- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-15.0-build2
by morgan (＠morgan) 28 Oct '25

28 Oct '25

morgan pushed new tag tbb-15.0-build2 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41584,41585: Prepare Tor, Mullvad Browser 15.0 build2
by morgan (＠morgan) 28 Oct '25

28 Oct '25

morgan pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: c8a24a7a by Morgan at 2025-10-28T09:48:31+00:00 Bug 41584,41585: Prepare Tor, Mullvad Browser 15.0 build2 - - - - - 5 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/firefox/config - projects/geckoview/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,4 +1,4 @@ -Mullvad Browser 15.0 - October 28 +Mullvad Browser 15.0 - October 28 2025 * All Platforms * Updated Firefox to 140.4.0esr * Updated NoScript to 13.2.2 @@ -64,6 +64,8 @@ Mullvad Browser 15.0 - October 28 * Bug 44234: No images in PDF [tor-browser] * Bug 44242: Hand over Security Level's WebAssembly controls to NoScript [tor-browser] * Bug 44262: Disable adding search engines from HTML forms [tor-browser] + * Bug 44270: Match Firefox's TLS fingerprint [tor-browser] + * Bug 44275: Reduce console noise on security level guess [tor-browser] * Bug 44279: Disable contextual search install prompt [tor-browser] * Windows * Bug 440: Make abseil use win32 thread model on mingw [mullvad-browser] @@ -73,9 +75,11 @@ Mullvad Browser 15.0 - October 28 * Bug 43950: Review Mozilla 1894818: Support HEVC playback on Linux [tor-browser] * Bug 43959: Make Noto Color Emoji the default emoji font on Linux [tor-browser] * Bug 44227: Some CJK characters cannot be rendered by Tor which uses the Noto font family [tor-browser] + * Bug 44286: Hardcode GTK system font [tor-browser] * Bug 41586: Replace Noto CJK with Jigmo on Linux [tor-browser-build] * Build System * All Platforms + * Bug 466: Automate the release process / replace the new build email [mullvad-browser] * Bug 43891: Update the translation CI to use the new mozilla versions [tor-browser] * Bug 44067: Move --enable-geckodriver only to Linux-only mozconfigs [tor-browser] * Bug 44103: git's export-subst is a reproducibility problem [tor-browser] ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -20,9 +20,12 @@ Tor Browser 15.0 - October 28 2025 * Bug 44069: Update `meek-azure` related strings to `meek` [tor-browser] * Bug 44140: Refactored patch to prevent writing temp PDF files to disk [tor-browser] * Bug 44234: No images in PDF [tor-browser] + * Bug 44275: Reduce console noise on security level guess [tor-browser] + * Bug 44280: Test stream isolation [tor-browser] * Bug 41429: Add a note about user safety to Tor Browser Alpha blog posts [tor-browser-build] * Bug 41442: Update our audit CSVs to use the new Audit template [tor-browser-build] * Bug 41502: Application services build is failing on isNetworkAllowed() [tor-browser-build] + * Bug 41609: Use new CDN77 fronts for snowflake [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 140.4.0esr * Bug 42025: Purple elements (e.g. Tor buttons) need dark theme variants [tor-browser] @@ -88,6 +91,7 @@ Tor Browser 15.0 - October 28 2025 * Bug 44221: Backport MozBug 1984333 Bump Spoofed Processor Count [tor-browser] * Bug 44239: DDG HTML page and search results displayed incorrectly with Safest security setting [tor-browser] * Bug 44262: Disable adding search engines from HTML forms [tor-browser] + * Bug 44270: Match Firefox's TLS fingerprint [tor-browser] * Bug 44279: Disable contextual search install prompt [tor-browser] * Windows + Android * Bug 44062: Force touch enabled on Windows and Android [tor-browser] @@ -99,6 +103,7 @@ Tor Browser 15.0 - October 28 2025 * Bug 43950: Review Mozilla 1894818: Support HEVC playback on Linux [tor-browser] * Bug 43959: Make Noto Color Emoji the default emoji font on Linux [tor-browser] * Bug 44227: Some CJK characters cannot be rendered by Tor which uses the Noto font family [tor-browser] + * Bug 44286: Hardcode GTK system font [tor-browser] * Bug 41586: Replace Noto CJK with Jigmo on Linux [tor-browser-build] * Android * Updated GeckoView to 140.4.0esr @@ -110,6 +115,7 @@ Tor Browser 15.0 - October 28 2025 * Bug 43676: Preemptively disable unified trust panel by default so we are tracking for next ESR [tor-browser] * Bug 43699: Dummy "about:" pages are not cleared from recently closed tabs (and possibly elsewhere) because they are normal tabs, not private tabs. [tor-browser] * Bug 43755: Restore functionality of "switch to tab" urlbar suggestion [tor-browser] + * Bug 43757: Disable setting for trending search [tor-browser] * Bug 43826: Review Mozilla 1960122: Use `MOZ_BUILD_DATE` in Fenix build configuration [tor-browser] * Bug 43855: brand.properties merging on Android is broken in 140 [tor-browser] * Bug 43943: Review Mozilla 1928705: Ship Android Font Restrictions as part of FPP [tor-browser] @@ -124,7 +130,9 @@ Tor Browser 15.0 - October 28 2025 * Bug 44133: Hide the "Allow in private browsing" checkboxes from WebExtension management UI [tor-browser] * Bug 44139: Restore the (inactive) YouTube and Reddit search plugins on Android [tor-browser] * Bug 44172: Fix crash in TorAndroidIntegration.handleMessage() [tor-browser] + * Bug 44196: Persistent notification sometimes does not clear [tor-browser] * Bug 44237: Revoke access to all advertising ids available in Android [tor-browser] + * Bug 44293: Force immediate NoScript update checks after bootstrap [tor-browser] * Bug 41494: Update GeckoView build scripts for ESR140 [tor-browser-build] * Build System * All Platforms ===================================== projects/firefox/config ===================================== @@ -21,7 +21,7 @@ var: browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 4 + browser_build: 5 copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]' nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]' gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser @@ -114,7 +114,7 @@ targets: updater_url: 'https://cdn.mullvad.net/browser/update_responses/update_1/' mar_id_prefix: 'mullvadbrowser-mullvad' nightly_updates_publish_dir_prefix: mullvadbrowser- - browser_build: 3 + browser_build: 4 linux-x86_64: var: ===================================== projects/geckoview/config ===================================== @@ -23,7 +23,7 @@ var: browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 4 + browser_build: 5 gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]' deps: ===================================== rbm.conf ===================================== @@ -75,10 +75,10 @@ buildconf: var: torbrowser_version: '15.0' - torbrowser_build: 'build1' + torbrowser_build: 'build2' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2025/10/20 17:00:00' + browser_release_date: '2025/10/28 09:45:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: release browser_platforms: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-140.4.0esr-15.0-1-build4
by morgan (＠morgan) 28 Oct '25

