March 2026 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-149.0a1-16.0-2-build2
by Pier Angelo Vendrame (＠pierov) 31 Mar '26

31 Mar '26

Pier Angelo Vendrame pushed new tag tor-browser-149.0a1-16.0-2-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41766: Use Gzip for all platforms for Go vendoring.
by Pier Angelo Vendrame (＠pierov) 31 Mar '26

31 Mar '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: d7c21044 by Pier Angelo Vendrame at 2026-03-31T19:38:26+02:00 Bug 41766: Use Gzip for all platforms for Go vendoring. If we use different compression method, we need to version different tarball hashes, one for each method. - - - - - cf6881e7 by Pier Angelo Vendrame at 2026-03-31T19:38:33+02:00 Bug 41755&41756: Prepare Tor&Mullvad Browser 16.0a5 - - - - - 10 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/geckoview/config - projects/lyrebird/config - projects/moat-settings/config - projects/tor/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,3 +1,31 @@ +Mullvad Browser 16.0a5 - April 01 2026 + * All Platforms + * Updated Firefox to 149.0a1 + * Updated NoScript to 13.6.14.90101984 + * Updated uBlock Origin to 1.70.0 + * Bug 514: Revert New Identity commit [mullvad-browser] + * Bug 522: Rebase Mullvad Browser onto 149 [mullvad-browser] + * Bug 44546: Rename `appearance-chooser-item` to `setting-chooser-item` after we reach nightly 149 [tor-browser] + * Bug 44702: Rebase alpha onto 149.0a1 [tor-browser] + * Bug 44714: The browser opens a new about:blank tab in 148 [tor-browser] + * Bug 44755: Trusted Types (Firefox 148 and above) + Web Workers broken on Safer Level [tor-browser] + * Bug 44757: Update tests for removed Services.search [rebase-149] [tor-browser] + * Bug 44761: Safer Level's worker patching filters out Worker constructor options [tor-browser] + * Bug 44763: Disable WebGPU until audited [tor-browser] + * Bug 44764: Review Mozilla 2012344: Hide main AI settings when the feature is blocked [tor-browser] + * Bug 44765: Review Mozilla 1972073: Convert Sidebar to config-based prefs [tor-browser] + * Bug 44767: Safer Level's worker patching throws on new about:blank frames with Trusted Types [tor-browser] + * Bug 44772: Review Mozilla 1980264: Canvas randomization is too slow [tor-browser] + * Bug 44778: Safer Level: xray causes patched TrustedTypePolicy instances to be unusable by content. [tor-browser] + * Bug 44780: AIFeature.sys.mjs failures in 149 desktop builds [tor-browser] + * Bug 44793: `privacy.spoof_english` console error in about:preferences [tor-browser] + * Bug 44801: Redact onion origins from Location.ancestorOrigins. [tor-browser] + * Bug 44814: Disable trustpanel until our new designs are ready [tor-browser] + * Build System + * All Platforms + * Bug 43180: Remove translation CI 13.5 legacy extension [tor-browser] + * Bug 41758: Rename `tools/signing/deploy-legacy` to `tools/signing/redeploy-update_responses-release` [tor-browser-build] + Mullvad Browser 16.0a4 - March 11 2026 * All Platforms * Updated Firefox to 148.0a1 ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,57 @@ +Tor Browser 16.0a5 - April 01 2026 + * All Platforms + * Updated NoScript to 13.6.14.90101984 + * Updated Tor to 0.4.9.6 + * Bug 43858: Clean out deprecated or unused methods in TorConnect [tor-browser] + * Bug 44251: Drop pt_config.json meek-azure migration logic [tor-browser] + * Bug 44546: Rename `appearance-chooser-item` to `setting-chooser-item` after we reach nightly 149 [tor-browser] + * Bug 44621: Move about:torconnect back to browser [tor-browser] + * Bug 44702: Rebase alpha onto 149.0a1 [tor-browser] + * Bug 44720: Migrate New Identity commit to Tor Browser [tor-browser] + * Bug 44753: Drop TorProvider.isBootstrapDone [tor-browser] + * Bug 44755: Trusted Types (Firefox 148 and