- tbb-commits - lists.torproject.org

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 8f29664e by Beatriz Rizental at 2025-08-20T14:39:14+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -282,6 +282,8 @@ pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.cryptomining.enabled", false); pref("privacy.trackingprotection.fingerprinting.enabled", false); pref("privacy.trackingprotection.socialtracking.enabled", false); +// tor-browser#43986: Explicitly disable bounce tracking protection +pref("privacy.bounceTrackingProtection.mode", 0); pref("privacy.socialtracking.block_cookies.enabled", false); pref("privacy.annotate_channels.strict_list.enabled", false); // tor-browser#43178: for defense-in-depth, avoid remote overrides to FPP. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8f2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8f2… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch base-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 4891bcd3 by Beatriz Rizental at 2025-08-20T14:38:13+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -282,6 +282,8 @@ pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.cryptomining.enabled", false); pref("privacy.trackingprotection.fingerprinting.enabled", false); pref("privacy.trackingprotection.socialtracking.enabled", false); +// tor-browser#43986: Explicitly disable bounce tracking protection +pref("privacy.bounceTrackingProtection.mode", 0); pref("privacy.socialtracking.block_cookies.enabled", false); pref("privacy.annotate_channels.strict_list.enabled", false); // tor-browser#43178: for defense-in-depth, avoid remote overrides to FPP. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4891bcd… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4891bcd… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.5] Bug 41543: Update Ubuntu version used to run mmdebstrap to 24.04.3
by Pier Angelo Vendrame (＠pierov) 20 Aug '25

20 Aug '25

Pier Angelo Vendrame pushed to branch maint-13.5 at The Tor Project / Applications / tor-browser-build Commits: d15a7ca4 by NoisyCoil at 2025-08-20T14:27:02+02:00 Bug 41543: Update Ubuntu version used to run mmdebstrap to 24.04.3 - - - - - 1 changed file: - projects/mmdebstrap-image/config Changes: ===================================== projects/mmdebstrap-image/config ===================================== @@ -7,7 +7,7 @@ container: use_container: 1 var: - ubuntu_version: 22.04.3 + ubuntu_version: 24.04.3 pre: | #!/bin/sh @@ -68,4 +68,4 @@ input_files: name: mmdebstrap - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: ad33b7ae47b75c92c2e2fe21fd4612e15357e67679d8751d6ce892a475be24fe + sha256sum: 6bc2cde3930ad088b3bb46fa45279e96d25bc3810f209850ecbe4722711874f9 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-14.5] Bug 41543: Update Ubuntu version used to run mmdebstrap to 24.04.3
by Pier Angelo Vendrame (＠pierov) 20 Aug '25

20 Aug '25

Pier Angelo Vendrame pushed to branch maint-14.5 at The Tor Project / Applications / tor-browser-build Commits: aee4bf4a by NoisyCoil at 2025-08-19T18:07:27+02:00 Bug 41543: Update Ubuntu version used to run mmdebstrap to 24.04.3 - - - - - 1 changed file: - projects/mmdebstrap-image/config Changes: ===================================== projects/mmdebstrap-image/config ===================================== @@ -7,7 +7,7 @@ container: use_container: 1 var: - ubuntu_version: 22.04.3 + ubuntu_version: 24.04.3 pre: | #!/bin/sh @@ -68,4 +68,4 @@ input_files: name: mmdebstrap - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: ad33b7ae47b75c92c2e2fe21fd4612e15357e67679d8751d6ce892a475be24fe + sha256sum: 6bc2cde3930ad088b3bb46fa45279e96d25bc3810f209850ecbe4722711874f9 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: b66d9c97 by Beatriz Rizental at 2025-08-20T10:31:16+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -282,6 +282,8 @@ pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.cryptomining.enabled", false); pref("privacy.trackingprotection.fingerprinting.enabled", false); pref("privacy.trackingprotection.socialtracking.enabled", false); +// tor-browser#43986: Explicitly disable bounce tracking protection +pref("privacy.bounceTrackingProtection.mode", 0); pref("privacy.socialtracking.block_cookies.enabled", false); pref("privacy.annotate_channels.strict_list.enabled", false); // tor-browser#43178: for defense-in-depth, avoid remote overrides to FPP. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b66d9c9… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b66d9c9… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 98035f31 by Beatriz Rizental at 2025-08-20T10:42:16+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -251,6 +251,9 @@ pref("security.xfocsp.errorReporting.enabled", false); // Added in tor-browser#41496 even though it shuld be already always disabled // since we disable MOZ_CRASHREPORTER. pref("breakpad.reportURL", "data:"); +// tor-browser#43985: Disable captcha detector code that is just used upstream +// for identifying captchas with the purpose of sending telemetry about it. +pref("captchadetection.actor.enabled", false); #ifdef XP_WIN // Defense-in-depth: ensure that the Windows default browser agent will // not ping Mozilla if it is somehow present (we omit it at build time). View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/980… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/980… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch base-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 35774dc9 by Beatriz Rizental at 2025-08-20T10:37:12+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -251,6 +251,9 @@ pref("security.xfocsp.errorReporting.enabled", false); // Added in tor-browser#41496 even though it shuld be already always disabled // since we disable MOZ_CRASHREPORTER. pref("breakpad.reportURL", "data:"); +// tor-browser#43985: Disable captcha detector code that is just used upstream +// for identifying captchas with the purpose of sending telemetry about it. +pref("captchadetection.actor.enabled", false); #ifdef XP_WIN // Defense-in-depth: ensure that the Windows default browser agent will // not ping Mozilla if it is somehow present (we omit it at build time). View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/35774dc… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/35774dc… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! Firefox preference overrides.
by brizental (＠brizental) 20 Aug '25

