- tor-announce - lists.torproject.org

New Release: Tor Browser 13.5.26 (ONLY Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 09 Dec '25

09 Dec '25

Hi everyone, Tor Browser 13.5.26 has now been published for legacy Windows and macOS platforms ONLY. For details please see our blog post https://blog.torproject.org/new-release-tor-browser-13526/ Changelog: * All Platforms o Updated Firefox to 115.31.0esr o Updated NoScript to 13.5.2.1984 o Updated Tor to 0.4.8.21 o Bug tor-browser#22974 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22974>: Self-host NoScript Updates o Bug tor-browser#44391 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44391>: Restrictions cascade blocks every capability in subframes (e.g. captchas) o Bug tor-browser#44397 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44397>: Rebase Tor Browser legacy onto 115.31.0esr o Bug tor-browser#44409 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44409>: Backport Security Fixes from Firefox 146 * Build System o All Platforms + Bug tor-browser-build#41644 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Self-hosted browser extensions support in relprep.py -- ma1

1 0

New Release: Tor Browser 15.0.3 (Android, Windows, macOS, Linux)
by Giorgio Maone 09 Dec '25

09 Dec '25

Hi everyone, Tor Browser 15.0.3 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-15 <https://blog.torproject.org/new-release-tor-browser-1503>03 Changelog: *Tor Browser 15.0.3 - December 09 2025* * All Platforms o Updated NoScript to 13.5.2.1984 o Bug tor-browser#22974 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22974>: Self-host NoScript Updates o Bug tor-browser#44348 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44348>: Backport Bugzilla 1999126: Protect whether PDF.js is enabled/disabled to improve fingerprinting protection o Bug tor-browser#44391 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44391>: Restrictions cascade blocks every capability in subframes (e.g. captchas) o Bug tor-browser#44399 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44399>: Rebase Tor Browser 15.0 stable onto 140.6.0esr o Bug tor-browser#44409 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44409>: Backport Security Fixes from Firefox 146 o Bug tor-browser-build#41646 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update lyrebird version to v0.7.0 * Windows + macOS + Linux o Updated Firefox to 140.6.0esr o Bug tor-browser#44414 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44414>: Disable Zucchini for the 15.0 series. * Android o Updated GeckoView to 140.6.0esr o Bug tor-browser#44346 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44346>: Webrender broken on Adreno 510 devices with esr140 * Build System o All Platforms + Bug tor-browser-build#41644 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Self-hosted browser extensions support in relprep.py o Windows + Linux + Android + Updated Go to 1.24.11 -- ma1

1 0

New Release: Tor Browser 13.5.25 (Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 19 Nov '25

19 Nov '25

Hi everyone, Tor Browser 13.5.25 has now been published for Windows 7/8/8.1, macOS 10.12-10.14. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13525 Changelog: Tor Browser 13.5.25 - November 13 2025 * All Platforms * Updated Tor to 0.4.8.20 * Bug 44335: Additional Security Fix Backport from Firefox 145 to esr115 [tor-browser] -- ma1

1 0

New Release: Tor Browser 15.0.2 (Android, Windows, macOS, Linux)
by Giorgio Maone 19 Nov '25

19 Nov '25

Hi everyone, Tor Browser 15.0.2 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1502 Changelog: * All Platforms o Updated Tor to 0.4.8.20 * Build System o Android + Bug tor-browser-build#41629 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Bump JNA to 5.16.0 -- ma1

