- tor-announce - lists.torproject.org

New Alpha Release: Tor Browser 12.5a1 (Android, Windows, macOS, Linux)
by Richard Pospesel 21 Dec '22

21 Dec '22

Hi everyone, Tor Browser 12.5a1 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-125a1/ best, -Richard

1 0

New Release: Tor Browser 12.0.1 (Android, Windows, macOS, Linux)
by Giorgio Maone 17 Dec '22

17 Dec '22

Hello everyone, Tor Browser 12.0.1 is now available from the Tor Browser download page <https://www.torproject.org/download/> and also from our distribution directory <https://dist.torproject.org/torbrowser/12.0.1/>. This release updates Firefox to 102.6, including bug fixes, stability improvements and important security updates <https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/>. We've fixed a regression in our drag and drop protection, whose hardening disrupted some interface interactions, and most notably rearranging bookmarks by dragging them around. We'd like to thank poncho for fixing another regression causing the |TOR_SOCKS_IPC_PATH| environment variable to be ignored. Blog post with changelog here <https://blog.torproject.org/new-release-tor-browser-1201/>. Have a nice weekend and a happy holiday season :) -- ma1

1 0

New Release: Tor Browser 12.0 (Android, Windows, macOS, Linux)
by Richard Pospesel 07 Dec '22

07 Dec '22

Hi Everyone, We've just enabled updates for Tor Browser 12.0. Please see our blog post for all the details about this release: - https://blog.torproject.org/new-release-tor-browser-120/ best, -Richard

1 0

[RELEASE] 0.4.5.15 and 0.4.7.12
by David Goulet 06 Dec '22

06 Dec '22

Greetings, We just released two stable releases: https://forum.torproject.net/t/stable-release-0-4-5-15-and-0-4-7-12/5800 The ChangeLog for both is attached below. Cheers! David Changes in version 0.4.7.12 - 2022-12-06 This version contains a major change that is a new key for moria1. Also, new metrics are exported on the MetricsPort for the congestion control subsystem. o Directory authority changes (moria1): - Rotate the relay identity key and v3 identity key for moria1. They have been online for more than a decade and refreshing keys periodically is good practice. Advertise new ports too, to avoid confusion. Closes ticket 40722. o Minor feature (Congestion control metrics): - Add additional metricsport relay metrics for congestion control. Closes ticket 40724. o Minor features (fallbackdir): - Regenerate fallback directories generated on December 06, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/12/06. o Minor bugfixes (cpuworker, relay): - Fix an off by one overload calculation on the number of CPUs being used by our thread pool. Fixes bug 40719; bugfix on 0.3.5.1-alpha. Changes in version 0.4.5.15 - 2022-12-06 This version has several major changes for directory authorities. And a major bugfix on OSX. Again, we strongly recommend to upgrade to our 0.4.7.x series latest stable. This series is EOL on February 15th, 2023. o Directory authority changes (dizum): - Change dizum IP address. Closes ticket 40687. o Directory authority changes (Faravahar): - Remove Faravahar until its operator, Sina, set it back up online outside of Team Cymru network. Closes ticket 40688. o Directory authority changes (moria1): - Rotate the relay identity key and v3 identity key for moria1. They have been online for more than a decade and refreshing keys periodically is good practice. Advertise new ports too, to avoid confusion. Closes ticket 40722. o Major bugfixes (OSX): - Fix coarse-time computation on Apple platforms (like Mac M1) where the Mach absolute time ticks do not correspond directly to nanoseconds. Previously, we computed our shift value wrong, which led us to give incorrect timing results. Fixes bug 40684; bugfix on 0.3.3.1-alpha. o Major bugfixes (relay): - Improve security of our DNS cache by randomly clipping the TTL value. TROVE-2021-009. Fixes bug 40674; bugfix on 0.3.5.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on December 06, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/12/06. -- sSW4eiPIDeZwMMhfPCejDwsC8ypVacQQywYo36Dgc4w=