above) + Web Workers broken on Safer Level [tor-browser] + * Bug 44757: Update tests for removed Services.search [rebase-149] [tor-browser] + * Bug 44761: Safer Level's worker patching filters out Worker constructor options [tor-browser] + * Bug 44763: Disable WebGPU until audited [tor-browser] + * Bug 44764: Review Mozilla 2012344: Hide main AI settings when the feature is blocked [tor-browser] + * Bug 44765: Review Mozilla 1972073: Convert Sidebar to config-based prefs [tor-browser] + * Bug 44767: Safer Level's worker patching throws on new about:blank frames with Trusted Types [tor-browser] + * Bug 44772: Review Mozilla 1980264: Canvas randomization is too slow [tor-browser] + * Bug 44778: Safer Level: xray causes patched TrustedTypePolicy instances to be unusable by content. [tor-browser] + * Bug 44801: Redact onion origins from Location.ancestorOrigins. [tor-browser] + * Bug 44814: Disable trustpanel until our new designs are ready [tor-browser] + * Windows + macOS + Linux + * Updated Firefox to 149.0a1 + * Bug 44714: The browser opens a new about:blank tab in 148 [tor-browser] + * Bug 44780: AIFeature.sys.mjs failures in 149 desktop builds [tor-browser] + * Bug 44781: Use a static page title for about:torconnect [tor-browser] + * Bug 44793: `privacy.spoof_english` console error in about:preferences [tor-browser] + * Bug 44797: Clean up `about:torconnect` styling [tor-browser] + * Bug 44799: Onionize toggle in `about:tor` uses blue text color [tor-browser] + * Android + * Updated GeckoView to 149.0a1 + * Bug 43790: Address "Various android workarounds" commit introduced in the 138 rebase [tor-browser] + * Bug 44332: Fix android tor logs screen issues presented in 144 rebase [tor-browser] + * Bug 44594: DoH is visible on Android [tor-browser] + * Bug 44653: Disable "Allow search suggestions in private sessions" prompt presented in RR 148 android [tor-browser] + * Bug 44694: Remove new "Tab bar" feature on Android [tor-browser] + * Bug 44698: Clean up comments in AccountSettingsFragment.kt. FIXME: Update A-S [tor-browser] + * Bug 44700: Untracked change to `HomepageHeader.kt` [tor-browser] + * Bug 44751: Noscript (and likely any extension) can be accidently turned off on Android alpha [tor-browser] + * Bug 44752: Remove new expanded toolbar option on Android due to fingerprintability [tor-browser] + * Bug 44785: Fix SiteSecurityRobot.kt after the 149 rebase [tor-browser] + * Bug 44788: Extensions are unreachable via 3 dot menu in alpha (android) [tor-browser] + * Bug 44789: Icon of "New Circuit" is not centered but lies in top left corner [tor-browser] + * Build System + * All Platforms + * Bug 43180: Remove translation CI 13.5 legacy extension [tor-browser] + * Bug 41758: Rename `tools/signing/deploy-legacy` to `tools/signing/redeploy-update_responses-release` [tor-browser-build] + * Bug 41766: Use gzip for all platforms for Go vendoring [tor-browser-build] + * Windows + macOS + * Bug 41741: Create a 13.5-specific update path [tor-browser-build] + * macOS + * Bug 41753: Allow running custom commands when vendoring Go dependencies [tor-browser-build] + Tor Browser 16.0a4 - March 11 2026 * All Platforms * Updated NoScript to 13.6.6.90401984 ===================================== projects/browser/config ===================================== @@ -87,12 +87,12 @@ input_files: enable: '[% !c("var/android") %]' - filename: dmg-root enable: '[% c("var/macos") %]' - - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.6.90401984.xpi + - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.14.90101984.x… name: noscript - sha256sum: a961c57791bc4dc8add25f8e21b527d5b60d8eaff32e627bd6b61383588921ed - - URL: https://addons.mozilla.org/firefox/downloads/file/4675310/ublock_origin-1.6… + sha256sum: e02bcdecaa47512a116ae7367f70c327aaa084817fe64e66ac6fbb52dc2c492a + - URL: https://addons.mozilla.org/firefox/downloads/file/4721638/ublock_origin-1.7… name: ublock-origin - sha256sum: 785bcde68a25faa8a0949964ec5ffe9bdcb85d3f0ae21c23f607c6c8f91472cf + sha256sum: f2730d2877005763a45d765749892e936f49cae713d28f7aa6ea314454b89cf1 enable: '[% c("var/mullvad-browser") %]' - URL: https://cdn.mullvad.net/browser-extension/0.9.7/mullvad-browser-extension-0… name: mullvad-extension ===================================== projects/firefox/config ===================================== @@ -22,7 +22,7 @@ var: browser_series: '16.0' browser_rebase: 2 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 2 upstream_firefox_commit: FIREFOX_NIGHTLY_149_END copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]' nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]' ===================================== projects/geckoview/config ===================================== @@ -25,7 +25,7 @@ var: browser_series: '16.0' browser_rebase: 2 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 2 gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]' deps: ===================================== projects/lyrebird/config ===================================== @@ -18,7 +18,6 @@ targets: tag_gpg_id: 0 macos: var: - go_vendor_sha256sum: 6a054acb7793becdbcb9a08ce7781f3d331f15e85242b399fcef96fb89941f4d pre_go_vendor: | if [ -e "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch" ]; then patch -p1 < "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch" ===================================== projects/moat-settings/config ===================================== @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' git_url: https://gitlab.torproject.org/tpo/anti-censorship/rdsys-admin.git -git_hash: b4e3b47c3ed31c35a6df43ba654de37b62b93c27 +git_hash: b99317d18b69d878700e124bbfe575495581270d version: '[% c("abbrev") %]' # Use gz for now, since we do not support Zstandard on Linux containers. compress_tar: 'gz' ===================================== projects/tor/config ===================================== @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' -version: 0.4.9.5 +version: 0.4.9.6 git_hash: 'tor-[% c("version") %]' git_url: https://gitlab.torproject.org/tpo/core/tor.git git_submodule: 1 ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: 0c951426ef9c309ba2c5e49f2a429c7914c73c6c + git_hash: 25f648dc77b9fe7a6f376a009f2e0073df66b62e targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: e531300282aef8d2af89e94a8725ed9368f0a52b + git_hash: df0ed48b6e007f4e078ea03cbe2c06a5756af991 targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 01957ed5cfe97206ebd1fbdba8c7bd94c10ebf0e + git_hash: 8451b06e9473a2b137d2f19cd604062891396788 compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -49,6 +49,9 @@ steps: go_vendor: filename: '[% project %]-vendor-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' + # Use gzip for all platforms, so that they all have the same hash, at least + # if they do not have a patch step. + compress_tar: gz output_dir: "out/[% project %]/go_vendor" go_vendor: | #!/bin/bash @@ -78,11 +81,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '16.0a4' + torbrowser_version: '16.0a5' torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2026/03/10 18:30:00' + browser_release_date: '2026/03/31 17:00:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: alpha browser_platforms: @@ -128,9 +131,9 @@ var: updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + - 16.0a4 - 16.0a3 - 16.0a2 - - 16.0a1 mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # torbrowser_legacy_version: 13.5.22 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-149.0a1-16.0-2] 2 commits: fixup! Firefox preference overrides.
by henry (＠henry) 31 Mar '26

