- tor-announce - lists.torproject.org

New Release: Tor Browser 13.5a6 (Android, Windows, macOS, Linux)
by Richard Pospesel 28 Mar '24

28 Mar '24

Hi everyone, Tor Browser 13.5a6 has now been published for all platforms. For details please see our blog post: - $(BLOG_POST_URL) Changelog: > Tor Browser 13.5a6 - March 28 2024 > * All Platforms > * Bug 41114: Fix no-async-promise-executor on TorConnect [tor-browser] > * Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth [tor-browser] > * Bug 42336: Review the relationship between TorSettings and the TorProvider [tor-browser] > * Bug 42428: Timezone offset leak via document.lastModified [tor-browser] > * Bug 42435: Update moat domain fronting configuration [tor-browser] > * Bug 42437: Drop "torbrowser.version" preference [tor-browser] > * Bug 42444: Remove the "Prioritize .onion sites when known" option [tor-browser] > * Bug 42449: Rebase Tor Browser alpha onto Firefox 115.9.0esr [tor-browser] > * Bug 42459: Add startpage onion service to list of search providers [tor-browser] > * Bug 42466: Drop the "Onion Logo" from trademark statement [tor-browser] > * Bug 42472: Timezone May leak from XSLT Date function [tor-browser] > * Bug 42473: ESR 115.9.1 fixes [tor-browser] > * Bug 42481: Modularize SecurityLevel [tor-browser] > * Bug 41105: Bump version of snowflake to v2.9.2 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 115.9.0esr > * Bug 41916: Letterboxing preferences UI [tor-browser] > * Bug 41918: Add option to reuse last window size when letterboxing is enabled [tor-browser] > * Bug 42203: Fluent migration: about dialog [tor-browser] > * Bug 42209: Fluent migration: tor circuit [tor-browser] > * Bug 42211: Fluent migration: new identity [tor-browser] > * Bug 42214: Fluent migration: security level [tor-browser] > * Bug 42236: Let users decide whether to load their home page on new identity. [tor-browser] > * Bug 42443: Shrink the window to match letterboxing size when the emtpy area is doble-clicked [tor-browser] > * Bug 42446: Improve accessible descriptions in built-in dialog [tor-browser] > * Bug 42458: Update the "Submit Feedback" link in "About Tor Browser" [tor-browser] > * Windows > * Bug 42377: Hidden fonts are automatically added to the allow list [tor-browser] > * Linux > * Bug 42438: Adapt the data import wizard to use the original $HOME on Linux [tor-browser] > * Bug 41110: Avoid Fontconfig warning about "ambiguous path" [tor-browser-build] > * Android > * Updated GeckoView to 115.9.0esr > * Bug 41187: Improve Android's bridge settings UI [tor-browser] > * Bug 42427: Do not ship bridges as prefences anymore [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.21.8 > * Bug 41102: src archive does not match likely due to mismatched xz-utils version [tor-browser-build] > * Bug 41107: Update download-unsigned-sha256sums-gpg-signatures-from-people-tpo for new type of URL [tor-browser-build] > * Bug 40073: We should remove ./ when using 7-zip for zip files [rbm] > * Windows + macOS + Linux > * Bug 42305: (Semi-)Automatically merge translation resources across tor browser releases (desktop) [tor-browser] > * Bug 41088: Remove use of projects/browser/run_scripts [tor-browser-build] > * Windows > * Bug 41097: authenticode-timestamping.sh fails to run again because tmp-timestamp already exists [tor-browser-build] > * Android > * Bug 40502: Do not recommend addons on Tor Browser [tor-browser] > * Bug 41082: Package tor expert bundle on android as .aar that firefox-android can use in lieu of tor-android-service with geckoview bootstrap [tor-browser-build] best, -richard

1 1

[RELEASE] Onionspray release 1.6.1
by rhatto 26 Mar '24

26 Mar '24

Greetings, We just released Onionspray 1.6.1. This is a maintenance release, with some fixes and a few minor underlying features. Operators are advised to reconfigure and restart their services to apply template updates. The full ChangeLog is available at https://gitlab.torproject.org/tpo/onion-services/onionspray/-/blob/main/doc… -- Silvio Rhatto pronouns he/him

1 0

New Release: Tor Browser 13.0.13 (Windows, macOS, Linux)
by Richard Pospesel 22 Mar '24

