ChangeLog.txt 234 KB
Newer Older
Georg Koppen's avatar
Georg Koppen committed
1
Tor Browser 9.5a4 -- January 8 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
 * All Platforms
   * Update Firefox to 68.4.0esr
   * Bump NoScript to 11.0.11
   * Translations update
   * Update OpenPGP keyring
   * Bug 31134: Govern graphite again by security settings
   * Bug 31855: Remove End of Year Fundraising Campaign from about:tor
   * Bug 32053: Fix LLVM reproducibility issues
   * Bug 32547: Add new default bridge at UMN
   * Bug 32659: Remove IPv6 address of default bridge
 * Windows + OS X + Linux
   * Update Tor to 0.4.2.5
   * Update Tor Launcher to 0.2.21
     * Bug 32636: Clean up locales shipped with Tor Launcher
     * Translations update
   * Bug 32674: Point the about:tor "Get involved" link to the community portal
 * Build System
   * All Platforms
Georg Koppen's avatar
Georg Koppen committed
20
     * Bug 32739: Bump clang to 8.0.1
21
22
23
   * Linux
     * Bug 32676: Create a tarball with all Linux x86_64 language packs

24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
Tor Browser 9.0.2 -- December 3 2019
 * All Platforms
   * Update Firefox to 68.3.0esr
   * Bump NoScript to 11.0.9
     * Bug 32362: NoScript TRUSTED setting doesn't work
     * Bug 32429: Issues with about:blank and NoScript on .onion sites
   * Bump HTTPS Everywhere to 2019.11.7
   * Bug 27268: Preferences clean-up in Torbutton code
   * Translations update
 * Windows + OS X + Linux
   * Bug 32125: Fix circuit display for bridge without a fingerprint
   * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017)
 * Windows
   * Bug 31989: Backport backout of old mingw-gcc patch
   * Bug 32616: Disable GetSecureOutputDirectoryPath() functionality
 * Android
   * Bug 32365: Localization is broken in Tor Browser 9 on Android
 * Build System
   * All Platforms
     * Bug 32413: Bump Go version to 1.12.13

45
46
47
48
49
50
Tor Browser 9.5a3 -- December 3 2019
 * All Platforms
   * Update Firefox to 68.3.0esr
   * Bump NoScript to 11.0.9
     * Bug 32362: NoScript TRUSTED setting doesn't work
     * Bug 32429: Issues with about:blank and NoScript on .onion sites
Georg Koppen's avatar
Georg Koppen committed
51
     * Bug 32549: NoScript makes requests to sync-messages.invalid
52
53
54
55
56
   * Update HTTPS Everywhere to 2019.11.7
   * Bug 32618: Backport fixes from Mozilla bugs 1467970 and 1590526
   * Bug 32606: Set up default bridge at Georgetown University
   * Bug 30787: Add lt locale
   * Bug 30788: Add ms locale
boklm's avatar
boklm committed
57
   * Bug 30786: Add th locale
58
   * Translations update
59
60
61
62
63
64
   * Bug 28746: Remove torbutton isolation and fp prefs sync
   * Bug 28745: Assume always running in Tor Browser
   * Bug 30888: move torbutton_util.js to modules/utils.js
   * Bug 30851: Move default preferences to 000-tor-browser.js
   * Bug 28745: Remove torbutton.js unused code
   * Bug 32255: Missing ORIGIN header breaks CORS
65
66
67
68
 * Windows + OS X + Linux
   * Update Tor to 0.4.2.4-rc
   * Update Tor Launcher to 0.2.20.3
     * Bug 30787: Add lt locale
69
     * Bug 30788: Add ms locale
boklm's avatar
boklm committed
70
     * Bug 30786: Add th locale
71
   * Bug 30237: Improve TBB UI of hidden service client authorization
72
73
 * Android
   * Bug 32365: Localization is broken in Tor Browser 9 on Android
74
   * Bug 32405: Crash immediately after bootstrap on Android
75
76
 * OS X
   * Bug 32505: Tighten our rules in our entitlements file for macOS
Matthew Finkel's avatar
Matthew Finkel committed
77
78
 * Windows
   * Bug 32616: Disable GetSecureOutputDirectoryPath() functionality
79

80
81
82
83
84
85
Tor Browser 9.0.2 -- December 3 2019
 * All Platforms
   * Update Firefox to 68.3.0esr
   * Bump NoScript to 11.0.9
     * Bug 32362: NoScript TRUSTED setting doesn't work
     * Bug 32429: Issues with about:blank and NoScript on .onion sites
Georg Koppen's avatar
Georg Koppen committed
86
     * Bug 32549: NoScript makes requests to sync-messages.invalid
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
   * Bump HTTPS Everywhere to 2019.11.7
   * Bug 27268: Preferences clean-up in Torbutton code
   * Translations update
 * Windows + OS X + Linux
   * Bug 32125: Fix circuit display for bridge without a fingerprint
   * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017)
 * Windows
   * Bug 31989: Backport backout of old mingw-gcc patch
   * Bug 32616: Disable GetSecureOutputDirectoryPath() functionality
 * Android
   * Bug 32365: Localization is broken in Tor Browser 9 on Android
 * Build System
   * All Platforms
     * Bug 32413: Bump Go version to 1.12.13

Georg Koppen's avatar
Georg Koppen committed
102
Tor Browser 9.5a2 -- November 11 2019
Georg Koppen's avatar
Georg Koppen committed
103
 * All Platforms
Georg Koppen's avatar
Georg Koppen committed
104
   * Update NoScript to 11.0.7
Georg Koppen's avatar
Georg Koppen committed
105
106
107
108
109
     * Bug 21004: Don't block JavaScript on onion services on medium security
     * Bug 27307: NoScript marks HTTP onions as not secure
   * Bug 30783: Fundraising banner for EOY 2019 campain
   * Bug 32321: Don't ping Mozilla for Man-in-the-Middle-detection
   * Bug 32318: Backport Mozilla's fix for bug 1534339
Georg Koppen's avatar
Georg Koppen committed
110
   * Bug 31573: Catch SessionStore.jsm exception
Georg Koppen's avatar
Georg Koppen committed
111
112
   * Bug 27268: Preferences clean-up
 * Windows + OS X + Linux
113
   * Update Tor to 0.4.2.3-alpha
Georg Koppen's avatar
Georg Koppen committed
114
115
116
   * Update Tor Launcher to 0.2.20.2
     * Bug 32164: Trim each received log line from tor
     * Translations update
Georg Koppen's avatar
Georg Koppen committed
117
   * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017)
Georg Koppen's avatar
Georg Koppen committed
118
119
120
121
122
123
124
125
   * Bug 31803: Replaced about:debugging logo with flat version
   * Bug 31764: Fix for error when navigating via 'Paste and go'
   * Bug 32169: Fix TB9 Wikipedia address bar search
   * Bug 32210: Hide the tor pane when using a system tor
   * Bug 31658: Use builtin --panel-disabled-color for security level text
   * Bug 32188: Fix localization on about:preferences#tor
   * Bug 32184: Red dot is shown while downloading an update
   * Bug 27604: Fix broken Tor Browser after moving it to a different directory
Georg Koppen's avatar
Georg Koppen committed
126
127
   * Bug 32220: Improve the letterboxing experience
   * Bug 30683: Backport upstreamed fix from Mozilla (bug 1581537)
Georg Koppen's avatar
Georg Koppen committed
128
129
 * Android
   * Bug 32342: Crash when changing the browser locale
Georg Koppen's avatar
Georg Koppen committed
130
131
132
133
134
135
   * Bug 32303: Obfs4 is broken on Android Q
 * Build System
   * All Platforms
     * Bug 32413: Bump Go version to 1.12.13
   * Android
     * Bug 28803: Integrate building Pluggable Transports for Android
Georg Koppen's avatar
Georg Koppen committed
136

Georg Koppen's avatar
Georg Koppen committed
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
Tor Browser 9.0.1 -- November 4 2019
 * All Platforms
   * Update NoScript to 11.0.4
     * Bug 21004: Don't block JavaScript on onion services on medium security
     * Bug 27307: NoScript marks HTTP onions as not secure
   * Bug 30783: Fundraising banner for EOY 2019 campain
   * Bug 32321: Don't ping Mozilla for Man-in-the-Middle-detection
   * Bug 27268: Preferences clean-up
 * Windows + OS X + Linux
   * Update Tor Launcher to 0.2.20.2
     * Bug 32164: Trim each received log line from tor
     * Translations update
   * Bug 31803: Replaced about:debugging logo with flat version
   * Bug 31764: Fix for error when navigating via 'Paste and go'
   * Bug 32169: Fix TB9 Wikipedia address bar search
   * Bug 32210: Hide the tor pane when using a system tor
   * Bug 31658: Use builtin --panel-disabled-color for security level text
   * Bug 32188: Fix localization on about:preferences#tor
   * Bug 32184: Red dot is shown while downloading an update
 * Android
   * Bug 32342: Crash when changing the browser locale

Georg Koppen's avatar
Georg Koppen committed
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
Tor Browser 9.5a1 -- October 23 2019
 * All Platforms
   * Update Firefox to 68.2.0esr
   * Bug 31740: Remove some unnecessary RemoteSettings instances
   * Bug 30681: Set security.enterprise_roots.enabled to false
   * Bug 31144: Review network code changes for Firefox 68 ESR
   * Bug 21549: Enable WASM on standard security level
 * Windows + OS X + Linux
   * Update Tor Launcher to 0.2.20.1
     * Bug 32154: Custom bridge field only allows one line of input
     * Bug 32112: Fix bad & escaping in translations
     * Bug 31286: Update to tor settings related strings
     * Translations update
   * Bug 32125: Fix circuit display for bridge without a fingerprint
   * Bug 32076: Upgrade to goptlib v1.1.0
   * Bug 32061: Bump snowflake version to b4f4b29a03
   * Bug 32092: Fix Tor Browser Support link in preferences
   * Bug 32111: Fixed issue parsing user-provided bridge strings
   * Bug 31749: Fix security level panel spawning events
   * Bug 31920: Fix Security Level panel when its toolbar button moves to overflow
   * Bug 31748+31961: Fix 'Learn More' links in Security Level preferences and panel
   * Translations update
Georg Koppen's avatar
Georg Koppen committed
181
182
183
 * Windows
   * Bug 32132: Re-enable jemalloc for Windows users
   * Bug 31989: Backport backout of old mingw-gcc patch
Georg Koppen's avatar
Georg Koppen committed
184
185
186
187
188
189
190
 * Android
   * Bug 32097: Fix conflicts in mobile onboarding while rebasing to 68.2.0esr
   * Bug 26529: Notify user about possible proxy-bypass before opening external app
 * Build System
   * Android
     * Bug 30461: Clean up tor-android-service project