31 Mar '26

henry pushed to branch mullvad-browser-149.0a1-16.0-2 at The Tor Project / Applications / Mullvad Browser Commits: 9e67112f by Henry Wilkes at 2026-03-31T18:03:01+01:00 fixup! Firefox preference overrides. BB 44764: Hide some AI settings using `browser.ai.control.default`. - - - - - 832ee4b4 by Henry Wilkes at 2026-03-31T18:03:02+01:00 fixup! BB 44045: Disable ML features. BB 44764: Stop commenting out link preview setting controls. - - - - - 2 changed files: - browser/app/profile/001-base-profile.js - browser/components/preferences/main.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -350,6 +350,13 @@ pref("browser.search.serpEventTelemetryCategorization.enabled", false); // lock the preference because the engine is excluded and the // "translations-models" RemoteSettings needed for the engine is empty. pref("browser.translations.enable", false, locked); +// Hide some AI settings outside the "ai" setting pane. See tor-browser#44764. +// NOTE: This preference tracks whether the *user* opted out of all AI features +// in about:preferences. By itself, it does not provide global blocking of the +// AI features, which are often controlled by separate preferences below. +// However, some parts of the UI will react to this preference. See +// tor-browser#44541. +pref("browser.ai.control.default", "blocked", locked); // Disables many (but not all) ML engines. Note, this does not have overall // control over exposure to ML features. tor-browser#44045. pref("browser.ml.enable", false, locked); ===================================== browser/components/preferences/main.js ===================================== @@ -3426,21 +3426,21 @@ SettingGroupManager.registerGroups({ // supportPage: "extensionrecommendations", // subcategory: "cfrfeatures", // }, - // { - // id: "linkPreviewEnabled", - // l10nId: "link-preview-settings-enable", - // subcategory: "link-preview", - // items: [ - // { - // id: "linkPreviewKeyPoints", - // l10nId: "link-preview-settings-key-points", - // }, - // { - // id: "linkPreviewLongPress", - // l10nId: "link-preview-settings-long-press", - // }, - // ], - // }, + { + id: "linkPreviewEnabled", + l10nId: "link-preview-settings-enable", + subcategory: "link-preview", + items: [ + { + id: "linkPreviewKeyPoints", + l10nId: "link-preview-settings-key-points", + }, + { + id: "linkPreviewLongPress", + l10nId: "link-preview-settings-long-press", + }, + ], + }, ], }, httpsOnly: { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/83… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/83… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-149.0a1-16.0-2] 2 commits: fixup! Firefox preference overrides.
by henry (＠henry) 31 Mar '26

31 Mar '26

henry pushed to branch tor-browser-149.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 0d49f501 by Henry Wilkes at 2026-03-31T17:01:01+00:00 fixup! Firefox preference overrides. BB 44764: Hide some AI settings using `browser.ai.control.default`. - - - - - b100d25a by Henry Wilkes at 2026-03-31T17:01:01+00:00 fixup! BB 44045: Disable ML features. BB 44764: Stop commenting out link preview setting controls. - - - - - 2 changed files: - browser/app/profile/001-base-profile.js - browser/components/preferences/main.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -350,6 +350,13 @@ pref("browser.search.serpEventTelemetryCategorization.enabled", false); // lock the preference because the engine is excluded and the // "translations-models" RemoteSettings needed for the engine is empty. pref("browser.translations.enable", false, locked); +// Hide some AI settings outside the "ai" setting pane. See tor-browser#44764. +// NOTE: This preference tracks whether the *user* opted out of all AI features +// in about:preferences. By itself, it does not provide global blocking of the +// AI features, which are often controlled by separate preferences below. +// However, some parts of the UI will react to this preference. See +// tor-browser#44541. +pref("browser.ai.control.default", "blocked", locked); // Disables many (but not all) ML engines. Note, this does not have overall // control over exposure to ML features. tor-browser#44045. pref("browser.ml.enable", false, locked); ===================================== browser/components/preferences/main.js ===================================== @@ -3430,21 +3430,21 @@ SettingGroupManager.registerGroups({ // supportPage: "extensionrecommendations", // subcategory: "cfrfeatures", // }, - // { - // id: "linkPreviewEnabled", - // l10nId: "link-preview-settings-enable", - // subcategory: "link-preview", - // items: [ - // { - // id: "linkPreviewKeyPoints", - // l10nId: "link-preview-settings-key-points", - // }, - // { - // id: "linkPreviewLongPress", - // l10nId: "link-preview-settings-long-press", - // }, - // ], - // }, + { + id: "linkPreviewEnabled", + l10nId: "link-preview-settings-enable", + subcategory: "link-preview", + items: [ + { + id: "linkPreviewKeyPoints", + l10nId: "link-preview-settings-key-points", + }, + { + id: "linkPreviewLongPress", + l10nId: "link-preview-settings-long-press", + }, + ], + }, ], }, httpsOnly: { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/9c9c27… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/9c9c27… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-149.0a1-16.0-2] fixup! Firefox preference overrides.
by henry (＠henry) 31 Mar '26