20 Aug '25

brizental pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: e98acd8f by Beatriz Rizental at 2025-08-20T10:10:37+02:00 fixup! Firefox preference overrides. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -251,6 +251,9 @@ pref("security.xfocsp.errorReporting.enabled", false); // Added in tor-browser#41496 even though it shuld be already always disabled // since we disable MOZ_CRASHREPORTER. pref("breakpad.reportURL", "data:"); +// tor-browser#43985: Disable captcha detector code that is just used upstream +// for identifying captchas with the purpose of sending telemetry about it. +pref("captchadetection.actor.enabled", false); #ifdef XP_WIN // Defense-in-depth: ensure that the Windows default browser agent will // not ping Mozilla if it is somehow present (we omit it at build time). View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e98acd8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e98acd8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 40551: Remove our patch for the Go compiler.
by Pier Angelo Vendrame (＠pierov) 19 Aug '25

19 Aug '25

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b484354a by Pier Angelo Vendrame at 2025-08-19T18:44:06+02:00 Bug 40551: Remove our patch for the Go compiler. - - - - - 4 changed files: - − projects/go/0001-Use-fixed-go-build-tmp-directory.patch - projects/go/README.md - projects/go/build - projects/go/config Changes: ===================================== projects/go/0001-Use-fixed-go-build-tmp-directory.patch deleted ===================================== @@ -1,36 +0,0 @@ -From 2c1c98d6404284df744a194dd23bd3660f365387 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Fri, 17 Apr 2020 10:24:23 +0000 -Subject: [PATCH] Use fixed go-build tmp directory - -Use fixed go-build tmp directory, when the directory does not exist, in -order to avoid some reproducibility issues where build directory gets -embedded in generated binaries. ---- - src/cmd/go/internal/work/action.go | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/src/cmd/go/internal/work/action.go b/src/cmd/go/internal/work/action.go -index 8beb1345d0..dccf39c1c1 100644 ---- a/src/cmd/go/internal/work/action.go -+++ b/src/cmd/go/internal/work/action.go -@@ -279,9 +279,13 @@ func NewBuilder(workDir string) *Builder { - if !buildInitStarted { - panic("internal error: NewBuilder called before BuildInit") - } -- tmp, err := os.MkdirTemp(cfg.Getenv("GOTMPDIR"), "go-build") -- if err != nil { -- base.Fatalf("go: creating work dir: %v", err) -+ tmp := filepath.Join(cfg.Getenv("GOTMPDIR"), "go-build-workdir") -+ _, err := os.Stat(tmp) -+ if !os.IsNotExist(err) { -+ tmp, err = os.MkdirTemp(cfg.Getenv("GOTMPDIR"), "go-build") -+ if err != nil { -+ base.Fatalf("go: creating work dir: %v", err) -+ } - } - if !filepath.IsAbs(tmp) { - abs, err := filepath.Abs(tmp) --- -2.39.2 - ===================================== projects/go/README.md ===================================== @@ -7,7 +7,5 @@ We use it to build the various pluggable transports. We have another project (`go-bootstrap`) to provide it, and we make all targets use the `linux-x86_64` bootstrapper, since we don't need to cross-compile anything with it. -- On Android, we include a patch to fix a temporary directory whose path might - end up on binaries under some circumstances. - We create a compiler wrapper to include our custom arguments on macOS and on Windows because the `make.bash` script seems to lose our arguments. ===================================== projects/go/build ===================================== @@ -43,7 +43,6 @@ cd /var/tmp/dist/go/src chmod +x "$CC_FOR_TARGET" CGO_ENABLED=1 CC_FOR_TARGET="$CC_FOR_TARGET" CC= CFLAGS= LDFLAGS= ./make.bash [% ELSIF c("var/android") -%] - patch -p2 < $rootdir/0001-Use-fixed-go-build-tmp-directory.patch CGO_ENABLED=1 CC_FOR_TARGET=[% c("var/CC") %] CC= CFLAGS= LDFLAGS= ./make.bash [% END -%] ===================================== projects/go/config ===================================== @@ -92,5 +92,3 @@ input_files: name: go-bootstrap target_replace: '^.*browser-(?!testbuild).*': 'basebrowser-linux-x86_64' - - filename: 0001-Use-fixed-go-build-tmp-directory.patch - enable: '[% c("var/android") %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-update-responses][main] 7 commits: release: new version, 14.5.6 (linux-i686)
by ma1 (＠ma1) 19 Aug '25

