[tor-announce] Tor Browser 12.0a2 released

[Richard Pospesel]

Tor Browser 12.0a2 is now available from the Tor Browser download page and also from our 
distribution directory.

This marks our first alpha on the Firefox ESR 102 series, and our first Android released based on 
the Firefox ESR (Extended Support Release) series.

In the past, our Tor Browser for Android releases have been based on the Firefox Rapid Release 
schedule. Going forward, Tor Browser for Android will be based on the latest Firefox ESR (same as 
our Windows, macOS and Linux releases) and we will be back-porting Android-specific security updates 
from the Rapid Release branches.

This updated release schedule should allow us to improve the general stability of Tor Browser for 
Android and be more confident in our releases going forward.

Tor Browser 12.0a2 updates Firefox on Android, Windows, macOS, and Linux to 102.2.0esr.

We use this opportunity to update various other components of Tor Browser as well :

     Tor 0.4.7.10
     Tor Launcher 0.2.39 (Desktop only)
     NoScript 11.4.10
     Go 1.18.5 (Android only)

This version includes important security updates to Firefox. We also backport the following 
Android-specific security updates:

     CVE-2022-36317
     CVE-2022-38474

Notably, we have also enabled HTTPS-Only mode for Tor Browser for Android (this feature is already 
enabled for Desktop). This feature, when enabled, overrides HTTPS-Everywhere functionality. For now 
this can be reverted in the 'Settings > Privacy and security' pane( see: 
https://gitlab.torproject.org/tpo/applications/fenix/-/merge_requests/151 ).

The full changelog since Tor Browser 12.0a1 is:

     All Platforms
         Update Firefox to 102.2.0esr
         Update Tor to 0.4.7.10
         Update NoScript to 11.4.10
         Update Translations
         Bug tor-browser#40242: Tor Browser has two default bridges that share a fingerprint, and 
Tor ignores one
     Windows + macOS + Linux
         Update Tor-Launcher to 0.2.39
         Update Manual
         Bug tor-browser-build#40580: Add support for uk (ukranian) locale
         Bug tor-browser-buid#40595: Migrate to 102 on desktop
         Bug tor-browser#41075: The Tor Browser is showing caution sign but your document said it won't
         Bug tor-browser#41089: Add tor-browser build scripts + Makefile to tor-browser
     macOS
         Bug tor-browser#41108: Remove privileged macOS installation from 102
     Android
         Bug fenix#40225: Bundled extensions don't get updated with Android Tor Browser updates 
(they stay stuck at the first installed version)
         Bug tor-browser#41094: Enable HTTPS-Only Mode by default in Tor Browser Android
         Bug tor-browser#41156: User-installed addons are broken on Android
         Bug tor-browser#41166: Backport fix for CVE-2022-36317: Long URL would hang Firefox for 
Android (Bug 1759951)
         Bug tor-browser#41167: Backport fix for CVE-2022-38474: Recording notification not shown 
when microphone was recording on Android (Bug 1719511)
     Build System
         All Platforms
             Bug tor-browser-build#40407: Bump binutils version to pick up security improvements for 
Windows users
             Bug tor-browser-build#40591: Rust 1.60 not working to build 102 on Debian Jessie
             Bug tor-browser-build#40592: Consider re-using our LLVM/Clang to build Rust
             Bug tor-browser-build#40593: Update signing scripts to take into account new project 
names and layout
             Bug tor-browser-build#40607: Add alpha-specific release prep template
             Bug tor-browser-build#40610: src-*.tar.xz tarballs are missing in 
https://dist.torproject.org/torbrowser/12.0a1/
             Bug tor-browser-build#40612: Migrate Release Prep template to Release Prep - Stable
         Windows + macOS + Linux
             Bug tor-browser#41099: Update+comment the update channels in update_responses.config.yaml
         Windows
             Bug tor-browser-buid#29318: Use Clang for everything on Windows
             Bug tor-browser-build#29321: Use mingw-w64/clang toolchain to build tor
             Bug tor-browser-build#29322: Use mingw-w64/clang toolchain to build OpenSSL
             Bug tor-browser-build#40409: Upgrade NSIS to 3.08
         macOS
             Bug tor-browser-build#40605: Reworked the macOS toolchain creation
             Bug tor-browser-build#40620: Update macosx-sdk to 11.0
         Linux
             Bug tor-browser-build#31321: Add cc -> gcc link to projects/gcc
         Android
             Update Go to 1.18.5
             Bug tor-browser-build#40574: Improve tools/signing/android-signing
             Bug tor-browser-build#40582: Prepared TBA to use Mozilla 102 components
             Bug tor-browser-build#40604: Bug 40604: Fix binutils build on android

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xDE47360363F34B2C.asc
Type: application/pgp-keys
Size: 5560 bytes
Desc: OpenPGP public key
URL: <http://lists.torproject.org/pipermail/tor-announce/attachments/20220910/162e7ca1/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-announce/attachments/20220910/162e7ca1/attachment.sig>