191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
Tor Browser 9.0 -- October 22 2019
 * All Platforms
   * Update Firefox to 68.2.0esr
   * Bug 31740: Remove some unnecessary RemoteSettings instances
   * Bug 13543: Spoof smooth and powerEfficient for Media Capabilities
   * Bug 28196: about:preferences is not properly translated anymore
   * Bug 19417: Disable asmjs on safer and safest security levels
   * Bug 30463: Explicitly disable MOZ_TELEMETRY_REPORTING
   * Bug 31935: Disable profile downgrade protection
   * Bug 16285: Disable DRM/EME on Android and drop Adobe CDM
   * Bug 31602: Remove Pocket indicators in UI and disable it
   * Bug 31914: Fix eslint linter error
   * Bug 30429: Rebase patches for Firefox 68 ESR
   * Bug 31144: Review network code changes for Firefox 68 ESR
   * Bug 10760: Integrate Torbutton into Tor Browser directly
   * Bug 25856: Remove XUL overlays from Torbutton
   * Bug 31322: Fix about:tor assertion failure debug builds
   * Bug 29430: Add support for meek_lite bridges to bridgeParser
   * Bug 28561: Migrate "About Tor Browser" dialog to tor-browser
   * Bug 30683: Prevent detection of locale via some *.properties
   * Bug 31298: Backport patch for #24056
   * Bug 9336: Odd wyswig schemes without isolation for browserspy.dk
   * Bug 27601: Browser notifications are not working anymore
   * Bug 30845: Make sure internal extensions are enabled
   * Bug 28896: Enable extensions in private browsing by default
   * Bug 31563: Reload search extensions if extensions.enabledScopes has changed
   * Bug 31396: Fix communication with NoScript for security settings
   * Bug 31142: Fix crash of tab and messing with about:newtab
   * Bug 29049: Backport JS Poison Patch
   * Bug 25214: Canvas data extraction on local pdf file should be allowed
   * Bug 30657: Locale is leaked via title of link tag on non-html page
   * Bug 31015: Disabling SVG hides UI icons in extensions
   * Bug 30681: Set security.enterprise_roots.enabled to false
   * Bug 30538: Unable to comment on The Independent Newspaper
   * Bug 31209: View PDF in Tor Browser is fuzzy
   * Translations update
 * Windows + OS X + Linux
   * Update Tor to 0.4.1.6
   * Update OpenSSL to 1.1.1d
     * Bug 31844: OpenSSL 1.1.1d fails to compile for some platforms/architectures
   * Update Tor Launcher to 0.2.20.1
     * Bug 28044: Integrate Tor Launcher into tor-browser
     * Bug 32154: Custom bridge field only allows one line of input
     * Bug 31286: New strings for about:preferences#tor
     * Bug 31303: Do not launch tor in browser toolbox
     * Bug 32112: Fix bad & escaping in translations
     * Bug 31491: Clean up the old meek http helper browser profiles
     * Bug 29197: Remove use of overlays
     * Bug 31300: Modify Tor Launcher so it is compatible with ESR68
     * Bug 31487: Modify moat client code so it is compatible with ESR68
     * Bug 31488: Moat: support a comma-separated list of transports
     * Bug 30468: Add mk locale
     * Bug 30469: Add ro locale
     * Bug 30319: Remove FTE bits
     * Translations update
   * Bug 32092: Fix Tor Browser Support link in preferences
   * Bug 32111: Fixed issue parsing user-provided bridge strings
   * Bug 31749: Fix security level panel spawning events
   * Bug 31920: Fix Security Level panel when its toolbar button moves to overflow
   * Bug 31748+31961: Fix 'Learn More' links in Security Level preferences and panel
   * Bug 28044: Integrate Tor Launcher into tor-browser
   * Bug 31059: Enable Letterboxing
   * Bug 30468: Add mk locale
   * Bug 30469: Add ro locale
   * Bug 29430: Use obfs4proxy's meek_lite with utls instead of meek
   * Bug 31251: Security Level button UI polish
   * Bug 31344: Register SecurityLevelPreference's 'unload' callback
   * Bug 31286: Provide network settings on about:preferences#tor
   * Bug 31886: Fix ko bundle bustage
   * Bug 31768: Update onboarding for Tor Browser 9
   * Bug 27511: Add new identity button to toolbar
   * Bug 31778: Support dark-theme for the Circuit Display UI
   * Bug 31910: Replace meek_lite with meek in circuit display
   * Bug 30504: Deal with New Identity related browser console errors
   * Bug 31929: Don't escape DTD entity in ar
   * Bug 31747: Some onboarding UI is always shown in English
   * Bug 32041: Replace = with real hamburguer icon ≡
   * Bug 30304: Browser locale can be obtained via DTD strings
   * Bug 31065: Set network.proxy.allow_hijacking_localhost to true
   * Bug 24653: Merge securityLevel.properties into torbutton.dtd
   * Bug 31164: Set up default bridge at Karlstad University
   * Bug 15563: Disable ServiceWorkers on all platforms
   * Bug 31598: Disable warning on window resize if letterboxing is enabled
   * Bug 31562: Fix circuit display for error pages
   * Bug 31575: Firefox is phoning home during start-up
   * Bug 31491: Clean up the old meek http helper browser profiles
   * Bug 26345: Hide tracking protection UI
   * Bug 31601: Disable recommended extensions again
   * Bug 30662: Don't show Firefox Home when opening new tabs
   * Bug 31457: Disable per-installation profiles
   * Bug 28822: Re-implement desktop onboarding for ESR 68
 * Windows
   * Bug 31942: Re-enable signature check for language packs
   * Bug 29013: Enable stack protection for Firefox on Windows
   * Bug 30800: ftp:// on Windows can be used to leak the system time zone
   * Bug 31547: Back out patch for Mozilla's bug 1574980
   * Bug 31141: Fix typo in font.system.whitelist
   * Bug 30319: Remove FTE bits
 * OS X
   * Bug 30126: Make Tor Browser compatible with macOS 10.15
   * Bug 31607: App menu items stop working on macOS
   * Bug 31955: On macOS avoid throwing inside nonBrowserWindowStartup()
   * Bug 29818: Adapt #13379 patch for 68esr
   * Bug 31464: Meek and moat are broken on macOS 10.9 with Go 1.12
 * Linux
   * Bug 31942: Re-enable signature check for language packs
   * Bug 31646: Update abicheck to require newer libstdc++.so.6
   * Bug 31968: Don't fail if /proc/cpuinfo is not readable
   * Bug 24755: Stop using a heredoc in start-tor-browser
   * Bug 31550: Put curly quotes inside single quotes
   * Bug 31394: Replace "-1" with "−1" in start-tor-browser.desktop
   * Bug 30319: Remove FTE bits
 * Android
   * Update Tor to 0.4.1.5
   * Bug 31010: Rebase mobile patches for Fennec 68
   * Bug 31010: Don't use addTrustedTab() on mobile
   * Bug 30607: Support Tor Browser running on Android Q
   * Bug 31192: Support x86_64 target on Android
   * Bug 30380: Cancel dormant by startup
   * Bug 30943: Show version number on mobile
   * Bug 31720: Enable website suggestions in address bar
   * Bug 31822: Security slider is not really visible on Android anymore
   * Bug 24920: Only create Private tabs in permanent Private Browsing Mode
   * Bug 31730: Revert aarch64-workaround against JIT-related crashes
   * Bug 32097: Fix conflicts in mobile onboarding while rebasing to 68.2.0esr
 * Build System
   * All Platforms
     * Bug 30585: Provide standalone clang 8 project across all platforms
     * Bug 30376: Use Rust 1.34 for Tor Browser 9
     * Bug 30490: Add cbindgen project for building Firefox 68 ESR/Fennec 68
     * Bug 30701: Add nodejs project for building Firefox 68 ESR/Fennec 68
       * Bug 31621: Fix node bug that makes large writes to stdout fail
     * Bug 30734: Add nasm project for building Firefox 68 ESR/Fennec 68
     * Bug 31293: Make sure the lo interface inside the containers is up
     * Bug 27493: Clean up mozconfig options
     * Bug 31308: Sync mozconfig files used in tor-browser over to tor-browser-build for esr68
   * Windows
     * Bug 29307: Use Stretch for cross-compiling for Windows
     * Bug 29731: Remove faketime for Windows builds
     * Bug 30322: Windows toolchain update for Firefox 68 ESR
       * Bug 28716: Create mingw-w64-clang toolchain
       * Bug 28238: Adapt firefox and fxc2 projects for Windows builds
       * Bug 28716: Optionally omit timestamp in PE header
       * Bug 31567: NS_tsnprintf() does not handle %s correctly on Windows
       * Bug 31458: Revert patch for #27503 and bump mingw-w64 revision used
     * Bug 9898: Provide clean fix for strcmpi issue in NSPR
     * Bug 29013: Enable stack protection support for Firefox on Windows
     * Bug 30384: Use 64bit containers to build 32bit Windows Tor Browser
     * Bug 31538: Windows bundles based on ESR 68 are not built reproducibly
     * Bug 31584: Clean up mingw-w64 project
     * Bug 31596: Bump mingw-w64 version to pick up fix for #31567
     * Bug 29187: Bump NSIS version to 3.04
     * Bug 31732: Windows nightly builds are busted due to mingw-w64 commit bump
     * Bug 29319: Remove FTE support for Windows
   * OS X
     * Bug 30323: MacOS toolchain update for Firefox 68 ESR
     * Bug 31467: Switch to clang for cctools project
     * Bug 31465: Adapt tor-browser-build projects for macOS notarization
   * Linux
     * Bug 31448: gold and lld break linking 32bit Linux bundles
     * Bug 31618: Linux32 builds of Tor Browser 9.0a6 are not matching
     * Bug 31450: Still use GCC for our ASan builds
     * Bug 30321: Linux toolchain update for Firefox ESR 68
       * Bug 30736: Install yasm from wheezy-backports
       * Bug 31447: Don't install Python just for Mach
     * Bug 30448: Strip Browser/gtk2/libmozgtk.so
   * Android
     * Bug 30324: Android toolchain update for Fennec 68
       * Bug 31173: Update android-toolchain project to match Firefox
       * Bug 31389: Update Android Firefox to build with Clang
       * Bug 31388: Update Rust project for Android
       * Bug 30665: Get Firefox 68 ESR working with latest android toolchain
       * Bug 30460: Update TOPL project to use Firefox 68 toolchain
       * Bug 30461: Update tor-android-service project to use Firefox 68 toolchain
     * Bug 28753: Use Gradle with --offline when building the browser part
     * Bug 31564: Make Android bundles based on ESR 68 reproducible
     * Bug 31981: Remove require-api.patch
     * Bug 31979: TOPL: Sort dependency list
     * Bug 30665: Remove unnecessary build patches for Firefox

Georg Koppen's avatar
Georg Koppen committed
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
Tor Browser 9.0a8 -- October 14 2019
 * All Platforms
   * Bug 13543: Spoof smooth and powerEfficient for Media Capabilities
   * Bug 28196: about:preferences is not properly translated anymore
   * Bug 19417: Disable asmjs on safer and safest security levels
   * Bug 30463: Explicitly disable MOZ_TELEMETRY_REPORTING
   * Bug 31935: Disable profile downgrade protection
   * Bug 31811: Backport fix for bug 1554805
   * Bug 16285: Disable DRM/EME on Android and drop Adobe CDM
   * Bug 31602: Remove Pocket indicators in UI and disable it
   * Bug 31914: Fix eslint linter error
   * Translations update
 * Windows + OS X + Linux
   * Update Tor to 0.4.2.2-alpha
   * Update Tor Launcher to 0.2.19.5
     * Bug 31286: New strings for about:preferences#tor
     * Translations update
   * Bug 31286: Provide network settings on about:preferences#tor
   * Bug 31886: Fix ko bundle bustage
   * Bug 31768: Update onboarding for Tor Browser 9
   * Bug 27511: Add new identity button to toolbar
   * Bug 31778: Support dark-theme for the Circuit Display UI
   * Bug 31910: Replace meek_lite with meek in circuit display
   * Bug 30504: Deal with New Identity related browser console errors
   * Bug 31929: Don't escape DTD entity in ar
   * Bug 31747: Some onboarding UI is always shown in English
   * Bug 32041: Replace = with real hamburguer icon ≡
 * Windows
   * Bug 31942: Re-enable signature check for language packs
   * Bug 29013: Enable stack protection for Firefox on Windows
 * OS X
   * Bug 31607: App menu items stop working on macOS
   * Bug 31955: On macOS avoid throwing inside nonBrowserWindowStartup()
 * Linux
   * Bug 31942: Re-enable signature check for language packs
   * Bug 31968: Don't fail if /proc/cpuinfo is not readable
   * Bug 24755: Stop using a heredoc in start-tor-browser
   * Bug 31550: Put curly quotes inside single quotes
 * Android
   * Bug 31822: Security slider is not really visible on Android anymore
 * Build System
   * All Platforms
     * Bug 31293: Make sure the lo interface inside the containers is up
   * Windows
     * Bug 29013: Enable stack protection support for Firefox on Windows
   * Android
     * Bug 31564: Make Android bundles based on ESR 68 reproducible
     * Bug 31981: Remove require-api.patch
     * Bug 31979: TOPL: Sort dependency list
     * Bug 30665: Remove unnecessary build patches for Firefox

