
bookmarks, etc.). On upgrades to 153esr, firefox keeps using the
~/.mozilla directory if it exists, so nothing is lost.

Firefox 147 introduced a change[1] that makes firefox start using XDG
Base Directory Specification.

Hence on newly installed debian systems, or newly created user accounts,
the ~/.mozilla directory does not exist and firefox starts using the new
XDG location ~/.config/mozilla instead of ~/.mozilla and starts saving
user data to this new location.

This means that firefox starts just fine, but the outdated firejail
profile redirects all attempts that would save files to
~/.config/mozilla into a temporary ephemeral location, and all user data
is discarded when firefox is closed and the firejail sandbox terminates.
The user has no way of knowing that user data is not being saved,
because the firejail redirection is transparent to firefox.

The necessary changes to avoid this serious data loss are available in
the upstream accepted merge request[2].

Please apply those changes to the firejail-profiles package, and create
a targetted backport for the firejail-profiles in debian stable
(trixie), and if possible let the LTS team know that the changes are
necessary for debian oldstable (bookworm) as well.

Marking this as critical according to rc policy[3] due to causing
serious data loss (passwords saved to firefox password manager, as well
as other user data in firefox).

[1] https://www.firefox.com/en-US/firefox/147.0/releasenotes/
[2] https://github.com/netblue30/firejail/pull/7061
[3] https://release.debian.org/testing/rc_policy.txt