- tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-140.14.0esr-15.0-1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new branch tor-browser-140.14.0esr-15.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-153.1.0esr-16.0-1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new branch tor-browser-153.1.0esr-16.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] 3 commits: fixup! BB 42027: Base Browser migration procedures.
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: de436cdf by Henry Wilkes at 2026-08-11T15:56:46+01:00 fixup! BB 42027: Base Browser migration procedures. BB 45197: Clear password settings for hidden controls. - - - - - bf6247a4 by Henry Wilkes at 2026-08-11T15:56:47+01:00 fixup! BB 44711: Hide unwanted setting controls in Base Browser. BB 45197: Hide the password controls if there is no password database. - - - - - 873a7d2e by Henry Wilkes at 2026-08-11T15:57:37+01:00 fixup! Base Browser strings BB 45197: Password manager unavailable banner string. - - - - - 3 changed files: - browser/components/ProfileDataUpgrader.sys.mjs - browser/components/preferences/config/passwords-autofill.mjs - toolkit/locales/en-US/toolkit/global/base-browser.ftl Changes: ===================================== browser/components/ProfileDataUpgrader.sys.mjs ===================================== @@ -1051,6 +1051,8 @@ export let ProfileDataUpgrader = { // Version 7: 16.0a10: Reset safe browsing preferences. tor-browser#44802. // Also reset delete downloads preferences. // tor-browser#45187. + // Also reset password manager preferences. + // tor-browser#45197. const MIGRATION_VERSION = 7; const MIGRATION_PREF = "basebrowser.migration.version"; @@ -1167,9 +1169,24 @@ export let ProfileDataUpgrader = { // re-offer this feature again in the future. tor-browser#45187. "browser.download.deletePrivate", "browser.download.deletePrivate.chosen", + // Clear the password breach alert preference since it does not work. + // tor-browser#45197. + "signon.management.page.breach-alerts.enabled", ]) { Services.prefs.clearUserPref(prefName); } + if (Services.prefs.getBoolPref("security.nocertdb", true)) { + // Password manager does not read or write passwords from the database. + // We want to clear the preferences that no longer have any visible + // controls in the settings UI. tor-browser#45197. + for (const prefName of [ + "signon.rememberSignons", + "signon.autofillForms", + "signon.generation.enabled", + ]) { + Services.prefs.clearUserPref(prefName); + } + } } Services.prefs.setIntPref(MIGRATION_PREF, MIGRATION_VERSION); }, ===================================== browser/components/preferences/config/passwords-autofill.mjs ===================================== @@ -257,6 +257,7 @@ Preferences.addAll([ { id: "signon.autofillForms", type: "bool" }, { id: "signon.management.page.breach-alerts.enabled", type: "bool" }, { id: "signon.firefoxRelay.feature", type: "string" }, + { id: "security.nocertdb", type: "bool" }, ]); Preferences.addSetting({ @@ -522,15 +523,50 @@ Preferences.addSetting( } ); +Preferences.addSetting({ + id: "canSavePasswords", + pref: "security.nocertdb", + get: pref => { + return !pref; + }, +}); + Preferences.addSetting({ id: "savePasswords", pref: "signon.rememberSignons", + deps: ["canSavePasswords"], + visible: ({ canSavePasswords }, savePasswords) => { + // Only show this option if the user has explicitly disabled "nocertdb", or + // they have somehow switched this option on. tor-browser#45197. + return canSavePasswords.value || savePasswords.value; + }, controllingExtensionInfo: { storeId: "services.passwordSavingEnabled", l10nId: "extension-controlling-password-saving", }, }); +Preferences.addSetting({ + id: "showPasswordControls", + deps: ["canSavePasswords", "savePasswords"], + get: (_pref, { canSavePasswords, savePasswords }) => { + // Only show other password controls if the user has explicitly disabled + // "nocertdb", or they have somehow switched on save passwords. + // tor-browser#45197. + return canSavePasswords.value || savePasswords.value; + }, +}); + +Preferences.addSetting({ + id: "passwordsUnsupportedBanner", + deps: ["canSavePasswords"], + visible: ({ canSavePasswords }) => { + // NOTE: We show the banner even if disabling the password controls are + // visible because "savePasswords" is true. + return !canSavePasswords.value; + }, +}); + Preferences.addSetting({ id: "managePasswordExceptions", onUserClick: () => { @@ -551,7 +587,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "requireOSAuthForPasswords", - visible: () => lazy.OSKeyStore.canReauth(), + deps: ["showPasswordControls"], + visible: ({ showPasswordControls }) => { + return showPasswordControls.value && lazy.OSKeyStore.canReauth(); + }, get: () => lazy.LoginHelper.getOSAuthEnabled(), async set(checked) { const [messageText, captionText] = await Promise.all([ @@ -585,10 +624,14 @@ Preferences.addSetting({ Preferences.addSetting({ id: "manageSavedPasswords", + deps: ["showPasswordControls"], onUserClick: () => { PasswordSettingHelpers.showPasswords(); }, - visible: () => { + visible: ({ showPasswordControls }) => { + if (!showPasswordControls.value) { + return false; + } let policy = Services.policies.getActivePolicies(); return policy?.PasswordManagerEnabled !== false; }, @@ -596,6 +639,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "additionalProtectionsGroup", + deps: ["showPasswordControls"], + visible: ({ showPasswordControls }) => { + return showPasswordControls.value; + }, }); Preferences.addSetting({ @@ -668,6 +715,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "breachAlerts", pref: "signon.management.page.breach-alerts.enabled", + // Even for users who force passwords to be enabled, we hide this because + // login breach requires "fxmonitor-breaches" remote settings, which has no + // local JSON dumps in Base Browser. tor-browser#45197. + visible: () => false, }); Preferences.addSetting({ @@ -687,6 +738,16 @@ SettingGroupManager.registerGroups({ l10nId: "forms-passwords-header", headingLevel: 2, items: [ + // Add a banner to explain that passwords are unsupported. + // tor-browser#45197. + { + id: "passwordsUnsupportedBanner", + l10nId: "passwords-settings-unsupported-banner", + control: "moz-message-bar", + controlAttr: { + role: "status", + }, + }, { id: "savePasswords", l10nId: "forms-ask-to-save-passwords", ===================================== toolkit/locales/en-US/toolkit/global/base-browser.ftl ===================================== @@ -114,6 +114,13 @@ browser-layout-show-sidebar-limited = search-suggestions-warning-banner = .message = Turning this on reduces your privacy by sharing your queries with the search engine as you type. +## Preferences - Passwords. + +# "{ -brand-short-name }" will be replaced with the localized name of the browser, e.g. "Tor Browser". +passwords-settings-unsupported-banner = + .heading = Built-in password manager isn’t supported. + .message = { -brand-short-name }’s built-in password manager is disabled by default. This prevents your anonymous browsing from being linked to your regular identity. + ## Preferences - Contrast Control. preferences-contrast-control-fixed-color2 = View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_153_1_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new tag FIREFOX_153_1_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_140_14_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new tag FIREFOX_140_14_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41850: Update keyring/torbrowser.gpg for new subkey
by boklm (＠boklm) 12 Aug '26