Georg Koppen's avatar
Georg Koppen committed
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
Tor Browser 9.0a7 -- October 1 2019
 * All platforms
   * Bug 30304: Browser locale can be obtained via DTD strings
   * Bug 31065: Set network.proxy.allow_hijacking_localhost to true
   * Bug 24653: Merge securityLevel.properties into torbutton.dtd
   * Bug 31725: Pick up mk in Torbutton properly
   * Bug 31164: Set up default bridge at Karlstad University
   * Bug 15563: Disable ServiceWorkers on all platforms
   * Translations update
 * Windows + OS X + Linux
   * Update Tor to 0.4.2.1-alpha
   * Update OpenSSL to 1.1.1d
     * Bug 31844: OpenSSL 1.1.1d fails to compile for some platforms/architectures
   * Update Tor Launcher to 0.2.19.4
     * Bug 31303: Do not launch tor in browser toolbox
     * Bug 31491: Clean up the old meek http helper browser profiles
     * Translations update
   * Bug 31598: Disable warning on window resize if letterboxing is enabled
   * Bug 31562: Fix circuit display for error pages
   * Bug 31575: Firefox is phoning home during start-up
   * Bug 31491: Clean up the old meek http helper browser profiles
   * Bug 26345: Hide tracking protection UI
   * Bug 31601: Disable recommended extensions again
Georg Koppen's avatar
Georg Koppen committed
445
   * Bug 30662: Don't show Firefox Home when opening new tabs
Georg Koppen's avatar
Georg Koppen committed
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
   * Bug 31457: disable per-installation profiles
   * Bug 28822: Re-implement desktop onboarding for ESR 68
   * Bug 25483: Provide Snowflake based on Pion for Windows, macOS, and Linux
 * Windows
   * Bug 30800: ftp:// on Windows can be used to leak the system time zone
 * OS X
   * Bug 30126: Make Tor Browser on macOS compatible with Apple's notarization
   * Bug 31702: Backport Mozilla's bug 1578075
 * Linux
   * Bug 31646: Update abicheck to require newer libstdc++.so.6
   * Bug 31380: Snowflake does not start on older Linux systems
 * Android
   * Update Tor to 0.4.1.5
   * Bug 31192: Support x86_64 target on Android
   * Bug 30380: Cancel dormant by startup
   * Bug 30943: Show version number on mobile
   * Bug 31720: Enable website suggestions in address bar
 * Build System
   * All platforms
     * Bug 31621: Fix node bug that makes large writes to stdout fail
     * Bug 27493: Clean up mozconfig options
     * Bug 31308: Sync mozconfig files used in tor-browser over to tor-browser-build for esr68
   * Windows
     * Bug 30384: Use 64bit containers to build 32bit Windows Tor Browser
     * Bug 31538: Windows bundles based on ESR 68 are not built reproducibly
     * Bug 31584: Clean up mingw-w64 project
     * Bug 31596: Bump mingw-w64 version to pick up fix for #31567
Georg Koppen's avatar
Georg Koppen committed
473
     * Bug 29187: Bump NSIS version to 3.04
Georg Koppen's avatar
Georg Koppen committed
474
475
476
477
     * Bug 31732: Windows nightly builds are busted due to mingw-w64 commit bump
   * Linux
     * Bug 31448: gold and lld break linking 32bit Linux bundles
     * Bug 31618: linux32 builds of Tor Browser 9.0a6 are not matching
Georg Koppen's avatar
Georg Koppen committed
478
     * Bug 31450: Still use GCC for our ASan builds
Georg Koppen's avatar
Georg Koppen committed
479

Georg Koppen's avatar
Georg Koppen committed
480
481
482
483
484
Tor Browser 8.5.6 -- September 9 2019
 * Android
   * Update Torbutton to 2.1.14
     * Bug 31616: Fix JIT related crashes on aarch64

Georg Koppen's avatar
Georg Koppen committed
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
Tor Browser 9.0a6 -- September 4 2019
 * All platforms
   * Update Firefox to 68.1.0esr
   * Update NoScript to 11.0.3
     * Bug 26847: NoScript pops up a full-site window for XSS warning
     * Bug 31287: NoScript leaks browser locale
   * Bug 30429: Rebase patches for Firefox 68 ESR
   * Bug 10760: Integrate Torbutton into Tor Browser directly
   * Bug 25856: Remove XUL overlays from Torbutton
   * Bug 31322: Fix about:tor assertion failure debug builds
   * Bug 31520: Remove monthly giving banner from Tor Browser
   * Bug 29430: Add support for meek_lite bridges to bridgeParser
   * Bug 28561: Migrate "About Tor Browser" dialog to tor-browser
   * Bug 30683: Prevent detection of locale via some *.properties
   * Bug 31298: Backport patch for #24056
Georg Koppen's avatar
Georg Koppen committed
500
   * Bug 9336: Odd wyswig schemes without isolation for browserspy.dk
Georg Koppen's avatar
Georg Koppen committed
501
502
503
504
505
   * Bug 27601: Browser notifications are not working anymore
   * Bug 30845: Make sure internal extensions are enabled
   * Bug 28896: Enable extensions in private browsing by default
   * Bug 31563: Reload search extensions if extensions.enabledScopes has changed
   * Bug 31396: Fix communication with NoScript for security settings
Georg Koppen's avatar
Georg Koppen committed
506
507
   * Bug 31142: Fix crash of tab and messing with about:newtab
   * Bug 29049: Backport JS Poison Patch
508
   * Bug 25214: Canvas data extraction on local pdf file should be allowed
Georg Koppen's avatar
Georg Koppen committed
509
510
   * Bug 30657: Locale is leaked via title of link tag on non-html page
   * Bug 31015: Disabling SVG hides UI icons in extensions
511
   * Bug 30538: Unable to comment on The Independent Newspaper
Georg Koppen's avatar
Georg Koppen committed
512
513
514
515
516
517
518
519
520
521
522
523
   * Bug 31357: Retire Tom's default obfs4 bridge
 * Windows + OS X + Linux
   * Update Tor to 0.4.1.5
   * Update Tor Launcher to 0.2.19.3
     * Bug 29197: Remove use of overlays
     * Bug 31300: Modify Tor Launcher so it is compatible with ESR68
     * Bug 31487: Modify moat client code so it is compatible with ESR68
     * Bug 31488: Moat: support a comma-separated list of transports
     * Translations update
   * Bug 29430: Use obfs4proxy's meek_lite with utls instead of meek
   * Bug 31251: Security Level button UI polish
   * Bug 31344: Register SecurityLevelPreference's 'unload' callback
Georg Koppen's avatar
Georg Koppen committed
524
   * Bug 12774: Selecting meek in the browser UI is broken
Georg Koppen's avatar
Georg Koppen committed
525
526
527
528
529
530
531
532
   * Build System:
     * Bug 31465: Bump Go to 1.12.9
 * Windows
   * Bug 31547: Back out patch for Mozilla's bug 1574980
   * Bug 31141: Fix typo in font.system.whitelist
   * Backport fix for bug 1572844 to fix broken build
 * OS X
   * Bug 29818: Adapt #13379 patch for 68esr
533
   * Bug 31464: meek and moat are broken on macOS 10.9 with Go 1.12
Georg Koppen's avatar
Georg Koppen committed
534
535
536
537
538
539
   * Bug 31403: Bump snowflake commit to cd650fa009
 * Linux
   * Bug 31403: Bump snowflake commit to cd650fa009
 * Android
   * Bug 31010: Rebase mobile patches for Fennec 68
   * Bug 31010: Don't use addTrustedTab() on mobile
Georg Koppen's avatar
Georg Koppen committed
540
   * Bug 30607: Support Tor Browser running on Android Q
Georg Koppen's avatar
Georg Koppen committed
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
 * Build System:
   * All Platforms:
     * Bug 30585: Provide standalone clang 8 project across all platforms
     * Bug 30376: Use Rust 1.34 for Tor Browser 9
     * Bug 30490: Add cbindgen project for building Firefox 68 ESR/Fennec 68
     * Bug 30701: Add nodejs project for building Firefox 68 ESR/Fennec 68
     * Bug 30734: Add nasm project for building Firefox 68 ESR/Fennec 68
   * Windows
     * Bug 30322: Windows toolchain update for Firefox 68 ESR
       * Bug 28716: Create mingw-w64-clang toolchain
       * Bug 28238: Adapt firefox and fxc2 projects for Windows builds
       * Bug 28716: Optionally omit timestamp in PE header
       * Bug 31567: NS_tsnprintf() does not handle %s correctly on Windows
       * Bug 31458: Revert patch for #27503 and bump mingw-w64 revision used
     * Bug 9898: Provide clean fix for strcmpi issue in NSPR
   * OS X
     * Bug 30323: MacOS toolchain update for Firefox 68 ESR
     * Bug 31467: Switch to clang for cctools project
     * Bug 31465: Adapt tor-browser-build projects for macOS notarization
   * Linux
     * Bug 30321: Linux toolchain update for Firefox ESR 68
       * Bug 30736: Install yasm from wheezy-backports
       * Bug 31447: Don't install Python just for Mach
     * Bug 31394: Replace "-1" with "−1" in start-tor-browser.desktop.
   * Android
     * Bug 30324: Android toolchain update for Fennec 68
       * Bug 31173: Update android-toolchain project to match Firefox
       * Bug 31389: Update Android Firefox to build with Clang
       * Bug 31388: Update Rust project for Android
       * Bug 30665: Get Firefox 68 ESR working with latest android toolchain
       * Bug 30460: Update TOPL project to use Firefox 68 toolchain
       * Bug 30461: Update tor-android-service project to use Firefox 68 toolchain
     * Bug 28753: Use Gradle with --offline when building the browser part

Georg Koppen's avatar
Georg Koppen committed
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
Tor Browser 8.5.5 -- September 3 2019
 * All platforms
   * Update Firefox to 60.9.0esr
   * Update Torbutton to 2.1.13
     * Bug 31520: Remove monthly giving banner from Tor Browser
     * Bug 31140: Do not enable IonMonkey on AARCH64
     * Translations update
   * Update NoScript to 11.0.3
     * Bug 26847: NoScript pops up a full-site window for XSS warning
     * Bug 31287: NoScript leaks browser locale
   * Bug 31357: Retire Tom's default obfs4 bridge
 * Windows + OS X + Linux
   * Update Tor to 0.4.1.5
 * Windows
   * Bug 31547: Back out patch for Mozilla's bug 1574980
   * Bug 27503: Provide full support for accessibility tools
   * Bug 30575: Don't allow enterprise policies in Tor Browser
   * Bug 31141: Fix typo in font.system.whitelist
 * Android
   * Bug 28119: Tor Browser for aarch64
 * Build System
   * All platforms
     * Bug 31465: Bump Go to 1.12.9

Georg Koppen's avatar
Georg Koppen committed
599
600
601
602
Tor Browser 9.0a5 -- July 31 2019
 * Android
   * Bug 31260: Backport bug 1477259 for aarch64 support on Google Play

Georg Koppen's avatar
Georg Koppen committed
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
Tor Browser 9.0a4 -- July 9 2019
 * All platforms
   * Update Firefox to 60.8.0esr
   * Update Torbutton to 2.2.1
     * Bug 30577: Add Fundraising Banner
     * Bug 31041: Stop syncing network.cookie.lifetimePolicy
     * Bug 30468: Add mk locale
     * Translations update
   * Update Tor Launcher to 0.2.19.2
     * Bug 30468: Add mk locale
     * Translations update
   * Update HTTPS Everywhere to 2019.6.27
   * Bug 31055+31058: Remove four default bridges
   * Bug 30849: Backport fixes for Mozilla's bug 1552627 and 1549833
 * Windows + OS X + Linux
   * Update Tor to 0.4.1.3-alpha
   * Bug 30468: Add mk locale
   * Bug 31059: Enable Letterboxing
 * Windows
   * Bug 27503: Provide full support for accessibility tools
   * Bug 30575: Don't allow enterprise policies in Tor Browser
 * OS X
   * Bug 30631: Blurry Tor Browser icon on macOS app switcher
 * Android
   * Bug 28119: Tor Browser for aarch64

Georg Koppen's avatar
Georg Koppen committed
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
Tor Browser 8.5.4 -- July 9 2019
 * All platforms
   * Update Firefox to 60.8.0esr
   * Update Torbutton to 2.1.12
     * Bug 30577: Add Fundraising Banner
     * Bug 31041: Stop syncing network.cookie.lifetimePolicy
     * Translations update
   * Update HTTPS Everywhere to 2019.6.27
   * Bug 31055+31058: Remove four default bridges
   * Bug 30712: Backport fix for Mozilla's bug 1552993
   * Bug 30849: Backport fixes for Mozilla's bug 1552627 and 1549833
 * Windows + OS X + Linux
   * Update Tor to 0.4.0.5
   * Update OpenSSL to 1.0.2s
   * Bug 29045: Ensure that tor does not start up in dormant mode
 * OS X
   * Bug 30631: Blurry Tor Browser icon on macOS app switcher

647
Tor Browser 9.0a3 -- June 24 2019
Georg Koppen's avatar
Georg Koppen committed
648
 * All platforms
649
   * Pick up fixes for Mozilla's bug 1544386 and 1560192
Georg Koppen's avatar
Georg Koppen committed
650
651
652
653
   * Update NoScript to 10.6.3
     * Bug 29904: NoScript blocks MP4 on higher security levels
     * Bug 30624+29043+29647: Prevent XSS protection from freezing the browser

Georg Koppen's avatar
Georg Koppen committed
654
655
656
657
658
659
660
661
662
663
664
Tor Browser 8.5.3 -- June 21 2019
 * All platforms
   * Pick up fix for Mozilla's bug 1560192

