July 2026 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-154.0a1-17.0-1
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new branch tor-browser-154.0a1-17.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-16.0a9-build1
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag mb-16.0a9-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-16.0a9-build1
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag tbb-16.0a9-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41833&41834: Prepare Tor&Mullvad Browser 16.0a9
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7dd751cf by Pier Angelo Vendrame at 2026-07-22T15:48:58+02:00 Bug 41833&41834: Prepare Tor&Mullvad Browser 16.0a9 - - - - - 8 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/geckoview/config - projects/go/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,3 +1,25 @@ +Mullvad Browser 16.0a9 - July 23 2026 + * All Platforms + * Updated Firefox to 153.0esr + * Updated NoScript to 13.6.30.90201984 + * Updated uBlock Origin to 1.72.2 + * Bug 559: about:preferences is broken in 153 nightlies [mullvad-browser] + * Bug 561: Rebase Mullvad Browser onto 153.0esr [mullvad-browser] + * Bug 44439: Remove translate action from urlbar [tor-browser] + * Bug 44811: Remove the lock on pdfjs.disable. [tor-browser] + * Bug 45110: Disable the settings redesign until ready for us [tor-browser] + * Bug 45131: Security level is using an unsafe getBoolPref [tor-browser] + * Bug 45132: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE' [tor-browser] + * Windows + * Bug 555: Fix our wchar_t to char conversion in desktop_capture_utils.cc [mullvad-browser] + * macOS + * Bug 45108: Artifact generation fails due to missing .DS_Store in the branding directories [tor-browser] + * Build System + * All Platforms + * Bug 41838: Update personal_access_tokens URL in tools/fetch_changelogs.py [tor-browser-build] + * Windows + * Bug 41819: Fix windows-rs URL in projects/firefox/config [tor-browser-build] + Mullvad Browser 16.0a8 - July 01 2026 * All Platforms * Updated Firefox to 152.0a1 ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,42 @@ +Tor Browser 16.0a9 - July 23 2026 + * All Platforms + * Updated NoScript to 13.6.30.90201984 + * Bug 43819: Show custom security level on android [tor-browser] + * Bug 44748: Revert Funding the Commons Implementations [tor-browser] + * Bug 44811: Remove the lock on pdfjs.disable. [tor-browser] + * Bug 45101: Rebase Tor Browser onto 153.0esr [tor-browser] + * Bug 45131: Security level is using an unsafe getBoolPref [tor-browser] + * Bug 41831: Update libevent to 2.1.13 [tor-browser-build] + * Windows + macOS + Linux + * Updated Firefox to 153.0esr + * Bug 44439: Remove translate action from urlbar [tor-browser] + * Bug 44883: Remove urlbar quick action for labs [tor-browser] + * Bug 45029: Convert connection status settings to new design and config approach [tor-browser] + * Bug 45055: Rename --color-gray-05 to --color-gray-0 [tor-browser] + * Bug 45081: Use the new "Acorn" icons on desktop [tor-browser] + * Bug 45110: Disable the settings redesign until ready for us [tor-browser] + * Bug 45112: Missing CSS border tokens in 153 [tor-browser] + * Bug 45132: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE' [tor-browser] + * Bug 41800: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser [tor-browser-build] + * macOS + * Bug 45108: Artifact generation fails due to missing .DS_Store in the branding directories [tor-browser] + * Android + * Updated GeckoView to 153.0esr + * Bug 43820: Use SecurityLevel integration on android [tor-browser] + * Bug 44157: Remove secret setting toggle for Tab Management Redesign [tor-browser] + * Bug 45045: Remove moz asset in Downloads screen [tor-browser] + * Bug 45103: Disable broken "tab management" [tor-browser] + * Bug 45109: No value passed for parameter 'jsEnabled' [tor-browser] + * Bug 45118: Audit and disable Mozilla VPN promo [tor-browser] + * Bug 45130: Clean up TorHomePage padding [tor-browser] + * Build System + * All Platforms + * Bug 41838: Update personal_access_tokens URL in tools/fetch_changelogs.py [tor-browser-build] + * Windows + Linux + Android + * Updated Go to 1.26.5 + * Windows + * Bug 41819: Fix windows-rs URL in projects/firefox/config [tor-browser-build] + Tor Browser 16.0a8 - July 01 2026 * All Platforms * Updated NoScript to 13.6.25.90301984 ===================================== projects/browser/config ===================================== @@ -87,12 +87,12 @@ input_files: enable: '[% !c("var/android") %]' - filename: dmg-root enable: '[% c("var/macos") %]' - - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.25.90301984.x… + - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.30.90201984.x… name: noscript - sha256sum: 1449e39c15bf00493c274697486fc5f520124d52901fcae696c05083b2c7e921 - - URL: https://addons.mozilla.org/firefox/downloads/file/4814095/ublock_origin-1.7… + sha256sum: ef7b48702916f86d44f0578fcc18dcd4ed4a013481abafca96891e10af1bcf85 + - URL: https://addons.mozilla.org/firefox/downloads/file/4888680/ublock_origin-1.7… name: ublock-origin - sha256sum: 47f788a1fc2c014830b30bb0ef9588615701b98c5265fb19b8cf4ba779849feb + sha256sum: 40c315b0da7871868155ecfae7a50a58dfa0920aebd865e008214986f1b7c578 enable: '[% c("var/mullvad-browser") %]' - URL: https://cdn.mullvad.net/browser-extension/0.9.10/mullvad-browser-extension-… name: mullvad-extension ===================================== projects/firefox/config ===================================== @@ -23,7 +23,7 @@ var: browser_series: '16.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 2 upstream_firefox_commit: FIREFOX_NIGHTLY_153_END copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]' nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]' ===================================== projects/geckoview/config ===================================== @@ -26,7 +26,7 @@ var: browser_series: '16.