- tor-announce - lists.torproject.org

[RELEASE] Tor alpha 0.4.9.2-alpha
by David Goulet 02 Apr '25

02 Apr '25

Greetings, We just release the second alpha of the 0.4.9.x series. https://forum.torproject.org/t/alpha-release-0-4-9-2-alpha/18206 Here it the rather large ChangeLog. Cheers! David Changes in version 0.4.9.2-alpha - 2025-04-02 This is the second alpha of the 0.4.9.x series. We have several new minor features and a big one, the happy families that was long awaited by relay operators. This release also fixes a number of bugs including major ones. o Major feature (happy families): - Clients and relays now support "happy families", a system to simplify relay family operation and improve directory performance. With "happy families", relays in a family shares a secret "family key", which they use to prove their membership in the family. Implements proposal 321; closes ticket 41009. Note that until enough clients are upgraded, relay operators will still need to configure MyFamily lists. But once clients no longer depend on those lists, we will be able to remove them entirely, thereby simplifying family operation, and making microdescriptor downloads approximately 80% smaller. For more information, see https://community.torproject.org/relay/setup/post-install/family-ids/ o Major features (client): - Clients now respect "happy families" per proposal 321. This feature will eventually allow a much more compact representation for relay families, for a significant savings in directory download size. o Minor feature (onion service, control port): - Add 3 more keywords to the ADD_ONION control command: PoWDefensesEnabled, PoWQueueRate and PoWQueueBurst which correspond to HiddenServicePoWDefensesEnabled, HiddenServicePoWQueueRate and HiddenServicePoWQueueBurst from torrc. o Minor feature (testing, CI): - Use a fixed version of chutney (be881a1e) instead of its current HEAD. This version should also be preferred when testing locally. o Minor features (compilation): - Fix a warning when compiling with GCC 14.2. Closes 41032. o Minor features (continuous integration): - Upgrade CI runners to use Debian Bookworm instead of Bullseye. Closes ticket 41029. o Minor features (fallbackdir): - Regenerate fallback directories generated on February 05, 2025. - Regenerate fallback directories generated on March 20, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/02/05. - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/03/20. - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/03/24. o Minor features (recommended protocols): - Directory authorities now vote to recommend that clients support certain protocols beyond those that are required. These include improved support for connecting to relays on IPv6, NtorV3, and congestion control. Part of ticket 40836. o Minor features (required protocols): - Directory authorities now vote to require clients to support the authenticated SENDME feature, which was introduced in 0.4.1.1-alpha. Part of ticket 40836. - Directory authorities now vote to require relays to support certain protocols, all of which have been implemented since 0.4.7.4-alpha or earlier. These include improved support for connecting to relays on IPv6, NtorV3, running as a rate-limited introduction point, authenticated SENDMEs, and congestion control. Part of ticket 40836. o Major bugfix (control-events, bw-cache): - Fixes spikes occurring in bandwidth cache on control connection. Fixes bug 31524; bugfix on 0.4.8.12-dev. o Major bugfixes (conflux): - Ensure conflux guards obey family and subnet restrictions. Fixes bug 40976; bugfix on 0.4.8.13. o Major bugfixes (onion service directory cache): - When the OOM killer kicks in, cleanup the descriptor cache of an HSDir by looking at the lowest downloaded count instead of time in cache. Fixes bug 40996; bugfix on 0.3.5.1-alpha. o Minor bugfix (client DNS): - Handle empty DNS reply without sending back an error and instead send back NOERROR (RFC1035 error code 0x0). Fixes bug 40248; o Minor bugfix (conflux): - Avoid a non fatal assert when describing a conflux circuit on the control port after being prepped to be freed. Fixes bug 41037; bugfix on 0.4.8.15. o Minor bugfix (dirauth): - Fix typo in flag assignment approved-routers file. Fixes bug 41035; bugfix on 0.4.8.15 o Minor bugfixes (control port): - Correctly report conflux pair information to controller fields Fixes bug 40872; bugfix on 0.4.8.1-alpha o Minor bugfixes (directory authorities): - After we added layer-two vanguards, directory authorities wouldn't think any of their vanguards were suitable for circuits, leading to a "Failed to find node for hop #2 of our path. Discarding this circuit." log message once per second from startup until they made a fresh consensus. Now they look to their existing consensus on startup, letting them build circuits properly from the beginning. Fixes bug 40802; bugfix on 0.4.7.1-alpha. o Minor bugfixes (relay flag usage): - Fix client usage of the MiddleOnly flag so that MiddleOnly relays are not used as HS IP or RP by clients or services. Additionally, give dirauths the ability to remove specific flags, as an alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha o Minor bugfixes (sandbox, bwauth): - Fix sandbox to work for bandwidth authority. Fixes bug 40933; bugfix on 0.2.2.1-alpha o Minor bugfixes (tests): - Fix a test failure with OpenSSL builds running at security level 1 or greater, which does not permit SHA-1 certificates. (Fixes bug 41021; bugfix on 0.2.8.1-alpha.) o Minor bugfixes (threads, memory): - Improvements in cleanup of resources used by threads. Fixes bug 40991; bugfix on 0.4.8.13-dev. - Rework start and exit of worker threads. o Removed features: - Relays no longer support the obsolete "RSA-SHA256-TLSSecret" authentication method, which used a dangerously short RSA key, and which required access TLS session internals. The current method ("Ed25519-SHA256-RFC5705") has been supported since 0.3.0.1-alpha. Closes ticket 41020. -- PEQQHf0Mu+LG/0COSU7iNuNQPwIUol84CpOuS0SYbXY=