Tor Browser 8.5.2 -- June 19 2019
 * All platforms
   * Pick up fix for Mozilla's bug 1544386
   * Update NoScript to 10.6.3
     * Bug 29904: NoScript blocks MP4 on higher security levels
     * Bug 30624+29043+29647: Prevent XSS protection from freezing the browser

Georg Koppen's avatar
Georg Koppen committed
665
Tor Browser 9.0a2 -- June 11 2019
Georg Koppen's avatar
Georg Koppen committed
666
667
668
669
670
671
672
673
674
675
676
677
 * All platforms
   * Update Torbutton to 2.2
     * Bug 30565: Sync nocertdb with privatebrowsing.autostart at startup
     * Bug 30469: Add ro translation
     * Translations update
   * Update NoScript to 10.6.2
     * Bug 29969: Remove workaround for Mozilla's bug 1532530
   * Update HTTPS Everywhere to 2019.5.13
   * Bug 30541: Disable WebGL readPixel() for web content
   * Bug 30712: Backport fix for Mozilla's bug 1552993
   * Bug 30469: Add locale ro
 * Windows + OS X + Linux
Georg Koppen's avatar
Georg Koppen committed
678
   * Update Tor to 0.4.1.2-alpha
Georg Koppen's avatar
Georg Koppen committed
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
   * Update OpenSSL to 1.1.1c
   * Update Tor Launcher to 0.2.19.1
     * Bug 30469: Add locale ro
     * Translations update
   * Bug 30639: Revert IPv6 support test
   * Bug 30560: Better match actual toolbar in onboarding toolbar graphic
   * Bug 30571: Correct more information URL for security settings
 * Linux
   * Bug 30451: Compile go-webrtc with a non executable stack
 * Android
   * Bug 24920: Only create Private tabs in permanent Private Browsing Mode
   * Bug 30635: Sync mobile default bridges list with desktop one
 * Build System
   * All platforms
     * Bug 30480: Check that signed tag contains expected tag name
     * Bug 30536: Update Go to 1.12.5
   * OS X
     * Bug 30491: Move our macOS builds to Debian Stretch
Georg Koppen's avatar
Georg Koppen committed
697
698
   * Linux
     * Bug 25930: Update GCC to 8.3.0 for our Linux builds
Georg Koppen's avatar
Georg Koppen committed
699

Georg Koppen's avatar
Georg Koppen committed
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
Tor Browser 8.5.1 -- June 4 2019
 * All platforms
   * Update Torbutton to 2.1.10
     * Bug 30565: Sync nocertdb with privatebrowsing.autostart at startup
     * Bug 30464: Add WebGL to safer descriptions
     * Translations update
   * Update NoScript to 10.6.2
     * Bug 29969: Remove workaround for Mozilla's bug 1532530
   * Update HTTPS Everywhere to 2019.5.13
   * Bug 30541: Disable WebGL readPixel() for web content
 * Windows + OS X + Linux
   * Bug 30560: Better match actual toolbar in onboarding toolbar graphic
   * Bug 30571: Correct more information URL for security settings
 * Android
   * Bug 30635: Sync mobile default bridges list with desktop one
 * Build System
   * All platforms
     * Bug 30480: Check that signed tag contains expected tag name

Georg Koppen's avatar
Georg Koppen committed
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
Tor Browser 9.0a1 -- May 21 2019
 * All platforms
   * Update Firefox to 60.7.0esr
   * Update Torbutton to 2.1.9
     * Bug 30069: Use slider and about:tor localizations
     * Bug 30115+27449+25145: Map browser + domain -> credentials to fix UI issues
     * Bug 30171: Don't sync cookie.cookieBehavior and firstparty.isolate
     * Bug 30425: Revert armagadd-on-2.0 changes
     * Bug 30497: Add Donate link to about:tor
     * Bug 30464: Add WebGL to safer descriptions
     * Translations update
   * Update HTTPS Everywhere to 2019.5.6.1
   * Bug 24622: Proper first-party isolation of s3.amazonaws.com
   * Bug 30425: Revert armagadd-on-2.0 changes
 * Windows + OS X + Linux
   * Update Tor Launcher to 0.2.19
     * Bug 28044: Integrate Tor Launcher into tor-browser
     * Bug 29627: Moat: add support for obfsproxy's meek_lite
Georg Koppen's avatar
Georg Koppen committed
737
     * Bug 30319: Remove FTE bits
Georg Koppen's avatar
Georg Koppen committed
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
     * Translations update
   * Bug 28044: Integrate Tor Launcher into tor-browser
   * Bug 30372: Backport letterboxing (bug 1538130)
   * Bug 28369: Stop shipping pingsender executable
   * Bug 30457: Remove defunct default bridges
   * Bug 29045: Ensure that tor does not start up in dormant mode
   * Bug 29641: Try to connect over IPv6 if needed
 * Windows
   * Bug 30319: Drop FTE releated bits
   * Bug 29319: Remove FTE support for Windows
 * OS X
   * Bug 30241: Bump snowflake version to d11e55aabe
 * Linux
   * Bug 30319: Drop FTE releated bits
   * Bug 30241: Bump snowflake version to d11e55aabe
 * Android
   * Bug 29982: Force single-pane UI on Tor Preferences
   * Bug 30086: Prevent Sync-related crashes on Android
   * Bug 30214: Kill background thread when Activity is null
   * Bug 30239: Render Fragments after crash
   * Bug 30136: Use 'Tor Browser' as brand name on mobile, too
   * Bug 30069: Use slider and about:tor localizations
   * Bug 30371: Stop hard-coding the content provider name in tor-android-service
   * Bug 30162: Tor Browser bootstrap process got stuck after interrupting it
   * Bug 30166: If specified, only use custom bridges for connecting
   * Bug 30518: Add SocksPort flags for consistency across platforms
   * Bug 30284: Fix broken start-up on KitKat devices
   * Bug 30489: Remove Unused Resources from tor-android-service
 * Build System
   * Windows
     * Bug 29307: Use Stretch for cross-compiling for Windows
     * Bug 29731: Remove faketime for Windows builds
   * Linux
     * Bug 30377: Remove selfrando from our build system
     * Bug 30448: Strip Browser/gtk2/libmozgtk.so
   * Android
     * Bug 29981: Add option to build without using containers
     * Bug 30169: Switch to our tor-android-service repo
     * Bug 30404: Remove Orbot Project
     * Bug 30280: Wrong SHA-256 sum for j2objc-annotations-1.1.jar

Georg Koppen's avatar
Georg Koppen committed
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
Tor Browser 8.5 -- May 21 2019
 * All platforms
   * Update Firefox to 60.7.0esr
   * Update Torbutton to 2.1.8
     * Bug 25013: Integrate Torbutton into tor-browser for Android
     * Bug 27111: Update about:tor desktop version to work on mobile
     * Bug 22538+22513: Fix new circuit button for error pages
     * Bug 25145: Update circuit display when back button is pressed
     * Bug 27749: Opening about:config shows circuit from previous website
     * Bug 30115+27449+25145: Map browser+domain to credentials to fix circuit display
     * Bug 25702: Update Tor Browser icon to follow design guidelines
     * Bug 21805: Add click-to-play button for WebGL
     * Bug 28836: Links on about:tor are not clickable
     * Bug 30171: Don't sync cookie.cookieBehavior and firstparty.isolate
     * Bug 29825: Intelligently add new Security Level button to taskbar
     * Bug 29903: No WebGL click-to-play on the standard security level
     * Bug 27290: Remove WebGL pref for min capability mode
     * Bug 25658: Replace security slider with security level UI
     * Bug 28628: Change onboarding Security panel to open new Security Level panel
     * Bug 29440: Update about:tor when Tor Browser is updated
     * Bug 27478: Improved Torbutton icons for dark theme
     * Bug 29239: Don't ship the Torbutton .xpi on mobile
     * Bug 27484: Improve navigation within onboarding (strings)
     * Bug 29768: Introduce new features to users (strings)
     * Bug 28093: Update donation banner style to make it fit in small screens
     * Bug 28543: about:tor has scroll bar between widths 900px and 1000px
     * Bug 28039: Enable dump() if log method is 0
     * Bug 27701: Don't show App Blocker dialog on Android
     * Bug 28187: Change tor circuit icon to torbutton.svg
     * Bug 29943: Use locales in AB-CD scheme to match Mozilla
     * Bug 26498: Add locale: es-AR
     * Bug 28082: Add locales cs, el, hu, ka
     * Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces
     * Bug 28075: Tone down missing SOCKS credential warning
     * Bug 30425: Revert armagadd-on-2.0 changes
     * Bug 30497: Add Donate link to about:tor
     * Bug 30069: Use slider and about:tor localizations on mobile
     * Bug 21263: Remove outdated information from the README
     * Bug 28747: Remove NoScript (XPCOM) related unused code
     * Translations update
     * Code clean-up
   * Update HTTPS Everywhere to 2019.5.6.1
   * Bug 27290: Remove WebGL pref for min capability mode
   * Bug 29120: Enable media cache in memory
   * Bug 24622: Proper first-party isolation of s3.amazonaws.com
   * Bug 29082: Backport patches for bug 1469916
   * Bug 28711: Backport patches for bug 1474659
   * Bug 27828: "Check for Tor Browser update" doesn't seem to do anything
   * Bug 29028: Auto-decline most canvas warning prompts again
   * Bug 27919: Backport SSL status API
   * Bug 27597: Fix our debug builds
   * Bug 28082: Add locales cs, el, hu, ka
   * Bug 26498: Add locale: es-AR
   * Bug 29916: Make sure enterprise policies are disabled
   * Bug 29349: Remove network.http.spdy.* overrides from meek helper user.js
   * Bug 29327: TypeError: hostName is null on about:tor page
   * Bug 30425: Revert armagadd-on-2.0 changes
 * Windows + OS X + Linux
   * Update OpenSSL to 1.0.2r
   * Update Tor Launcher to 0.2.18.3
     * Bug 27994+25151: Use the new Tor Browser logo
     * Bug 29328: Account for Tor 0.4.0.x's revised bootstrap status reporting
     * Bug 22402: Improve "For assistance" link
     * Bug 27994: Use the new Tor Browser logo
     * Bug 25405: Cannot use Moat if a meek bridge is configured
     * Bug 27392: Update Moat URLs
     * Bug 28082: Add locales cs, el, hu, ka
     * Bug 26498: Add locale es-AR
     * Bug 28039: Enable dump() if log method is 0
     * Translations update
   * Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines
   * Bug 28111: Use Tor Browser icon in identity box
   * Bug 22343: Make 'Save Page As' obey first-party isolation
   * Bug 29768: Introduce new features to users
   * Bug 27484: Improve navigation within onboarding
   * Bug 25658+29554: Replace security slider with security level UI
   * Bug 25405: Cannot use Moat if a meek bridge is configured
   * Bug 28885: Notify users that update is downloading
   * Bug 29180: MAR download stalls when about dialog is opened
   * Bug 27485: Users are not taught how to open security-slider dialog
   * Bug 27486: Avoid about:blank tabs when opening onboarding pages
   * Bug 29440: Update about:tor when Tor Browser is updated
   * Bug 23359: WebExtensions icons are not shown on first start
   * Bug 28628: Change onboarding Security panel to open new Security Level panel
   * Bug 27905: Fix many occurrences of "Firefox" in about:preferences
   * Bug 28369: Stop shipping pingsender executable
   * Bug 30457: Remove defunct default bridges
 * Windows
   * Bug 27503: Improve screen reader accessibility
   * Bug 27865: Tor Browser 8.5a2 is crashing on Windows
   * Bug 22654: Firefox icon is shown for Tor Browser on Windows 10 start menu
   * Bug 28874: Bump mingw-w64 commit to fix WebGL crash
   * Bug 12885: Windows Jump Lists fail for Tor Browser
   * Bug 28618: Set MOZILLA_OFFICIAL for Windows build
   * Bug 21704: Abort install if CPU is missing SSE2 support
 * OS X
   * Bug 27623: Use MOZILLA_OFFICIAL for our builds
 * Linux
   * Bug 28022: Use `/usr/bin/env bash` for bash invocation
   * Bug 27623: Use MOZILLA_OFFICIAL for our builds
 * Android
   * Bug 5709: Ship Tor Browser for Android
 * Build System
   * All platforms
     * Bug 25623: Disable network during build
     * Bug 25876: Generate source tarballs during build
     * Bug 28685: Set Build ID based on Tor Browser version
     * Bug 29194: Set DEBIAN_FRONTEND=noninteractive
     * Bug 29167: Upgrade go to 1.11.5
     * Bug 29158: Install updated apt packages (CVE-2019-3462)
     * Bug 29097: Don't try to install python3.6-lxml for HTTPS Everywhere
     * Bug 27061: Enable verification of langpacks checksums
   * Windows
     * Bug 26148: Update binutils to 2.31.1
     * Bug 27320: Build certutil for Windows
   * OS X
     * Bug 27320: Build certutil for macOS
   * Linux
     * Bug 26323+29812: Build 32bit Linux bundles on 64bit Debian Wheezy
     * Bug 26148: Update binutils to 2.31.1
     * Bug 29758: Build firefox debug symbols for linux-i686
     * Bug 29966: Use archive.debian.org for Wheezy images
     * Bug 29183: Use linux-x86_64 langpacks on linux-x86_64
   * Android
     * Bug 29981: Add option to build without using containers