28 Oct '25

morgan pushed new tag mullvad-browser-140.4.0esr-15.0-1-build4 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-140.4.0esr-15.0-1-build5
by ma1 (＠ma1) 28 Oct '25

28 Oct '25

ma1 pushed new tag tor-browser-140.4.0esr-15.0-1-build5 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.4.0esr-15.0-1] fixup! [android] Modify add-on support
by ma1 (＠ma1) 28 Oct '25

28 Oct '25

ma1 pushed to branch tor-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: ab8cd7fd by hackademix at 2025-10-28T10:09:52+01:00 fixup! [android] Modify add-on support TB 44293: Force immediate NoScript update checks after bootstraps - - - - - 1 changed file: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/TorBrowserFeatures.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/TorBrowserFeatures.kt ===================================== @@ -146,11 +146,10 @@ object TorBrowserFeatures { override fun onBootstrapped() { // Enable automatic updates. This must be done on every startup (tor-browser#42353) context.components.addonUpdater.registerForFutureUpdates(NOSCRIPT_ID) - // Force a one-time immediate update check for older installations - if (settings.noscriptUpdated < 2) { - context.components.addonUpdater.update(NOSCRIPT_ID) - settings.noscriptUpdated = 2 - } + // Force an immediate update check for older installations + // and as belt-and-suspenders if scheduled updates fail (tor-browser#44293) + context.components.addonUpdater.update(NOSCRIPT_ID) + settings.noscriptUpdated = 2 } }) } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ab8cd7f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ab8cd7f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.4.0esr-15.0-1] fixup! fixup! [android] Disable features and functionality
by Dan Ballard (＠dan) 28 Oct '25