22 Mar '24

Hi everyone, Tor Browser 13.0.13 has now been published for all Desktop platforms. This is an unscheduled emergency release for our Desktop platforms only. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13013/ Changelog: > Tor Browser 13.0.13 - March 22 2024 > * Windows + macOS + Linux > * Updated Firefox to 115.9.1esr > * Bug 42473: ESR 115.9.1 fixes [tor-browser] > * Bug 42474: Rebase stable browsers on 115.9.1 [tor-browser] best, -richard

1 0

New Release: Tor Browser 13.0.12 (Android, Windows, macOS, Linux)
by Nicolas Vigier 19 Mar '24

19 Mar '24

Hi everyone, Tor Browser 13.0.12 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-release-tor-browser-13012/ Changelog: * All Platforms * Updated Snowflake to 2.9.2 * Bug 42376: The placeholder of datetime inputs keeps being localized when spoof English is on [tor-browser] * Bug 42378: spoof english + htmlform <details> can leak app language [tor-browser] * Bug 42444: Remove the "Prioritize .onion sites when known" option [tor-browser] * Bug 42448: Rebase Tor Browser stable onto Firefox 115.9.0esr [tor-browser] * Bug 42459: Add startpage onion service to list of search providers [tor-browser] * Bug 41105: Bump version of snowflake to v2.9.2 [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 115.9.0esr * Windows * Bug 42377: Hidden fonts are automatically added to the allow list [tor-browser] * Android * Updated GeckoView to 115.9.0esr * Bug 42407: TTP-03-010 WP3: Potential phishing [tor-browser] * Build System * All Platforms * Updated Go to 1.21.8 * Bug 41102: src archive does not match likely due to mismatched xz-utils version [tor-browser-build]

1 0

New Release: Tor Browser 13.0.11 (Android, Windows, macOS, Linux)
by Richard Pospesel 06 Mar '24

06 Mar '24

Hi everyone, Tor Browser 13.0.11 has now been published for all platforms. This is an unscheduled release fixing an issue with the Snowflake pluggable transport and the connect-assist domain-fronting configurations. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13011/ Changelog: > Tor Browser 13.0.11 - March 06 2024 > * All Platforms > * Bug 42435: Update moat domain fronting configuration [tor-browser] > * Build System > * All Platforms > * Bug 41085: kick_devmole_build script prints wrong URL for Mullvad's build hashes [tor-browser-build] > * Bug 41097: authenticode-timestamping.sh fails to run again because tmp-timestamp already exists [tor-browser-build] best, -richard

1 0

New Release: Tor Browser 13.5a5 (Android, Windows, macOS, Linux)
by Richard Pospesel 28 Feb '24

28 Feb '24

Hi everyone, Tor Browser 13.5a5 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-135a5/ Changelog: > Tor Browser 13.5a5 - February 28 2024 > * All Platforms > * Updated OpenSSL to 3.0.13 > * Updated Snowflake to 2.9.0 > * Bug 42376: The placeholder of datetime inputs keeps being localized when spoof English is on [tor-browser] > * Bug 42378: spoof english + htmlform <details> can leak app language [tor-browser] > * Bug 42390: Betterboxing: make the decorator border disappear when the corners are flat [tor-browser] > * Bug 42397: Change RFP-spoofed Timezone from UTC to a real-world, less discriminable one [tor-browser] > * Bug 42412: Rebase Tor Browser Alpha onto 115.8.0esr [tor-browser] > * Bug 41079: Bump version of Snowflake to v2.9.0 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 115.8.0esr > * Bug 41814: Change "vanilla bridge:" to "Tor bridge:" in bridge cards [tor-browser] > * Bug 42270: Implement design changes to QR code dialog [tor-browser] > * Bug 42389: Betterboxing: gradient is never shown [tor-browser] > * Bug 42398: Include Alpha and Nightly in MOZ_APP_DISPLAYNAME (and possibly in other places) [tor-browser] > * Bug 42414: Show ellipsis when the tor bridge address overflows [tor-browser] > * Bug 42415: Improve focus styling for forced focus in bridge settings [tor-browser] > * Bug 42421: Remove bridge option should be hidden for Lox bridges [tor-browser] > * Bug 42423: Move temporary Lox Fluent strings to new file [tor-browser] > * Bug 42425: Improve accessibility of the bridge emoji cells [tor-browser] > * Android > * Updated GeckoView to 115.8.0esr > * Bug 42253: Remove "New private tab" action and widget [tor-browser] > * Bug 42402: Remove Android YEC strings [tor-browser] > * Bug 42407: TTP-03-010 WP3: Potential phishing [tor-browser] > * Bug 42416: Backport Android security fixes from Firefox 123 [tor-browser] > * macOS > * Bug 40569: Create build-specific installer for macOS [tor-browser-build] > * Build System > * All Platforms > * Updated Go to 1.20.14 and 1.21.7 > * Bug 41081: Update detailsURL in tools/signing/nightly/update-responses-base-config.yml [tor-browser-build] > * Bug 41085: kick_devmole_build script prints wrong URL for Mullvad's build hashes [tor-browser-build] > * Bug 40068: Switch from IO::CaptureOutput to Capture::Tiny [rbm] > * Bug 40069: Make stdout and stderr utf8 [rbm] > * Bug 40071: Add an option to create zip files using 7z [rbm] > * Bug 40072: Move capture_exec to a separate module [rbm] > * Windows > * Bug 41076: Include the ShellLink plugin in NSIS [tor-browser-build] > * macOS > * Bug 41084: $app_bundle is missing the final .app in projects/firefox/build [tor-browser-build] > * Android > * Bug 42399: Re-enable minimization of JS for Android [tor-browser] > * Bug 41080: Re-pack omni.ja with 7-zip on Android [tor-browser-build] > * Bug 41092: Use an uncompressed omni.ja to improve final apk compression. [tor-browser-build] > * Bug 41093: Sign unsigned APKs instead of the QA-signed ones [tor-browser-build] best, -richard