905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
Tor Browser 8.5a12 -- May 7 2019
 * All platforms
   * Update Torbutton to 2.1.7
     * Bug 30388: Make sure the updated intermediate certificate keeps working
   * Backport fixes for bug 1549010 and bug 1549061
     * Bug 30388: Make sure the updated intermediate certificate keeps working

Tor Browser 8.0.9 -- May 7 2019
* All platforms
  * Update Torbutton to 2.0.13
    * Bug 30388: Make sure the updated intermediate certificate keeps working
  * Backport fixes for bug 1549010 and bug 1549061
    * Bug 30388: Make sure the updated intermediate certificate keeps working
  * Update NoScript to 10.6.1
     * Bug 29872: XSS popup with DuckDuckGo search on about:tor

Georg Koppen's avatar
Georg Koppen committed
921
922
923
924
925
926
927
928
929
930
931
932
Tor Browser 8.5a11 -- April 16 2019
 * All platforms
   * Update Torbutton to 2.1.6
     * Bug 22538+22513: Fix new circuit button for error pages
     * Bug 29825: Intelligently add new Security Level button to taskbar
     * Bug 29903: No WebGL click-to-play on the standard security level
     * Bug 27484: Improve navigation within onboarding (strings)
     * Bug 29768: Introduce new features to users (strings)
     * Bug 29943: Use locales in AB-CD scheme to match Mozilla
     * Bug 26498: Add locale: es-AR
     * Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces
     * Translations update
boklm's avatar
boklm committed
933
   * Update NoScript to 10.6.1
Georg Koppen's avatar
Georg Koppen committed
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
     * Bug 29872: XSS popup with DuckDuckGo search on about:tor
   * Bug 29916: Make sure enterprise policies are disabled
   * Bug 26498: Add locale: es-AR
 * Windows + OS X + Linux
   * Update Tor to 0.4.0.4-rc
   * Update Tor Launcher to 0.2.18.2
     * Bug 26498: Add locale es-AR
     * Translations update
   * Bug 29768: Introduce new features to users
   * Bug 27484: Improve navigation within onboarding
   * Bug 25658: Improve toolbar layout for new security settings
 * Windows
   * Bug 27503: Improve screen reader accessibility
 * Android
   * Bug 27609 (and child bugs): Use Tor Onion Proxy Library
   * Bug 29312: Bump Tor to 0.3.5.8
   * Bug 29859: Disable HLS support for now
   * Bug 28622: Update Tor Browser icon for mobile
   * Bug 29238: Prevent crash on Android after update
   * Bug 29982: Add additional safe guards against crashes during bootstrap
   * Bug 29906: Fix crash on older devices due to missing API
   * Bug 29858: Load onboarding panels after bootstrapping is done
   * Bug 28329: Improve bootstrapping experience
   * Bug 30016: Localize bootstrap-/bridge-related strings for mobile
 * Build System
   * All platforms
     * Bug 29868: Fix installation of python-future package
     * Bug 25623: Disable network during build
   * Linux
     * Bug 29966: Use archive.debian.org for Wheezy images
boklm's avatar
boklm committed
964
   * Android
Georg Koppen's avatar
Georg Koppen committed
965
966
     * Bug 30089: Use apksigner instead of jarsigner

Georg Koppen's avatar
Georg Koppen committed
967
968
969
970
971
972
Tor Browser 8.5a10 -- March 24 2019
 * All platforms
   * Update Firefox to 60.6.1esr
   * Update NoScript to 10.2.4
     * Bug 29733: Work around Mozilla's bug 1532530

973
974
975
976
977
978
Tor Browser 8.0.8 -- March 22 2019
 * All platforms
   * Update Firefox to 60.6.1esr
   * Update NoScript to 10.2.4
     * Bug 29733: Work around Mozilla's bug 1532530

979
Tor Browser 8.5a9 -- March 20 2019
Georg Koppen's avatar
Georg Koppen committed
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
 * All platforms
   * Update Firefox to 60.6.0esr
   * Update Torbutton to 2.1.5
     * Bug 25658: Replace security slider with security level UI
     * Bug 28628: Change onboarding Security panel to open new Security Level panel
     * Bug 29440: Update about:tor when Tor Browser is updated
     * Bug 27478: Improved Torbutton icons for dark theme
     * Bug 29021: Tell NoScript it is running within Tor Browser
     * Bug 29239: Don't ship the Torbutton .xpi on mobile
     * Translations update
   * Bug 29120: Enable media cache in memory
   * Bug 29445: Enable support for enterprise policies
 * Windows + OS X + Linux
   * Update Tor to 0.4.0.2-alpha
     * Bug 29660: XMPP can not connect to SOCKS5 anymore
   * Update OpenSSL to 1.0.2r
   * Update Tor Launcher to 0.2.18.1
     * Bug 29328: Account for Tor 0.4.0.x's revised bootstrap status reporting
     * Bug 22402: Improve "For assistance" link
     * Translations update
   * Bug 25658+29554: Replace security slider with security level UI
   * Bug 28885: notify users that update is downloading
   * Bug 29180: MAR download stalls when about dialog is opened
   * Bug 27485: Users are not taught how to open security-slider dialog
   * Bug 27486: Avoid about:blank tabs when opening onboarding pages
   * Bug 29440: Update about:tor when Tor Browser is updated
   * Bug 23359: WebExtensions icons are not shown on first start
   * Bug 28628: Change onboarding Security panel to open new Security Level panel
 * Android
   * Bug 28329: Design Tor Browser for Android configuration UI
   * Bug 28802: Support PTs in Tor Browser for Android
   * Bug 29794: Update TBA built-in bridges
   * Bug 27210: Add support for x86 on Android
1013
   * Bug 29809: Only ship tor binary for .apk architecture
Georg Koppen's avatar
Georg Koppen committed
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
   * Bug 29633: Don't ship pdnsd anymore
   * Bug 28708: about:tor is not the default homepage after upgrade
   * Bug 29626: Application name is now "Always-On Notifications"
   * Bug 29467: Backport fix for arc4random_buf bustage
 * Build System
   * All platforms
     * Bug 25876: Generate source tarballs during build
     * Bug 28685: Set Build ID based on Tor Browser version
     * Bug 29194: Set DEBIAN_FRONTEND=noninteractive
   * Linux
1024
     * Bug 26323+29812: Build 32bit Linux bundles on 64bit Debian Wheezy
Georg Koppen's avatar
Georg Koppen committed
1025
1026
1027
1028
     * Bug 29758: Build firefox debug symbols for linux-i686
   * Android
     * Bug 29632: Use HTTPS for downloading Gradle

1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
Tor Browser 8.0.7 -- March 19 2019
 * All platforms
   * Update Firefox to 60.6.0esr
   * Update Tor to 0.3.5.8
     * Bug 29660: XMPP can not connect to SOCKS5 anymore
   * Update Torbutton to 2.0.11
     * Bug 29021: Tell NoScript it is running within Tor Browser
 * Windows
   * Bug 29081: Harden libwinpthread
 * Linux
   * Bug 27531: Add separate LD_LIBRARY_PATH for fteproxy

Georg Koppen's avatar
Georg Koppen committed
1041
1042
1043
1044
1045
1046
Tor Browser 8.5a8 -- February 13 2019
 * All platforms
   * Update Firefox to 60.5.1esr
   * Update HTTPS Everywhere to 2019.1.31
   * Bug 29378: Remove 83.212.101.3 from default bridges
   * Bug 29349: Remove network.http.spdy.* overrides from meek helper user.js
Georg Koppen's avatar
Georg Koppen committed
1047
   * Bug 29327: TypeError: hostName is null on about:tor page
Georg Koppen's avatar
Georg Koppen committed
1048
1049
1050
1051
1052
1053
1054
 * Build System
   * All Platforms
     * Bug 29235: Build our own version of python3.6 for HTTPS Everywhere
     * Bug 29167: Upgrade go to 1.11.5
   * Linux
     * Bug 29183: Use linux-x86_64 langpacks on linux-x86_64

Georg Koppen's avatar
Georg Koppen committed
1055
1056
1057
1058
1059
1060
1061
1062
1063
Tor Browser 8.0.6 -- February 12 2019
 * All platforms
   * Update Firefox to 60.5.1esr
   * Update HTTPS Everywhere to 2019.1.31
   * Bug 29378: Remove 83.212.101.3 from default bridges
 * Build System
   * All Platforms
     * Bug 29235: Build our own version of python3.6 for HTTPS Everywhere

Georg Koppen's avatar
Georg Koppen committed
1064
Tor Browser 8.5a7 -- January 29 2019
Georg Koppen's avatar
Georg Koppen committed
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
 * All Platforms
   * Update Firefox to 60.5.0esr
   * Update Torbutton to 2.1.4
     * Bug 25702: Update Tor Browser icon to follow design guidelines
     * Bug 21805: Add click-to-play button for WebGL
     * Bug 28836: Links on about:tor are not clickable
     * Bug 29035: Clean up our donation campaign and add newsletter sign-up link
     * Translations update
     * Code clean-up
   * Update HTTPS Everywhere to 2019.1.7
   * Update NoScript to 10.2.1
     * Bug 28873: Cascading of permissions is broken
     * Bug 28720: Some videos are blocked outright on higher security levels
   * Bug 29082: Backport patches for bug 1469916
   * Bug 28711: Backport patches for bug 1474659
   * Bug 27828: "Check for Tor Browser update" doesn't seem to do anything
   * Bug 29028: Auto-decline most canvas warning prompts again
   * Bug 27597: Fix our debug builds
 * Windows
   * Update Tor to 0.4.0.1-alpha
   * Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines
   * Bug 28111: Use Tor Browser icon in identity box
   * Bug 22654: Firefox icon is shown for Tor Browser on Windows 10 start menu
   * Bug 27503: Compile with accessibility support
   * Bug 28874: Bump mingw-w64 commit to fix WebGL crash
   * Bug 12885: Windows Jump Lists fail for Tor Browser
   * Bug 28618: Set MOZILLA_OFFICIAL for Windows build
 * OS X
   * Update Tor to 0.4.0.1-alpha
   * Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines
   * Bug 28111: Use Tor Browser icon in identity box
 * Linux
   * Update Tor to 0.4.0.1-alpha
   * Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines
   * Bug 28111: Use Tor Browser icon in identity box
   * Bug 27531: Fix crashing print dialog
 * Android
   * Bug 28705: Fix download crash on newer Android devices
   * Bug 28814: Backport 1480079 to allow installing downloaded apps
 * Build System
   * All Platforms
     * Bug 29158: Install updated apt packages (CVE-2019-3462)
     * Bug 29097: Don't try to install python3.6-lxml for HTTPS Everywhere
   * Windows
     * Bug 26148: Update binutils to 2.31.1
     * Bug 29081: Harden libwinpthread
   * Linux
     * Bug 26148: Update binutils to 2.31.1
   * Android
     * Bug 28752: Don't download tor-android-binary resources during build

Georg Koppen's avatar
Georg Koppen committed
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
Tor Browser 8.0.5 -- January 29 2019
 * All platforms
   * Update Firefox to 60.5.0esr
   * Update Tor to 0.3.5.7
   * Update Torbutton to 2.0.10
     * Bug 29035: Clean up our donation campaign and add newsletter sign-up link
     * Bug 27175: Add pref to allow users to persist custom noscript settings
   * Update HTTPS Everywhere to 2019.1.7
   * Update NoScript to 10.2.1
     * Bug 28873: Cascading of permissions is broken
     * Bug 28720: Some videos are blocked outright on higher security levels
   * Bug 26540: Enabling pdfjs disableRange option prevents pdfs from loading
   * Bug 28740: Adapt Windows navigator.platform value on 64-bit systems
   * Bug 28695: Set default security.pki.name_matching_mode to enforce (3)