1 0

New Release: Tor Browser 14.0.9 (Android, Windows, macOS, Linux)
by Giorgio Maone 01 Apr '25

01 Apr '25

Hi everyone, Tor Browser 14.0.9 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-1409/>. Changelog: * All Platforms o Updated Tor to 0.4.8.16 o Bug tor-browser#43580 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43580>: Backport tor-browser#43443: Drop effective top level domain for |au.securedrop.tor.onion| o Bug tor-browser#43584 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43584>: Rebase Tor Browser stable onto 128.9.0esr o Bug tor-browser#43601 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43601>: Backport security fixes from Firefox 137 * Windows + macOS + Linux o Updated Firefox to 128.9.0esr * macOS + Linux + Android o Bug tor-browser#43553 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43553>: Backport tor-browser#43504: Implement User Survey UX (Desktop) * Android o Updated GeckoView to 128.9.0esr o Bug tor-browser#43552 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43552>: Backport tor-browser#43505: Impement User Survey UX (Android) o Bug tor-browser#43578 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43578>: Backport tor-browser#43556: Add the "Dismiss" translations in the survey banner * Build System o All Platforms + Updated Go to 1.22.12 + Bug tor-browser-build#41407 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Use Lyrebird also for the Snowflake PT + Bug tor-browser-build#41420 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update the changelog script for label updates o Windows + macOS + Linux + Bug tor-browser-build#41378 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport Bug 41363: Make separate update_responses commit for each platform o macOS + Linux + Android + Bug tor-browser-build#41375 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport Bug 41374+40799: Remove support for migrate_archs and migrate_langs in update_responses + Remove legacy locale iteration in update-responses and dmg2mar + Bug tor-browser-build#41383 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add clairehurst to list of accepted firefox/geckoview signers + Bug tor-browser-build#41384 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: OpenSSL hash files have changed format + Bug tor-browser-build#41399 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update snowflake to 2.11.0 and lyrebird to 0.6.0 + Bug tor-browser-build#41378 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport Bug 41363: Make separate update_responses commit for each platform o Linux + Bug tor-browser-build#41337 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove libstdc++ from Linux tor-expert-bundle o Android + Bug tor-browser-build#41410 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Use the Lyrebird name on Android -- ma1