1 0

New Alpha Release: Tor Browser 12.0a5 (Android, Windows, macOS, Linux)
by Richard Pospesel 01 Dec '22

01 Dec '22

Tor Browser 12.0a5 is now available from the Tor Browser download page and also from our distribution directory: - https://www.torproject.org/dist/torbrowser/12.0a5/ Tor Browser 12.0a5 updates Firefox on Android, Windows, macOS, and Linux to 102.5.0esr. This version includes important security updates to Firefox and GeckoView. Tor Browser 12.0a5 backports the following security updates from Firefox 107 to Firefox ESR 102.5 on Android: CVE-2022-45413: SameSite=Strict cookies could have been sent cross-site via intent URLs # Major Changes since 11.5 This is the final planned alpha release before 12.0 stable. We have made a lot of changes over the past several months both large and small, and would like to encourage alpha users to test the following features and report any issues you discover. ## Universal macOS packages This is the first universal package release of Tor Browser for macOS. Now Tor Browser should run natively for macOS users, regardless of whether they are running on older x86_64 devices or on newer Apple M1 aarch64 devices. **What to test:** Users with existing x86_64 macOS installs should receive an automatic update to the new universal package without any loss of functionality. The universal dmg downloaded from the Tor Project website should continue to work for macOS users on both x86_64 and aarch64 platforms. We would also appreciate if macOS users attempted a build-to-build upgrade from an older version of Tor Browser Alpha to help us validate this update path. Once installed, macOS users using aarch64-based Macs (i.e. those with Apple Silicon) can verify whether Tor Browser is running natively by following these steps: 1. Open the Activity Monitor 2. Search for "Tor Browser" within the CPU tab. 3. Should Tor Browser read "Apple" under the Kind column, you are successfully running the native Apple Silicon build. ## Multi-locale bundles (Desktop) As of Tor Browser 12.0a4, all supported languages are now included in a single bundle, and can be changed without requiring additional downloads via the Language menu in General settings on the about:preferences page. **What to test:** Tor Browser Alpha should default to your system language on first launch if it matches a language we support. Alpha testers are also encouraged to test changing language within about:preferences#general, and to report any new bugs with localization in general (in particular instances of 'Firefox' appearing instead of 'Tor Browser' or other similar branding issues). We would also appreciate if users on all our Desktop platforms attempted a build-to-build upgrade from an older version of Tor Browser Alpha to help us validate the update path. ## Unified Español locale (Desktop and Android) Previous versions of Tor Browser Alpha were available in both "es" and "es-AR" (Español Argentina) locales. As of Tor Browser, 12.0a4 these have been unified into a single Spanish locale instead. **What to test:** Alpha testers who use the "es-AR" locale should be automatically switched to "es-ES" after updating. ## New supported locales (Ukranian and Albanian) We have added support for both Ukranian and Albanian languages. **What to test:** Alpha testers who use the "uk" and "sq" locales should try them on both Desktop (using the language picker in about:preferences#general) and Android (using the options in Settings > Language). ## tor-launcher migration (Desktop) Parts of the code that power tor-launcher – which starts tor within Tor Browser – have been refactored. Although this work doesn't include any changes to the user experience, those who run non-standard Tor Browser setups are encouraged to test 12.0a5 on their systems. **What to test:** Alpha testers who run non-standard Tor Browser setups (including, but not limited to, those who use system tor in conjunction with Tor Browser and those with specific network and bridge settings) should test starting and connecting to Tor, and report any unexpected error messages they encounter. All of the previously supported environment variables should still behave the same way as in the stable series. ## Onion Auth fixes (Desktop) Tor Browser 12.0a4 included two fixes to Onion Service client authorization: 1. A fix to the auth window itself, which was broken in Alpha due to a regression caused by the esr102 transition: tor-browser#41344 2. Another fix to a longstanding issue with Onion Auth failing on subdomains, which has also been backported to 11.5.5: tor-browser#40465 **What to test:** Accessing client authorized Onion Services on both top-level and subdomains. ## Always prioritize .onion sites (Android) Android users can now enable automatic Onion-Location redirects by switching "Prioritize .onion sites" within Privacy and Security settings. However, we have not yet implemented the url bar UI which we have in Tor Browser for Desktop. **What to test:** Enable "Prioritize .onion sites" within settings, visit a website that supports Onion-Location, and verify that you were redirected to the website's .onion address. The full changelog since Tor Browser 12.0a4 is: All Platforms Update Translations Update OpenSSL to 1.1.1s Update NoScript to 11.4.13 Update tor to 0.4.7.11 Update zlib to 1.2.13 Bug tor-browser#17228: Consideration for disabling/trimming referrers within TBB Bug tor-browser#27258: font whitelist means we don't have to set gfx.downloadable_fonts.fallback_delay Bug tor-browser#40183: Consider disabling TLS ciphersuites containing SHA-1 Bug tor-browser-build#40622: Update obfs4proxy to 0.0.14 in Tor Browser Bug tor-browser-build#40674: Add Secondary Snowflake Bridge Bug tor-browser#40783: Review 000-tor-browser.js and 001-base-profile.js for 102 Bug tor-browser#41406: Do not define --without-wasm-sandboxed-libraries if WASI_SYSROOT is defined Bug tor-browser#41420: Remove brand.dtd customization on nightly Bug tor-browser#41457: Remove more Mozilla permissions Bug tor-browser#41460: Migrate new identity and security level preferences in 11.5.8 Bug tor-browser#41473: Add support for Albanian (sq) Windows + macOS + Linux Update Firefox to 102.5.0esr Bug tor-browser#31064: Letterboxing is enabled in priviledged contexts too Bug tor-browser#31821: reapply window.open() clamping Bug tor-browser#32411: Consider adding about:tor and others to the list of pages that do not need letterboxing Bug tor-browser#40081: Letterboxing since 32220 affected by layout.css.devPixelsPerPx Bug tor-browser#40767: 1px white border visible on fullscreen video playback Bug tor-browser#41293: Incomplete branding in German with 12.0a2 Bug tor-browser#41378: Inform users when Tor Browser sets their language automatically Bug tor-browser#41409: Circuit display is broken on Tails Bug tor-browser#41410: Opening and closing HTTPS-Only settings make the identity panel shrink Bug tor-browser#41412: New Identity shows "Tor Browser" instead of "Restart Tor Browser" in unstranslated locales Bug tor-browser#41417: Prompt users to restart after changing language Bug tor-browser#41429: TorConnect and TorSettings are initialized twice Bug tor-browser#41433: Should letterboxing take in account optional components' heights? Bug tor-browser#41434: Letterboxing bypass through secondary tab (popup/popunder...) Bug tor-browser#41436: The new tor-launcher handles arrays in the wrong way Bug tor-browser#41437: Use the new media query for dark theme for the "Connected" pill in bridges Bug tor-browser#41449: Onion authentication's learn more should link to the offline manual Bug tor-browser#41451: Still using requestedLocales in torbutton Bug tor-browser#41455: Tor Browser dev build cannot launch tor Bug tor-browser#41458: Prevent mach package-multi-locale from actually creating a package Bug tor-browser#41462: Add anchors to bridge-moji and onion authentication entries Bug tor-browser#41498: The Help panel is empty in 12.0a4 Windows Bug tor-browser#41426: base-browser nightly fails to build for windows-i686 macOS Bug tor-browser#23451: Adapt font whitelist to changes on macOS (zh locales) Bug tor-browser-build#40687: macOS nightly builds with packaged locales fail Android Update GeckoView to 102.5.0esr Bug tor-browser#40014: Check which of our mobile prefs and configuration changes are still valid for GeckoView Bug tor-browser#41471: Update targetSdkVersion to 31 Bug tor-browser#41481: Tor Browser 11.5.9 for Android crashes on launch on Android 12+ after targetSdkVersion update Build System All Platforms Update Go to 1.19.3 Bug tor-browser-build#40675: Update tb_builders list in set-config Bug tor-browser-build#40667: Update Node.js to 12.22.12 Bug tor-browser-build#40690: Revert fix for zlib build break Bug tor-browser#41446: Multi-lingual alpha bundles break make fetch Windows + macOS + Linux Bug tor-browser-build#40503: Update Release Prep issue template with base-browser and privacy browser changes Bug tor-browser-build#40641: Fetch Firefox locales from l10n-central Bug tor-browser-build#40685: Remove targets/nightly/var/mar_locales from rbm.conf Bug tor-browser-build#40686: Add a temporary project to fetch Fluent tranlations for base-browser Bug tor-browser-build#40691: Update firefox config to point to base-browser branch rather than a particular tag in nightly Bug tor-browser-build#40699: Fix input_files in projects/firefox-l10n/config Windows Bug tor-browser-build#40666: Fix compiler depedencies for Firefox on Windows macOS Bug tor-browser-build#40067: Rename "OS X" to "macOS" Bug tor-browser-build#40439: Create universal x86-64/arm64 mac builds