1 0

[RELEASE] Tor 0.4.8.21 stable
by David Goulet 18 Nov '25

18 Nov '25

Greetings, We have another stable fixing more security issues. See announcement: https://forum.torproject.org/t/stable-release-0-4-8-21/20817 Here is the ChangeLog. Changes in version 0.4.8.21 - 2025-11-17 This release is a continuation of the previous one and addresses additional Conflux-related issues identified through further testing and feedback from relay operators. We strongly recommend upgrading as soon as possible. o Major bugfixes (conflux, exit): - When dequeuing out-of-order conflux cells, the circuit could be close in between two dequeue which could lead to a mishandling of a NULL pointer. Fixes bug 41162; bugfix on 0.4.8.4. o Minor feature (compiler flag): - Add -mbranch-protection=standard for arm64. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 17, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/11/17. o Minor bugfixes (bridges, pluggable transport): - Fix a bug causing the initial tor process to hang intead of exiting with RunAsDaemon, when pluggable transports are used. Fixes bug 41088; bugfix on 0.4.8.1-alpha. Cheers! David -- DKF8td80doiu+vmXr1f3qf84hR+DbmSu+T/Ll1tDT0k=

1 0

[RELEASE] Tor 0.4.8.20 stable - Security Fixes
by David Goulet 11 Nov '25

11 Nov '25

Greetings, We just released 0.4.8.20 containing two security medium severity fixes affecting Exit relays mostly. As of this announcement, our Debian packages are available at https://deb.torproject.org Here is the announcement: https://forum.torproject.org/t/stable-release-0-4-8-20/20781 Changes in version 0.4.8.20 - 2025-11-10 This release fixes several bugfixes related to Conflux edge cases as well as adding a new hardening compiler flag if supported. We strongly recommend to upgrade as soon as possible. o Minor feature (compiler flag): - Add -fcf-protection=full if supported by the compiler. Fixes 41139. o Minor features (fallbackdir): - Regenerate fallback directories generated on October 06, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/11/10. o Minor bugfixes (conflux fragile asserts): - Fix the root cause of some conflux fragile asserts when a control port listener is attached. Fixes bug 41037; bugfix on 0.4.8.16. o Minor bugfixes (conflux, relay): - Fix a series of conflux edge cases about sequence number arithmetic and OOM handler kicking in under heavy memory pressure. Fixes bug 41155; bugfix on 0.4.8.4. Cheers! David -- liO7tEkAvH7asFm910GjXnAJ++7tf/uz6e1uCcUHj8E=

1 0

New Release: Tor Browser 13.5.24 (Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 11 Nov '25

11 Nov '25

Hi everyone, Tor Browser 13.5.24 has now been published for legacy Windows and macOS platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-13524/>. <https://blog.torproject.org/new-release-tor-browser-13518/> <https://blog.torproject.org/new-release-tor-browser-13518/> Changelog: * All Platforms o Updated NoScript to 13.4 o Bug tor-browser#44270 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44270>: Re-enable SHA1 for signing to match Firefox's TLS fingerprint o Bug tor-browser#44320 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44320>: Rebase Tor Browser legacy onto 115.30.0esr o Bug tor-browser#44325 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44325>: Backport Security Fixes from Firefox 145 o Bug tor-browser-build#41609 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Move back to CDN77 for default snowflake bridge * Build System o All Platforms + Bug tor-browser-build#41603 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Automate stand-alone legacy release deployment -- ma1

1 0

New Release: Tor Browser 15.0.1 (Android, Windows, macOS, Linux)
by Giorgio Maone 11 Nov '25

11 Nov '25

Hi everyone, Tor Browser 15.0.1 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1501 Changelog: Tor Browser 15.0.1 - November 11 2025 * All Platforms o Updated NoScript to 13.4 o Bug tor-browser#44319 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44319>: Rebase Tor Browser onto 140.5.0esr o Bug tor-browser#44325 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44325>: Backport Security Fixes from Firefox 145 o Bug tor-browser#44333 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44333>: Add the "No AI" version of DuckDuckGo to available search engines o Bug mullvad-browser#487 <https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/487>: Search engines are sorted alphabetically rather than the desired order * Windows + macOS + Linux o Updated Firefox to 140.5.0esr o Bug tor-browser#44310 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44310>: Default zoom always resets to 100% o Bug tor-browser#44314 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44314>: Upgrade message not shown in about:tor * Linux o Bug tor-browser#44273 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44273>: Restore Noto CJK as Jigmo has a too low readability o Bug tor-browser#44315 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44315>: Font/text issue with self-upgrade window * Android o Updated GeckoView to 140.5.0esr o Bug tor-browser#44303 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44303>: Extension update job might never work on Android * Build System o All Platforms + Bug tor-browser-build#41618 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Restore the expert bundle's version in the final release directory o Windows + Linux + Android + Updated Go to 1.24.10 o Android + Bug tor-browser-build#41617 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Pass page size to zipalign + Bug tor-browser-build#41620 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Do not rerun zipalign when signing + Bug tor-browser-build#41621 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove support using older android build tools when signing 14.5 releases in tools/signing/wrappers/sign-apk -- ma1

