Changes in Thunderbird 115

WebExtensions usually are not reviewed when submitted but instead are made available instantly. The WebExtension permission system should guard against malicious actors. However, the data available to extensions is very sensitive and if a user granted access to messages and contacts he mostly assumes the data is only used locally. Extensions however, can unknowingly send this data to remote servers. We therefore started to enforce review of all extensions, which request sensitive permissions like messagesRead or addressBooks. We also introduce an additional sensitiveDataUpload permission, which allows to by-pass this human review, but prompts the user for the following permission: Transfer sensitive user data (if access has been granted) to a remote server for further processing.

If an add-on is not requesting that permission, but a reviewer concludes that it is indeed sending data to a remote server not under the control of the user, the reviewer may request the permission to be added.

browserAction API

  • Deprecate the default_area manifest entry in favour of the recently added allowed_spaces manifest entry.

  • Add support for the type manifest entry to define a menu button, whose menu entries can be controlled through the menus API and a new browser_action_menu context.

addressBooks API

  • The function openUI() now returns a Promise for the Tab of the opened tab.

commands API

  • Add the onChanged event to be notified when a command shortcut has been changed.

compose API

  • Add support for the type manifest entry to define a menu button, whose menu entries can be controlled through the menus API and a new compose_action_menu context.

messages API

  • The queryInfo parameter for query([queryInfo]) is now optional.

  • Added openAttachment(messageId, partName, tabId) to open message attachments with the registered application. A big thank you to Mark Banner.

  • Add support for the type manifest entry to define a menu button, whose menu entries can be controlled through the menus API and a new message_display_action_menu context.

messageDisplay API

sessions API

  • Add a first simple version of the sessions API to allow extensions to store tab related session data, which is restored on app restart.

spaces API

  • Add spaces API which supersedes the spacesToolbar API and allows to manage built-in and custom spaces.

spacesToolbar API

  • Add clickButton(id, [windowId]) to trigger a click on the button of a space in the spaces toolbar. In Manifest v3 the button-centric spacesToolbar API was removed and replaced by the space-centric spaces API, where the corresponding method is named spaces.open().

tabs API

  • The queryInfo parameter for query([queryInfo]) is now optional.

  • Add a spaceId member to the Tab type.

  • Add a cookieStoreId member to the Tab type. A big thank you to Neil Rashbrook.

  • Add support for the previousTabId parameter to the onActivated event.

  • Changed handling of URLs in update([tabId], updateProperties): If the URL points to a content page (a web page, an extension page or a registered WebExtension protocol handler page), the tab will navigate to the requested page. All other URLs will be opened externally without changing the tab. Note: The function will throw an error, if a content page is loaded into a non-content tab (its type must be either content or mail).

Bugzilla list of all fixed WebExtension API bugs in Thunderbird 114 and Thunderbird 115.