1 0

New Release: Tor Browser 11.5.10 (Android)
by Richard Pospesel 29 Nov '22

29 Nov '22

Tor Browser 11.5.10 is now available from the Tor Browser download page and also from our distribution directory: - https://www.torproject.org/dist/torbrowser/11.5.10/ This is an Android-only release which fixes crashes on Android 12+ devices caused by the targetSdkVersion update in 11.5.9. The full changelog since Tor Browser 11.5.9 is: Android Update NoScript to 11.4.13 Bug tor-browser#41481: Tor Browser 11.5.9 for Android crashes on launch on Android 12+ after targetSdkVersion update

1 0

New Release: Tor Browser 11.5.8 (Android, Windows, macOS, Linux)
by Richard Pospesel 22 Nov '22

22 Nov '22

Tor Browser 11.5.8 is now available from the Tor Browser download page and also from our distribution directory. - https://dist.torproject.org/torbrowser/11.5.8/ This release will not be published on Google Play due to their target API level requirements. Assuming we do not run into any major problems, Tor Browser 11.5.9 will be an Android-only release that fixes this issue. Tor Browser 11.5.8 backports the following security updates from Firefox ESR 102.5 to Firefox ESR 91.13 on Windows, macOS and Linux: CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-45403: Service Workers might have learned size of cross-origin media files CVE-2022-45404: Fullscreen notification bypass CVE-2022-45405: Use-after-free in InputStream implementation CVE-2022-45406: Use-after-free of a JavaScript Realm CVE-2022-45408: Fullscreen notification bypass via windowName CVE-2022-45409: Use-after-free in Garbage Collection CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers CVE-2022-45416: Keystroke Side-Channel Leakage CVE-2022-45420: Iframe contents could be rendered outside the iframe CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 Tor Browser 11.5.8 updates GeckoView on Android to Firefox ESR 102.5 and includes important security updates. Tor Browser 11.5.8 backports the following security updates from Firefox 107 to Firefox ESR 102.5 on Android: CVE-2022-45413: SameSite=Strict cookies could have been sent cross-site via intent URLs The full changelog since Tor Browser 11.5.7 is: All Platforms Update Translations Update OpenSSL to 1.1.1s Update NoScript to 11.4.12 Update tor to 0.4.7.11 Update zlib to 1.2.13 Bug tor-browser-build#40622: Update obfs4proxy to 0.0.14 in Tor Browser Windows + macOS + Linux Bug tor-browser#31064: Letterboxing is enabled in priviledged contexts too Bug tor-browser#32411: Consider adding about:tor and others to the list of pages that do not need letterboxing Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x Bug tor-browser#41434: Letterboxing bypass through secondary tab (popup/popunder...) Bug tor-browser#41456: Backport ESR 102.5 security fixes to 91.13-based Tor Browser Bug tor-browser#41460: Migrate new identity and security level preferences in 11.5.8 Bug tor-browser#41463: Backport fix for CVE-2022-43680 Android Update GeckoView to 102.5.0esr Bug tor-browser#41461: Backport Android-specific 107-rr security fixes to 102.5-esr based Geckoview Build All Platforms Update Go to 1.18.8 Bug tor-browser-build#40658: Create an anticensorship team keyring Bug tor-browser-build#40690: Revert fix for zlib build break