19 Aug '25

ma1 pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: 596b78fe by hackademix at 2025-08-19T19:29:29+02:00 release: new version, 14.5.6 (linux-i686) - - - - - e2740434 by hackademix at 2025-08-19T19:29:29+02:00 release: new version, 14.5.6 (linux-x86_64) - - - - - 77a900e4 by hackademix at 2025-08-19T19:29:29+02:00 release: new version, 14.5.6 (macos) - - - - - b87e16a5 by hackademix at 2025-08-19T19:29:30+02:00 release: new version, 14.5.6 (windows-i686) - - - - - 6fad930b by hackademix at 2025-08-19T19:29:30+02:00 release: new version, 14.5.6 (windows-x86_64) - - - - - 9e5b15f6 by hackademix at 2025-08-19T19:29:31+02:00 release: new version, 14.5.6 (android) - - - - - c913ee8f by hackademix at 2025-08-19T19:29:31+02:00 release: new version, 14.5.6 - - - - - 73 changed files: - update_3/release/download-android-aarch64.json - update_3/release/download-android-armv7.json - update_3/release/download-android-x86.json - update_3/release/download-android-x86_64.json - update_3/release/download-linux-i686.json - update_3/release/download-linux-x86_64.json - update_3/release/download-macos.json - update_3/release/download-windows-i686.json - update_3/release/download-windows-x86_64.json - update_3/release/downloads.json - update_3/release/linux-i686/.htaccess - − update_3/release/linux-i686/update-14.5.2-14.5.5+13.5.20-linux-i686.xml - − update_3/release/linux-i686/update-14.5.3-14.5.5+13.5.20-linux-i686.xml - + update_3/release/linux-i686/update-14.5.3-14.5.6+13.5.21-linux-i686.xml - − update_3/release/linux-i686/update-14.5.4-14.5.5+13.5.20-linux-i686.xml - + update_3/release/linux-i686/update-14.5.4-14.5.6+13.5.21-linux-i686.xml - − update_3/release/linux-i686/update-14.5.5+13.5.20-linux-i686.xml - + update_3/release/linux-i686/update-14.5.5-14.5.6+13.5.21-linux-i686.xml - + update_3/release/linux-i686/update-14.5.6+13.5.21-linux-i686.xml - update_3/release/linux-x86_64/.htaccess - − update_3/release/linux-x86_64/update-14.5.2-14.5.5+13.5.20-linux-x86_64.xml - − update_3/release/linux-x86_64/update-14.5.3-14.5.5+13.5.20-linux-x86_64.xml - + update_3/release/linux-x86_64/update-14.5.3-14.5.6+13.5.21-linux-x86_64.xml - − update_3/release/linux-x86_64/update-14.5.4-14.5.5+13.5.20-linux-x86_64.xml - + update_3/release/linux-x86_64/update-14.5.4-14.5.6+13.5.21-linux-x86_64.xml - − update_3/release/linux-x86_64/update-14.5.5+13.5.20-linux-x86_64.xml - + update_3/release/linux-x86_64/update-14.5.5-14.5.6+13.5.21-linux-x86_64.xml - + update_3/release/linux-x86_64/update-14.5.6+13.5.21-linux-x86_64.xml - update_3/release/macos/.htaccess - − update_3/release/macos/update-13.5.17-14.5.5+13.5.20-macos.xml - − update_3/release/macos/update-13.5.18-14.5.5+13.5.20-macos.xml - + update_3/release/macos/update-13.5.18-14.5.6+13.5.21-macos.xml - − update_3/release/macos/update-13.5.19-14.5.5+13.5.20-macos.xml - + update_3/release/macos/update-13.5.19-14.5.6+13.5.21-macos.xml - + update_3/release/macos/update-13.5.20-14.5.6+13.5.21-macos.xml - − update_3/release/macos/update-14.5.2-14.5.5+13.5.20-macos.xml - − update_3/release/macos/update-14.5.3-14.5.5+13.5.20-macos.xml - + update_3/release/macos/update-14.5.3-14.5.6+13.5.21-macos.xml - − update_3/release/macos/update-14.5.4-14.5.5+13.5.20-macos.xml - + update_3/release/macos/update-14.5.4-14.5.6+13.5.21-macos.xml - − update_3/release/macos/update-14.5.5+13.5.20-macos.xml - + update_3/release/macos/update-14.5.5-14.5.6+13.5.21-macos.xml - + update_3/release/macos/update-14.5.6+13.5.21-macos.xml - update_3/release/windows-i686/.htaccess - − update_3/release/windows-i686/update-13.5.17-14.5.5+13.5.20-windows-i686.xml - − update_3/release/windows-i686/update-13.5.18-14.5.5+13.5.20-windows-i686.xml - + update_3/release/windows-i686/update-13.5.18-14.5.6+13.5.21-windows-i686.xml - − update_3/release/windows-i686/update-13.5.19-14.5.5+13.5.20-windows-i686.xml - + update_3/release/windows-i686/update-13.5.19-14.5.6+13.5.21-windows-i686.xml - + update_3/release/windows-i686/update-13.5.20-14.5.6+13.5.21-windows-i686.xml - − update_3/release/windows-i686/update-14.5.2-14.5.5+13.5.20-windows-i686.xml - − update_3/release/windows-i686/update-14.5.3-14.5.5+13.5.20-windows-i686.xml - + update_3/release/windows-i686/update-14.5.3-14.5.6+13.5.21-windows-i686.xml - − update_3/release/windows-i686/update-14.5.4-14.5.5+13.5.20-windows-i686.xml - + update_3/release/windows-i686/update-14.5.4-14.5.6+13.5.21-windows-i686.xml - − update_3/release/windows-i686/update-14.5.5+13.5.20-windows-i686.xml - + update_3/release/windows-i686/update-14.5.5-14.5.6+13.5.21-windows-i686.xml - + update_3/release/windows-i686/update-14.5.6+13.5.21-windows-i686.xml - update_3/release/windows-x86_64/.htaccess - − update_3/release/windows-x86_64/update-13.5.17-14.5.5+13.5.20-windows-x86_64.xml - − update_3/release/windows-x86_64/update-13.5.18-14.5.5+13.5.20-windows-x86_64.xml - + update_3/release/windows-x86_64/update-13.5.18-14.5.6+13.5.21-windows-x86_64.xml - − update_3/release/windows-x86_64/update-13.5.19-14.5.5+13.5.20-windows-x86_64.xml - + update_3/release/windows-x86_64/update-13.5.19-14.5.6+13.5.21-windows-x86_64.xml - + update_3/release/windows-x86_64/update-13.5.20-14.5.6+13.5.21-windows-x86_64.xml - − update_3/release/windows-x86_64/update-14.5.2-14.5.5+13.5.20-windows-x86_64.xml - − update_3/release/windows-x86_64/update-14.5.3-14.5.5+13.5.20-windows-x86_64.xml - + update_3/release/windows-x86_64/update-14.5.3-14.5.6+13.5.21-windows-x86_64.xml - − update_3/release/windows-x86_64/update-14.5.4-14.5.5+13.5.20-windows-x86_64.xml - + update_3/release/windows-x86_64/update-14.5.4-14.5.6+13.5.21-windows-x86_64.xml - − update_3/release/windows-x86_64/update-14.5.5+13.5.20-windows-x86_64.xml - + update_3/release/windows-x86_64/update-14.5.5-14.5.6+13.5.21-windows-x86_64.xml - + update_3/release/windows-x86_64/update-14.5.6+13.5.21-windows-x86_64.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] fixup! BB 18905: Hide unwanted items from help menu
