- tor-announce - lists.torproject.org

New Release: Tor Browser 15.0.13 (Android, Windows, macOS, Linux)
by Morgan 08 May '26

08 May '26

Hi everyone, Tor Browser 15.0.13 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-15013/ Changelog: > * All Platforms > * Updated tor to 0.4.9.8 > * Updated NoScript to 13.6.19.1984 best, -morgan

1 0

[RELEASE] Tor stable 0.4.8.25 and 0.4.9.8
by David Goulet 07 May '26

07 May '26

Greetings, Due to an error in the previous releases (0.4.8.24 and 0.4.9.7), we had to quickly release a new version today. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559 Changelog is below (same for both versions): Changes in version 0.4.9.8 - 2026-05-07 A quick second release because a silent error occurred in our CI build, which resulted in all fallback directories being removed from the list. This means that all new clients will bootstrap against the directory authorities. o Minor features (fallbackdir): - Regenerate fallback directories generated on May 07, 2026. Cheers! David -- G05XBgdQ1rTFTD4+6xzxND2USETuERE6bxDBnJH8wA0=

1 0

New Release: Tor Browser 15.0.12 (Android, Windows, macOS, Linux)
by Giorgio Maone 07 May '26

07 May '26

Hi everyone, Tor Browser 15.0.12 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15012/>. * All Platforms o Updated tor to 0.4.9.7 o Bug tor-browser#44940 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44940>: Rebase Tor Browser stable onto 140.10.2esr * Windows + macOS + Linux o Updated Firefox to 140.10.2esr o Bug tor-browser#44746 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44746>: Funding the Commons Implementation (Desktop) * Android o Updated GeckoView to 140.10.2esr o Bug tor-browser#44747 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44747>: Funding the Commons Implementation (Android) * Build System o All Platforms + Bug tor-browser-build#41781 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix clean section in rbm.local.conf.example -- ma1

1 0

New Release: Tor Browser 16.0a6 (Android, Windows, macOS, Linux)
by Giorgio Maone 07 May '26