1 0

New Release: Tor Browser 14.0.8 (Windows)
by Giorgio Maone 27 Mar '25

27 Mar '25

Hi everyone, Tor Browser 14.0.8 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-1408/>. Changelog: * Windows o Bug tor-browser#43553 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43553>: Backport tor-browser#43504: Implement User Survey UX (Desktop) o Bug tor-browser#43592 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43592>: Backport security fixes from Firefox 128.8.1esr * Build System o Windows + Bug tor-browser-build#41375 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport Bug 41374+40799: Remove support for migrate_archs and migrate_langs in update_responses + Remove legacy locale iteration in update-responses and dmg2mar + Bug tor-browser-build#41383 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add clairehurst to list of accepted firefox/geckoview signers + Bug tor-browser-build#41384 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: OpenSSL hash files have changed format + Bug tor-browser-build#41399 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update snowflake to 2.11.0 and lyrebird to 0.6.0 + Bug tor-browser-build#41378 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport Bug 41363: Make separate update_responses commit for each platform -- ma1

1 0

New Release: Tor Browser 13.5.14 (Windows Windows 7/8/8.1)
by Giorgio Maone 27 Mar '25

27 Mar '25

Hi everyone, Tor Browser 13.5.14 has now been published for legacy Windows versions. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-13514/>. Changelog: * Windows o Bug tor-browser#43592 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43592>: Backport security fixes from Firefox 128.8.1esr * Build System o Windows + Bug tor-browser-build#41383 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add clairehurst to list of accepted firefox/geckoview signers -- ma1

1 0

[RELEASE] Tor 0.4.8.16 stable
by David Goulet 24 Mar '25

24 Mar '25

Greetings, Unfortunately, we had to do another quick release to fix a bug only affecting directory authorities: https://forum.torproject.org/t/stable-release-0-4-8-16/18062 ChangeLog follows. Sorry about this. Cheers! David Changes in version 0.4.8.16 - 2025-03-24 This is quick second release since 0.4.8.15 due to a typo in a directory authority rule file. This only affects directory authorities. Regardless, upgrading to latest stable is always desired. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/03/24. o Minor bugfix (dirauth): - Fix typo in flag assignment approved-routers file. Fixes bug 41035; bugfix on 0.4.8.15 -- BFuFTwoN6r8edsBUW3yUvtQoZWuOkVTVpLpA/LYezfw=

1 0

New Release: Tor Browser 14.5a5 (Android, Windows, macOS, Linux)
by Morgan 22 Mar '25

22 Mar '25

Hi everyone, Tor Browser 14.5a5 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-145a5/ Changelog: > Tor Browser 14.5a5 - March 21 2025 > * All Platforms > * Updated Lyrebird to 0.6.0 > * Updated Snowflake to 2.11.0 > * Bug 42300: Do not store logs inside TorProvider [tor-browser] > * Bug 43488: Handle Moat connection errors and other non-bootstrapping errors in TorConnect [tor-browser] > * Bug 43490: Use lower case "n" for "Tor network" in the UI [tor-browser] > * Bug 43556: Update Desktop and Android survey dismissal string [tor-browser] > * Bug 43575: Cleanup channel preferences [tor-browser] > * Windows + macOS + Linux > * Bug 41051: Replace Noto Sans Myanmar with Pyidaungsu [tor-browser] > * Bug 41755: Show the link to about:support in the help menu [tor-browser] > * Bug 42550: Do not re-try auto-bootstrapping after the user selects a specific region in about:torconnect [tor-browser] > * Bug 42656: about:torconnect new url location override (maybeUpdateOpenLocationForTorConnect) mostly does nothing [tor-browser] > * Bug 42670: Letterboxing visible even if disable with tiled window managers [tor-browser] > * Bug 42720: Link to release notes missing from "About Tor Browser" window [tor-browser] > * Bug 43321: Do not focus the connect button if the user has never connected before [tor-browser] > * Bug 43405: Handle failing to apply tor settings [tor-browser] > * Android > * Bug 41188: Implement Android-native Connection Assist UI [tor-browser] > * Bug 42251: Expose TorConnect lifecycle events to fenix [tor-browser] > * Bug 43091: Delete unused android strings [tor-browser] > * Bug 43361: [Android] Move code relating to `onTerminate()` in `FenixApplication.kt` [tor-browser] > * Bug 43473: Rename "Quickstart" toggle as "Connect automatically" (Android) [tor-browser] > * Bug 43505: Implement User Survey UX (Android) [tor-browser] > * Build System > * All Platforms > * Bug 41394: Fix upload-update_responses-to-staticiforme for mullvadbrowser [tor-browser-build] > * Bug 41398: Build snowflake from main on nightlies [tor-browser-build] > * Bug 41399: Update snowflake to 2.11.0 and lyrebird to 0.6.0 [tor-browser-build] > * Windows + macOS + Linux > * Bug 41401: Replace Noto Sans Myanmar with Pyidaungsu [tor-browser-build] > * Android > * Bug 41402: Fix Snowflake 2.11.0 on Android [tor-browser-build] best, -morgan

