January 2026 - tor-announce - lists.torproject.org

New Release: Tor Browser 15.0.5 (Android, Windows, macOS, Linux)
by Pier Angelo Vendrame 29 Jan '26

29 Jan '26

Hi everyone, Tor Browser 15.0.5 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-release-tor-browser-1505/ Changelog: * All Platforms * Updated Tor to 0.4.8.22 * Updated NoScript to 13.5.12.1984 * Updated OpenSSL to 3.5.5 * Android * Bug 44533: Update NoScript to the version bundled with the browser on Android [tor-browser] * Build System * All Platforms * Bug 41691: Update Lyrebird to v0.8.1 [tor-browser-build] * Windows + Linux + Android * Updated Go to 1.24.12 Best, Pier Angelo Vendrame

1 0

[RELEASE] Stable 0.4.8.22 and release candidate 0.4.9.4-rc
by David Goulet 29 Jan '26

29 Jan '26

Greetings, We have released 0.4.8.22 stable and 0.4.9.4-rc: https://forum.torproject.org/t/release-candidate-and-stable-release-0-4-8-2… Note that 0.4.8.22 will most likely be the final release of the 0.4.8.x series. Changelog below: Changes in version 0.4.9.4-rc - 2026-01-28 Finally, the release candidate for the 0.4.9.x series. It consists of minor features and several bugfixes. Nothing major has been added since the alpha. If everything goes well, the next version will be the first stable. o Minor features (security, reliability): - When KeepaliveIsolateSOCKSAuth is keeping a circuit alive, expire the circuit based on when it was last in use for any stream, not (as we did before) based on when a stream was last attached to it. Closes ticket 41157. Implements a minimal version of Proposal 368. o Minor feature (Exit): - Add Monero ports to the ReducedExitPolicy. Closes ticket 41168. o Minor features (HTTPTunnelPort): - Implement new HTTPTunnelPort features for interoperability with Arti's HTTP CONNECT proxy. This work adds new headers to requests to and replies from the HttpConnectPort, support for OPTIONS requests, tightens the expected syntax for Proxy-Authorization, and increases defense-in-depth against some kinds of cross-site HTTP attacks. Closes ticket 41156. Implements proposal 365. o Minor features (linux seccomp2 sandbox): - Allow the fstatat64 and statx syscalls on i386 architecture when glibc >= 2.33. On i386, glibc uses fstatat64 instead of newfstatat for stat operations, and statx for time64 support. Without this, SIGHUP configuration reload fails when using sandbox mode with %include directives on i386 with Debian Bookworm or newer. - Allow the lstat64 syscall on i386 architecture. This syscall is used by glob() in glibc 2.36+ when processing %include directives with directory patterns. o Minor bugfixes (DNS, exit): - Clip every returned DNS TTL to 60 (RESOLVED) in order to mitigate an exit DNS cache oracle. Fixes bug 40979; bugfix on 0.3.5.1-alpha. o Minor bugfixes (spec conformance): - Do not treat "15" as a recognized remote END reason code. Formerly, we treated it as synonymous with a local ENTRYPOLICY, which isn't a valid remote code at all. Fixes bug 41171; bugfix on 0.2.0.8-alpha. o Minor bugfixes (tooling): - Fix a false positive valgrind related to inspecting a bitfield next to another uninitialized bitfield. Fixes bug 41182; bugfix on 0.3.3.2-alpha. o Minor bugfixes (warnings): - Fix minor warnings from newer versions of shellcheck and clang. Fixes bug 41166; bugfix on 0.4.3.1-alpha and several other versions. Changes in version 0.4.8.22 - 2026-01-28 This is likely the very last release of the 0.4.8.x series. Three major bugfixes detailed below including two affecting directory servers (basically all relays). We strongly recommend upgrading as soon as possible. o Major bugfixes (security): - Avoid an out-of-bounds read error that could occur with V1-formatted EXTEND cells. Fixes bug 41180; bugfix on 0.4.8.1-alpha. This is tracked as TROVE-2025-016. o Major bugfixes (directory servers): - Allow old clients to fetch the consensus even if they use version 0 of the SENDME protocol. In mid 2025 we changed the required minimum version of the "FlowCtrl" protocol to 1, meaning directory caches hang up on clients that send a version 0 SENDME cell. Since old clients were no longer able to retrieve the consensus, they couldn't learn about this required minimum version -- meaning we've had many many old clients loading down directory servers for the past months. Fixes bug 41191; bugfix on 0.4.1.1-alpha. - Don't count networkstatus serves until they finish. When we started serving a consensus document but the client didn't receive all of it, we were still counting that as a success in our stats. This mistake, which can be triggered for example by obsolete clients or by DPI-based censorship, led to wildly inflated user counts because we estimate total users in the world based on successful consensus fetches. Fixes bug 41192; bugfix on 0.2.1.1-alpha. o Minor feature (testing, CI): - Bump the CI version of chutney to the current version as of 2026-01-21 (3338f5c). o Minor features (debugging, compression): - Do not check for compression bombs for buffers smaller than 5MB (increased from 64 KB). Fixes ticket 40739; bugfix on 0.2.1.29. o Minor features (directory servers): - Track how many times directory servers begin serving networkstatus documents, so we can compare it to the number of times we finish serving them. Motivated by the fixes in ticket 41192. o Minor features (fallbackdir): - Regenerate fallback directories generated on January 28, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/01/28. o Minor bugfixes (relay): - Downgrade "Error relaying cell across rendezvous" log warn to info as the error condition is possible under normal circumstances. Fixes bug 40951; bugfix on 0.3.5.1-alpha. o Code simplification and refactoring: - Simplify SOCKS4a parsing to avoid the (false) appearance of integer underflows, and to make the logic more obvious. Fixes bug 41190; bugfix on 0.3.5.1-alpha. Cheers! David -- FQ8KxEoJUblilD5txJNxMJu3JdzR1uWAsSdqDORyehI=