1 0

New Release: Tor Browser 13.0.10 (Android, Windows, macOS, Linux)
by Richard Pospesel 20 Feb '24

20 Feb '24

Hi everyone, Tor Browser 13.0.10 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13010/ Changelog: > Tor Browser 13.0.10 - February 20 2024 > * All Platforms > * Updated OpenSSL to 3.0.13 > * Updated zlib to 1.3.1 > * Updated Snowflake to 2.9.0 > * Bug 42374: spoof english leaks via numberingSystem: numbers (non-latn) or decimal separator (latn) [tor-browser] > * Bug 42411: Rebase Tor Browser stable onto 115.8.0esr [tor-browser] > * Bug 41079: Bump version of Snowflake to v2.9.0 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 115.8.0esr > * Bug 42338: Changing circuit programmatically in Tor Browser not working anymore! [tor-browser] > * Android > * Updated GeckoView to 115.8.0esr > * Bug 42402: Remove Android YEC strings [tor-browser] > * Bug 42416: Backport Android security fixes from Firefox 123 [tor-browser] > * Linux > * Bug 42293: Updater is disabled when tor-browser is run by torbrowser-launcher flatpak [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.20.14 and 1.21.7 > * Bug 41067: Use Capture::Tiny instead of IO::CaptureOutput [tor-browser-build] > * Bug 40067: Use --no-verbose wget option when not running in a terminal [rbm] > * Bug 40068: Switch from IO::CaptureOutput to Capture::Tiny [rbm] > * Bug 40069: Make stdout and stderr utf8 [rbm] > * Bug 40072: Move capture_exec to a separate module [rbm] best, -richard

1 0

New Release: Tor Browser 13.5a4 (Android, Windows, macOS, Linux)
by Richard Pospesel 01 Feb '24