1 0

Tor stable release 0.4.7.11
by David Goulet 10 Nov '22

10 Nov '22

Greetings, We just released the latest stable tor 0.4.7.11. As usual, we strongly recommend you upgrade. Announcement: https://forum.torproject.net/t/stable-release-0-4-7-11/5501 ChangeLog: Changes in version 0.4.7.11 - 2022-11-10 This version contains several major fixes aimed at helping defend against network denial of service. It is also extending drastically the MetricsPort for relays to help us gather more internal data to investigate performance and attacks. We strongly recommend to upgrade to this version especially for Exit relays in order to help the network defend against this ongoing DDoS. o Directory authority changes (dizum, Faravahar): - Change dizum IP address. Closes ticket 40687. - Remove Faravahar until its operator, Sina, set it back up online outside of Team Cymru network. Closes ticket 40688. o Major bugfixes (geoip data): - IPFire informed us on August 12th that databases generated after (including) August 10th did not have proper ARIN network allocations. We are updating the database to use the one generated on August 9th, 2022. Fixes bug 40658; bugfix on 0.4.5.13. o Major bugfixes (onion service): - Set a much higher circuit build timeout for opened client rendezvous circuit. Before this, tor would time them out very quickly leading to unnecessary retries meaning more load on the network. Fixes bug 40694; bugfix on 0.3.5.1-alpha. o Major bugfixes (OSX): - Fix coarse-time computation on Apple platforms (like Mac M1) where the Mach absolute time ticks do not correspond directly to nanoseconds. Previously, we computed our shift value wrong, which led us to give incorrect timing results. Fixes bug 40684; bugfix on 0.3.3.1-alpha. o Major bugfixes (relay): - Improve security of our DNS cache by randomly clipping the TTL value. TROVE-2021-009. Fixes bug 40674; bugfix on 0.3.5.1-alpha. o Minor feature (Mac and iOS build): - Change how combine_libs works on Darwin like platforms to make sure we don't include any `__.SYMDEF` and `__.SYMDEF SORTED` symbols on the archive before we repack and run ${RANLIB} on the archive. This fixes a build issue with recent Xcode versions on Mac Silicon and iOS. Closes ticket 40683. o Minor feature (metrics): - Add various congestion control counters to the MetricsPort. Closes ticket 40708. o Minor feature (performance): - Bump the maximum amount of CPU that can be used from 16 to 128. Note that NumCPUs torrc option overrides this hardcoded maximum. Fixes bug 40703; bugfix on 0.3.5.1-alpha. o Minor feature (relay): - Make an hardcoded value for the maximum of per CPU tasks into a consensus parameter. - Two new consensus parameters are added to control the wait time in queue of the onionskins. One of them is the torrc MaxOnionQueueDelay options which supersedes the consensus parameter. Closes ticket 40704. o Minor feature (relay, DoS): - Apply circuit creation anti-DoS defenses if the outbound circuit max cell queue size is reached too many times. This introduces two new consensus parameters to control the queue size limit and number of times allowed to go over that limit. Closes ticket 40680. o Minor feature (relay, metrics): - Add DoS defenses counter to MetricsPort. - Add congestion control RTT reset counter to MetricsPort. - Add counters to the MetricsPort how many connections, per type, are currently opened and how many were created. - Add relay flags from the consensus to the MetricsPort. - Add total number of opened circuits to MetricsPort. - Add total number of streams seen by an Exit to the MetricsPort. - Add traffic stats as in number of read/written bytes in total. - Related to ticket 40194. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 10, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/11/10. o Minor bugfixes (authorities, sandbox): - Allow to write file my-consensus-<flavor-name> to disk when sandbox is activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha. o Minor bugfixes (dirauth): - Directory authorities stop voting a consensus "Measured" weight for relays with the Authority flag. Now these relays will be considered unmeasured, which should reserve their bandwidth for their dir auth role and minimize distractions from other roles. In place of the "Measured" weight, they now include a "MeasuredButAuthority" weight (not used by anything) so the bandwidth authority's opinion on this relay can be recorded for posterity. Lastly, remove the AuthDirDontVoteOnDirAuthBandwidth torrc option which never worked right. Fixes bugs 40698 and 40700; bugfix on 0.4.7.2-alpha. o Minor bugfixes (onion service client): - A collapsing onion service circuit should be seen as an "unreachable" error so it can be retried. Fixes bug 40692; bugfix on 0.3.5.1-alpha. o Minor bugfixes (onion service): - Make the service retry a rendezvous if the circuit is being repurposed for measurements. Fixes bug 40696; bugfix on 0.3.5.1-alpha. o Minor bugfixes (relay overload statistics): - Count total create cells vs dropped create cells properly, when assessing if our fraction of dropped cells is too high. We only count non-client circuits in the denominator, but we would include client circuits in the numerator, leading to surprising log lines claiming that we had dropped more than 100% of incoming create cells. Fixes bug 40673; bugfix on 0.4.7.1-alpha. o Code simplification and refactoring (bridges): - Remove unused code related to ExtPort connection ID. Fixes bug 40648; bugfix on 0.3.5.1-alpha. Cheers! David -- hZneJUk5igeV4rJ7+XERfxw3J5MVx71fwVx6lK72yUk=