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 518cccfe by Henry Wilkes at 2025-08-19T12:53:57+00:00 fixup! BB 18905: Hide unwanted items from help menu TB 43903: Hide "Report broken site" items. - - - - - 1 changed file: - browser/components/reportbrokensite/ReportBrokenSite.sys.mjs Changes: ===================================== browser/components/reportbrokensite/ReportBrokenSite.sys.mjs ===================================== @@ -452,9 +452,8 @@ export var ReportBrokenSite = new (class ReportBrokenSite { // Altering the disabled attribute on the command does not propagate // the change to the related menuitems (see bug 805653), so we change them all. const cmd = document.getElementById("cmd_reportBrokenSite"); - const allowedByPolicy = Services.policies.isAllowed( - "DisableFeedbackCommands" - ); + // Hide the items in base-browser. tor-browser#43903. + const allowedByPolicy = false; if (allowedByPolicy) { cmd.setAttribute("hidden", "false"); // see bug 805653 } else { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/518… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/518… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.2.0esr-15.0-1] fixup! BB 18905: Hide unwanted items from help menu
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch base-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 836e8132 by Henry Wilkes at 2025-08-19T12:52:18+00:00 fixup! BB 18905: Hide unwanted items from help menu TB 43903: Hide "Report broken site" items. - - - - - 1 changed file: - browser/components/reportbrokensite/ReportBrokenSite.sys.mjs Changes: ===================================== browser/components/reportbrokensite/ReportBrokenSite.sys.mjs ===================================== @@ -452,9 +452,8 @@ export var ReportBrokenSite = new (class ReportBrokenSite { // Altering the disabled attribute on the command does not propagate // the change to the related menuitems (see bug 805653), so we change them all. const cmd = document.getElementById("cmd_reportBrokenSite"); - const allowedByPolicy = Services.policies.isAllowed( - "DisableFeedbackCommands" - ); + // Hide the items in base-browser. tor-browser#43903. + const allowedByPolicy = false; if (allowedByPolicy) { cmd.setAttribute("hidden", "false"); // see bug 805653 } else { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/836e813… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/836e813… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! BB 18905: Hide unwanted items from help menu
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 4be90537 by Henry Wilkes at 2025-08-19T12:34:59+00:00 fixup! BB 18905: Hide unwanted items from help menu TB 43903: Hide "Report broken site" items. - - - - - 1 changed file: - browser/components/reportbrokensite/ReportBrokenSite.sys.mjs Changes: ===================================== browser/components/reportbrokensite/ReportBrokenSite.sys.mjs ===================================== @@ -452,9 +452,8 @@ export var ReportBrokenSite = new (class ReportBrokenSite { // Altering the disabled attribute on the command does not propagate // the change to the related menuitems (see bug 805653), so we change them all. const cmd = document.getElementById("cmd_reportBrokenSite"); - const allowedByPolicy = Services.policies.isAllowed( - "DisableFeedbackCommands" - ); + // Hide the items in base-browser. tor-browser#43903. + const allowedByPolicy = false; if (allowedByPolicy) { cmd.setAttribute("hidden", "false"); // see bug 805653 } else { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4be9053… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4be9053… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] fixup! MB 213: Customize the search engines list
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: fc0be3f5 by Pier Angelo Vendrame at 2025-08-19T12:33:56+00:00 fixup! MB 213: Customize the search engines list TB 43728: Update search engine icon size. Update the .ico sizes in mullvadBrowserSearchEngineIcons.json to match the biggest available size. Add a 32x32 icon for Startpage and update its 16x16 one. - - - - - 4 changed files: - toolkit/components/search/content/mullvadBrowserSearchEngineIcons.json - + toolkit/components/search/content/startpage-16.png - + toolkit/components/search/content/startpage-32.png - − toolkit/components/search/content/startpage.png Changes: ===================================== toolkit/components/search/content/mullvadBrowserSearchEngineIcons.json ===================================== @@ -1,23 +1,27 @@ { "ddg": [ - { "url": "chrome://global/content/search/duckduckgo.ico", "iconSize": 16 } + { "url": "chrome://global/content/search/duckduckgo.ico", "iconSize": 32 } ], "ddg-html": [ - { "url": "chrome://global/content/search/duckduckgo.ico", "iconSize": 16 } + { "url": "chrome://global/content/search/duckduckgo.ico", "iconSize": 32 } ], "mullvad-leta": [ { "url": "chrome://global/content/search/mullvad-leta.svg", "iconSize": 16 } ], "mojeek": [ - { "url": "chrome://global/content/search/mojeek.ico", "iconSize": 16 } + { "url": "chrome://global/content/search/mojeek.ico", "iconSize": 32 } ], "brave": [ { "url": "chrome://global/content/search/brave.svg", "iconSize": 16 } ], "startpage": [ - { "url": "chrome://global/content/search/startpage.png", "iconSize": 16 } + { + "url": "chrome://global/content/search/startpage-16.png", + "iconSize": 16 + }, + { "url": "chrome://global/content/search/startpage-32.png", "iconSize": 32 } ], "metager": [ - { "url": "chrome://global/content/search/metager.ico", "iconSize": 16 } + { "url": "chrome://global/content/search/metager.ico", "iconSize": 196 } ] } ===================================== toolkit/components/search/content/startpage-16.png ===================================== Binary files /dev/null and b/toolkit/components/search/content/startpage-16.png differ ===================================== toolkit/components/search/content/startpage-32.png ===================================== Binary files /dev/null and b/toolkit/components/search/content/startpage-32.png differ ===================================== toolkit/components/search/content/startpage.png deleted ===================================== Binary files a/toolkit/components/search/content/startpage.png and /dev/null differ View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/fc0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/fc0… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! TB 42891: Set the bundled search engine for Tor Browser.