01 Feb '24

Hi everyone, Tor Browser 13.5a4 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-135a4/ Changelog since 13.5a3: > Tor Browser 13.5a4 - January 31 2024 > * All Platforms > * Updated zlib to 1.3.1 > * Updated Snowflake to 2.8.1 > * Bug 42343: Consume pt_config.json in the browser [tor-browser] > * Bug 42348: TorSettings.defaultSettings() removed but still referenced by Moat.sys.mjs [tor-browser] > * Bug 42354: Refactor exclusions in ShouldSanitizePreference() to the pref list. [tor-browser] > * Bug 42358: Separate the domain fronted requests from Moat [tor-browser] > * Bug 42359: Handle firewall and proxy in TorSettings.setSettings [tor-browser] > * Bug 42363: Tab thumbnails enhancements [tor-browser] > * Bug 42366: Rebase Tor Browser Alpha onto Firefox 115.7.0esr [tor-browser] > * Bug 42369: Revert YEC 2023 changes [tor-browser] > * Bug 42374: spoof english leaks via numberingSystem: numbers (non-latn) or decimal separator (latn) [tor-browser] > * Bug 42384: Regression: quickstart doesn't work anymore [tor-browser] > * Bug 41058: Update Snowflake to 2.8.1 [tor-browser-build] > * Bug 262: Mouse-over long links causes the browser element to re-center relative to width of status tooltip [mullvad-browser] > * Windows + macOS + Linux > * Updated Firefox to 115.7.0esr > * Bug 41917: Make the appearance of letterboxing look more intentional [tor-browser] > * Bug 42036: Design and build a user interface for Lox [tor-browser] > * Bug 42338: Changing circuit programmatically in Tor Browser not working anymore! [tor-browser] > * Bug 42387: Visual noise in 13.5a4 letterboxing [tor-browser] > * Linux > * Bug 42293: Updater is disabled when tor-browser is run by torbrowser-launcher flatpak [tor-browser] > * Android > * Updated GeckoView to 115.7.0esr > * Bug 42252: Plumb down TorConnect commands from firefox-android to GeckoView [tor-browser] > * Bug 42346: Crash in firefox-android originating in backported FullScreenNotificationDialog patch [tor-browser] > * Bug 42353: Fix Android NoScript automatic updates [tor-browser] > * Bug 42355: Fullscreen on Android doesn't hide system bars [tor-browser] > * Bug 42367: Backport Android security fixes from Firefox 122 [tor-browser] > * Bug 42368: Tor Browser 13.5a3 crashes during start-up because of API26+ methods [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.20.13 and 1.21.6 > * Bug 41037: Set time on signing machine before starting signing [tor-browser-build] > * Bug 41038: Add RPM dependencies to README [tor-browser-build] > * Bug 41059: Update keyring/torbrowser.gpg with updated key [tor-browser-build] > * Bug 41063: Run "file $keyring" in tools/keyring/list-all-keyrings [tor-browser-build] > * Bug 41067: Use Capture::Tiny instead of IO::CaptureOutput [tor-browser-build] > * Bug 41073: Update documention about required packages for container-less build [tor-browser-build] > * Bug 40067: Use --no-verbose wget option when not running in a terminal [rbm] > * Windows + macOS + Linux > * Bug 41078: pt_config.json not touch'd before adding to omni.ja, resulting in build non-determinism [tor-browser-build] > * Windows > * Bug 40606: Use Clang to compile NSIS [tor-browser-build] > * Bug 40900: Update NSIS to 3.09 [tor-browser-build] > * Bug 41065: Do a cleanup of the NSIS script [tor-browser-build] best, -richard

1 0

New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
by Richard Pospesel 23 Jan '24

23 Jan '24

Hi everyone, Tor Browser 13.0.9 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1309/ Changelog: > Tor Browser 13.0.9 - January 23 2024 > * All Platforms > * Updated Snowflake to 2.8.1 > * Bug 42363: Tab thumbnails enhancements [tor-browser] > * Bug 42365: Rebase Tor Browser Stable onto Firefox 115.7.0esr [tor-browser] > * Bug 42367: Backport Android security fixes from Firefox 122 [tor-browser] > * Bug 42369: Revert YEC 2023 changes [tor-browser] > * Bug 41058: Update Snowflake to 2.8.1 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 115.7.0esr > * Bug 42099: Blind cross-origin requests to .tor.onion domains [tor-browser] > * Bug 42189: Assertion failure: the value of mPrivateBrowsingId in the loadContext and in the loadInfo are not the same! [tor-browser] > * Android > * Updated GeckoView to 115.7.0esr > * Bug 42313: Enable One UI Sans KR as a possible font for Korean (MozBug 1865238) [tor-browser] > * Bug 42324: Onion Location on Android is ignored [tor-browser] > * Bug 42346: Crash in firefox-android originating in backported FullScreenNotificationDialog patch [tor-browser] > * Bug 42353: Fix Android NoScript automatic updates [tor-browser] > * Bug 42355: Fullscreen on Android doesn't hide system bars [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.20.13 and 1.21.6 > * Bug 41059: Update keyring/torbrowser.gpg with updated key [tor-browser-build] > * Bug 41063: Run "file $keyring" in tools/keyring/list-all-keyrings [tor-browser-build] > * Windows + macOS + Linux > * Bug 41056: Make it possible to use templates in var/torbrowser_incremental_from [tor-browser-build] > * Windows + macOS > * Bug 41016: Switch from bullseye to bookworm for desktop platforms [tor-browser-build] > * Windows > * Bug 41015: Enable std::filesystem on libc++ on Windows [tor-browser-build] > * Android > * Bug 41066: The Android x86 APK for 13.0.9 is too big [tor-browser-build] best, -richard

1 0

New Release: Tor Browser 13.5a3 (Android, Windows, macOS, Linux)
by Richard Pospesel 22 Dec '23