1 0

New Release: Tor Browser 13.5.27 (ONLY Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 13 Jan '26

13 Jan '26

Hi everyone, Tor Browser 13.5.27 has now been published for legacy Windows andmacOS platforms ONLY. For details please see our blog post https://blog.torproject.org/new-release-tor-browser-13527/ Changelog: Tor Browser 13.5.27 - January 13 2026 * All Platforms * Updated Firefox to 115.32.0esr * Updated NoScript to 13.5.7.1984 * Bug 44418: Update built-in obfs4 bridges [tor-browser] * Bug 44433: Weird §:domain.com label in the Blocked Objects window [tor-browser] * Bug 44471: Rebase Tor Browser legacy onto 115.32.0esr [tor-browser] * Bug 44474: Backport Security Fixes from Firefox 147 [tor-browser] * Bug 44482: (H1) Script execution in Safest mode via data URI navigation [tor-browser] * Build System * All Platforms * Bug 41682: relprep.py should fail when a GitHub release is not found [tor-browser-build] -- ma1

1 0

New Release: Tor Browser 15.0.4 (Android, Windows, macOS, Linux)
by Giorgio Maone 13 Jan '26

13 Jan '26

Hi everyone, Tor Browser 15.0.4 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1504 Changelog: Tor Browser 15.0.4 - January 13 2025 * All Platforms * Bug 44418: Update built-in obfs4 bridges [tor-browser] * Bug 44433: Weird §:domain.com label in the Blocked Objects window [tor-browser] * Bug 44470: Rebase Tor Browser stable onto 140.7.0esr [tor-browser] * Bug 44474: Backport Security Fixes from Firefox 147 [tor-browser] * Bug 44482: (H1) Script execution in Safest mode via data URI navigation [tor-browser] * Windows + macOS + Linux * Updated Firefox to 140.7.0esr * Android * Updated GeckoView to 140.7.0esr * Bug 41681: Keep public suffixes up-to-date on 140esr-based Tor Browser for Android [tor-browser-build] * Build System * All Platforms * Bug 41654: Make relprep.py update Moat settings [tor-browser-build] * Bug 41682: relprep.py should fail when a GitHub release is not found [tor-browser-build] * Bug 40090: Make the cleanup faster [rbm] * Bug 40095: cached checksums should not be used for input files when refresh_input is enabled [rbm] * Android * Bug 41679: Android tor-expert-bundle archives missing version in filename [tor-browser-build] -- ma1

1 0