1 0

[RELEASE] Tor stable 0.4.8.15
by David Goulet 20 Mar '25

20 Mar '25

Greetings, We just released tor 0.4.8.15. Here is the announcement: https://forum.torproject.org/t/stable-release-0-4-8-15/17998 ChangeLog is attached below. Cheers! David Changes in version 0.4.8.15 - 2025-03-20 This is a minor release fixing a sandbox issue for bandwidth authority and a conflux issue on the control port. It also has a client fix about relay flag usage. We strongly recommend to update as soon as possible as usual. o Minor feature (testing, CI): - Use a fixed version of chutney (be881a1e) instead of its current HEAD. This version should also be preferred when testing locally. o Minor features (continuous integration): - Upgrade CI runners to use Debian Bookworm instead of Bullseye. Closes ticket 41029. o Minor features (fallbackdir): - Regenerate fallback directories generated on March 20, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/03/20. o Minor bugfixes (control port): - Correctly report conflux pair information to controller fields Fixes bug 40872; bugfix on 0.4.8.1-alpha o Minor bugfixes (relay flag usage): - Fix client usage of the MiddleOnly flag so that MiddleOnly relays are not used as HS IP or RP by clients or services. Additionally, give dirauths the ability to remove specific flags, as an alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha o Minor bugfixes (sandbox, bwauth): - Fix sandbox to work for bandwidth authority. Fixes bug 40933; bugfix on 0.2.2.1-alpha -- geIK4eOG0SEfa9eU/ufkQruZyBM8MFQbGzw3ZkwcYt4=

1 0

New Release: Tor Browser 14.5a4 (Android, Windows, macOS, Linux)
by Nicolas Vigier 13 Mar '25