07 May '26

Hi everyone, Tor Browser 16.0a6 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-alpha-release-tor-browser-160a6/>. * All Platforms o Updated tor to 0.4.9.7 o Updated NoScript to 13.6.18.90101984 o Updated OpenSSL to 3.5.6 o Bug tor-browser#43857 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43857>: Review in-source TODOs o Bug tor-browser#44402 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44402>: Re-enable ESLint rule mozilla/no-browser-refs-in-toolkit as an error o Bug tor-browser#44749 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44749>: Check search engines parameter replacements o Bug tor-browser#44792 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44792>: Rebase alpha onto 150.0a1 o Bug tor-browser#44796 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44796>: Adjust TorProviderBuilder to report the provider state to consumers o Bug tor-browser#44828 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44828>: Remove browser module references from toolkit/modules/ActorManagerParent.sys.mjs o Bug tor-browser#44841 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44841>: TorDomainIsolator proxy filter returns null on exception instead of preserving SOCKS proxy o Bug tor-browser#44865 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44865>: Block chrome:////locale// to content o Bug tor-browser#44868 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds o Bug tor-browser#44870 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44870>: Remove legacy branch from gitlab templates o Bug tor-browser#44895 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44895>: Undo the patch for #44772 o Bug tor-browser-build#41775 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update list of Snowflake STUN servers in default bridge line, 2026 edition o Bug tor-browser-build#41778 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove base-browser from protected-branches.py o Bug tor-browser-build#41780 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories * Windows + macOS + Linux o Updated Firefox to 150.0a1 o Bug tor-browser#43824 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43824>: Switch resource:// modules to use moz-src: o Bug tor-browser#44288 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44288>: New identity fails to block loading a custom home page o Bug tor-browser#44458 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44458>: Fix the "Connect" and ".onion available" button height o Bug tor-browser#44560 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44560>: Customize the flags for alternate 'Application Data' directories o Bug tor-browser#44630 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44630>: Use settings config to hide settings, rather than data-hidden-from-search or commenting out o Bug tor-browser#44648 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44648>: Unexpected changes to SearchService.sys.mjs o Bug tor-browser#44685 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44685>: Use border radius for letterboxing o Bug tor-browser#44798 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44798>: Don't load |about:torconnect| into iframes o Bug tor-browser#44829 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44829>: Hide the settings privacy card o Bug tor-browser#44832 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44832>: Hide the Firefox mascot in about:neterror o Bug tor-browser#44846 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44846>: about:torconnect redirect doesn't work with the new neterror page o Bug tor-browser#44847 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44847>: Drop letterboxing sidebar rounded corner logic o Bug tor-browser#44902 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44902>: Error in privacy preference initialisation due to missing |dataCollectionViewProfilesMultiProfileBackupWarning| o Bug tor-browser-build#31860 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/3…>: Start using LTO for firefox project * Windows o Bug tor-browser#44862 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44862>: Fontvis is missing Segoe MDL2 Assets o Bug tor-browser#44868 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds * macOS o Bug tor-browser#44850 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44850>: Wrong path for bootstrapped tor daemon on macOS o Bug tor-browser-build#41476 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Since 13.5-legacy is not longer supported, remove tools/signing/wrappers/sign-rcodesign * Linux o Bug tor-browser#44361 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44361>: Notify Linux i686 users that they won't receive updates anymore o Bug tor-browser#44521 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44521>: Disable widget.wayland.fractional-scale.enabled * Android o Updated GeckoView to 150.0a1 o Bug tor-browser#44615 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44615>: Remove ability to "Rate/Review in Google Play" in app o Bug tor-browser#44827 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44827>: Always enable noscript for android o Bug tor-browser#44842 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44842>: Replace instances of SwitchPreference with SwitchPreferenceCompat o Bug tor-browser#44848 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848>: Do not overwrite Android toolchains on default mozconfigs o Bug tor-browser#44880 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44880>: Fix edgeToEdge display issue presented in 150 android rebase o Bug tor-browser#44925 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44925>: Fix bootstrap screen color styling for light mode presented in one of the rebases between 140 and 150 o Bug tor-browser#44935 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44935>: Remove incorrectly shown "open in app" notification dot on settings button * Build System o All Platforms + Bug tor-browser-build#41591 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove support for old mar filenames when 13.5 legacy branch is EOL + Bug tor-browser-build#41764 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 150 + Bug tor-browser-build#41767 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add jwilde to allowed signer for browser projects + Bug tor-browser-build#41778 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove base-browser from protected-branches.py + Bug tor-browser-build#41780 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories + Bug tor-browser-build#41786 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add comment to rbm.local.conf.example warning about potential recursive loops in tmp_dir definition + Bug rbm#40106 <https://gitlab.torproject.org/tpo/applications/rbm/-/issues/40106>: Improve error message in case of recursive definition o Windows + macOS + Linux + Bug tor-browser-build#41759 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove references to legacy release in tor-browser-build o Windows + Linux + Android + Bug tor-browser-build#41770 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update Go to 1.26.x + Updated Go to 1.26.2 o Windows + Bug tor-browser#44853 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44853>: Update target in mozconfig-windows-x86_64 and mozconfig-windows-i686 o macOS + Bug tor-browser-build#41773 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Change the position of -mindepth when creating the dmg o Linux + Bug tor-browser#44555 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44555>: Remove mozconfig-linux-i686 o Android + Bug tor-browser#44848 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848>: Do not overwrite Android toolchains on default mozconfigs -- ma1

1 0

[RELEASE] Tor stable 0.4.8.24 and 0.4.9.7
by David Goulet 07 May '26

07 May '26

Greetings, We released a security release of C-tor: 0.4.8.24 and 0.4.9.7. Announcement: https://forum.torproject.org/t/security-release-0-4-8-24-and-0-4-9-7/21551 Here is the ChangeLog (it is the same for both versions): Changes in version 0.4.8.24 - 2026-05-06 This is a security release fixing several major bugfixes that were reported in the past weeks. Huge thanks to everyone that reported these issues! We strongly recommend upgrading as soon as possible. o Major bugfixes (cell handling): - Fix out-of-bounds read (OOB) when END, TRUNCATE and TRUNCATED cell have no reason in their payload. TROVE-2026-011. Found by Brian Carpenter (geeknik). Fixes bug 41254; bugfix on 0.1.1.1-alpha. o Major bugfixes (conflux): - Do not attempt or accept BEGIN_DIR via conflux legs. TROVE-2026- 008. Credit to Anas Cherni from Calif.io in collaboration with Claude and Anthropic Research. Fixes bug 41243; bugfix on 0.4.8.1-alpha. o Major bugfixes (conflux, relay): - Adjust conflux out-of-order queue accounting when clearing a queue. TROVE-2026-010. Found by aptupdate. Fixes bug 41251; bugfix on 0.4.8.1-alpha. o Major bugfixes (pathbias): - Fix a client-side crash caused by double-close of a circuit while under circuit queue memory pressure. TROVE-2026-009. Found by cypherpunks. Fixes bug 41237; bugfix on 0.3.3.6-rc. o Major bugfixes (relay): - Fix null pointer dereference when receiving a CERT cell out of order. TROVE-2026-006. Found by Fwame. Fixes bug 41240; bugfix on 0.2.4.4-alpha. o Major bugfixes (relay, onion service): - Fix off-by-one out-of-bounds read if a malformed BEGIN cell is received. TROVE-2026-007. Found by Flanagan. Fixes bug 41245; bugfix on 0.2.4.7-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on May 06, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/05/06. Cheers! David -- CwtGMI5zvZfUUSzq+R0XWB1Y22UbVycqzHo0MCpl6X0=

