- tor-announce - lists.torproject.org

New Release: Tor Browser 13.5.27 (ONLY Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 13 Jan '26

13 Jan '26

Hi everyone, Tor Browser 13.5.27 has now been published for legacy Windows andmacOS platforms ONLY. For details please see our blog post https://blog.torproject.org/new-release-tor-browser-13527/ Changelog: Tor Browser 13.5.27 - January 13 2026 * All Platforms * Updated Firefox to 115.32.0esr * Updated NoScript to 13.5.7.1984 * Bug 44418: Update built-in obfs4 bridges [tor-browser] * Bug 44433: Weird §:domain.com label in the Blocked Objects window [tor-browser] * Bug 44471: Rebase Tor Browser legacy onto 115.32.0esr [tor-browser] * Bug 44474: Backport Security Fixes from Firefox 147 [tor-browser] * Bug 44482: (H1) Script execution in Safest mode via data URI navigation [tor-browser] * Build System * All Platforms * Bug 41682: relprep.py should fail when a GitHub release is not found [tor-browser-build] -- ma1

1 0

New Release: Tor Browser 15.0.4 (Android, Windows, macOS, Linux)
by Giorgio Maone 13 Jan '26

13 Jan '26

Hi everyone, Tor Browser 15.0.4 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1504 Changelog: Tor Browser 15.0.4 - January 13 2025 * All Platforms * Bug 44418: Update built-in obfs4 bridges [tor-browser] * Bug 44433: Weird §:domain.com label in the Blocked Objects window [tor-browser] * Bug 44470: Rebase Tor Browser stable onto 140.7.0esr [tor-browser] * Bug 44474: Backport Security Fixes from Firefox 147 [tor-browser] * Bug 44482: (H1) Script execution in Safest mode via data URI navigation [tor-browser] * Windows + macOS + Linux * Updated Firefox to 140.7.0esr * Android * Updated GeckoView to 140.7.0esr * Bug 41681: Keep public suffixes up-to-date on 140esr-based Tor Browser for Android [tor-browser-build] * Build System * All Platforms * Bug 41654: Make relprep.py update Moat settings [tor-browser-build] * Bug 41682: relprep.py should fail when a GitHub release is not found [tor-browser-build] * Bug 40090: Make the cleanup faster [rbm] * Bug 40095: cached checksums should not be used for input files when refresh_input is enabled [rbm] * Android * Bug 41679: Android tor-expert-bundle archives missing version in filename [tor-browser-build] -- ma1

1 0

New Release: Tor VPN Beta 4 (Android)
by Duncan R. 22 Dec '25

22 Dec '25

Greetings, I am pleased to report that Tor VPN Beta 4 was published on Google Play[1] last week. Thank you @dan for shepherding this release along while the team was AFK. Tor VPN Beta 4 adds support for WebTunnel bridges to Tor VPN. This release also features an update to onionmasq, fixes several bugs and crashes, and includes other minor improvements. For the full changelog, please see here: https://gitlab.torproject.org/tpo/applications/vpn/-/blob/main/CHANGELOG.md Happy holidays and happy new year when it comes. —Duncan [1] https://play.google.com/store/apps/details?id=org.torproject.vpn

1 0

New Release: Tor Browser 16.0a1 (Android, Windows, macOS, Linux)
by Giorgio Maone 16 Dec '25