1 0

New Release: Tor Browser 15.0 (Android, Windows, macOS, Linux)
by Morgan 28 Oct '25

28 Oct '25

Hi everyone, Tor Browser 15.0 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-150/ Changelog: > Tor Browser 15.0 - October 28 2025 > * All Platforms > * Updated NoScript to 13.2.2 > * Updated Lyrebird to 0.6.2 > * Bug 19741: Opensearch (contextual search) does not obey FPI [tor-browser] > * Bug 43009: Backport Bug 1973265 - Put WebCodecs API behind RFP Target [tor-browser] > * Bug 43093: Refactor the patch to disable LaterRun [tor-browser] > * Bug 43727: Update moz-toggle customisation for ESR 140 [tor-browser] > * Bug 43745: Disable HEVC (H265) playback support [tor-browser] > * Bug 43772: Do not use official branding for BB/TB/MB [tor-browser] > * Bug 43784: Get confirmation from NoScript that settings are applied [tor-browser] > * Bug 43832: Drop eslint-env [tor-browser] > * Bug 43850: Modify the Contrast Control settings for RFP [tor-browser] > * Bug 43853: DomainFrontedRequests: setData is no longer a function [tor-browser] > * Bug 43864: Remove features from the unified search button [tor-browser] > * Bug 43869: Hide pens with RFP [tor-browser] > * Bug 43880: Update moat's domain front url [tor-browser] > * Bug 44045: Drop AI and machine learning components [tor-browser] > * Bug 44068: Handle migration from meek-azure to meek built-in bridge type [tor-browser] > * Bug 44069: Update `meek-azure` related strings to `meek` [tor-browser] > * Bug 44140: Refactored patch to prevent writing temp PDF files to disk [tor-browser] > * Bug 44234: No images in PDF [tor-browser] > * Bug 44275: Reduce console noise on security level guess [tor-browser] > * Bug 44280: Test stream isolation [tor-browser] > * Bug 41429: Add a note about user safety to Tor Browser Alpha blog posts [tor-browser-build] > * Bug 41442: Update our audit CSVs to use the new Audit template [tor-browser-build] > * Bug 41502: Application services build is failing on isNetworkAllowed() [tor-browser-build] > * Bug 41609: Use new CDN77 fronts for snowflake [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 140.4.0esr > * Bug 42025: Purple elements (e.g. Tor buttons) need dark theme variants [tor-browser] > * Bug 42738: Tidy up the commit structure for browser updates UI [tor-browser] > * Bug 43111: Delete our webextensions for search engines when Bug 1885953 is fixed upstream [tor-browser] > * Bug 43519: Replace tor-loading.png with SVG [tor-browser] > * Bug 43525: Check if our search engine customization still works after ESR 140 transition [tor-browser] > * Bug 43590: Move letterboxing rules out of browser/base/content/browser.css [tor-browser] > * Bug 43610: Use newer CSS variable names for ESR 140 [tor-browser] > * Bug 43629: All migrations in migrateUIBB are run for new profiles [tor-browser] > * Bug 43636: Tor exiting during startup with "connect automatically" leads to "Try a bridge" page [tor-browser] > * Bug 43638: Fix up our `<command>` elements [tor-browser] > * Bug 43664: Review Mozilla 1842832: Move the private browsing toggle to initial install dialog [tor-browser] > * Bug 43728: Update search engine icon sizes [tor-browser] > * Bug 43765: Temporarily disable Lox [tor-browser] > * Bug 43766: Only save the relevant TorSettings changes to preferences. [tor-browser] > * Bug 43770: Bugzilla 