1 0

New Release: Tor Browser 15.0.11 (Android, Windows, macOS, Linux)
by Giorgio Maone 28 Apr '26

28 Apr '26

Hi everyone, Tor Browser 15.0.11 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15011/>. * All Platforms o Updated NoScript to 13.6.18.1984 o Bug tor-browser#44907 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44907>: Rebase Tor Browser onto 140.10.1esr * Windows + macOS + Linux o Updated Firefox to 140.10.1esr * Android o Updated GeckoView to 140.10.1esr -- ma1

1 0

New Release: Tor Browser 15.0.10 (Android, Windows, macOS, Linux)
by Giorgio Maone 21 Apr '26

21 Apr '26

Hi everyone, Tor Browser 15.0.10 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15010/>. * All Platforms o Updated OpenSSL to 3.5.6 o Bug tor-browser#44749 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44749>: Check search engines parameter replacements o Bug tor-browser#44852 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44852>: Rebase Tor Browser stable onto 140.10.0esr o Bug tor-browser#44859 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44859>: Backport Bugzilla 1666613: Display XML error pages in the browser directionality while force LTRing the XML code itself, without the use of intl.css o Bug tor-browser#44863 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44863>: Backport Security Fixes from Firefox 150 o Bug tor-browser-build#41775 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update list of Snowflake STUN servers in default bridge line, 2026 edition * Windows + macOS + Linux o Updated Firefox to 140.10.0esr o Bug tor-browser#44288 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44288>: New identity fails to block loading a custom home page * Android o Updated GeckoView to 140.10.0esr * Build System o All Platforms + Bug tor-browser-build#41767 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add jwilde to allowed signer for browser projects o Windows + Linux + Android + Updated Go to 1.25.9 -- ma1

1 0

New Release: Tor Browser 15.0.9 (Android, Windows, macOS, Linux)
by Pier Angelo Vendrame 07 Apr '26

07 Apr '26

Hi everyone, Tor Browser ${TOR_BROWSER_VERSION} has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1509/ Changelog: > Tor Browser 15.0.9 - April 07 2026 > * All Platforms > * Updated Tor to 0.4.9.6 > * Updated NoScript to 13.6.15.1984 > * Bug 44837: Rebase Tor Browser stable onto 140.9.1esr [tor-browser] > * Windows + macOS + Linux > * Updated Firefox to 140.9.1esr > * Android > * Updated GeckoView to 140.9.1esr > * Build System > * All Platforms > * Bug 41758: Rename `tools/signing/deploy-legacy` to > `tools/signing/redeploy-update_responses-release` [tor-browser-build] > * Windows + macOS > * Bug 41741: Create a 13.5-specific update path [tor-browser-build] Best, Pier Angelo Vendrame

1 0

New Release: Tor Browser 16.0a5 (Android, Windows, macOS, Linux)
by Giorgio Maone 01 Apr '26

