tor-announce

tor-announce@lists.torproject.org

November 2026

1 participants
1 discussions

[RELEASE] Tor release 0.4.9.16
by David Goulet 04 Nov '26

04 Nov '26

Greetings, We just released tor 0.4.9.16. This is mostly an emergency release aimed at fixing a problem at the directory authority problem and thus only affects them. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-9-16/22372 ChangeLog below: Changes in version 0.4.9.16 - 2026-11-04 This is an emergency release affecting only directory authorities. It includes fixes to address the thundering herd caused by the new required protover values introduced in the previous release. o Major features (authority): - Work around a bug where old clients did not, in fact, correctly handle unparseable microdescriptors in the way that we had hoped that they would. We triggered this bug by omitting TAP keys from microdescriptors. To solve this issue, instead of omitting TAP keys, we replace them with a dummy TAP key. (This is safe, because nothing has used TAP since v2 onion services.) - New consensus method 38 added for this TAP dummy key. - Revert back the required protover version for both "Desc" and "Microdesc" from 3 to 2 which is causing <= 0.4.8.x clients to exit(1). o Minor features (fallbackdir): - Regenerate fallback directories generated on November 04, 2026. o Minor bugfixes (dirauth): - Let dir auth fetches be twice as big, to allow for the fact that 9 votes can exceed 16MB even compressed. Part of 41471; bugfix on 0.3.5.1-alpha. Cheers! David -- UspxqdwTnlbyVc5mmC4WYzmMj1/0ZB5xPThRiZISYXE=

1 0