1958070: More BrowserGlue simplification/splitting [tor-browser] > * Bug 43776: Set branding files for l10n merging [tor-browser] > * Bug 43795: Restore the URL classifier XPCOM components. [tor-browser] > * Bug 43817: Write e2e test for verifying if the browser is connected to the Tor network [tor-browser] > * Bug 43844: Security level shield icon should be flipped for RTL locales [tor-browser] > * Bug 43874: Incorporate our unified extension button hiding logic into mozilla's changes for ESR 140 [tor-browser] > * Bug 43879: tor-branding.css declarations are overwritten [tor-browser] > * Bug 43886: Fix new tab for ESR 140 [tor-browser] > * Bug 43900: Open newtab rather than firefoxview when unloading the last tab [tor-browser] > * Bug 43901: Modify about:license for Tor Browser and drop about:rights [tor-browser] > * Bug 43902: Hide Sidebar buttons [tor-browser] > * Bug 43903: Report broken site is disabled rather than hidden [tor-browser] > * Bug 43905: base-browser.ftl missing from about:addons [tor-browser] > * Bug 43906: Extension.sys.mjs change in the wrong commit [tor-browser] > * Bug 43913: Context menu not properly populated [tor-browser] > * Bug 43929: two about:tor pages opened after update [tor-browser] > * Bug 43930: Onionize toggle not centre aligned in about:tor [tor-browser] > * Bug 43947: Console error from ContentBlockingPrefs.init [tor-browser] > * Bug 43966: Notify the user when they are in a custom security level (desktop) [tor-browser] > * Bug 43989: Switch off AI chatbot preference [tor-browser] > * Bug 44030: Security Level selector does not get confirmation before restarting [tor-browser] > * Bug 44034: Update string used for checkbox on New Identity confirmation dialog [tor-browser] > * Bug 44040: Modify nsIPrompt and the commonDialog code to allow destructive buttons [tor-browser] > * Bug 44090: Several of our XUL pages cause a crash because of missing CSP [tor-browser] > * Bug 44095: Rename connectionPane.xhtml and remove it from the jar [tor-browser] > * Bug 44101: Toolbar connection status is not visible when using vertical tabs [tor-browser] > * Bug 44106: Make sure background tasks are not used for shutdown cleanup [tor-browser] > * Bug 44107: Switch tab search action is missing an icon [tor-browser] > * Bug 44108: Fix the new history sidebar [tor-browser] > * Bug 44115: Make remove all bridges dialog use a destructive red button [tor-browser] > * Bug 44123: Do not trim protocol off of URLs ever [tor-browser] > * Bug 44125: Do not offer to save signatures by default in Private Browsing Mode [tor-browser] > * Bug 44141: Hide "Report broken site" items by default [tor-browser] > * Bug 44142: Missing document_pdf.svg from our branding directories [tor-browser] > * Bug 44145: Switch onion connection icons to use --icon-color-critical and --icon-color [tor-browser] > * Bug 44153: Test search engine customization [tor-browser] > * Bug 44159: Change or hide the sidebar settings description [tor-browser] > * Bug 44177: Remove more urlbar actions [tor-browser] > * Bug 44178: Search preservation does not work with duckduckgo in safest security level [tor-browser] > * Bug 44180: Clear YEC 2024 preference [tor-browser] > * Bug 44184: Duckduckgo Onion Lite search does not work properly in safest when added as a search engine [tor-browser] > * Bug 44187: TLS session tickets leak Private Browsing mode [tor-browser] > * Bug 44192: Hovering unloaded tab causes console error [tor-browser] > * Bug 44213: Reduce linkability concerns of the "Search with" contextual search action [tor-browser] > * Bug 44214: Update letterboxing to reflect changes in ESR 140 [tor-browser] > * Bug 44215: Hide Firefox home settings in about:preferences [tor-browser] > * Bug 44221: Backport MozBug 1984333 Bump Spoofed Processor Count [tor-browser] > * Bug 44239: DDG HTML page and search results displayed incorrectly with Safest security setting [tor-browser] > * Bug 44262: Disable adding search engines from HTML forms [tor-browser] > * Bug 44270: Match Firefox's TLS fingerprint [tor-browser] > * Bug 44279: Disable contextual search install prompt [tor-browser] > * Windows + Android > * Bug 44062: Force touch enabled on Windows and Android [tor-browser] > * Windows > * Bug 44046: Replace BASE_BROWSER_UPDATE with BASE_BROWSER_VERSION in the font visibility list [tor-browser] > * macOS > * Bug 44127: Do not show macOS Privacy hint on network error pages [tor-browser] > * Linux > * Bug 43950: Review Mozilla 1894818: Support HEVC playback on Linux [tor-browser] > * Bug 43959: Make Noto Color Emoji the default emoji font on Linux [tor-browser] > * Bug 44227: Some CJK characters cannot be rendered by Tor which uses the Noto font family [tor-browser] > * Bug 44286: Hardcode GTK system font [tor-browser] > * Bug 41586: Replace Noto CJK with Jigmo on Linux [tor-browser-build] > * Android > * Updated GeckoView to 140.4.0esr > * Bug 43179: Make persistent 'private tabs' notification distinct from Firefox's [tor-browser] > * Bug 43401: Replace the constructor of Locale with a builder [tor-browser] > * Bug 43577: Flush settings fails on Android [tor-browser] > * Bug 43643: Clean out unused tor connect strings [tor-browser] > * Bug 43650: Survey banner behaves like a dialog on Android, rather than a card [tor-browser] > * Bug 43676: Preemptively disable unified trust panel by default so we are tracking for next ESR [tor-browser] > * Bug 43699: Dummy "about:" pages are not cleared from recently closed tabs (and possibly elsewhere) because they are normal tabs, not private tabs. [tor-browser] > * Bug 43755: Restore functionality of "switch to tab" urlbar suggestion [tor-browser] > * Bug 43757: Disable setting for trending search [tor-browser] > * Bug 43826: Review Mozilla 1960122: Use `MOZ_BUILD_DATE` in Fenix build configuration [tor-browser] > * Bug 43855: brand.properties merging on Android is broken in 140 [tor-browser] > * Bug 43943: Review Mozilla 1928705: Ship Android Font Restrictions as part of FPP [tor-browser] > * Bug 44021: Android settings page colors are sometimes messed up (seems to be on the first launch) [tor-browser] > * Bug 44029: Search/url bar doesn't work on android after ESR 140 [tor-browser] > * Bug 44036: Crash on opening "Search Settings" on android [tor-browser] > * Bug 44042: Debug crash when opening settings too quickly after launching app [tor-browser] > * Bug 44047: Tor Browser's home doesn't have the background at the first load on Android [tor-browser] > * Bug 44080: Further remove "Analytics data collection and usage" [tor-browser] > * Bug 44083: "snowflake" is lower case on Android [tor-browser] > * Bug 44098: Bookmarks offer