31 Mar '26

henry pushed to branch mullvad-browser-149.0a1-16.0-2 at The Tor Project / Applications / Mullvad Browser Commits: 83cb3c25 by Henry Wilkes at 2026-03-31T17:33:49+01:00 fixup! Firefox preference overrides. BB 44814: Hide the unified trust panel. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -295,6 +295,8 @@ pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.cryptomining.enabled", false); pref("privacy.trackingprotection.fingerprinting.enabled", false); pref("privacy.trackingprotection.socialtracking.enabled", false); +// Hide the Unified Trust Panel until we have new designs. tor-browser#44814. +pref("browser.urlbar.trustPanel.featureGate", false); // tor-browser#43986: Explicitly disable bounce tracking protection pref("privacy.bounceTrackingProtection.mode", 0); pref("privacy.socialtracking.block_cookies.enabled", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/83c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/83c… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-149.0a1-16.0-2] fixup! Firefox preference overrides.
by henry (＠henry) 31 Mar '26

31 Mar '26

henry pushed to branch tor-browser-149.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 9c9c2780 by Henry Wilkes at 2026-03-31T17:23:04+01:00 fixup! Firefox preference overrides. BB 44814: Hide the unified trust panel. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -295,6 +295,8 @@ pref("privacy.trackingprotection.annotate_channels", false); pref("privacy.trackingprotection.cryptomining.enabled", false); pref("privacy.trackingprotection.fingerprinting.enabled", false); pref("privacy.trackingprotection.socialtracking.enabled", false); +// Hide the Unified Trust Panel until we have new designs. tor-browser#44814. +pref("browser.urlbar.trustPanel.featureGate", false); // tor-browser#43986: Explicitly disable bounce tracking protection pref("privacy.bounceTrackingProtection.mode", 0); pref("privacy.socialtracking.block_cookies.enabled", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/9c9c278… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/9c9c278… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41753: Add pre_go_vendor and go_vendor_patch vars
by Pier Angelo Vendrame (＠pierov) 31 Mar '26