1 0

New Release: Tor Browser 11.5.7 (Windows, macOS, Linux)
by Richard Pospesel 03 Nov '22

03 Nov '22

Tor Browser 11.5.7 is now available from the Tor Browser download page and also from our distribution directory. This is a minor release for desktop platforms intended to facilitate the single-locale to multi-locale bundle upgrade coming with the 12.0 series later this month. The full changelog since Tor Browser 11.5.6 is: Windows + macOS + Linux Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x

1 0

New Alpha Release: Tor Browser 12.0a4 (Android, Windows, macOS, Linux)
by Richard Pospesel 31 Oct '22

31 Oct '22

Tor Browser 12.0a4 is now available from the Tor Browser download page and also from our distribution directory. Tor Browser 12.0a4 updates Firefox on Android, Windows, macOS, and Linux to 102.4.0esr. This version includes important security updates to Firefox and GeckoView. There were no Android-specific security updates to backport from the Firefox 106 release. What's new? Tor Browser 12.0a4 includes a number of changes that require testing and feedback: Multi-locale bundles (Desktop) This is the first multi-locale release of Tor Browser Alpha for desktop. All supported languages are now included in a single bundle, and can be changed without requiring additional downloads via the Language menu in General settings. What to test: Tor Browser Alpha should default to your system language on first launch if it matches a language we support. Alpha testers are also encouraged to test changing language within about:preferences#general, and to report any new bugs with localization in general. tor-launcher migration (Desktop) Parts of the code that power tor-launcher – which starts tor within Tor Browser – have been refactored. Although this work doesn't include any changes to the user experience, those who run non-standard Tor Browser setups are encouraged to test 12.0a4 on their systems. What to test: Alpha testers who run non-standard Tor Browser setups (including, but not limited to, those who use system tor in conjunction with Tor Browser) should test starting and connecting to Tor, and report any unexpected error messages they encounter. All of the previously supported environment variables should still behave the same way as in the stable series. Onion Auth fixes (Desktop) 12.0a4 includes two fixes to Onion Service client authorization: 1. A fix to the auth window itself, which was broken in Alpha due to a regression caused by the esr102 transition: tor-browser#41344 2. Another fix to a longstanding issue with Onion Auth failing on subdomains, which has also been backported to 11.5.5: tor-browser#40465 What to test: Accessing client authorized Onion Services on both top-level and subdomains. Always prioritize .onion sites (Android) Android users can now enable automatic Onion-Location redirects by switching "Prioritize .onion sites" within Privacy and Security settings. What to test: Enable "Prioritize .onion sites" within settings, visit a website that supports Onion-Location, and verify that you were redirected to the website's .onion address. Unified Español locale (Desktop and Android) Previous versions of Tor Browser Alpha were available in both "es" and "es-AR" (Español Argentina) locales. In Tor Browser 12.0a4 these have been unified into a single Spanish locale instead. What to test: Alpha