diff --git a/download b/download
index 41409f360a52c997c0961901c06a2fa85841dc76..6099d49c1f7a19484214cd6bd993a58597b407d8 100644
--- a/download
+++ b/download
@@ -1,4 +1,4 @@
-8d2e8b9115580dcbdeafeee60699ec81  firefox-128.3.1esr.source.tar.xz
+aab1f335242b809813d1d4b754d10c0b  firefox-128.7.0esr.source.tar.xz
 fc25f988b87b5187d4e2f006efa699a3  cbindgen-vendor.tar.xz
 b3c1d2ea615cb0195f4f62b005773262  mochitest-python.tar.gz
-cb946f6aae2abd13f4141ecb2872c343  firefox-langpacks-128.3.1esr-20241009.tar.xz
+de619e2868444395795c069006ab5357  firefox-langpacks-128.7.0esr-20250129.tar.xz
diff --git a/firefox.spec b/firefox.spec
index 458edbe13fe66bf42ce7255a64a1be9727dd6ccc..39fa9acd529a02b3aebc96013a88d9b3842d9e8d 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -1,4 +1,4 @@
-%define anolis_release 3
+%define anolis_release 1
 %define homepage %(grep '^HOME_URL\s*=' /etc/os-release | sed 's/^HOME_URL\s*=//;s/^\s*"//;s/"\s*$//')
 
 # Produce debug (non-optimized) package build. Suitable for debugging only
@@ -60,7 +60,7 @@
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        128.3.1
+Version:        128.7.0
 Release:        %{anolis_release}%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -72,7 +72,7 @@ License:        MPLv1.1 or GPLv2+ or LGPLv2+
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        https://ftp.mozilla.org/pub/firefox/releases/%{version}esr/source/firefox-%{version}esr.source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20241009.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20250129.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1575,6 +1575,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 
 #---------------------------------------------------------------------
 %changelog
+* Mon Apr 07 2025 mgb01105731 <mgb01105731@alibaba-inc.com> - 128.7.0-1
+- Update to 128.7.0 to fix CVE-2025-1017
+
 * Fri Feb  7 2025 Wenlong Zhang <zhangwenlong@loongson.cn> - 128.3.1-3
 - fix libpng skia build failed for loongarch64