files/en-us/mozilla/firefox/releases/139/index.md
This article provides information about the changes in Firefox 139 that affect developers. Firefox 139 was released on May 27, 2025.
hidden=until-found HTML attribute and the beforematch event are now supported.
The hidden until found state allows you to hide the contents of an element until it is found by user search (for example, using "Find in page") or by fragment navigation.
The beforematch event fires just before the hidden attribute is removed (Firefox bug 1761043 and Firefox bug 1955379).No notable changes
withCalendar() method for PlainDate, PlainDateTime, and ZonedDateTime objects:
islamicislamic-rgsaislamic-umalqura<discard> element has been removed, along with its corresponding {{domxref("SVGDiscardElement")}} JavaScript interface.
These aren't supported in other browsers and are expected to be removed from the specification.
(Firefox bug 1958839).No notable changes
cancel event handler.
(Firefox bug 1960556).largeBlob and credProps Web Authentication extensions are now supported, while the prf extension is supported on all desktop platforms.
These respectively provide support for large blob storage associated with a credential, additional information about a credential, and a mechanism for generating a random number associated with a credential and a particular input.
(Firefox bug 1795020, Firefox bug 1844449, Firefox bug 1935280).emulation.setGeolocationOverride command, allowing tests and automation tools to simulate geographic locations across specified browsing contexts or user contexts. This enables consumers to test location-aware features such as geofencing for local recommendations (Firefox bug 1954992).content_scripts manifest key array). Previously, the order was only guaranteed for scripts within the same js array. (Firefox bug 1792685)These features shipped in Firefox 139 but are disabled by default. To experiment with them, search for the appropriate preference on the about:config page and set it to true. You can find more such features on the Experimental features page.
< and > in attributes when serializing HTML: dom.security.html_serialization_escape_lt_gt.
Firefox now replaces the < and > characters with < and >, respectively, in attributes when serializing HTML. This helps prevent certain exploits where HTML is serialized and then injected back into the DOM.
The affected methods and properties are: {{domxref("Element.innerHTML")}}, {{domxref("Element.outerHTML")}}, {{domxref("Element.getHTML()")}}, {{domxref("ShadowRoot.innerHTML")}}, and {{domxref("ShadowRoot.getHTML()")}}. (Firefox bug 1941347).beforescriptexecute and afterscriptexecute: dom.events.script_execute.enabled.
The events have been disabled on Nightly only, allowing browser testing prior to their removal.
The affected events are: beforescriptexecute and afterscriptexecute on the {{domxref("Document")}} interface, and afterscriptexecute and beforescriptexecute on the {{domxref("Element")}} interface. (Firefox bug 1954685).