Georg Koppen's avatar
Georg Koppen committed
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
Tor Browser 8.5a6 -- December 11 2018
 * All Platforms
   * Update Firefox to 60.4.0esr
   * Update Torbutton to 2.1.3
     * Bug 28540: Use new text for 2018 donation banner
     * Bug 27290: Remove WebGL pref for min capability mode
     * Bug 28075: Tone down missing SOCKS credential warning
     * Bug 28747: Remove NoScript (XPCOM) related unused code
     * Translations update
   * Bug 28608: Disable background HTTP response throttling
   * Bug 28695: Set default security.pki.name_matching_mode to enforce (3)
   * Bug 27290: Remove WebGL pref for min capability mode
   * Bug 27919: Backport SSL status API
Georg Koppen's avatar
Georg Koppen committed
1144
   * Bug 25794: Disable pointer events
Georg Koppen's avatar
Georg Koppen committed
1145
 * Windows
Georg Koppen's avatar
Georg Koppen committed
1146
   * Update OpenSSL to 1.0.2q
Georg Koppen's avatar
Georg Koppen committed
1147
   * Bug 28740: Adapt Windows navigator.platform value on 64-bit systems
Georg Koppen's avatar
Georg Koppen committed
1148
1149
1150
1151
 * OS X
   * Update OpenSSL to 1.0.2q
 * Linux
   * Update OpenSSL to 1.0.2q
Georg Koppen's avatar
Georg Koppen committed
1152
1153
1154
1155
1156
1157
1158
1159
 * Android
   * Bug 26843: Multi-locale support for Tor Browser on Android
 * Build System
   * Android
     * Bug 25164: Add .apk to our sha256sums unsigned build file
     * Bug 28696: Make path to Gradle dependencies reproducible
     * Bug 28697: Use pregenerated keystore and fix timestamp issues

Georg Koppen's avatar
Georg Koppen committed
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
Tor Browser 8.0.4 -- December 11 2018
 * All platforms
   * Update Firefox to 60.4.0esr
   * Update Tor to 0.3.4.9
   * Update OpenSSL to 1.0.2q
   * Update Torbutton to 2.0.9
     * Bug 28540: Use new text for 2018 donation banner
     * Bug 28515: Use en-US for english Torbutton strings
     * Translations update
   * Update HTTPS Everywhere to 2018.10.31
   * Update NoScript to 10.2.0
 * Bug 1623: Block protocol handler enumeration (backport of fix for #680300)
 * Bug 25794: Disable pointer events
 * Bug 28608: Disable background HTTP response throttling
 * Bug 28185: Add smallerRichard to Tor Browser
 * Windows
   * Bug 26381: about:tor page does not load on first start on Windows
   * Bug 28657: Remove broken FTE bridge from Tor Browser
 * OS X
   * Bug 26263: App icon positioned incorrectly in macOS DMG installer window
   * Bug 26475: Fix Stylo related reproducibility issue
 * Linux
   * Bug 26475: Fix Stylo related reproducibility issue
   * Bug 28657: Remove broken FTE bridge from Tor Browser
 * Build System
   * All Platforms
     * Bug 27218: Generate multiple Tor Browser bundles in parallel

Georg Koppen's avatar
Georg Koppen committed
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
Tor Browser 8.5a5 -- December 3 2018
 * All Platforms
   * Update Torbutton to 2.1.2
     * Bug 25013: Integrate Torbutton into tor-browser for Android
     * Bug 27111: Update about:tor desktop version to work on mobile
     * Bug 28093: Update donation banner style to make it fit in small screens
     * Bug 28543: about:tor has scroll bar between widths 900px and 1000px
     * Bug 28039: Enable dump() if log method is 0
     * Bug 27701: Don't show App Blocker dialog on Android
     * Bug 28187: Change tor circuit icon to torbutton.svg
     * Bug 28515: Use en-US for english Torbutton strings
     * Translations update
   * Update Tor Launcher to 0.2.18
     * Bug 28039: Enable dump() if log method is 0
     * Translations update
   * Update HTTPS Everywhere to 2018.10.31
   * Update NoScript to 10.2.0
   * Bug 22343: Make 'Save Page As' obey first-party isolation
   * Bug 26540: Enabling pdfjs disableRange option prevents pdfs from loading
 * Windows
   * Update Tor to 0.3.5.5-alpha
   * Bug 28310: Don't build obfs4 with module versioning support
   * Bug 27827: Update Go to 1.11.1
   * Bug 28185: Add smallerRichard to Tor Browser
   * Bug 28657: Remove broken FTE bridge from Tor Browser
 * OS X
   * Update Tor to 0.3.5.5-alpha
   * Bug 28310: Don't build obfs4 with module versioning support
   * Bug 27827: Update Go to 1.11.1
   * Bug 27827: Build snowflake reproducibly
   * Bug 28258: Don't look for webrtc headers under talk/
   * Bug 28185: Add smallerRichard to Tor Browser
 * Linux
   * Update Tor to 0.3.5.5-alpha
   * Bug 28310: Don't build obfs4 with module versioning support
   * Bug 27827: Update Go to 1.11.1
   * Bug 27827: Build snowflake reproducibly
   * Bug 28258: Don't look for webrtc headers under talk/
   * Bug 28185: Add smallerRichard to Tor Browser
   * Bug 28657: Remove broken FTE bridge from Tor Browser
 * Android
   * Bug 28051: Fix up Orbot for inclusion into Tor Browser
Georg Koppen's avatar
Georg Koppen committed
1230
   * Bug 26690+25765: Port padlock states for .onion services to mobile
Georg Koppen's avatar
Georg Koppen committed
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
   * Bug 28507: Delete private data in the browser startup
   * Bug 27111+25013: Configure Tor Browser for mobile to load about:tor
   * Bug 27256: Enable TouchEvents on Android
   * Bug 28640: Use system add-on and distributed preferences
 * Build System
   * Bug 27977: Build Orbot inside tor-browser-build
   * Bug 27443: Update Firefox RBM config and build for Android
   * Bug 27439: Add android target for rust compiler
   * Bug 28469: Fix unsupported libbacktrace in Rust 1.26
   * Bug 28468: Modify Android toolchain to support Orbot
   * Bug 28483: Modify Android Toolchain API Version
   * Bug 28472: Add Android Makefile Rules
   * Bug 28470: Add fetch gradle dependency script to common project
   * Bug 28144: Update projects/tor-browser for Android

Georg Koppen's avatar
Georg Koppen committed
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
Tor Browser 8.5a4 -- October 23 2018
 * All Platforms
   * Update Firefox to 60.3.0esr
   * Update Tor to 0.3.5.3-alpha
   * Update Torbutton to 2.1.1
     * Bug 23925+27959: Donation banner for year end 2018 campaign
     * Bug 24172: Donation banner clobbers Tor Browser version string
     * Bug 28082: Add locales cs, el, hu, ka
     * Translations update
   * Update Tor Launcher to 0.2.17
     * Bug 27994+25151: Use the new Tor Browser logo
     * Bug 28082: Add locales cs, el, hu, ka
     * Translations update
   * Update HTTPS Everywhere to 2018.9.19
   * Update NoScript to 10.1.9.9
   * Bug 1623: Block protocol handler enumeration (backport of fix for #680300)
   * Bug 27905: Fix many occurrences of "Firefox" in about:preferences
   * Bug 28082: Add locales cs, el, hu, ka
 * Windows
   * Bug 21704: Abort install if CPU is missing SSE2 support
   * Bug 28002: Fix the precomplete file in the en-US installer
 * OS X
   * Bug 26263: App icon positioned incorrectly in macOS DMG installer window
Georg Koppen's avatar
Georg Koppen committed
1269
   * Bug 26475: Fix Stylo related reproducibility issue
Georg Koppen's avatar
Georg Koppen committed
1270
 * Linux
Georg Koppen's avatar
Georg Koppen committed
1271
   * Bug 26475: Fix Stylo related reproducibility issue
Georg Koppen's avatar
Georg Koppen committed
1272
1273
1274
1275
1276
   * Bug 28022: Use `/usr/bin/env bash` for bash invocation
 * Android
   * Backport of fixes for bug 1448014, 1458905, 1441345, and 1448305
 * Build System
   * All Platforms
Georg Koppen's avatar
Georg Koppen committed
1277
     * Bug 27218: Generate multiple Tor Browser bundles in parallel
Georg Koppen's avatar
Georg Koppen committed
1278
1279
1280
1281
1282
   * Windows
     * Bug 27320: Build certutil for Windows
   * OS X
     * Bug 27320: Build certutil for macOS

Georg Koppen's avatar
Georg Koppen committed
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
Tor Browser 8.0.3 -- October 23 2018
 * All platforms
   * Update Firefox to 60.3.0esr
   * Update Torbutton to 2.0.8
     * Bug 23925+27959: Donation banner for year end 2018 campaign
     * Bug 24172: Donation banner clobbers Tor Browser version string
     * Bug 27760: Use new NoScript API for IPC and fix about:blank issue
     * Translations update
   * Update HTTPS Everywhere to 2018.9.19
   * Update NoScript to 10.1.9.9
 * Linux
   * Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3
   * Bug 27552: Use bundled dir on CentOS/RHEL 6

Georg Koppen's avatar
Georg Koppen committed
1297
1298
1299
1300
1301
1302
1303
1304
1305
Tor Browser 8.5a3 -- October 4 2018
 * All platforms
   * Update Firefox to 60.2.1esr
   * Backport fix for Mozilla bug 1493900 and 1493903
 * Windows
   * Bug 27865: Tor Browser 8.5a2 is crashing on Windows
 * OS X
   * Backport fix for Mozilla bug 1489785 for macOS 10.14 compatibility

Georg Koppen's avatar
Georg Koppen committed
1306
1307
1308
1309
1310
1311
1312
Tor Browser 8.0.2 -- October 2 2018
 * All platforms
   * Update Firefox to 60.2.1esr
   * Backport fix for Mozilla bug 1493900 and 1493903
 * OS X
   * Backport fix for Mozilla bug 1489785 for macOS 10.14 compatibility

1313
Tor Browser 8.5a2 -- September 24 2018
Georg Koppen's avatar
Georg Koppen committed
1314
 * All platforms
Georg Koppen's avatar
Georg Koppen committed
1315
   * Update Tor to 0.3.5.2-alpha
Georg Koppen's avatar
Georg Koppen committed
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
   * Update Torbutton to 2.1
     * Bug 27097: Tor News signup banner
     * Bug 27663: Add New Identity menuitem again
     * Bug 27175: Add pref to allow users to persist custom noscript settings
     * Bug 27760: Use new NoScript API for IPC and fix about:blank issue
     * Bug 26624: Only block OBJECT on highest slider level
     * Bug 26555: Don't show IP address for meek or snowflake
     * Bug 27478: Torbutton icons for dark theme
     * Bug 27506+14520: Move status version to upper left corner for RTL locales
     * Bug 27558: Update the link to "Your Guard note may not change" text
     * Bug 21263: Remove outdated information from the README
     * Translations update
   * Update Tor Launcher to 0.2.16.5
     * Bug 27469: Adapt Moat URLs
     * Translations update
     * Clean-up
   * Update NoScript to 10.1.9.6
   * Bug 27763: Restrict Torbutton signing exemption to mobile
   * Bug 26146: Spoof HTTP User-Agent header for desktop platforms
   * Bug 27543: QR code is broken on web.whatsapp.com
   * Bug 27264: Bookmark items are not visible on the boomark toolbar
   * Bug 27535: Enable TLS 1.3 draft version
   * Bug 27623: Use MOZILLA_OFFICIAL for our builds
1339
   * Backport of Mozilla bug 1490585, 1475775, and 1489744
Georg Koppen's avatar
Georg Koppen committed
1340
1341
1342
1343
1344
1345
1346
 * Windows:
   * Bug 26381: about:tor page does not load on first start on Windows
 * Linux:
   * Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3
   * Bug 27552: Use bundled dir on CentOS/RHEL 6
   * Bug 26556: Fix broken Tor Browser icon path on Linux