a way to go to sync in 15.0a1 [tor-browser] > * Bug 44133: Hide the "Allow in private browsing" checkboxes from WebExtension management UI [tor-browser] > * Bug 44139: Restore the (inactive) YouTube and Reddit search plugins on Android [tor-browser] > * Bug 44172: Fix crash in TorAndroidIntegration.handleMessage() [tor-browser] > * Bug 44196: Persistent notification sometimes does not clear [tor-browser] > * Bug 44237: Revoke access to all advertising ids available in Android [tor-browser] > * Bug 44293: Force immediate NoScript update checks after bootstrap [tor-browser] > * Bug 41494: Update GeckoView build scripts for ESR140 [tor-browser-build] > * Build System > * All Platforms > * Bug 43615: Add Gitlab Issue and Merge request templates [tor-browser] > * Bug 43616: Customize Gitlab Issue and Merge templates [tor-browser] > * Bug 43891: Update the translation CI to use the new mozilla versions [tor-browser] > * Bug 43954: Update tb-dev to handle lightweight tags [tor-browser] > * Bug 43962: update tb-dev auto-fixup for git 2.50 [tor-browser] > * Bug 44061: "Contributing" link is broken [tor-browser] > * Bug 44067: Move --enable-geckodriver only to Linux-only mozconfigs [tor-browser] > * Bug 44103: git's export-subst is a reproducibility problem [tor-browser] > * Bug 44104: Don't run linter when there are no overall changes [tor-browser] > * Bug 26408: Make MAR signature checks clearer when creating incremental MAR files [tor-browser-build] > * Bug 34434: Remove unused variables from rbm.conf [tor-browser-build] > * Bug 40551: Drop go reproducibility patches [tor-browser-build] > * Bug 40697: Delete repackage_browser.sh [tor-browser-build] > * Bug 40698: Update locale in tbb_version.json [tor-browser-build] > * Bug 41064: Update tools/signing/README and add a tools/signing/machines-setup/README [tor-browser-build] > * Bug 41227: Update projects/common/list_toolchain_updates-common-firefox-geckoview to include check for binutils [tor-browser-build] > * Bug 41434: Go updates shouldn't target all platforms until macOS is on legacy in the changelogs [tor-browser-build] > * Bug 41444: Build artifacts to support artifact builds of Tor/Muillvad/Base Browser [tor-browser-build] > * Bug 41448: Update toolchains for Firefox ESR 140 [tor-browser-build] > * Bug 41459: Update taskcluster/ci paths in README and comments [tor-browser-build] > * Bug 41465: Disable development artifacts generation by default, keep it enabled for nightly builds [tor-browser-build] > * Bug 41474: update README to explain moat-settings project requires `jq` to be installed [tor-browser-build] > * Bug 41478: Add vim and others missing basic tools to base container image [tor-browser-build] > * Bug 41486: Track bundletool and osslicenses-plugin versions in list_toolchain_updates_checks [tor-browser-build] > * Bug 41496: Clean up unused projects [tor-browser-build] > * Bug 41501: cargo_vendor generated archive maintains timestamps [tor-browser-build] > * Bug 41514: Remove var/build_go_lib from projects/go/config [tor-browser-build] > * Bug 41532: Rename meek-azure to meek in pt_config.json [tor-browser-build] > * Bug 41534: Copy geckodriver only for Linux x86-64 [tor-browser-build] > * Bug 41537: Add script to count mar downloads from web logs [tor-browser-build] > * Bug 41539: Update Ubuntu version used to