testers who use the "es-AR" locale should be automatically switched to "es-ES" after updating. The full changelog since Tor Browser 12.0a3 is: All Plaforms Update Translations Bug tor-browser#24686: In Tor Browser context, should network.http.tailing.enabled be set to false? Bug tor-browser#27127: Audit and enable HTTP/2 push Bug tor-browser#40057: ensure that CSS4 system colors are not a fingerprinting vector Bug tor-browser#40058: ensure no locale leaks from new Intl APIs Bug tor-browser#40251: Clear obsolete prefs after torbutton!27 Bug tor-browser#40406: Remove Presentation API related prefs Bug tor-browser#40465: Onion Authentication fails when connecting to a subdomain Bug tor-browser#40491: Don't auto-pick a v2 address when it's in Onion-Location header Bug tor-browser#40494: Update Startpage and Blockchair onion search providers Bug tor-browser-build#40629: Bump snowflake version to 9ce1de4eee4e Bug tor-browser-build#40633: Remove Team Cymru hard-coded bridges Bug tor-browser-build#40646: Don't build Español AR anymore Bug tor-browser-build#40649: Update meek default bridge Bug tor-browser-build#40654: Enable uTLS and use the full bridge line for snowflake Bug tor-browser-build#40665: Snowflake bridge parameters are too long (535 bytes) in 11.5.5 Bug tor-browser#41098: Compare Tor Browser's and GeckoView's profiles Bug tor-browser#41154: Review Mozilla 1765167: Deprecate Cu.import Bug tor-browser#41164: Add some #define for the base-browser section Bug tor-browser#41306: Typo "will not able" in "Tor unexpectedly exited" dialog Bug tor-browser#41317: Tor Browser leaks banned ports in network.security.ports.banned Bug tor-browser#41326: Update preference for remoteRecipes Bug tor-browser#41345: fonts: windows whitelist contains supplemental fonts Bug tor-browser#41398: Disable Web MIDI API Windows + macOS + Linux Update Firefox to 102.4.0esr Bug tor-browser#17400: Decide how to use the multi-lingual Tor Browser in the alpha/release series Bug tor-browser-build#40638: Visit our website link after build-to-build upgrade in Nightly channel points to old v2 onion Bug tor-browser-build#40648: Do not customize update.locale in multi-lingual builds Bug tor-browser#40853: use Subprocess.jsm to launch tor Bug tor-browser#40933: Migrate remaining tor-launcher functionality to tor-browser Bug tor-browser#41117: Review Mozilla 1512851: Add Share Menu to File Menu on macOS Bug tor-browser#41323: Tor-ify notification bar gradient colors (branding) Bug tor-browser#41337: Add a title to the new identity confirmation Bug tor-browser#41342: Update the New Identity dialog to the proton modal style Bug tor-browser#41344: Authenticated Onion Services do not prompt for auth key in 12.0 alpha series Bug tor-browser#41352: Update or drop the show manual logic in torbutton Bug tor-browser#41369: Consider a different list-order for locales in language menu Bug tor-browser#41374: Missing a few torconnect strings in the DTD Bug tor-browser#41377: Hide Search for more languages... from Language selector in multi-locale build Bug tor-browser#41385: Bootstrap failure is logged but not raised up to about:torconnect Bug tor-browser#41386: The new tor-launcher has a problem when another Tor is running Bug tor-browser#41387: New identity and new circuit ended up inside history Bug tor-browser#41400: Missing onionAuthViewKeys causes "Onion