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 56d378c4 by Pier Angelo Vendrame at 2025-08-19T12:30:46+00:00 fixup! TB 42891: Set the bundled search engine for Tor Browser. TB 43728: Update search engine icon sizes. The .ico we're using for DDG and Wikipedia already contains the 32px variant, so update the size. Firefox should already do the best choice between the two available sizes. For Startpage, update the favicon, and ship both the 16px and the 32px icons. - - - - - 4 changed files: - + toolkit/components/search/content/startpage-16.png - + toolkit/components/search/content/startpage-32.png - − toolkit/components/search/content/startpage.png - toolkit/components/search/content/torBrowserSearchEngineIcons.json Changes: ===================================== toolkit/components/search/content/startpage-16.png ===================================== Binary files /dev/null and b/toolkit/components/search/content/startpage-16.png differ ===================================== toolkit/components/search/content/startpage-32.png ===================================== Binary files /dev/null and b/toolkit/components/search/content/startpage-32.png differ ===================================== toolkit/components/search/content/startpage.png deleted ===================================== Binary files a/toolkit/components/search/content/startpage.png and /dev/null differ ===================================== toolkit/components/search/content/torBrowserSearchEngineIcons.json ===================================== @@ -2,31 +2,39 @@ "ddg": [ { "url": "chrome://global/content/search/duckduckgo.ico", - "imageSize": 16 + "imageSize": 32 } ], "ddg-onion": [ { "url": "chrome://global/content/search/duckduckgo.ico", - "imageSize": 16 + "imageSize": 32 } ], "startpage": [ { - "url": "chrome://global/content/search/startpage.png", + "url": "chrome://global/content/search/startpage-16.png", "imageSize": 16 + }, + { + "url": "chrome://global/content/search/startpage-32.png", + "imageSize": 32 } ], "startpage-onion": [ { - "url": "chrome://global/content/search/startpage.png", + "url": "chrome://global/content/search/startpage-16.png", "imageSize": 16 + }, + { + "url": "chrome://global/content/search/startpage-32.png", + "imageSize": 32 } ], "wikipedia": [ { "url": "chrome://global/content/search/wikipedia.ico", - "imageSize": 16 + "imageSize": 32 } ] } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/56d378c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/56d378c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] BB 43902: Modify the new sidebar for Base Browser.
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 4f240699 by Henry Wilkes at 2025-08-19T12:09:22+00:00 BB 43902: Modify the new sidebar for Base Browser. - - - - - 1 changed file: - browser/components/sidebar/browser-sidebar.js Changes: ===================================== browser/components/sidebar/browser-sidebar.js ===================================== @@ -113,6 +113,9 @@ var SidebarController = { gleanEvent: Glean.history.sidebarToggle, gleanClickEvent: Glean.sidebar.historyIconClick, recordSidebarVersion: true, + // In permanent private browsing, the history panel can be opened, but + // we hide the sidebar button to control this. tor-browser#43902. + visible: !PrivateBrowsingUtils.permanentPrivateBrowsing, }), ], [ @@ -131,6 +134,15 @@ var SidebarController = { ? "sidebar-synced-tabs-context-menu" : undefined, gleanClickEvent: Glean.sidebar.syncedTabsIconClick, + // firefoxview is disabled. tor-browser#42037 and tor-browser#43902. + // See bugzilla bug 1983505. + // NOTE: The menuId and elementId menu items (sidebar switchers) + // should be hidden via the `sync-ui-item` class, which will *one* + // time hide the menu items via gSync.init. + // #sidebar-switcher-tabs is already in the initial browser DOM, + // and #menu_tabsSidebar is created during SidebarController.init, + // which seems to run prior to gSync.init. + visible: false, }), ], [ View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/4f2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/4f2… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.2.0esr-15.0-1] BB 43902: Modify the new sidebar for Base Browser.
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch base-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 76412dec by Henry Wilkes at 2025-08-19T12:08:17+00:00 BB 43902: Modify the new sidebar for Base Browser. - - - - - 1 changed file: - browser/components/sidebar/browser-sidebar.js Changes: ===================================== browser/components/sidebar/browser-sidebar.js ===================================== @@ -113,6 +113,9 @@ var SidebarController = { gleanEvent: Glean.history.sidebarToggle, gleanClickEvent: Glean.sidebar.historyIconClick, recordSidebarVersion: true, + // In permanent private browsing, the history panel can be opened, but + // we hide the sidebar button to control this. tor-browser#43902. + visible: !PrivateBrowsingUtils.permanentPrivateBrowsing, }), ], [ @@ -131,6 +134,15 @@ var SidebarController = { ? "sidebar-synced-tabs-context-menu" : undefined, gleanClickEvent: Glean.sidebar.syncedTabsIconClick, + // firefoxview is disabled. tor-browser#42037 and tor-browser#43902. + // See bugzilla bug 1983505. + // NOTE: The menuId and elementId menu items (sidebar switchers) + // should be hidden via the `sync-ui-item` class, which will *one* + // time hide the menu items via gSync.init. + // #sidebar-switcher-tabs is already in the initial browser DOM, + // and #menu_tabsSidebar is created during SidebarController.init, + // which seems to run prior to gSync.init. + visible: false, }), ], [ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/76412de… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/76412de… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] BB 43902: Modify the new sidebar for Base Browser.
by morgan (＠morgan) 19 Aug '25