22 Dec '23

Hi everyone, Tor Browser 13.5a3 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-135a3/ changelog: > Tor Browser 13.5a3 - December 22 2023 > * All Platforms > * Updated Tor to 0.4.8.10 > * Updated NoScript to 11.4.29 > * Bug 42042: view-source:http://ip-address does not work because of HTTPS Only [tor-browser] > * Bug 42308: Update README for tor browser [tor-browser] > * Bug 42332: Rebase Tor Browser alpha onto 115.6.0esr [tor-browser] > * Bug 42334: Keep returning ERROR_ONION_WITH_SELF_SIGNED_CERT only for .onion sites whose cert throws ERROR_UNKNOWN_ISSUER [tor-browser] > * Bug 42335: Do not localize the order of locales for app lang [tor-browser] > * Bug 42340: TorBridgeChanged notification sends out "[object Object]" as its data. [tor-browser] > * Windows + macOS + Linux > * Updated Firefox to 115.6.0esr > * Bug 40856: Add a default for preferences in TorSettings [tor-browser] > * Bug 42099: Blind cross-origin requests to .tor.onion domains [tor-browser] > * Bug 42189: Assertion failure: the value of mPrivateBrowsingId in the loadContext and in the loadInfo are not the same! [tor-browser] > * Bug 42283: Tor Browser shouldn't ship blockchair by default [tor-browser] > * Bug 42299: After adding incorrect bridge addres on user cannot go back to the Connection page [tor-browser] > * Bug 42303: Remove unused "help" button logic in tor dialogs [tor-browser] > * Bug 42319: Make all the wordmark of the same size [tor-browser] > * Windows > * Bug 42163: Make the 3rd party DLL blocklist obey portable mode [tor-browser] > * Bug 42179: PTs on Tor Browser 13 do not work with Windows 7 [tor-browser] > * Linux > * Bug 41050: Improve the disk leak sanitization on start-$browser [tor-browser-build] > * Android > * Updated GeckoView to 115.6.0esr > * Bug 42248: Allow GeckoView to launch tor [tor-browser] > * Bug 42249: Allow GeckoView to launch lyrebird [tor-browser] > * Bug 42250: Allow Moat.sys.mjs to invoke lyrebird on Android [tor-browser] > * Bug 42301: Make TorSettings interact with the old Android Settings [tor-browser] > * Bug 42313: Enable One UI Sans KR as a possible font for Korean (MozBug 1865238) [tor-browser] > * Bug 42323: Add a checkbox to enable the connect assist experiments on alpha [tor-browser] > * Bug 42324: Onion Location on Android is ignored [tor-browser] > * Bug 42339: Backport Android security fixes from Firefox 121 to 115.6 - based Tor Browser [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.21.5 > * Bug 42331: tb-dev fetch command is missing repository argument [tor-browser] > * Bug 40995: Use cdn.stagemole.eu instead of cdn.devmole.eu in download-unsigned-sha256sums-gpg-signatures-from-people-tpo [tor-browser-build] > * Bug 41026: Do not use ~ when uploading the signed hashes [tor-browser-build] > * Bug 41027: Remove tb-build-04 and tb-build-05 from tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo [tor-browser-build] > * Bug 41036: Remove go_vendor-lyrebird-nightly makefile target, and rename go_vendor-$project-alpha makefile targets to go_vendor-$project [tor-browser-build] > * Bug 41039: Update tools/signing/upload-update_responses-to-staticiforme to keep download-*json files from previous release when new release does not include them [tor-browser-build] > * Bug 41042: Add options to include updates in the changelog scripts [tor-browser-build] > * Bug 41043: Create script to push build requests to Mullvad build servers [tor-browser-build] > * Bug 41045: Dump more information about build times on Firefox [tor-browser-build] > * Bug 41048: Drop the kcp-go project [tor-browser-build] > * Windows + macOS + Linux > * Bug 41031: Add command to unsign .mar files and compare with sha256sums-unsigned-build.txt [tor-browser-build] > * Bug 41056: Make it possible to use templates in var/torbrowser_incremental_from [tor-browser-build] > * Bug 41057: make fetch is not fetching mullvad repo [tor-browser-build] > * Windows + macOS > * Bug 41016: Switch from bullseye to bookworm for desktop platforms [tor-browser-build] > * Windows > * Bug 41015: Enable std::filesystem on libc++ on Windows [tor-browser-build] > * Bug 41030: Add command to unsign .exe files and compare with sha256sums-unsigned-build.txt [tor-browser-build] > * macOS > * Bug 40990: Remove old macos signing scripts [tor-browser-build] > * Linux > * Bug 41046: Use the final path for Linux debug symbols [tor-browser-build] best, -richard

1 0