31 Mar '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 9c867ad5 by Cecylia Bocovich at 2026-03-31T18:18:17+02:00 Bug 41753: Add pre_go_vendor and go_vendor_patch vars Let projects define pre_go_vendor and go_vendor_patch variables for the purpose of patching vendored dependencies. - - - - - 9d1d9a64 by Cecylia Bocovich at 2026-03-31T18:18:17+02:00 Bug 41753: Keep lyrebird support for go1.22 in macos only - - - - - 4 changed files: - Makefile - projects/lyrebird/build - projects/lyrebird/config - rbm.conf Changes: ===================================== Makefile ===================================== @@ -476,6 +476,9 @@ go_vendor-conjure: submodule-update go_vendor-lyrebird: submodule-update $(rbm) build lyrebird --step go_vendor --target alpha --target torbrowser-linux-x86_64 +go_vendor-lyrebird-macos: submodule-update + $(rbm) build lyrebird --step go_vendor --target alpha --target torbrowser-macos + go_vendor-go-licenses: submodule-update $(rbm) build go-licenses --step go_vendor --target alpha --target torbrowser-linux-x86_64 ===================================== projects/lyrebird/build ===================================== @@ -18,6 +18,12 @@ mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.[% c('compress_tar') %] cd /var/tmp/build/[% project %]-[% c('version') %] +[% IF c("var/macos") -%] + if [ -e "go-1.22.patch" ]; then + patch -p1 < "go-1.22.patch" + fi +[% END -%] + tar -xf $rootdir/[% c('input_files_by_name/go_vendor') %] go build -mod=vendor -ldflags '-X main.lyrebirdVersion=[% c("version") %] -s[% IF c("var/android") %] -checklinkname=0[% END %]' ./cmd/lyrebird ===================================== projects/lyrebird/config ===================================== @@ -16,8 +16,13 @@ targets: git_hash: main version: '[% c("abbrev") %]' tag_gpg_id: 0 + macos: var: - go_vendor_sha256sum: '' + go_vendor_sha256sum: 6a054acb7793becdbcb9a08ce7781f3d331f15e85242b399fcef96fb89941f4d + pre_go_vendor: | + if [ -e "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch" ]; then + patch -p1 < "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch" + fi steps: build: @@ -33,9 +38,7 @@ steps: pkg_type: go_vendor project: lyrebird norec: - sha256sum: '[% c("var/go_vendor_sha256sum") %]' - target_replace: - '^torbrowser-(?!testbuild).*': 'torbrowser-linux-x86_64' + sha256sum: '[% IF !c("var/nightly") %][% c("var/go_vendor_sha256sum") %][% END %]' - name: go-licenses project: go-licenses target_replace: ===================================== rbm.conf ===================================== @@ -57,6 +57,7 @@ steps: mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.[% c('compress_tar') %] cd /var/tmp/build/[% project %]-[% c('version') %] + [% IF c("var/pre_go_vendor"); GET c("var/pre_go_vendor"); END -%] go mod vendor [% c('tar', { tar_src => [ 'vendor' ], View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-149.0a1-16.0-2] BB 44801: Redact onion origins from Location.ancestorOrigins.
by ma1 (＠ma1) 31 Mar '26

31 Mar '26

ma1 pushed to branch mullvad-browser-149.0a1-16.0-2 at The Tor Project / Applications / Mullvad Browser Commits: 6a686c89 by hackademix at 2026-03-31T15:49:38+02:00 BB 44801: Redact onion origins from Location.ancestorOrigins. - - - - - 1 changed file: - docshell/base/CanonicalBrowsingContext.cpp Changes: ===================================== docshell/base/CanonicalBrowsingContext.cpp ===================================== @@ -41,6 +41,7 @@ #include "mozilla/StaticPrefs_browser.h" #include "mozilla/StaticPrefs_docshell.h" #include "mozilla/StaticPrefs_fission.h" +#include "mozilla/StaticPrefs_network.h" #include "mozilla/StaticPrefs_security.h" #include "mozilla/glean/DomMetrics.h" #include "nsILayoutHistoryState.h" @@ -3695,6 +3696,10 @@ void CanonicalBrowsingContext::CreateRedactedAncestorOriginsList( // 11. Let masked be false. bool masked = false; + // Tor-specific, not in spec: + // we want to redact cross-origin onions if hideOnionSource is true. + bool redactOnions = StaticPrefs::network_http_referer_hideOnionSource(); + if (referrerPolicy == ReferrerPolicy::No_referrer) { // 12. If referrerPolicy is "no-referrer", then set masked to true. masked = true; @@ -3705,6 +3710,12 @@ void CanonicalBrowsingContext::CreateRedactedAncestorOriginsList( // origin is not same origin with innerDoc's origin, then set masked to // true. masked = true; + } else if (redactOnions && ancestorWGP->DocumentPricipal()->GetIsOnion() && + !ancestorWGP->DocumentPrincipal()->Equals( + aThisDocumentPrincipal)) { + // Tor-specific, not in spec: + // mask parent origin if it's an onion it's different than this document's. + masked = true; } if (masked) { @@ -3721,6 +3732,13 @@ void CanonicalBrowsingContext::CreateRedactedAncestorOriginsList( // 16. For each ancestorOrigin of ancestorOrigins: for (const auto& ancestorOrigin : parentAncestorOriginsList) { + // Tor-specific, not in spec: + // Redact any ancestor onion origin different than this document's origin. + if (redactOnions && ancestorOrigin && ancestorOrigin->GetIsOnion() && + !ancestorOrigin->Equals(aThisDocumentPrincipal)) { + ancestorPrincipals.AppendElement(nullptr); + continue; + } // 16.1 if masked is true if (masked && ancestorOrigin && ancestorOrigin->Equals(ancestorWGP->DocumentPrincipal())) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/6a6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/6a6… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-149.0a1-16.0-2] fixup! TB 40041 [android]: Implement Tor Network Settings
by Pier Angelo Vendrame (＠pierov) 31 Mar '26