16 Dec '25

Hi everyone, Tor Browser 16.0a1 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-160a1 Changelog: * All Platforms o Updated NoScript to 13.5.1.90101984 o Bug tor-browser#43792 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43792>: Determine whether noscript_persist users need to have their NoScript settings migrated o Bug tor-browser#43998 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43998>: Rebase Tor Browser Alpha onto 141.0 o Bug tor-browser#44118 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44118>: Decide how to deal with upstream feature gates in a RR world o Bug tor-browser#44280 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44280>: Test stream isolation o Bug tor-browser#44333 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44333>: Add the "No AI" version of DuckDuckGo to available search engines o Bug tor-browser#44365 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44365>: Fix CSS linting errors introduced for firefox 145 o Bug tor-browser#44391 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44391>: Restrictions cascade blocks every capability in subframes (e.g. captchas) o Bug tor-browser#44408 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44408>: Fix TorDomainIsolator in 146 o Bug tor-browser#44418 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44418>: Update built-in obfs4 bridges o Bug tor-browser-build#41609 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Move back to CDN77 for default snowflake bridge o Bug tor-browser-build#41646 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update lyrebird version to v0.7.0 o Bug mullvad-browser#483 <https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/483>: Add the "No AI" version of DuckDuckGo to available search engines o Bug mullvad-browser#487 <https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/487>: Search engines are sorted alphabetically rather than the desired order * Windows + macOS + Linux o Updated Firefox to 146.0a1esr o Bug tor-browser#44302 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44302>: Fix the flags of some about pages o Bug tor-browser#44310 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44310>: Default zoom always resets to 100% o Bug tor-browser#44411 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44411>: DownloadsTorWarning.sys.mjs fails to load o Bug tor-browser#44419 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44419>: Re-add the moz-toggle title attribute patch * Linux o Bug tor-browser#44273 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44273>: Restore Noto CJK as Jigmo has a too low readability o Bug tor-browser#44315 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44315>: Font/text issue with self-upgrade window * Android o Updated GeckoView to 146.0a1esr o Bug tor-browser#44303 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44303>: Extension update job might never work on Android o Bug tor-browser#44324 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44324>: Refactor the NSS no proxy-bypass patch on A-S to avoid -Wunreachable-code * Build System o All Platforms + Bug tor-browser#43951 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43951>: Include product with the component in triage CSVs + Bug tor-browser-build#40903 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Make xz multi-threaded + Bug tor-browser-build#41445 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Better handle bugzilla "Web Compatibility" issues in generate-bugzilla-triage-csv + Bug tor-browser-build#41607 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix regression from #41373 in tools/count-mar-downloads + Bug tor-browser-build#41608 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add per-platform numbers for incrementals in count-mar-downloads + Bug tor-browser-build#41643 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 146 + Bug tor-browser-build#41644 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Self-hosted browser extensions support in relprep.py + Bug tor-browser-build#41647 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add a XZ_DEFAULTS to set_default_env + Bug tor-browser-build#41648 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add a mozconfig to projects/geckoview + Bug tor-browser-build#41654 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Make relprep.py update Moat settings o Windows + macOS + Linux + Bug tor-browser-build#41662 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add python-zstandard to desktop containers o Windows + Linux + Android + Bug tor-browser-build#41580 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update Go major to 1.25.x + Updated Go to 1.25.5 o macOS + Bug tor-browser-build#41665 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update macos signing wrapper for new executable gpu-helper.app o Linux + Bug tor-browser-build#41601 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Upstream droppped Linux i686 support + Bug tor-browser-build#41627 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Firefox build system needs a more recent version of OpenSSL on Linux + Bug tor-browser-build#41632 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Ship Linux aarch64 builds in Alpha Release Channel + Bug tor-browser-build#41639 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove linux-arm target + Bug tor-browser-build#41640 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Clean the GCC config file o Android + Bug tor-browser#44360 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44360>: Patch the vendored Gradle Nimbus plugin + Bug tor-browser#44370 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44370>: Always produce target.maven.zip + Bug tor-browser-build#41485 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Retire get_gradle_dependencies_list and create a simple way to update gradle deps + Bug tor-browser-build#41573 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove Android x86 support + Bug tor-browser-build#41617 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Pass page size to zipalign + Bug tor-browser-build#41620 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Do not rerun zipalign when signing + Bug tor-browser-build#41621 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove support using older android build tools when signing 14.5 releases in tools/signing/wrappers/sign-apk + Bug tor-browser-build#41628 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: android_ndk_version and revision can be grouped together + Bug tor-browser-build#41636 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update the scripts to manage Gradle dependencies + Bug tor-browser-build#41666 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Normalize the path to tor-expert-bundle.aar + Bug tor-browser-build#41669 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Restore UglifyJS but for Android x86_64 -- ma1

1 0

New Release: Tor Browser 13.5.26 (ONLY Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 09 Dec '25

09 Dec '25

Hi everyone, Tor Browser 13.5.26 has now been published for legacy Windows and macOS platforms ONLY. For details please see our blog post https://blog.torproject.org/new-release-tor-browser-13526/ Changelog: * All Platforms o Updated Firefox to 115.31.0esr o Updated NoScript to 13.5.2.1984 o Updated Tor to 0.4.8.21 o Bug tor-browser#22974 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22974>: Self-host NoScript Updates o Bug tor-browser#44391 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44391>: Restrictions cascade blocks every capability in subframes (e.g. captchas) o Bug tor-browser#44397 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44397>: Rebase Tor Browser legacy onto 115.31.0esr o Bug tor-browser#44409 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44409>: Backport Security Fixes from Firefox 146 * Build System o All Platforms + Bug tor-browser-build#41644 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Self-hosted browser extensions support in relprep.py -- ma1

1 0

New Release: Tor Browser 15.0.3 (Android, Windows, macOS, Linux)
by Giorgio Maone 09 Dec '25