01 Apr '26

Hi everyone, Tor Browser 16.0a5 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-alpha-release-tor-browser-160a5/>. * All Platforms o Updated NoScript to 13.6.14.90101984 o Updated Tor to 0.4.9.6 o Bug tor-browser#43858 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43858>: Clean out deprecated or unused methods in TorConnect o Bug tor-browser#44251 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44251>: Drop pt_config.json meek-azure migration logic o Bug tor-browser#44546 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44546>: Rename |appearance-chooser-item| to |setting-chooser-item| after we reach nightly 149 o Bug tor-browser#44621 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44621>: Move about:torconnect back to browser o Bug tor-browser#44702 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44702>: Rebase alpha onto 149.0a1 o Bug tor-browser#44720 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44720>: Migrate New Identity commit to Tor Browser o Bug tor-browser#44753 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44753>: Drop TorProvider.isBootstrapDone o Bug tor-browser#44755 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44755>: Trusted Types (Firefox 148 and above) + Web Workers broken on Safer Level o Bug rebase-149#44757 <https://gitlab.torproject.org/tpo/applications/rebase-149/-/issues/44757>: Update tests for removed Services.search [tor-browser] o Bug tor-browser#44761 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44761>: Safer Level's worker patching filters out Worker constructor options o Bug tor-browser#44763 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44763>: Disable WebGPU until audited o Bug tor-browser#44764 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44764>: Review Mozilla 2012344: Hide main AI settings when the feature is blocked o Bug tor-browser#44765 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44765>: Review Mozilla 1972073: Convert Sidebar to config-based prefs o Bug tor-browser#44767 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44767>: Safer Level's worker patching throws on new about:blank frames with Trusted Types o Bug tor-browser#44772 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44772>: Review Mozilla 1980264: Canvas randomization is too slow o Bug tor-browser#44778 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44778>: Safer Level: xray causes patched TrustedTypePolicy instances to be unusable by content. o Bug tor-browser#44801 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44801>: Redact onion origins from Location.ancestorOrigins. o Bug tor-browser#44814 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44814>: Disable trustpanel until our new designs are ready * Windows + macOS + Linux o Updated Firefox to 149.0a1 o Bug tor-browser#44714 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44714>: The browser opens a new about:blank tab in 148 o Bug tor-browser#44780 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44780>: AIFeature.sys.mjs failures in 149 desktop builds o Bug tor-browser#44781 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44781>: Use a static page title for about:torconnect o Bug tor-browser#44793 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44793>: |privacy.spoof_english| console error in about:preferences o Bug tor-browser#44797 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44797>: Clean up |about:torconnect| styling o Bug tor-browser#44799 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44799>: Onionize toggle in |about:tor| uses blue text color * Android o Updated GeckoView to 149.0a1 o Bug tor-browser#43790 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43790>: Address "Various android workarounds" commit introduced in the 138 rebase o Bug tor-browser#44332 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44332>: Fix android tor logs screen issues presented in 144 rebase o Bug tor-browser#44594 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44594>: DoH is visible on Android o Bug tor-browser#44653 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44653>: Disable "Allow search suggestions in private sessions" prompt presented in RR 148 android o Bug tor-browser#44694 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44694>: Remove new "Tab bar" feature on Android o Bug tor-browser#44698 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44698>: Clean up comments in AccountSettingsFragment.kt. FIXME: Update A-S o Bug tor-browser#44700 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44700>: Untracked change to |HomepageHeader.kt| o Bug tor-browser#44751 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44751>: Noscript (and likely any extension) can be accidently turned off on Android alpha o Bug tor-browser#44752 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44752>: Remove new expanded toolbar option on Android due to fingerprintability o Bug tor-browser#44785 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44785>: Fix SiteSecurityRobot.kt after the 149 rebase o Bug tor-browser#44788 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44788>: Extensions are unreachable via 3 dot menu in alpha (android) o Bug tor-browser#44789 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44789>: Icon of "New Circuit" is not centered but lies in top left corner * Build System o All Platforms + Bug tor-browser#43180 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43180>: Remove translation CI 13.5 legacy extension + Bug tor-browser-build#41758 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Rename |tools/signing/deploy-legacy| to |tools/signing/redeploy-update_responses-release| + Bug tor-browser-build#41766 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Use gzip for all platforms for Go vendoring o Windows + macOS + Bug tor-browser-build#41741 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Create a 13.5-specific update path o macOS + Bug tor-browser-build#41753 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Allow running custom commands when vendoring Go dependencies -- ma1

1 0

[SECURITY RELEASE] Tor stable 0.4.8.23 and 0.4.9.6
by David Goulet 25 Mar '26

25 Mar '26

Greetings, We just released today 0.4.8.23 and 0.4.9.6. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386 Please upgrade as soon as possible if you are running a relay. Change log: Changes in version 0.4.8.23 - 2026-03-25 This is a security release fixing major bugfixes that could possibly lead to remote crashing relays. We strongly recommend upgrading as soon as possible. o Major bugfix (security, conflux): - Fix a memory compare using the wrong length. This could lead to a remote crash when using the conflux subsystem. TROVE-2026-004. Fixes bug 41232; bugfix on 0.4.8.1-alpha. o Minor bugfixes (security): - Fix a series of defense in depth security issues found across the codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on March 25, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/03/25. Changes in version 0.4.9.6 - 2026-03-25 This is a security release fixing major bugfixes that could possibly lead to remote crashing relays. We strongly recommend upgrading as soon as possible. o Major bugfix (security): - Fix a stack overflow of 11 bytes on malicious CREATED2. This lead to a remote crash. TROVE-2026-003. Reported-by: Anas Cherni of Calif.io. Fixes bug 41231; bugfix on 0.4.9.1-alpha. o Major bugfix (security, conflux): - Fix a memory compare using the wrong length. This could lead to a remote crash when using the conflux subsystem. TROVE-2026-004. Fixes bug 41232; bugfix on 0.4.8.1-alpha. o Minor bugfixes (security): - Fix a series of defense in depth security issues found across the codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. o Minor bugfixes (portability): - (Hopefully) fix our polyval implementation on big-endian platforms. Fixes bug 41215; bugfix on 0.4.9.3-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on March 25, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/03/25. Cheers! David -- 7Cse8G921+pZrNTPQ6t2z5h5ZO83kH17z68vTK0aSQM=

1 0