31 Mar '26

Pier Angelo Vendrame pushed to branch tor-browser-149.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: d4bb5dd4 by clairehurst at 2026-03-31T14:41:08+02:00 fixup! TB 40041 [android]: Implement Tor Network Settings - - - - - 1 changed file: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/tor/TorLogsComposeFragment.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/tor/TorLogsComposeFragment.kt ===================================== @@ -11,6 +11,7 @@ import android.view.ViewGroup import androidx.compose.foundation.background import androidx.compose.foundation.layout.Column import androidx.compose.foundation.layout.PaddingValues +import androidx.compose.foundation.layout.WindowInsets import androidx.compose.foundation.layout.fillMaxSize import androidx.compose.foundation.layout.fillMaxWidth import androidx.compose.foundation.layout.padding @@ -53,6 +54,7 @@ class TorLogsComposeFragment : Fragment() { Scaffold( floatingActionButton = { CopyLogsButton() }, content = { TorLogs(paddingValues = it) }, + contentWindowInsets = WindowInsets(left = 0, top = 0, right = 0, bottom = 0), ) } } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d4bb5dd… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d4bb5dd… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-update-responses][main] Create a 13.5-specific update path (tor-browser-build#41741)
by boklm (＠boklm) 31 Mar '26

31 Mar '26

boklm pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: 117479d2 by Nicolas Vigier at 2026-03-31T11:54:01+02:00 Create a 13.5-specific update path (tor-browser-build#41741) - - - - - 35 changed files: - update_3/release/.htaccess - update_3/release/linux-i686/.htaccess - update_3/release/linux-i686/update-15.0.5-15.0.8+13.5.29-linux-i686.xml → update_3/release/linux-i686/update-15.0.5-15.0.8-linux-i686.xml - update_3/release/linux-i686/update-15.0.6-15.0.8+13.5.29-linux-i686.xml → update_3/release/linux-i686/update-15.0.6-15.0.8-linux-i686.xml - update_3/release/linux-i686/update-15.0.7-15.0.8+13.5.29-linux-i686.xml → update_3/release/linux-i686/update-15.0.7-15.0.8-linux-i686.xml - update_3/release/linux-i686/update-15.0.8+13.5.29-linux-i686.xml → update_3/release/linux-i686/update-15.0.8-linux-i686.xml - update_3/release/linux-x86_64/.htaccess - update_3/release/linux-x86_64/update-15.0.5-15.0.8+13.5.29-linux-x86_64.xml → update_3/release/linux-x86_64/update-15.0.5-15.0.8-linux-x86_64.xml - update_3/release/linux-x86_64/update-15.0.6-15.0.8+13.5.29-linux-x86_64.xml → update_3/release/linux-x86_64/update-15.0.6-15.0.8-linux-x86_64.xml - update_3/release/linux-x86_64/update-15.0.7-15.0.8+13.5.29-linux-x86_64.xml → update_3/release/linux-x86_64/update-15.0.7-15.0.8-linux-x86_64.xml - update_3/release/linux-x86_64/update-15.0.8+13.5.29-linux-x86_64.xml → update_3/release/linux-x86_64/update-15.0.8-linux-x86_64.xml - update_3/release/macos/.htaccess - − update_3/release/macos/update-13.5.26-15.0.8+13.5.29-macos.xml - − update_3/release/macos/update-13.5.27-15.0.8+13.5.29-macos.xml - − update_3/release/macos/update-13.5.28-15.0.8+13.5.29-macos.xml - update_3/release/macos/update-15.0.5-15.0.8+13.5.29-macos.xml → update_3/release/macos/update-15.0.5-15.0.8-macos.xml - update_3/release/macos/update-15.0.6-15.0.8+13.5.29-macos.xml → update_3/release/macos/update-15.0.6-15.0.8-macos.xml - update_3/release/macos/update-15.0.7-15.0.8+13.5.29-macos.xml → update_3/release/macos/update-15.0.7-15.0.8-macos.xml - update_3/release/macos/update-15.0.8+13.5.29-macos.xml → update_3/release/macos/update-15.0.8-macos.xml - update_3/release/windows-i686/.htaccess - − update_3/release/windows-i686/update-13.5.26-15.0.8+13.5.29-windows-i686.xml - − update_3/release/windows-i686/update-13.5.27-15.0.8+13.5.29-windows-i686.xml - − update_3/release/windows-i686/update-13.5.28-15.0.8+13.5.29-windows-i686.xml - update_3/release/windows-i686/update-15.0.5-15.0.8+13.5.29-windows-i686.xml → update_3/release/windows-i686/update-15.0.5-15.0.8-windows-i686.xml - update_3/release/windows-i686/update-15.0.6-15.0.8+13.5.29-windows-i686.xml → update_3/release/windows-i686/update-15.0.6-15.0.8-windows-i686.xml - update_3/release/windows-i686/update-15.0.7-15.0.8+13.5.29-windows-i686.xml → update_3/release/windows-i686/update-15.0.7-15.0.8-windows-i686.xml - update_3/release/windows-i686/update-15.0.8+13.5.29-windows-i686.xml → update_3/release/windows-i686/update-15.0.8-windows-i686.xml - update_3/release/windows-x86_64/.htaccess - − update_3/release/windows-x86_64/update-13.5.26-15.0.8+13.5.29-windows-x86_64.xml - − update_3/release/windows-x86_64/update-13.5.27-15.0.8+13.5.29-windows-x86_64.xml - − update_3/release/windows-x86_64/update-13.5.28-15.0.8+13.5.29-windows-x86_64.xml - update_3/release/windows-x86_64/update-15.0.5-15.0.8+13.5.29-windows-x86_64.xml → update_3/release/windows-x86_64/update-15.0.5-15.0.8-windows-x86_64.xml - update_3/release/windows-x86_64/update-15.0.6-15.0.8+13.5.29-windows-x86_64.xml → update_3/release/windows-x86_64/update-15.0.6-15.0.8-windows-x86_64.xml - update_3/release/windows-x86_64/update-15.0.7-15.0.8+13.5.29-windows-x86_64.xml → update_3/release/windows-x86_64/update-15.0.7-15.0.8-windows-x86_64.xml - update_3/release/windows-x86_64/update-15.0.8+13.5.29-windows-x86_64.xml → update_3/release/windows-x86_64/update-15.0.8-windows-x86_64.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0