19 Aug '25

morgan pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 2c5430c0 by Henry Wilkes at 2025-08-18T14:04:47+01:00 BB 43902: Modify the new sidebar for Base Browser. - - - - - 1 changed file: - browser/components/sidebar/browser-sidebar.js Changes: ===================================== browser/components/sidebar/browser-sidebar.js ===================================== @@ -113,6 +113,9 @@ var SidebarController = { gleanEvent: Glean.history.sidebarToggle, gleanClickEvent: Glean.sidebar.historyIconClick, recordSidebarVersion: true, + // In permanent private browsing, the history panel can be opened, but + // we hide the sidebar button to control this. tor-browser#43902. + visible: !PrivateBrowsingUtils.permanentPrivateBrowsing, }), ], [ @@ -131,6 +134,15 @@ var SidebarController = { ? "sidebar-synced-tabs-context-menu" : undefined, gleanClickEvent: Glean.sidebar.syncedTabsIconClick, + // firefoxview is disabled. tor-browser#42037 and tor-browser#43902. + // See bugzilla bug 1983505. + // NOTE: The menuId and elementId menu items (sidebar switchers) + // should be hidden via the `sync-ui-item` class, which will *one* + // time hide the menu items via gSync.init. + // #sidebar-switcher-tabs is already in the initial browser DOM, + // and #menu_tabsSidebar is created during SidebarController.init, + // which seems to run prior to gSync.init. + visible: false, }), ], [ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2c5430c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2c5430c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-14.5.6-build1
by ma1 (＠ma1) 19 Aug '25

19 Aug '25

ma1 pushed new tag tbb-14.5.6-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-13.5.21-build1
by ma1 (＠ma1) 18 Aug '25

18 Aug '25

ma1 pushed new tag tbb-13.5.21-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-115.27.0esr-13.5-1-build3
by ma1 (＠ma1) 18 Aug '25

18 Aug '25

ma1 pushed new tag tor-browser-115.27.0esr-13.5-1-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.5] Bug 41521: Prepare Tor Browser 13.5.21
by ma1 (＠ma1) 18 Aug '25

18 Aug '25

ma1 pushed to branch maint-13.5 at The Tor Project / Applications / tor-browser-build Commits: 5f977a1f by hackademix at 2025-08-18T21:48:21+02:00 Bug 41521: Prepare Tor Browser 13.5.21 - - - - - 5 changed files: - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,12 @@ +Tor Browser 13.5.21 - August 19 2025 + * All Platforms + * Updated Firefox to 115.27.0esr + * Updated NoScript to 13.0.9 + * Bug 43168: Review ESR 115 expiry date for legacy OS message [tor-browser] + * Bug 44041: Letterboxing causes greyed out alert background to be mis-aligned [tor-browser] + * Bug 44048: Backport Bug 1979608 [tor-browser] + * Bug 44100: Backport Security Fixes from Firefox 142 [tor-browser] + Tor Browser 13.5.20 - July 22 2025 * All Platforms * Updated Firefox to 115.26.0esr ===================================== projects/browser/config ===================================== @@ -103,9 +103,9 @@ input_files: enable: '[% ! c("var/android") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.mozilla.org/firefox/downloads/file/4497468/noscript-13.0.8.x… + - URL: https://addons.mozilla.org/firefox/downloads/file/4551629/noscript-13.0.9.x… name: noscript - sha256sum: 9d978cfe083cb9cce120b5ee41e8933d752d7ab4680bf517c5ec4b29c4cfd2dc + sha256sum: 525ab61aff21f67d10c3e20965a86ed479631549908a658f54692adc47d771f5 - URL: https://addons.mozilla.org/firefox/downloads/file/4359936/ublock_origin-1.6… name: ublock-origin sha256sum: e2cda9b2a1b0a7f6e5ef0da9f87f28df52f8560587ba2e51a3003121cfb81600 ===================================== projects/firefox/config ===================================== @@ -16,7 +16,7 @@ container: use_container: 1 var: - firefox_platform_version: 115.26.0 + firefox_platform_version: 115.27.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' browser_series: '13.5' browser_rebase: 1 ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: 8600afeb12fdae895c37618e1386c1a1ac2f5308 + git_hash: e3eb649b9b964e3e874969aae0bf51cfa35488f9 targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: 9fe8a13ee4c69f91cd545dc3c575ca8f4851d58e + git_hash: e8471a5feca51868b261ecf3238f387269177427 targets: nightly: git_hash: 'tor-browser' ===================================== rbm.conf ===================================== @@ -73,18 +73,18 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '13.5.20' + torbrowser_version: '13.5.21' torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2025/07/22 13:07:32' + browser_release_date: '2025/08/18 19:35:49' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + - 13.5.20 - 13.5.19 - 13.5.18 - - 13.5.17 mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # By default, we sort the list of installed packages. This allows sharing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.27.0esr-13.5-1] fixup! Bug 43125: Extend the 13.5 EOL expiry date for tor-browser.
by morgan (＠morgan) 18 Aug '25

18 Aug '25

morgan pushed to branch tor-browser-115.27.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 6d7f63e9 by Henry Wilkes at 2025-08-18T18:16:27+01:00 fixup! Bug 43125: Extend the 13.5 EOL expiry date for tor-browser. TB 43168: Extend the 13.5 EOL to 14th October 2025. - - - - - 1 changed file: - browser/base/content/droppedSupportNotification.js Changes: ===================================== browser/base/content/droppedSupportNotification.js ===================================== @@ -3,8 +3,8 @@ // Show a prompt that a user's system will no longer be supported. window.addEventListener("load", () => { let labelId; - // Firefox moved ESR 115 EOL to 16th September 2025. - const isExpired = Date.now() > Date.UTC(2025, 8, 16); + // ESR 115 EOL pushed to 14th October 2025. + const isExpired = Date.now() > Date.UTC(2025, 9, 14); if ( AppConstants.platform === "macosx" && View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6d7f63e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6d7f63e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser-update-responses][main] 4 commits: release: new version, 14.5.6 (linux-x86_64)
by ma1 (＠ma1) 18 Aug '25

