diff --git a/www/firefox-esr/Makefile b/www/firefox-esr/Makefile
index 342503a40bbe..0c4835a0173f 100644
--- a/www/firefox-esr/Makefile
+++ b/www/firefox-esr/Makefile
@@ -1,65 +1,64 @@
 PORTNAME=	firefox
-DISTVERSION=	140.1.0
-PORTREVISION=	1
+DISTVERSION=	140.2.0
 PORTEPOCH=	1
 CATEGORIES=	www wayland
 MASTER_SITES=	MOZILLA/${PORTNAME}/releases/${DISTVERSION}esr/source \
 		MOZILLA/${PORTNAME}/candidates/${DISTVERSION}esr-candidates/build1/source
 PKGNAMESUFFIX=	-esr
 DISTFILES=	${DISTNAME}esr.source${EXTRACT_SUFX}
 
 MAINTAINER=	gecko@FreeBSD.org
 COMMENT=	Web browser based on the browser portion of Mozilla
-WWW=		https://www.mozilla.com/firefox
+WWW=		https://www.firefox.com/
 
 BUILD_DEPENDS=	nspr>=4.32:devel/nspr \
 		nss>=3.112:security/nss \
 		icu>=76.1,1:devel/icu \
 		libevent>=2.1.8:devel/libevent \
 		harfbuzz>=10.1.0:print/harfbuzz \
 		graphite2>=1.3.14:graphics/graphite2 \
 		png>=1.6.45:graphics/png \
 		dav1d>=1.0.0:multimedia/dav1d \
 		libvpx>=1.14.0:multimedia/libvpx \
 		${PYTHON_PKGNAMEPREFIX}sqlite3>0:databases/py-sqlite3@${PY_FLAVOR} \
 		v4l_compat>0:multimedia/v4l_compat \
 		autoconf2.13:devel/autoconf2.13 \
 		nasm:devel/nasm \
 		yasm:devel/yasm \
 		zip:archivers/zip \
 		${LOCALBASE}/share/wasi-sysroot/lib/wasm32-wasi/libc++abi.a:devel/wasi-libcxx${LLVM_VERSION} \
 		${LOCALBASE}/share/wasi-sysroot/lib/wasm32-wasi/libc.a:devel/wasi-libc@${LLVM_VERSION} \
 		wasi-compiler-rt${LLVM_VERSION}>0:devel/wasi-compiler-rt${LLVM_VERSION}
 
 USE_GECKO=	gecko
 CPE_PRODUCT=	${PORTNAME}_esr
 CONFLICTS_INSTALL=	firefox
 USE_MOZILLA=	-sqlite
 CFLAGS_powerpc64le=	-DSQLITE_BYTEORDER=1234
 CONFIGURE_ENV+=	BINDGEN_CFLAGS="-I${LOCALBASE}/include"
 
 USES=		tar:xz
 
 FIREFOX_ICON=		${MOZILLA}.png
 FIREFOX_ICON_SRC=	${PREFIX}/lib/${MOZILLA}/browser/chrome/icons/default/default48.png
 FIREFOX_DESKTOP=	${MOZSRC}/taskcluster/docker/${MOZILLA}-snap/${MOZILLA}.desktop
 MOZ_OPTIONS=	--enable-application=browser \
 		--enable-official-branding \
 		--with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot
 
 .include "${.CURDIR}/../../www/firefox/Makefile.options"
 
 post-extract:
 	@${SED} -e 's|@FIREFOX_ICON@|${FIREFOX_ICON:R}|;s|@MOZILLA@|${MOZILLA}|' \
 		<${FILESDIR}/firefox.desktop.in >${WRKDIR}/${MOZILLA_EXEC_NAME}.desktop
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|%%LOCALBASE%%|${LOCALBASE}|g' \
 		${WRKSRC}/browser/app/nsBrowserApp.cpp
 
 post-install:
 	${INSTALL_DATA} ${WRKDIR}/${MOZILLA_EXEC_NAME}.desktop ${STAGEDIR}${PREFIX}/share/applications
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/pixmaps
 	${LN} -sf ${FIREFOX_ICON_SRC} ${STAGEDIR}${PREFIX}/share/pixmaps/${FIREFOX_ICON}
 