run mmdebstrap to 24.04.3 [tor-browser-build] > * Bug 41568: Update instructions for manually building 7zip [tor-browser-build] > * Bug 41576: Build expert bundles outside containers [tor-browser-build] > * Bug 41579: Add zip to the list of Tor Browser Build dependencies [tor-browser-build] > * Bug 41594: Remove version from tor-expert-bundle and tor-expert-bundle-aar filenames [tor-browser-build] > * Bug 41600: update lyrebird version to v0.6.2 [tor-browser-build] > * Bug 41602: Update tools/changelog-format-blog-post [tor-browser-build] > * Bug 40084: Always use bash for the debug terminal [rbm] > * Bug 40087: Downloaded files getting stricter permissions than expected [rbm] > * Windows + macOS + Linux > * Bug 44131: Generate torrc-defaults and put it in objdir post-build [tor-browser] > * Bug 41373: Remove `_ALL` from mar filenames [tor-browser-build] > * Bug 41457: Set mar IDs as env variables in tor-browser-build [tor-browser-build] > * Bug 41604: Keep update-responses files from previous release [tor-browser-build] > * Windows + Linux + Android > * Updated Go to 1.24.9 > * Windows > * Bug 44167: Move the nsis-uninstall.patch to tor-browser repository [tor-browser] > * macOS > * Bug 41503: Error 403 when downloading macOS SDK [tor-browser-build] > * Bug 41527: Update libdmg-hfsplus and enable LZMA compression on dmgs [tor-browser-build] > * Bug 41538: Bump macOS SDK to 15.5 [tor-browser-build] > * Bug 41571: Work-around to prevent older 7z versions to break rcodesign. [tor-browser-build] > * Linux > * Bug 41458: Ship geckodriver only on Linux [tor-browser-build] > * Bug 41488: Disable sys/random.h for Node.js [tor-browser-build] > * Bug 41558: Share descriptions between Linux packages and archives [tor-browser-build] > * Bug 41561: Ship Noto Color Emoji on Linux [tor-browser-build] > * Bug 41569: Use var/display_name in .desktop files [tor-browser-build] > * Android > * Bug 43984: Update android build scripts and docs for ESR 140 [tor-browser] > * Bug 43987: 140 Android is not reproducible [tor-browser] > * Bug 44078: Modify ./autopublish-settings.gradle for building a-s and glean with uniffi-bindgen no-op [tor-browser] > * Bug 44220: Disable the JS minifier as it produces invalid JS [tor-browser] > * Bug 41453: Update application-services and uniffi-rs for ESR140 [tor-browser-build] > * Bug 41467: Remove list_toolchain_updates-firefox-android from Makefile [tor-browser-build] > * Bug 41483: geckoview_example-withGeckoBinaries-....apk doesn't exist anymore in Firefox 140 [tor-browser-build] > * Bug 41484: Create a fork of application-services [tor-browser-build] > * Bug 41500: Optimize tor and its dependencies for size on Android [tor-browser-build] > * Bug 41506: Use appilcation-services branch for nightlies builds [tor-browser-build] > * Bug 41507: Single-arch build fails because artifacts don't have arch subdirectories [tor-browser-build] > * Bug 41523: Use custom built Glean package on Android [tor-browser-build] > * Bug 41548: Hide tor's symbols on Android and add other linker options to save space [tor-browser-build] > * Bug 41577: Minify JS with UglifyJS on Android x86 [tor-browser-build] > * Bug 41583: Align tor and PTs to 16kB on Android [tor-browser-build] > * Bug 41605: Ignore incrementals if we're not building desktop [tor-browser-build] best, -morgan