18 Aug '25

ma1 pushed to branch main at The Tor Project / Applications / mullvad-browser-update-responses Commits: a18955e5 by hackademix at 2025-08-18T18:30:44+02:00 release: new version, 14.5.6 (linux-x86_64) - - - - - 710c12ea by hackademix at 2025-08-18T18:30:45+02:00 release: new version, 14.5.6 (macos) - - - - - 269a05c4 by hackademix at 2025-08-18T18:30:45+02:00 release: new version, 14.5.6 (windows-x86_64) - - - - - 670215e8 by hackademix at 2025-08-18T18:30:46+02:00 release: new version, 14.5.6 - - - - - 31 changed files: - update_1/release/download-linux-x86_64.json - update_1/release/download-macos.json - update_1/release/download-windows-x86_64.json - update_1/release/downloads.json - update_1/release/linux-x86_64/.htaccess - − update_1/release/linux-x86_64/update-14.5.2-14.5.5-linux-x86_64.xml - − update_1/release/linux-x86_64/update-14.5.3-14.5.5-linux-x86_64.xml - + update_1/release/linux-x86_64/update-14.5.3-14.5.6-linux-x86_64.xml - − update_1/release/linux-x86_64/update-14.5.4-14.5.5-linux-x86_64.xml - + update_1/release/linux-x86_64/update-14.5.4-14.5.6-linux-x86_64.xml - + update_1/release/linux-x86_64/update-14.5.5-14.5.6-linux-x86_64.xml - − update_1/release/linux-x86_64/update-14.5.5-linux-x86_64.xml - + update_1/release/linux-x86_64/update-14.5.6-linux-x86_64.xml - update_1/release/macos/.htaccess - − update_1/release/macos/update-14.5.2-14.5.5-macos.xml - − update_1/release/macos/update-14.5.3-14.5.5-macos.xml - + update_1/release/macos/update-14.5.3-14.5.6-macos.xml - − update_1/release/macos/update-14.5.4-14.5.5-macos.xml - + update_1/release/macos/update-14.5.4-14.5.6-macos.xml - + update_1/release/macos/update-14.5.5-14.5.6-macos.xml - − update_1/release/macos/update-14.5.5-macos.xml - + update_1/release/macos/update-14.5.6-macos.xml - update_1/release/windows-x86_64/.htaccess - − update_1/release/windows-x86_64/update-14.5.2-14.5.5-windows-x86_64.xml - − update_1/release/windows-x86_64/update-14.5.3-14.5.5-windows-x86_64.xml - + update_1/release/windows-x86_64/update-14.5.3-14.5.6-windows-x86_64.xml - − update_1/release/windows-x86_64/update-14.5.4-14.5.5-windows-x86_64.xml - + update_1/release/windows-x86_64/update-14.5.4-14.5.6-windows-x86_64.xml - + update_1/release/windows-x86_64/update-14.5.5-14.5.6-windows-x86_64.xml - − update_1/release/windows-x86_64/update-14.5.5-windows-x86_64.xml - + update_1/release/windows-x86_64/update-14.5.6-windows-x86_64.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-respo… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-respo… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.27.0esr-13.5-1] 3 commits: Bug 672618 - Don't execute javascript: URLs on CTRL+click, middle-click etc. r=dao
by ma1 (＠ma1) 18 Aug '25