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 2 gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]' deps: ===================================== projects/go/config ===================================== @@ -1,11 +1,11 @@ # vim: filetype=yaml sw=2 -version: '1.26.4' +version: '1.26.5' filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 var: - source_sha256: 4f668a32fbfc1132e6a881fb968c2f1dada631492a339211735fbb255a42602d + source_sha256: 495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42 no_crosscompile: 1 setup: | mkdir -p /var/tmp/dist ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: f214fa73196b8b4ecfd2141ff373ddcbb5edf6b8 + git_hash: 7bd0a8e7226bbf29f16d477ff92d0024b1d48a7c targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: f1579ea805d3d1af56d394893d26561a2945824c + git_hash: 43635f68f04d7e5645e5b28bbab7cd7f0fc2ffa5 targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 925fa40ece33f0c66b11c41b856fc71a1f8bf25c + git_hash: f3757f734f6d08ff5aecc18f9f4b05e35c9bcbc4 compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -81,11 +81,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '16.0a8' - torbrowser_build: 'build3' + torbrowser_version: '16.0a9' + torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2026/07/01 08:30:00' + browser_release_date: '2026/07/22 13:30:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: alpha browser_platforms: @@ -131,9 +131,9 @@ var: updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + - 16.0a8 - 16.0a7 - 16.0a6 - - 16.0a5 mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # By default, we sort the list of installed packages. This allows sharing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-153.0esr-16.0-1-build2
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag mullvad-browser-153.0esr-16.0-1-build2 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-153.0esr-16.0-1-build2
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag tor-browser-153.0esr-16.0-1-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-153.0esr-16.0-1] fixup! BB 40925: Implemented the Security Level component
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed to branch mullvad-browser-153.0esr-16.0-1 at The Tor Project / Applications / Mullvad Browser Commits: a8a167fe by Pier Angelo Vendrame at 2026-07-22T15:28:09+02:00 fixup! BB 40925: Implemented the Security Level component BB 45131: Avoid the unsafe getBoolPref in the security level. In the security level we use getBoolPref without a default value. Therefore it might throw during the initialization of the security level. This case should not happen normally for us, but it might happen if upstream removes a preference default, and in that case the security level initialization will fail at startup. It seems better to handle the case (but add a console warning, so that we notice it and investigate it). - - - - - 1 changed file: - toolkit/components/securitylevel/SecurityLevel.sys.mjs Changes: ===================================== toolkit/components/securitylevel/SecurityLevel.sys.mjs ===================================== @@ -348,14 +348,22 @@ var read_setting_from_prefs = function (prefNames) { // For the given settingIndex, check if all current pref values // match the setting. for (const prefName of prefNames) { - const wanted = kSecuritySettings[prefName][settingIndex]; - const actual = Services.prefs.getBoolPref(prefName); - if (wanted !== actual) { - possibleSetting = false; - logger.debug( - `${prefName} does not match level ${settingIndex}: ${actual}, should be ${wanted}!` - ); - break; + try { + const wanted = kSecuritySettings[prefName][settingIndex]; + const actual = Services.prefs.getBoolPref(prefName); + if (wanted !== actual) { + possibleSetting = false; + logger.debug( + `${prefName} does not match level ${settingIndex}: ${actual}, should be ${wanted}!` + ); + break; + } + } catch (e) { + // All the relevant prefs must have a defined default. + // If we get here, a preference might have been dropped upstream, + // therefore it makes sense to ignore it to determine the security + // level, but warn so that we have a look at what went wrong. + logger.warn(`Cannot get the value for ${prefName}`, e); } } if (possibleSetting) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/a8a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/a8a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] fixup! BB 40925: Implemented the Security Level component
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 266b210c by Pier Angelo Vendrame at 2026-07-22T15:13:09+02:00 fixup! BB 40925: Implemented the Security Level component BB 45131: Avoid the unsafe getBoolPref in the security level. In the security level we use getBoolPref without a default value. Therefore it might throw during the initialization of the security level. This case should not happen normally for us, but it might happen if upstream removes a preference default, and in that case the security level initialization will fail at startup. It seems better to handle the case (but add a console warning, so that we notice it and investigate it). - - - - - 1 changed file: - toolkit/components/securitylevel/SecurityLevel.sys.mjs Changes: ===================================== toolkit/components/securitylevel/SecurityLevel.sys.mjs ===================================== @@ -336,14 +336,22 @@ var read_setting_from_prefs = function (prefNames) { // For the given settingIndex, check if all current pref values // match the setting. for (const prefName of prefNames) { - const wanted = kSecuritySettings[prefName][settingIndex]; - const actual = Services.prefs.getBoolPref(prefName); - if (wanted !== actual) { - possibleSetting = false; - logger.debug( - `${prefName} does not match level ${settingIndex}: ${actual}, should be ${wanted}!` - ); - break; + try { + const wanted = kSecuritySettings[prefName][settingIndex]; + const actual = Services.prefs.getBoolPref(prefName); + if (wanted !== actual) { + possibleSetting = false; + logger.debug( + `${prefName} does not match level ${settingIndex}: ${actual}, should be ${wanted}!` + ); + break; + } + } catch (e) { + // All the relevant prefs must have a defined default. + // If we get here, a preference might have been dropped upstream, + // therefore it makes sense to ignore it to determine the security + // level, but warn so that we have a look at what went wrong. + logger.warn(`Cannot get the value for ${prefName}`, e); } } if (possibleSetting) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/266b210… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/266b210… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_154_END
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_154_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_154_END
by Pier Angelo Vendrame (＠pierov) 22 Jul '26

22 Jul '26

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_154_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0