1 0

New Release: Tor Browser 15.0a4 (Android, Windows, macOS, Linux)
by Morgan 16 Oct '25

16 Oct '25

Hi everyone, Tor Browser 15.0a4 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-150a4/ This is a release candidate build for Tor Browser 15.0, so if you have some time please download/update and kick the tires :) Changelog: > Tor Browser 15.0a4 - October 16 2025 > * All Platforms > * Updated NoScript to 13.2.1 > * Updated OpenSSL to 3.5.4 > * Bug 19741: Opensearch (contextual search) does not obey FPI [tor-browser] > * Bug 43850: Modify the Contrast Control settings for RFP [tor-browser] > * Bug 43869: Hide pens with RFP [tor-browser] > * Bug 44068: Handle migration from meek-azure to meek built-in bridge type [tor-browser] > * Bug 44234: No images in PDF [tor-browser] > * Bug 44240: Typo on dom.security.https_first_add_exception_on_failure [tor-browser] > * Bug 44242: Hand over Security Level's WebAssembly controls to NoScript [tor-browser] > * Bug 44250: Rebase Tor Browser Alpha onto 140.4esr [tor-browser] > * Bug 41574: Update Snowflake builtin bridge lines [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 140.4.0esr > * Bug 43900: Open newtab rather than firefoxview when unloading the last tab [tor-browser] > * Bug 44101: Toolbar connection status is not visible when using vertical tabs [tor-browser] > * Bug 44107: Switch tab search action is missing an icon [tor-browser] > * Bug 44108: Fix the new history sidebar [tor-browser] > * Bug 44123: Do not trim protocol off of URLs ever [tor-browser] > * Bug 44153: Test search engines [tor-browser] > * Bug 44159: Change or hide the sidebar settings description [tor-browser] > * Bug 44177: Remove more urlbar actions [tor-browser] > * Bug 44178: Search preservation does not work with duckduckgo in safest security level [tor-browser] > * Bug 44184: Duckduckgo Onion Lite search does not work properly in safest when added as a search engine [tor-browser] > * Bug 44187: TLS session tickets leak Private Browsing mode [tor-browser] > * Bug 44192: Hovering unloaded tab causes console error [tor-browser] > * Bug 44213: Reduce linkability concerns of the "Search with" contextual search action [tor-browser] > * Bug 44214: Update letterboxing to reflect changes in ESR 140 [tor-browser] > * Bug 44215: Hide Firefox home settings in about:preferences [tor-browser] > * Bug 44221: Backport MozBug 1984333 Bump Spoofed Processor Count [tor-browser] > * Bug 44239: DDG HTML page and search results displayed incorrectly with Safest security setting [tor-browser] > * Bug 44262: Disable adding search engines from HTML forms [tor-browser] > * Linux > * Bug 44227: Some CJK characters cannot be rendered by Tor which uses the Noto font family [tor-browser] > * Bug 41586: Replace Noto CJK with Jigmo on Linux [tor-browser-build] > * Android > * Updated GeckoView to 140.4.0esr > * Bug 43401: Replace the constructor of Locale with a builder [tor-browser] > * Bug 43643: Clean out unused tor connect strings [tor-browser] > * Bug 43650: Survey banner behaves like a dialog on Android, rather than a card [tor-browser] > * Bug 43676: Preemptively disable unified trust panel by default so we are tracking for next ESR [tor-browser] > * Bug 44031: Implement YEC 2025 Takeover for Android Stable [tor-browser] > * Bug 44218: Tor Browser Alpha for Android (15.0a2) doesn't work on Huawei devices P20 and P30 [tor-browser] > * Bug 44237: Revoke access to all advertising ids available in Android [tor-browser] > * Build System > * All Platforms > * Bug 41568: Update instructions for manually building 7zip [tor-browser-build] > * Bug 41576: Build expert bundles outside containers [tor-browser-build] > * Bug 41579: Add zip to the list of Tor Browser Build dependencies [tor-browser-build] > * Bug 41588: Restore legacy channel support in projects/release/update_responses_config.yml [tor-browser-build] > * Bug 41589: Backport tor-browser-build-browser#41270: Add updater rewriterules to make 13.5.7 a watershed [tor-browser-build] > * Windows + macOS + Linux > * Bug 41373: Remove `_ALL` from mar filenames [tor-browser-build] > * Bug 44131: Generate torrc-defaults and put it in objdir post-build [tor-browser] > * Windows + Linux + Android > * Updated Go to 1.24.9 > * Windows > * Bug 44167: Move the nsis-uninstall.patch to tor-browser repository [tor-browser] > * macOS > * Bug 41571: Work-around to prevent older 7z versions to break rcodesign. [tor-browser-build] > * Linux > * Bug 41558: Share descriptions between Linux packages and archives [tor-browser-build] > * Bug 41569: Use var/display_name in .desktop files [tor-browser-build] > * Android > * Bug 44220: Disable the JS minifier as it produces invalid JS [tor-browser] > * Bug 41577: Minify JS with UglifyJS on Android x86 [tor-browser-build] > * Bug 41582: Drop --pack-dyn-relocs=relr [tor-browser-build] > * Bug 41583: Align tor and PTs to 16kB on Android [tor-browser-build] best, -morgan

1 0