18 Aug '25

ma1 pushed to branch tor-browser-115.27.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: f89188bd by Tom Schuster at 2025-08-18T17:22:37+02:00 Bug 672618 - Don't execute javascript: URLs on CTRL+click, middle-click etc. r=dao Differential Revision: https://phabricator.services.mozilla.com/D256648 BB 44100: cherry-picked except tests - - - - - 85feb19a by Steve Fink at 2025-08-18T17:22:42+02:00 Bug 1977130 - Error-check pthread_getattr_np. r=glandium,spidermonkey-reviewers,jandem, a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D258648 - - - - - 3239846a by Kershaw Chang at 2025-08-18T17:22:43+02:00 Bug 1979955 - ensure transaction is alive (for ESR140), a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D260484 - - - - - 5 changed files: - browser/actors/ClickHandlerChild.sys.mjs - browser/app/profile/firefox.js - js/src/util/NativeStack.cpp - mozglue/misc/StackWalk.cpp - netwerk/protocol/http/nsHttpConnection.cpp Changes: ===================================== browser/actors/ClickHandlerChild.sys.mjs ===================================== @@ -12,12 +12,26 @@ ChromeUtils.defineESModuleGetters(lazy, { E10SUtils: "resource://gre/modules/E10SUtils.sys.mjs", }); +XPCOMUtils.defineLazyPreferenceGetter( + lazy, + "autoscrollEnabled", + "general.autoScroll", + true +); + +XPCOMUtils.defineLazyPreferenceGetter( + lazy, + "blockJavascript", + "browser.link.alternative_click.block_javascript", + true +); + export class MiddleMousePasteHandlerChild extends JSWindowActorChild { handleEvent(clickEvent) { if ( clickEvent.defaultPrevented || clickEvent.button != 1 || - MiddleMousePasteHandlerChild.autoscrollEnabled + lazy.autoscrollEnabled ) { return; } @@ -34,13 +48,6 @@ export class MiddleMousePasteHandlerChild extends JSWindowActorChild { } } -XPCOMUtils.defineLazyPreferenceGetter( - MiddleMousePasteHandlerChild, - "autoscrollEnabled", - "general.autoScroll", - true -); - export class ClickHandlerChild extends JSWindowActorChild { handleEvent(wrapperEvent) { this.handleClickEvent(wrapperEvent.sourceEvent); @@ -112,6 +119,14 @@ export class ClickHandlerChild extends JSWindowActorChild { }; if (href && !isFromMiddleMousePasteHandler) { + if ( + lazy.blockJavascript && + Services.io.extractScheme(href) == "javascript" + ) { + // We don't want to open new tabs or windows for javascript: links. + return; + } + try { Services.scriptSecurityManager.checkLoadURIStrWithPrincipal( principal, ===================================== browser/app/profile/firefox.js ===================================== @@ -759,6 +759,9 @@ pref("browser.link.open_newwindow.restriction", 2); pref("browser.link.open_newwindow.disabled_in_fullscreen", false); #endif +// If true, opening javscript: URLs using middle-click, CTRL+click etc. are blocked. +pref("browser.link.alternative_click.block_javascript", true); + // Tabbed browser pref("browser.tabs.closeTabByDblclick", false); pref("browser.tabs.closeWindowWithLastTab", true); ===================================== js/src/util/NativeStack.cpp ===================================== @@ -95,17 +95,16 @@ void* js::GetNativeStackBaseImpl() { pthread_t thread = pthread_self(); pthread_attr_t sattr; pthread_attr_init(&sattr); - pthread_getattr_np(thread, &sattr); + int rc = pthread_getattr_np(thread, &sattr); + MOZ_RELEASE_ASSERT(rc == 0, "pthread_getattr_np failed"); // stackBase will be the *lowest* address on all architectures. void* stackBase = nullptr; size_t stackSize = 0; - int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize); - if (rc) { - MOZ_CRASH( - "call to pthread_attr_getstack failed, unable to setup stack range for " - "JS"); - } + rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize); + MOZ_RELEASE_ASSERT(rc == 0, + "call to pthread_attr_getstack failed, unable to setup " + "stack range for JS"); MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS"); pthread_attr_destroy(&sattr); @@ -148,7 +147,8 @@ void* js::GetNativeStackBaseImpl() { * FIXME: this function is non-portable; * other POSIX systems may have different np alternatives */ - pthread_getattr_np(thread, &sattr); + MOZ_RELEASE_ASSERT(pthread_getattr_np(thread, &sattr) == 0, + "pthread_getattr_np failed"); # endif void* stackBase = 0; ===================================== mozglue/misc/StackWalk.cpp ===================================== @@ -695,7 +695,8 @@ MFBT_API void MozStackWalk(MozWalkStackCallback aCallback, # elif defined(ANDROID) pthread_attr_t sattr; pthread_attr_init(&sattr); - pthread_getattr_np(pthread_self(), &sattr); + int rc = pthread_getattr_np(pthread_self(), &sattr); + MOZ_RELEASE_ASSERT(rc == 0, "pthread_getattr_np failed"); void* stackBase = stackEnd = nullptr; size_t stackSize = 0; if (gettid() != getpid()) { ===================================== netwerk/protocol/http/nsHttpConnection.cpp ===================================== @@ -1635,9 +1635,10 @@ nsresult nsHttpConnection::OnSocketWritable() { } LOG((" writing transaction request stream\n")); - rv = mTransaction->ReadSegmentsAgain(this, - nsIOService::gDefaultSegmentSize, - &transactionBytes, &again); + RefPtr<nsAHttpTransaction> transaction = mTransaction; + rv = transaction->ReadSegmentsAgain(this, + nsIOService::gDefaultSegmentSize, + &transactionBytes, &again); if (mTlsHandshaker->EarlyDataUsed()) { mContentBytesWritten0RTT += transactionBytes; if (NS_FAILED(rv) && rv != NS_BASE_STREAM_WOULD_BLOCK) { @@ -1660,7 +1661,8 @@ nsresult nsHttpConnection::OnSocketWritable() { static_cast<uint32_t>(mSocketOutCondition), again)); // XXX some streams return NS_BASE_STREAM_CLOSED to indicate EOF. - if (rv == NS_BASE_STREAM_CLOSED && !mTransaction->IsDone()) { + if (rv == NS_BASE_STREAM_CLOSED && + (mTransaction && !mTransaction->IsDone())) { rv = NS_OK; transactionBytes = 0; } @@ -1703,7 +1705,8 @@ nsresult nsHttpConnection::OnSocketWritable() { // When Spdy tunnel is used we need to explicitly set when a request is // done. if ((mState != HttpConnectionState::SETTING_UP_TUNNEL) && !mSpdySession) { - nsHttpTransaction* trans = mTransaction->QueryHttpTransaction(); + nsHttpTransaction* trans = + mTransaction ? mTransaction->QueryHttpTransaction() : nullptr; // needed for websocket over h2 (direct) if (!trans || !trans->IsWebsocketUpgrade()) { mRequestDone = true; @@ -1806,7 +1809,8 @@ nsresult nsHttpConnection::OnSocketReadable() { rv = NS_ERROR_FAILURE; LOG((" No Transaction In OnSocketWritable\n")); } else { - rv = mTransaction->WriteSegmentsAgain( + RefPtr<nsAHttpTransaction> transaction = mTransaction; + rv = transaction->WriteSegmentsAgain( this, nsIOService::gDefaultSegmentSize, &n, &again); } LOG(("nsHttpConnection::OnSocketReadable %p trans->ws rv=%" PRIx32 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/667d6d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/667d6d… You're receiving this email because of your account on gitlab.torproject.org.

1 0