28 Oct '25

Dan Ballard pushed to branch tor-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 3d1010a2 by Dan Ballard at 2025-10-27T16:05:30-07:00 fixup! fixup! [android] Disable features and functionality Bug 43918: disable composable toolbar for esr 140 - - - - - 1 changed file: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt ===================================== @@ -1943,7 +1943,10 @@ class Settings(private val appContext: Context) : PreferencesHolder { var shouldUseComposableToolbar by lazyFeatureFlagPreference( key = appContext.getPreferenceKey(R.string.pref_key_enable_composable_toolbar), - default = { FxNimbus.features.composableToolbar.value().enabled }, + // tb-43918 + // Setting to off for esr140 since we've done no work for it, but it appears moz has enabled + // by default in 144 so we'll likely be switching this to true and porting to it for esr-next + default = { false }, featureFlag = true, ) View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3d1010a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3d1010a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.29.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 27 Oct '25

27 Oct '25

Pier Angelo Vendrame pushed to branch tor-browser-115.29.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: c8385f67 by Pier Angelo Vendrame at 2025-10-27T18:02:47+01:00 fixup! Firefox preference overrides. BB 44270: Match Firefox's TLS fingerprint. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -121,10 +121,6 @@ pref("network.http.referer.hideOnionSource", true); // [4] https://www.ssllabs.com/ssl-pulse/ pref("security.ssl.require_safe_negotiation", true); -// mullvad-browser#361: Disable TLS cyphersuites using SHA1 for signing (ECDSA) -// see https://bugzilla.mozilla.org/show_bug.cgi?id=1600437 -pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); -pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // lock those disabled by https://bugzilla.mozilla.org/show_bug.cgi?id=1036765 pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked); pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c8385f6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c8385f6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.4.0esr-15.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 27 Oct '25

27 Oct '25

morgan pushed to branch mullvad-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 5aeceb7b by Pier Angelo Vendrame at 2025-10-27T16:29:49+00:00 fixup! Firefox preference overrides. BB 44270: Match Firefox's TLS fingerprint. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -155,10 +155,6 @@ pref("network.http.referer.hideOnionSource", true); // [4] https://www.ssllabs.com/ssl-pulse/ pref("security.ssl.require_safe_negotiation", true); -// mullvad-browser#361: Disable TLS cyphersuites using SHA1 for signing (ECDSA) -// see https://bugzilla.mozilla.org/show_bug.cgi?id=1600437 -pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); -pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // lock those disabled by https://bugzilla.mozilla.org/show_bug.cgi?id=1036765 pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked); pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/5ae… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/5ae… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.4.0esr-15.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 27 Oct '25

27 Oct '25

morgan pushed to branch base-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 93a069d9 by Pier Angelo Vendrame at 2025-10-27T16:29:01+00:00 fixup! Firefox preference overrides. BB 44270: Match Firefox's TLS fingerprint. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -155,10 +155,6 @@ pref("network.http.referer.hideOnionSource", true); // [4] https://www.ssllabs.com/ssl-pulse/ pref("security.ssl.require_safe_negotiation", true); -// mullvad-browser#361: Disable TLS cyphersuites using SHA1 for signing (ECDSA) -// see https://bugzilla.mozilla.org/show_bug.cgi?id=1600437 -pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); -pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // lock those disabled by https://bugzilla.mozilla.org/show_bug.cgi?id=1036765 pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked); pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/93a069d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/93a069d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.4.0esr-15.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 27 Oct '25

27 Oct '25

morgan pushed to branch tor-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 0134ec72 by Pier Angelo Vendrame at 2025-10-27T17:12:42+01:00 fixup! Firefox preference overrides. BB 44270: Match Firefox's TLS fingerprint. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -155,10 +155,6 @@ pref("network.http.referer.hideOnionSource", true); // [4] https://www.ssllabs.com/ssl-pulse/ pref("security.ssl.require_safe_negotiation", true); -// mullvad-browser#361: Disable TLS cyphersuites using SHA1 for signing (ECDSA) -// see https://bugzilla.mozilla.org/show_bug.cgi?id=1600437 -pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); -pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // lock those disabled by https://bugzilla.mozilla.org/show_bug.cgi?id=1036765 pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked); pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/0134ec7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/0134ec7… You're receiving this email because of your account on gitlab.torproject.org.

1 0