 .include <bsd.port.mk>
diff --git a/www/firefox-esr/distinfo b/www/firefox-esr/distinfo
index 5228f07cc408..9b2d3f0fc244 100644
--- a/www/firefox-esr/distinfo
+++ b/www/firefox-esr/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1752516226
-SHA256 (firefox-140.1.0esr.source.tar.xz) = d15c65d790e0c371b5c95332141b1bdeb29fefc27f852d22a5f542b6d1bc1922
-SIZE (firefox-140.1.0esr.source.tar.xz) = 638937036
+TIMESTAMP = 1754937436
+SHA256 (firefox-140.2.0esr.source.tar.xz) = 956dce675c3b706d563caf07ed3ca9af632ab830be710dfd4351da78a0a2ef55
+SIZE (firefox-140.2.0esr.source.tar.xz) = 631022940
diff --git a/www/firefox-esr/files/patch-bug1876366 b/www/firefox-esr/files/patch-bug1876366
deleted file mode 100644
index 78483c3fbab7..000000000000
--- a/www/firefox-esr/files/patch-bug1876366
+++ /dev/null
@@ -1,23 +0,0 @@
-commit 46a89fb0319d673b3139a068e3d89aed9f44fc16
-Author: Christoph Moench-Tegeder <cmt@burggraben.net>
-
-    use gdk legacy cursor interface by default
-    
-    Upstream https://bugzilla.mozilla.org/show_bug.cgi?id=1876366#c16
-    hints that we could re-test this once we have GTK 3.24.42 (with the
-    now-current gtk3-3.24.41 the original problem is still reproducable,
-    but toggling this flag does fix it for me)
-
-diff --git modules/libpref/init/StaticPrefList.yaml modules/libpref/init/StaticPrefList.yaml
-index 835450712a12..f2249006c36d 100644
---- modules/libpref/init/StaticPrefList.yaml
-+++ modules/libpref/init/StaticPrefList.yaml
-@@ -16070,7 +16070,7 @@
- # Whether to use gtk legacy cursor API.
- - name: widget.gtk.legacy-cursors.enabled
-   type: bool
--  value: false
-+  value: true
-   mirror: always
- 
- # Whether to use gtk high contrast themes to disable content styling like on
diff --git a/www/firefox-esr/pkg-message b/www/firefox-esr/pkg-message
index 5df4e99ac994..d12bd5033327 100644
--- a/www/firefox-esr/pkg-message
+++ b/www/firefox-esr/pkg-message
@@ -1,50 +1,66 @@
 [
 { type: install
   message: <<EOM
 ## Missing features
 
 Some features found on Windows, macOS and Linux are not implemented:
 
 - Encrypted Media Extensions (requires Widevine CDM binary)
 - Process sandboxing (requires Capsicum backend)
 - Reduced memory usage (requires mozjemalloc)
 - Crash Reporter (requires Google Breakpad and reproducible builds)
 - WebVR (requires open source runtime)
 - TCP fast open
 - `about:networking#networkid` (requires link state notification)
 
+## Cursors
+
+From Firefox 140.2 on, this port defaults to using the new (themed)
+cursor selection. On the upside, this makes Firefox respect the
+desktop environment's theme, on the downside this breaks compatibility
+with the legacy X cursor names. If you experience issues (i.e. the
+mouse cursor not changing to the pointer ("hand") when hovering over
+links), your desktop environment is most likely still set to the legacy
+default/builtin "theme". To remedy this, either
+- set about:config variable "widget.gtk.legacy-cursors.enabled" to "true"
+  to re-enable the legacy cursors, or
+- use the Xcursor framework to set a cursor theme (e.g. X resource
+  item Xcursor.theme), see Xcursor(3) for details. The Adwaita theme
+  will have been installed as a dependency of gtk3 and does work.
+The latter option is only available for X environments.
+
 ## Audio backend
 
 Currently used audio backend can be inspected on `about:support` page.
 Supported backends and default probing order is as follows:
 - `pulse-rust` if `pulseaudio` package is installed (PULSEAUDIO option)
 - `jack` if `jackit` package is installed (JACK option)
 - `sndio` if `sndio` package is installed (SNDIO option)
 - `alsa` if `alsa-lib` package is installed (ALSA option)
 - `oss` (always available)
 To force a specific backend open `about:config` page and create
 `media.cubeb.backend` preference.
 
 Microphone selection only works in `oss`, `pulse-rust` backends.
 Other backends are limited to `default` which is usually `/dev/dsp`,
 so use virtual_oss to reroute microphones from non-default devices.
 
 ## Gamepad API
 
 Requires evdev(4) joystick support. On FreeBSD 13 and later enable hgame(4)
 while older versions can use sysutils/iichid or multimedia/webcamd.
 
 ## smb:// issues
 Network group, machine, and share browsing does not work correctly.
 
 ## sftp://
 Only sftp access using public key authentication works. To easily
 setup public key authentication to `remote_host`:
 
     $ ssh-keygen
     $ cat ~/.ssh/id_rsa.pub | ssh remote_host "cat >> .ssh/authorized_keys"
 
 The SSH server on `remote_host` must allow pub key authentication.
 EOM
 }
 ]