Georg Koppen's avatar
Georg Koppen committed
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
Tor Browser 8.0.1 -- September 24 2018
 * All platforms
   * Update Tor to 0.3.4.8
   * Update Torbutton to 2.0.7
     * Bug 27097: Tor News signup banner
     * Bug 27663: Add New Identity menuitem again
     * Bug 26624: Only block OBJECT on highest slider level
     * Bug 26555: Don't show IP address for meek or snowflake
     * Bug 27478: Torbutton icons for dark theme
     * Bug 27506+14520: Move status version to upper left corner for RTL locales
     * Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages
     * Bug 27558: Update the link to "Your Guard note may not change" text
     * Translations update
   * Update Tor Launcher to 0.2.16.6
     * Bug 27469: Adapt Moat URLs
     * Translations update
     * Clean-up
   * Update NoScript to 10.1.9.6
   * Bug 27763: Restrict Torbutton signing exemption to mobile
   * Bug 26146: Spoof HTTP User-Agent header for desktop platforms
   * Bug 27543: QR code is broken on web.whatsapp.com
   * Bug 27264: Bookmark items are not visible on the boomark toolbar
   * Bug 27535: Enable TLS 1.3 draft version
   * Backport of Mozilla bug 1490585, 1475775, and 1489744
 * OS X
   * Bug 27482: Fix crash during start-up on macOS 10.9.x systems
 * Linux
   * Bug 26556: Fix broken Tor Browser icon path on Linux

1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
Tor Browser 8.5a1 -- September 5 2018
 * All platforms
   * Update Firefox to 60.2.0esr
   * Update Tor to 0.3.4.7-rc
   * Update OpenSSL to 1.0.2p
   * Update Torbutton to 2.0.6
     * Bug 27401: Start listening for NoScript before it loads
     * Bug 27276: Adapt to new NoScript messaging protocol
     * Bug 26884: Use Torbutton to provide security slider on mobile
     * Bug 26962: Circuit display onboarding
     * Bug 26520: Fix sec slider/NoScript for TOR_SKIP_LAUNCH=1
     * Bug 26490: Remove the security slider notification
     * Bug 27301: Improve about:tor behavior and appearance
     * Bug 27097: Add text for Tor News signup widget
     * Bug 27214: Improve the onboarding text
     * Translations update
   * Update Tor Launcher to 0.2.16.4
     * Bug 25405: Cannot use Moat if a meek bridge is configured
     * Bug 27392: Update Moat URLs
     * Translations update
   * Update HTTPS Everywhere to 2018.8.22
   * Update NoScript to 10.1.9.1
   * Bug 26962: New feature onboarding
   * Bug 27403: The onboarding bubble is not always displayed
   * Bug 27283: Fix first-party isolation for UI tour
   * Bug 27213: Update about:tbupdate to new (about:tor) layout
   * Bug 26670: Make canvas permission prompt respect first-party isolation
   * Bug 26561: .onion images are not displayed
   * Bug 21787: Spoof en-US for date picker
   * Bug 21607: Disable WebVR for now until it is properly audited
   * Bug 21549: Disable wasm for now until it is properly audited
   * Bug 26614: Disable Web Authentication API until it is properly audited
   * Bug 27281: Enable Reader View mode again
   * Bug 26114: Don't expose navigator.mozAddonManager to websites
   * Bug 26048: Fix potentially confusing "restart to update" message
   * Bug 27221: Purge startup cache if Tor Browser version changed
   * Bug 26049: Reduce delay for showing update prompt to 1 hour
   * Bug 25405: Cannot use Moat if a meek bridge is configured
Georg Koppen's avatar
Georg Koppen committed
1414
   * Bug 27268+27257+27262+26603: Preferences clean-up
1415
1416
1417
1418
1419
1420
1421
1422
 * Windows
   * Bug 26381: Work around endless loop during page load and about:tor not loading
   * Bug 27411: Fix broken security slider and NoScript interaction on Windows
 * Build System
   * All Platforms
     * Bug 27061: Enable verification of langpacks checksums
     * Bug 27178+27179: Add support for xz compression in mar files

Georg Koppen's avatar
Georg Koppen committed
1423
1424
1425
1426
1427
1428
Tor Browser 8.0 -- September 5 2018
 * All platforms
   * Update Firefox to 60.2.0esr
   * Update Tor to 0.3.3.9
   * Update OpenSSL to 1.0.2p
   * Update Libevent to 2.1.8
1429
   * Update Torbutton to 2.0.6
Georg Koppen's avatar
Georg Koppen committed
1430
1431
1432
1433
1434
1435
1436
1437
     * Bug 26960: Implement new about:tor start page
     * Bug 26961: Implement new user onboarding
     * Bug 26962: Circuit display onboarding
     * Bug 27301: Improve about:tor behavior and appearance
     * Bug 27214: Improve the onboarding text
     * Bug 26321: Move 'New Identity', 'New Circuit' to File, hamburger menus
     * Bug 26100: Adapt Torbutton to Firefox 60 ESR
     * Bug 26520: Fix sec slider/NoScript for TOR_SKIP_LAUNCH=1
1438
     * Bug 27401: Start listening for NoScript before it loads
Georg Koppen's avatar
Georg Koppen committed
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
     * Bug 26430: New Torbutton icon
     * Bug 24309: Move circuit display to the identity popup
     * Bug 26884: Use Torbutton to provide security slider on mobile
     * Bug 26128: Adapt security slider to the WebExtensions version of NoScript
     * Bug 27276: Adapt to new NoScript messaging protocol
     * Bug 23247: Show security state of .onions
     * Bug 26129: Show our about:tor page on startup
     * Bug 26235: Hide new unusable items from help menu
     * Bug 26058: Remove workaround for hiding 'sign in to sync' button
     * Bug 26590: Use new svg.disabled pref in security slider
     * Bug 26655: Adjust color and size of onion button
     * Bug 26500: Reposition circuit display relay icon for RTL locales
     * Bug 26409: Remove spoofed locale implementation
     * Bug 26189: Remove content-policy.js
       * Bug 26544: Images are not centered anymore
     * Bug 26490: Remove the security slider notification
     * Bug 25126: Make about:tor layout responsive
     * Bug 27097: Add text for Tor News signup widget
     * Bug 21245: Add da translation to Torbutton and keep track of it
     * Bug 27129+20628: Add locales ca, ga, id, is, nb, da, he, sv, and zh-TW
     * Translations update
  * Update Tor Launcher to 0.2.16.3
     * Bug 23136: Moat integration (fetch bridges for the user)
     * Bug 25750: Update Tor Launcher to make it compatible with Firefox 60 ESR
     * Bug 26985: Help button icons missing
     * Bug 25509: Improve the proxy help text
     * Bug 26466: Remove sv-SE from tracking for releases
     * Bug 27129+20628: Add locales ca, ga, id, is, nb, da, he, sv, and zh-TW
     * Translations update
   * Update HTTPS Everywhere to 2018.8.22
   * Update NoScript to 10.1.9.1
   * Update meek to 0.31
     * Bug 26477: Make meek extension compatible with ESR 60
   * Update obfs4proxy to v0.0.7 (bug 25356)
   * Bug 27082: Enable a limited UITour for user onboarding
   * Bug 26961: New user onboarding
   * Bug 26962: New feature onboarding
1476
   * Bug 27403: The onboarding bubble is not always displayed
Georg Koppen's avatar
Georg Koppen committed
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
   * Bug 27283: Fix first-party isolation for UI tour
   * Bug 27213: Update about:tbupdate to new (about:tor) layout
   * Bug 14952+24553: Enable HTTP2 and AltSvc
     * Bug 25735: Tor Browser stalls while loading Facebook login page
   * Bug 17252: Enable TLS session identifiers with first-party isolation
   * Bug 26353: Prevent speculative connects that violate first-party isolation
   * Bug 26670: Make canvas permission prompt respect first-party isolation
   * Bug 24056: Use en-US strings in HTML forms if locale is spoofed to english
   * Bug 26456: HTTP .onion sites inherit previous page's certificate information
   * Bug 26561: .onion images are not displayed
   * Bug 26321: Move 'New Identity', 'New Circuit' to File, hamburger menus
   * Bug 26833: Backport Mozilla's bug 1473247
   * Bug 26628: Backport Mozilla's bug 1470156
   * Bug 26237: Clean up toolbar for ESR60-based Tor Browser
   * Bug 26519: Avoid Firefox icons in ESR60
   * Bug 26039: Load our preferences that modify extensions (fixup)
   * Bug 26515: Update Tor Browser blog post URLs
   * Bug 26216: Fix broken MAR file generation
   * Bug 26409: Remove spoofed locale implementation
   * Bug 25543: Rebase Tor Browser patches for ESR60
   * Bug 23247: Show security state of .onions
   * Bug 26039: Load our preferences that modify extensions
   * Bug 17965: Isolate HPKP and HSTS to URL bar domain
   * Bug 21787: Spoof en-US for date picker
   * Bug 21607: Disable WebVR for now until it is properly audited
   * Bug 21549: Disable wasm for now until it is properly audited
   * Bug 26614: Disable Web Authentication API until it is properly audited
   * Bug 27281: Enable Reader View mode again
   * Bug 26114: Don't expose navigator.mozAddonManager to websites
   * Bug 21850: Update about:tbupdate handling for e10s
   * Bug 26048: Fix potentially confusing "restart to update" message
   * Bug 27221: Purge startup cache if Tor Browser version changed
   * Bug 26049: Reduce delay for showing update prompt to 1 hour
   * Bug 26365: Add potential AltSvc support
   * Bug 9145: Fix broken hardware acceleration on Windows and enable it
   * Bug 26045: Add new MAR signing keys
   * Bug 25215: Revert bug 18619 (we are not disabling IndexedDB any longer)
   * Bug 19910: Rip out optimistic data socks handshake variant (#3875)
   * Bug 22564: Hide Firefox Sync
   * Bug 25090: Disable updater telemetry
   * Bug 26127: Make sure Torbutton and Tor Launcher are not treated as legacy extensions
   * Bug 13575: Disable randomised Firefox HTTP cache decay user tests
   * Bug 22548: Firefox downgrades VP9 videos to VP8 for some users
   * Bug 24995: Include git hash in tor --version
   * Bug 27268+27257+27262+26603 : Preferences clean-up
   * Bug 26073: Migrate general.useragent.locale to intl.locale.requested
   * Bug 27129+20628: Make Tor Browser available in ca, ga, id, is, nb, da, he, sv, and zh-TW
     * Bug 12927: Include Hebrew translation into Tor Browser
     * Bug 21245: Add danish (da) translation
 * Windows
   * Bug 20636+10026: Create 64bit Tor Browser for Windows
     * Bug 26239+24197: Enable content sandboxing for 64bit Windows builds
     * Bug 26514: Fix intermittent updater failures on Win64 (Error 19)
     * Bug 26874: Fix UNC path restrictions failure in Tor Browser 8.0a9
     * Bug 12968: Enable HEASLR in Windows x86_64 builds
   * Bug 26381: Work around endless loop during page load and about:tor not loading
1533
   * Bug 27411: Fix broken security slider and NoScript interaction on Windows
Georg Koppen's avatar
Georg Koppen committed
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
   * Bug 22581: Fix shutdown crash
   * Bug 25266: PT config should include full names of executable files
   * Bug 26304: Update zlib to version 1.2.11
   * Update tbb-windows-installer to 0.4
     * Bug 26355: Update tbb-windows-installer to check for Windows7+
   * Bug 26355: Require Windows7+ for updates to Tor Browser 8
 * OS X
   * Bug 24136: After loading file:// URLs clicking on links is broken on OS X
   * Bug 24243: Tor Browser only renders HTML for local pages via file://
   * Bug 24263: Tor Browser does not run extension scripts if loaded via about:debugging
   * Bug 22794: Don't open AF_INET/AF_INET6 sockets when AF_LOCAL is configured
 * Linux
   * Bug 22794: Don't open AF_INET/AF_INET6 sockets when AF_LOCAL is configured
   * Bug 25485: Unbreak Tor Browser on systems with newer libstdc++
   * Bug 20866: Fix OpenGL software rendering on systems with newer libstdc++
   * Bug 26951+18022: Fix execdesktop argument passing
   * Bug 24136: After loading file:// URLs clicking on links is broken on Linux
   * Bug 24243: Tor Browser only renders HTML for local pages via file://
   * Bug 24263: Tor Browser does not run extension scripts if loaded via about:debugging
   * Bug 20283: Tor Browser should run without a `/proc` filesystem.
   * Bug 26354: Set SSE2 support as minimal requirement for Tor Browser 8
 * Build System
1556
   * All Platforms
Georg Koppen's avatar
Georg Koppen committed
1557
1558
1559
1560
1561
     * Bug 26362+26410: Use old MAR format for first ESR60-based stable
     * Bug 27020: RBM build fails with runc version 1.0.1
     * Bug 26949: Use GitHub repository for STIX
     * Bug 26773: Add --verbose to the ./mach build flag for firefox
     * Bug 26319: Don't package up Tor Browser in the `mach package` step
1562
     * Bug 27178: Add support for xz compression in mar files
Georg Koppen's avatar
Georg Koppen committed
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
     * Clean up
   * Windows
     * Bug 26203: Adapt tor-browser-build/tor-browser for Windows
     * Bug 26204: Bundle d3dcompiler_47.dll for Tor Browser 8
     * Bug 26205: Don't build the uninstaller for Windows during Firefox compilation
     * Bug 26206: Ship pthread related dll where needed
     * Bug 26396: Build libwinpthread reproducible
     * Bug 25837: Integrate fxc2 into our build setup for Windows builds
     * Bug 27152: Use mozilla/fxc2.git for the fxc2 repository
     * Bug 25894: Get a rust cross-compiler for Windows
     * Bug 25554: Bump mingw-w64 version for ESR 60
     * Bug 23561: Fix nsis builds for Windows 64
       * Bug 13469: Windows installer is missing many languages from NSIS file
     * Bug 23231: Remove our STL Wrappers workaround for Windows 64bit
     * Bug 26370: Don't copy msvcr100.dll and libssp-0.dll twice
     * Bug 26476: Work around Tor Browser crashes due to fix for bug 1467041
     * Bug 18287: Use SHA-2 signature for Tor Browser setup executables
     * Bug 25420: Update GCC to 6.4.0
     * Bug 16472: Update Binutils to 2.26.1
     * Bug 20302: Fix FTE compilation for Windows with GCC 6.4.0
     * Bug 25111: Don't compile Yasm on our own anymore for Windows Tor Browser
     * Bug 18691: Switch Windows builds from precise to jessie
   * OS X
     * Bug 24632: Update macOS toolchain for ESR 60
     * Bug 9711: Build our own cctools for macOS cross-compilation
     * Bug 25548: Update macOS SDK for Tor Browser builds to 10.11
     * Bug 26003: Clean up our mozconfig-osx-x86_64 file
     * Bug 26195: Use new cctools in our macosx-toolchain project
     * Bug 25975: Get a rust cross-compiler for macOS
     * Bug 26475: Disable Stylo to make macOS build reproducible
     * Bug 26489: Fix .app directory name in tools/dmg2mar
   * Linux
     * Bug 26073: Patch tor-browser-build for transition to ESR 60
     * Bug 25481: Rust support for tor-browser and tor
     * Bug 25304: Update GCC to 6.4.0
     * Bug 16472: Update Binutils to 2.26.1