Services Keys" dialog to be empty. Bug tor-browser#41401: Missing some mozilla icons because we still loading them from "chrome://browser/skin" rather than "chrome://global/skin/icons" Bug tor-browser#41404: Fix blockchair-onion search extension Windows Bug tor-browser#41149: Review Mozilla 1762576: Firefox is not allowing Symantec DLP to inject DLL into the browser for Data Loss Prevention software Bug tor-browser#41278: Create Tor Browser styled pdf logo similar to the vanilla Firefox one macOS Bug tor-browser#41294: Bookmarks manager broken in 12.0a2 on MacOS Bug tor-browser#41348: cherry-pick macOS OSSpinLock replacements Bug tor-browser#41370: Find a way to ship custom default bookmarks without changing language-packs on macOS Bug tor-browser#41372: "Japanese" language menu item is localised in multi-locale testbuild (on mac OS) Bug tor-browser#41379: The new tor-launcher is broken also on macOS Linux Bug tor-browser#40359: Tor Browser Launcher has Wrong Icon Android Update GeckoView to 102.4.0esr Bug tor-browser-build#40631: Stop bundling HTTPS Everywhere on Android Bug tor-browser#41360: Backport Android-specific Firefox 106 to ESR 102.4-based Tor Browser Bug tor-browser#41394: Implement a setting to always prefer onion sites Build All Platforms Update Go to 1.19.2 Bug tor-browser-build#23656: Use .mozconfig files in tor-browser repo for rbm builds Bug tor-browser-build#28754: make testbuild-android-armv7 stalls during sha256sum step Bug tor-browser-build#40397: Create a new build target to package tor daemon, pluggable transports and dependencies Bug tor-browser-build#40619: Make sure translations are taken from gitlab.tpo and not git.tpo Bug torbrowser-build#40627: Add boklm to torbutton.gpg Bug tor-browser-build#40634: Update the project/browser path in tools/changelog-format-blog-post and other files Bug tor-browser-build#40636: Remove https-everywhere from projects/browser/config Bug tor-browser-build#40639: Remove tor-launcher references Bug tor-browser-build#40643: Update Richard's key in torbutton.gpg Bug tor-browser-build#40655: Published tor-expert-bundle tar.gz files should not include their tor-browser-build build id Bug tor-browser-build#40656: Improve get_last_build_version in tools/signing/nightly/sign-nightly Bug tor-browser-build#40658: Create an anticensorship team keyring Bug tor-browser-build#40660: Update changelog-format-blog-post script to point gitlab rather than gitolite Bug tor-browser-build#40662: Make base-browser nightly build from tag Bug tor-browser-build#40671: Update langpacks URL Bug tor-browser#41308: Use the same branch for Desktop and GeckoView Bug tor-browser#41340: Opt in to some of the NIGHTLY_BUILD features Bug tor-browser#41343: Add -without-wam-sandboxed-libraries to mozconfig-linux-x86_64-dev for local builds Bug tor-browser-build#40585: Prune the manual more Bug tor-browser-build#40663: Do not ship bookmarks in tor-browser-build anymore Bug tor-browser-build#40669: Remove HTTPS-Everywhere keyring Bug tor-browser#41357: Enable browser toolbox debugging by default for dev builds macOS Bug tor-browser-build#40158: Add support for macOS AArch64 Bug tor-browser-build#40464: go 1.18 fails to build on macOS Linux Bug tor-browser-build#40659: Error building goservice for linux in nightly build Android Bug tor-browser-build#40640: Extract Gradle in the toolchain setup

1 0