09 Dec '25

Hi everyone, Tor Browser 15.0.3 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-15 <https://blog.torproject.org/new-release-tor-browser-1503>03 Changelog: *Tor Browser 15.0.3 - December 09 2025* * All Platforms o Updated NoScript to 13.5.2.1984 o Bug tor-browser#22974 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22974>: Self-host NoScript Updates o Bug tor-browser#44348 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44348>: Backport Bugzilla 1999126: Protect whether PDF.js is enabled/disabled to improve fingerprinting protection o Bug tor-browser#44391 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44391>: Restrictions cascade blocks every capability in subframes (e.g. captchas) o Bug tor-browser#44399 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44399>: Rebase Tor Browser 15.0 stable onto 140.6.0esr o Bug tor-browser#44409 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44409>: Backport Security Fixes from Firefox 146 o Bug tor-browser-build#41646 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update lyrebird version to v0.7.0 * Windows + macOS + Linux o Updated Firefox to 140.6.0esr o Bug tor-browser#44414 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44414>: Disable Zucchini for the 15.0 series. * Android o Updated GeckoView to 140.6.0esr o Bug tor-browser#44346 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44346>: Webrender broken on Adreno 510 devices with esr140 * Build System o All Platforms + Bug tor-browser-build#41644 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Self-hosted browser extensions support in relprep.py o Windows + Linux + Android + Updated Go to 1.24.11 -- ma1

1 0

New Release: Tor Browser 13.5.25 (Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 19 Nov '25

19 Nov '25

Hi everyone, Tor Browser 13.5.25 has now been published for Windows 7/8/8.1, macOS 10.12-10.14. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13525 Changelog: Tor Browser 13.5.25 - November 13 2025 * All Platforms * Updated Tor to 0.4.8.20 * Bug 44335: Additional Security Fix Backport from Firefox 145 to esr115 [tor-browser] -- ma1

1 0

New Release: Tor Browser 15.0.2 (Android, Windows, macOS, Linux)
by Giorgio Maone 19 Nov '25

19 Nov '25

Hi everyone, Tor Browser 15.0.2 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1502 Changelog: * All Platforms o Updated Tor to 0.4.8.20 * Build System o Android + Bug tor-browser-build#41629 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Bump JNA to 5.16.0 -- ma1

1 0

[RELEASE] Tor 0.4.8.21 stable
by David Goulet 18 Nov '25

18 Nov '25

Greetings, We have another stable fixing more security issues. See announcement: https://forum.torproject.org/t/stable-release-0-4-8-21/20817 Here is the ChangeLog. Changes in version 0.4.8.21 - 2025-11-17 This release is a continuation of the previous one and addresses additional Conflux-related issues identified through further testing and feedback from relay operators. We strongly recommend upgrading as soon as possible. o Major bugfixes (conflux, exit): - When dequeuing out-of-order conflux cells, the circuit could be close in between two dequeue which could lead to a mishandling of a NULL pointer. Fixes bug 41162; bugfix on 0.4.8.4. o Minor feature (compiler flag): - Add -mbranch-protection=standard for arm64. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 17, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/11/17. o Minor bugfixes (bridges, pluggable transport): - Fix a bug causing the initial tor process to hang intead of exiting with RunAsDaemon, when pluggable transports are used. Fixes bug 41088; bugfix on 0.4.8.1-alpha. Cheers! David -- DKF8td80doiu+vmXr1f3qf84hR+DbmSu+T/Ll1tDT0k=

1 0

[RELEASE] Tor 0.4.8.20 stable - Security Fixes
by David Goulet 11 Nov '25

11 Nov '25

Greetings, We just released 0.4.8.20 containing two security medium severity fixes affecting Exit relays mostly. As of this announcement, our Debian packages are available at https://deb.torproject.org Here is the announcement: https://forum.torproject.org/t/stable-release-0-4-8-20/20781 Changes in version 0.4.8.20 - 2025-11-10 This release fixes several bugfixes related to Conflux edge cases as well as adding a new hardening compiler flag if supported. We strongly recommend to upgrade as soon as possible. o Minor feature (compiler flag): - Add -fcf-protection=full if supported by the compiler. Fixes 41139. o Minor features (fallbackdir): - Regenerate fallback directories generated on October 06, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/11/10. o Minor bugfixes (conflux fragile asserts): - Fix the root cause of some conflux fragile asserts when a control port listener is attached. Fixes bug 41037; bugfix on 0.4.8.16. o Minor bugfixes (conflux, relay): - Fix a series of conflux edge cases about sequence number arithmetic and OOM handler kicking in under heavy memory pressure. Fixes bug 41155; bugfix on 0.4.8.4. Cheers! David -- liO7tEkAvH7asFm910GjXnAJ++7tf/uz6e1uCcUHj8E=

1 0