Upgrading libxul, dependency on Firefox 3

[Joe Altman]

Greetings...

I was running portupgrade on libxul and noticed it depends on Firefox
3.x. I cancelled the upgrade, because I thought FF3.x was insecure and
therefore deprecated while FF7 was recommended and secure.

My questions:

1) is the dependency libxul has for FF3 a security problem?

2) is the dependency on FF3 a bug in libxul? If it is a bug, who
   should receive a report: gecko@ or the Mozilla project?

FYI: I'm pretty sure it was portsclean -D (and not me) that deleted
FF3...yet libxul tried to pull it in during the portupgrade.

Best regards,

Joe