13 Mar '25

Hi everyone, Tor Browser 14.5a4 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-alpha-release-tor-browser-145a4/ Changelog: * All Platforms * Updated OpenSSL to 3.0.16 * Bug 43446: Change the Tor Browser name between releases [tor-browser] * Bug 43463: Include moat circumvention countries in the build (tor-browser part) [tor-browser] * Bug 43487: Rebase Tor Browser Alpha onto 128.8.0esr [tor-browser] * Bug 43529: AutoBootstrapAttempt cancel does not await BootstrapAttempt.cancel [tor-browser] * Bug 43524: Enable new locales: be, bg and pt-PT [tor-browser] * Bug 43551: Backport Mozilla Bug 1924070 - modify H.264 extradata to match sample conversion code.... [tor-browser] * Windows + macOS + Linux * Updated Firefox to 128.8.0esr * Bug 40473: Tor logs do not update in about:preferences#tor as new logs come in [tor-browser] * Bug 43205: newwin / letterboxing rounding with subpixels is off [tor-browser] * Bug 43328: Improve tor log dialog [tor-browser] * Bug 43465: Show the urlbar Connect button during a bootstrap or final error [tor-browser] * Bug 43469: Rename "Quickstart" toggle as "Connect automatically" (Desktop) [tor-browser] * Bug 43502: Move openTorConnect and getRedirectUrl to TorConnectParent [tor-browser] * Bug 43504: Implement User Survey UX (Desktop) [tor-browser] * Bug 43547: Cannot remove the final bridge [tor-browser] * Linux * Bug 30970: Different window borders in XFCE can lead to different, not rounded window sizes [tor-browser] * Android * Updated GeckoView to 128.8.0esr * Updated Zstandard to 1.5.7 * Bug 43329: Remove remaining traces of the old Bootstrap on Android [tor-browser] * Bug 43408: Access TorConnect.quickstart separately from TorSettings.getSettings on Android [tor-browser] * Bug 43480: Split up TorConnectionAssistViewModel for better readibility and performance. [tor-browser] * Bug 43498: Uplift tor-browser#43129: about:neterror cannot display SVG on Android with Security Level Safest [tor-browser] * Bug 43528: Improper handling of TorBootstrapChangeListener in HomeActivity [tor-browser] * Build System * All Platforms * Updated Go to 1.23.7 * Bug 41040: Add configuration to rbm.conf to select channel and platforms [tor-browser-build] * Bug 41121: Use the official Go binaries for bootstrapping [tor-browser-build] * Bug 41372: Handle branding names in tor-browser-build [tor-browser-build] * Bug 41379: Include moat circumvention countries in the build (tor-browser-build part) [tor-browser-build] * Bug 41380: Update kick-devmole script to use Mullvad's new GitHub action [tor-browser-build] * Bug 41381: Usability improvements for the browser commit tagging script [tor-browser-build] * Bug 41382: Replace gitlab templates ReleasePrep label references with Apps::Type::ReleasePreparation [tor-browser-build] * Bug 41383: Add clairehurst to list of accepted firefox/geckoview signers [tor-browser-build] * Bug 41384: OpenSSL hash files have changed format [tor-browser-build] * Bug 41389: Remove need to update set-config.tbb-version [tor-browser-build] * Bug 40082: With `fetch: if_needed`, rbm is doing a git fetch when it shouldn't, when using a fixed commit [rbm] * Windows + macOS + Linux * Bug 40799: Remove legacy locale iteration in build and signing scripts [tor-browser-build] * Bug 41363: Change update-response generation script to create one commit per OS+arch tuple [tor-browser-build] * Bug 41374: Remove support for migrate_archs and migrate_langs in update_responses [tor-browser-build] * Windows + Linux + Android * Bug 41386: Upgrade Go to 1.23 for Windows, Linux, and Android [tor-browser-build] * Linux * Bug 41337: Remove libstdc++ from Linux tor-expert-bundle [tor-browser-build] * Android * Bug 42669: Remove dependency on Application-Services [tor-browser] * Bug 43518: Verify existence of localProperties.dependencySubstitutions.geckoviewTopsrcdir before substituting [tor-browser] * Bug 41387: Fix Golang toolchain breakage for lyrebird: linkname [tor-browser-build]

1 0

New Release: Tor Browser 13.5.13 (Windows Windows 7/8/8.1, macOS 10.12-10.14)
by Giorgio Maone 04 Mar '25

04 Mar '25

Hi everyone, Tor Browser 13.5.13 has now been published for legacy Windows and macOS platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-13513/>. Changelog: * All Platforms o Updated Firefox to 115.21.0esr o Updated Tor to 0.4.8.14 o Updated OpenSSL to 3.0.16 o Bug tor-browser#43168 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43168>: Review ESR 115 expiry date for legacy OS message o Bug tor-browser#43530 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43530>: Rebase Tor Browser legacy onto 115.21.0esr o Bug tor-browser-build#41362 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove meek azure from the builtin bridges * Build System o All Platforms + Bug tor-browser-build#41380 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update kick-devmole script to use Mullvad's new GitHub action + Bug tor-browser-build#41384 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: OpenSSL hash files have changed format o macOS + Bug tor-browser-build#41367 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport to legacy: Bug 41314: Add tools/setup-martools and use it in dmg2mar and update_response scripts -- ma1

1 0

New Release: Tor Browser 14.0.7 (Android, Windows, macOS, Linux)
by Giorgio Maone 04 Mar '25

04 Mar '25

Hi everyone, Tor Browser 14.0.7 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-1407/>. Changelog: * All Platforms o Updated OpenSSL to 3.0.16 o Bug tor-browser#43522 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43522>: Rebase Tor Browser release onto 128.0.8esr o Bug tor-browser#43536 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43536>: Backport security fixes from Firefox 136 * Windows + macOS + Linux o Updated Firefox to 128.8.0esr * Android o Updated GeckoView to 128.8.0esr o Updated Zstandard to 1.5.7 * Build System o All Platforms + Bug tor-browser-build#41380 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update kick-devmole script to use Mullvad's new GitHub action -- ma1

1 0