12 Aug '26

boklm pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: f01c77f9 by Nicolas Vigier at 2026-08-12T09:45:13+02:00 Bug 41850: Update keyring/torbrowser.gpg for new subkey Also update expiration date of the main key. - - - - - 1 changed file: - keyring/torbrowser.gpg Changes: ===================================== keyring/torbrowser.gpg ===================================== Binary files a/keyring/torbrowser.gpg and b/keyring/torbrowser.gpg differ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41850: Update keyring/torbrowser.gpg for new subkey
by boklm (＠boklm) 12 Aug '26

12 Aug '26

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7e6cd044 by Nicolas Vigier at 2026-08-11T20:10:01+02:00 Bug 41850: Update keyring/torbrowser.gpg for new subkey Also update expiration date of the main key. - - - - - 1 changed file: - keyring/torbrowser.gpg Changes: ===================================== keyring/torbrowser.gpg ===================================== Binary files a/keyring/torbrowser.gpg and b/keyring/torbrowser.gpg differ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41831: Update libevent to 2.1.13.
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: a2e88ca9 by Pier Angelo Vendrame at 2026-08-11T17:31:47+02:00 Bug 41831: Update libevent to 2.1.13. Also, add nickm's key to keyrings/libevent.gpg. - - - - - 2 changed files: - keyring/libevent.gpg - projects/libevent/config Changes: ===================================== keyring/libevent.gpg ===================================== Binary files a/keyring/libevent.gpg and b/keyring/libevent.gpg differ ===================================== projects/libevent/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.1.12 +version: 2.1.13 git_url: https://github.com/libevent/libevent.git git_hash: 'release-[% c("version") %]-stable' tag_gpg_id: 1 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-153.0esr-16.0-1] fixup! Base Browser strings
by morgan (＠morgan) 11 Aug '26

11 Aug '26

morgan pushed to branch mullvad-browser-153.0esr-16.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 71212888 by Henry Wilkes at 2026-08-11T11:55:01+00:00 fixup! Base Browser strings BB 45079: Drop old letterboxing strings. - - - - - 1 changed file: - toolkit/locales/en-US/toolkit/global/base-browser.ftl Changes: ===================================== toolkit/locales/en-US/toolkit/global/base-browser.ftl ===================================== @@ -74,13 +74,6 @@ new-identity-blocked-home-ignore-button = Load it anyway ## Preferences - Letterboxing. -# The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. -# "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. -letterboxing-header = Letterboxing -# The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. -# "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. -letterboxing-overview = { -brand-short-name }'s Letterboxing feature restricts websites to display at specific sizes, making it harder to single out users on the basis of their window or screen size. -letterboxing-learn-more = Learn more # The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. # "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. # "{ -brand-short-name }" will be replaced with the localized name of the browser, e.g. "Tor Browser". View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/712… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/712… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] fixup! Base Browser strings
by morgan (＠morgan) 11 Aug '26

11 Aug '26

morgan pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 43fea19f by Henry Wilkes at 2026-08-11T11:49:18+00:00 fixup! Base Browser strings BB 45079: Drop old letterboxing strings. - - - - - 1 changed file: - toolkit/locales/en-US/toolkit/global/base-browser.ftl Changes: ===================================== toolkit/locales/en-US/toolkit/global/base-browser.ftl ===================================== @@ -74,13 +74,6 @@ new-identity-blocked-home-ignore-button = Load it anyway ## Preferences - Letterboxing. -# The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. -# "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. -letterboxing-header = Letterboxing -# The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. -# "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. -letterboxing-overview = { -brand-short-name }'s Letterboxing feature restricts websites to display at specific sizes, making it harder to single out users on the basis of their window or screen size. -letterboxing-learn-more = Learn more # The word "Letterboxing" is the proper noun for the Tor Browser feature, and is therefore capitalised. # "Letterboxing" should be treated as a feature/product name, and likely not changed in other languages. # "{ -brand-short-name }" will be replaced with the localized name of the browser, e.g. "Tor Browser". View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/43fea19… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/43fea19… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0