Georg Koppen's avatar
Georg Koppen committed
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
Tor Browser 8.0a10 -- August 20 2018
 * All platforms
   * Update Tor to 0.3.4.6-rc
   * Update Torbutton to 2.0.2
     * Bug 26960: Implement new about:tor start page
     * Bug 26961: Implement new user onboarding
     * Bug 26321: Move 'New Identity', 'New Circuit' to File, hamburger menus
     * Bug 26590: Use new svg.disabled pref in security slider
     * Bug 26655: Adjust color and size of onion button
     * Bug 26500: Reposition circuit display relay icon for RTL locales
     * Bug 26409: Remove spoofed locale implementation
     * Bug 26189: Remove content-policy.js
Georg Koppen's avatar
Georg Koppen committed
1612
       * Bug 26544: Images are not centered anymore
Georg Koppen's avatar
Georg Koppen committed
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
     * Bug 27129: Add locales ca, ga, id, is, nb
     * Translations update
   * Update Tor Launcher to 0.2.16.2
     * Bug 26985: Help button icons missing
     * Bug 25509: Improve the proxy help text
     * Bug 27129: Add locales ca, ga, id, is, nb
     * Translations update
   * Update NoScript to 10.1.8.16
   * Update meek to 0.31
     * Bug 26477: Make meek extension compatible with ESR 60
   * Bug 27082: Enable a limited UITour for user onboarding
   * Bug 26961: New user onboarding
1625
   * Bug 14952+24553: Enable HTTP2 and AltSvc
Georg Koppen's avatar
Georg Koppen committed
1626
     * Bug 25735: Tor Browser stalls while loading Facebook login page
Georg Koppen's avatar
Georg Koppen committed
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
   * Bug 17252: Enable TLS session identifiers with first-party isolation
   * Bug 26353: Prevent speculative connects that violate first-party isolation
   * Bug 24056: Use en-US strings in HTML forms if locale is spoofed to english
   * Bug 26456: HTTP .onion sites inherit previous page's certificate information
   * Bug 26321: Move 'New Identity', 'New Circuit' to File, hamburger menus
   * Bug 26833: Backport Mozilla's bug 1473247
   * Bug 26628: Backport Mozilla's bug 1470156
   * Bug 26237: Clean up toolbar for ESR60-based Tor Browser
   * Bug 26519: Avoid Firefox icons in ESR60
   * Bug 26039: Load our preferences that modify extensions (fixup)
   * Bug 26515: Update Tor Browser blog post URLs
   * Bug 27129: Add locales ca, ga, id, is, nb
   * Bug 26216: Fix broken MAR file generation
   * Bug 26409: Remove spoofed locale implementation
   * Bug 26603: Remove obsolete HTTP pipelining preferences
 * Windows
   * Bug 26514: Fix intermittent updater failures on Win64 (Error 19)
   * Bug 26874: Fix UNC path restrictions failure in Tor Browser 8.0a9
   * Bug 12968: Enable HEASLR in Windows x86_64 builds
   * Update tbb-windows-installer to 0.4
     * Bug 26355: Update tbb-windows-installer to check for Windows7+
   * Bug 26355: Require Windows7+ for updates to Tor Browser 8
 * OS X
   * Bug 26795: Bump snowflake to 6077141f4a for bug 25600
 * Linux
   * Bug 25485: Unbreak Tor Browser on systems with newer libstdc++
   * Bug 20866: Fix OpenGL software rendering on systems with newer libstdc++
   * Bug 26951+18022: Fix execdesktop argument passing
   * Bug 26795: Bump snowflake to 6077141f4a for bug 25600
 * Build System
1657
   * All Platforms
Georg Koppen's avatar
Georg Koppen committed
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
     * Bug 26410: Stop using old MAR format in the alpha series
     * Bug 27020: RBM build fails with runc version 1.0.1
     * Bug 26949: Use GitHub repository for STIX
     * Bug 26773: Add --verbose to the ./mach build flag for firefox
     * Bug 26569: Redirect pre-8.0a9 alpha users to a separate update directory
     * Bug 26319: Don't package up Tor Browser in the `mach package` step
   * OS X
     * Bug 26489: Fix .app directory name in tools/dmg2mar
   * Windows
     * Bug 27152: Use mozilla/fxc2.git for the fxc2 repository

Georg Koppen's avatar
Georg Koppen committed
1669
1670
1671
1672
1673
Tor Browser 8.0a9 -- June 27 2018
 * All platforms
   * Update Firefox to 60.1.0esr
   * Update Tor to 0.3.4.2-alpha
   * Update Libevent to 2.1.8
Georg Koppen's avatar
Georg Koppen committed
1674
   * Update Torbutton to 2.0.1
Georg Koppen's avatar
Georg Koppen committed
1675
     * Bug 26100: Adapt Torbutton to Firefox 60 ESR
Georg Koppen's avatar
Georg Koppen committed
1676
     * Bug 26430: New Torbutton icon
Georg Koppen's avatar
Georg Koppen committed
1677
1678
1679
1680
1681
1682
     * Bug 24309: Move circuit display to the identity popup
     * Bug 26128: Adapt security slider to the WebExtensions version of NoScript
     * Bug 23247: Show security state of .onions
     * Bug 26129: Show our about:tor page on startup
     * Bug 26235: Hide new unusable items from help menu
     * Bug 26058: Remove workaround for hiding 'sign in to sync' button
Georg Koppen's avatar
Georg Koppen committed
1683
     * Bug 20628: Add locales da, he, sv, and zh-TW
Georg Koppen's avatar
Georg Koppen committed
1684
     * Translations update
Georg Koppen's avatar
Georg Koppen committed
1685
   * Update Tor Launcher to 0.2.16.1
Georg Koppen's avatar
Georg Koppen committed
1686
1687
     * Bug 25750: Update Tor Launcher to make it compatible with Firefox 60 ESR
     * Bug 20890: Increase control port connection timeout
Georg Koppen's avatar
Georg Koppen committed
1688
     * Bug 26466: Remove sv-SE from tracking for releases
Georg Koppen's avatar
Georg Koppen committed
1689
1690
     * Bug 20628: Add more locales to Tor Browser
     * Translations update
1691
   * Update HTTPS Everywhere to 2018.6.21
Georg Koppen's avatar
Georg Koppen committed
1692
1693
1694
1695
   * Update NoScript to 10.1.8.2
   * Bug 25543: Rebase Tor Browser patches for ESR60
   * Bug 23247: Show security state of .onions
   * Bug 26039: Load our preferences that modify extensions
Georg Koppen's avatar
Georg Koppen committed
1696
   * Bug 17965: Isolate HPKP and HSTS to URL bar domain
Georg Koppen's avatar
Georg Koppen committed
1697
   * Bug 26365: Add potential AltSvc support
Georg Koppen's avatar
Georg Koppen committed
1698
   * Bug 9145: Fix broken hardware acceleration on Windows and enable it
Georg Koppen's avatar
Georg Koppen committed
1699
1700
1701
1702
1703
   * Bug 26045: Add new MAR signing keys
   * Bug 22564: Hide Firefox Sync
   * Bug 25090: Disable updater telemetry
   * Bug 26127: Make sure Torbutton and Tor Launcher are not treated as legacy extensions
   * Bug 26073: Migrate general.useragent.locale to intl.locale.requested
Georg Koppen's avatar
Georg Koppen committed
1704
   * Bug 20628: Make Tor Browser available in da, he, sv-SE, and zh-TW
Georg Koppen's avatar
Georg Koppen committed
1705
1706
1707
1708
1709
1710
1711
1712
1713
     * Bug 12927: Include Hebrew translation into Tor Browser
     * Bug 21245: Add danish (da) translation
 * Windows
   * Bug 26239+24197: Enable content sandboxing for 64bit Windows builds
   * Bug 22581: Fix shutdown crash
   * Bug 26424: Disable UNC paths to prevent possible proxy bypasses
   * Bug 26304: Update zlib to version 1.2.11
 * OS X
   * Bug 24052: Backport fix for bug 1412081 for better file:// handling
Georg Koppen's avatar
Georg Koppen committed
1714
1715
1716
   * Bug 24136: After loading file:// URLs clicking on links is broken on OS X
   * Bug 24243: Tor Browser only renders HTML for local pages via file://
   * Bug 24263: Tor Browser does not run extension scripts if loaded via about:debugging
Georg Koppen's avatar
Georg Koppen committed
1717
1718
1719
1720
   * Bug 24632: Disable snowflake for now until its build is fixed
   * Bug 26438: Remove broken seatbelt profiles
 * Linux
   * Bug 24052: Backport fix for bug 1412081 for better file:// handling
Georg Koppen's avatar
Georg Koppen committed
1721
1722
1723
   * Bug 24136: After loading file:// URLs clicking on links is broken on Linux
   * Bug 24243: Tor Browser only renders HTML for local pages via file://
   * Bug 24263: Tor Browser does not run extension scripts if loaded via about:debugging
Georg Koppen's avatar
Georg Koppen committed
1724
1725
1726
1727
   * Bug 26153: Update selfrando to be compatible with Firefox 60 ESR
   * Bug 22242: Remove RUNPATH in Linux binaries embedded by selfrando
   * Bug 26354: Set SSE2 support as minimal requirement for Tor Browser 8
 * Build System
1728
  * All Platforms
Georg Koppen's avatar
Georg Koppen committed
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
    * Bug 26362: Use old MAR format for first ESR60-based alpha
    * Clean up
  * Windows
    * Bug 26203: Adapt tor-browser-build/tor-browser for Windows
    * Bug 26204: Bundle d3dcompiler_47.dll for Tor Browser 8
    * Bug 26205: Don't build the uninstaller for Windows during Firefox compilation
    * Bug 26206: Ship pthread related dll where needed
    * Bug 26396: Build libwinpthread reproducible
    * Bug 25837: Integrate fxc2 into our build setup for Windows builds
    * Bug 25894: Get a rust cross-compiler for Windows
    * Bug 25554: Bump mingw-w64 version for ESR 60
    * Bug 23561: Fix nsis builds for Windows 64
Georg Koppen's avatar
Georg Koppen committed
1741
      * Bug 13469: Windows installer is missing many languages from NSIS file
Georg Koppen's avatar
Georg Koppen committed
1742
1743
    * Bug 23231: Remove our STL Wrappers workaround for Windows 64bit
    * Bug 26370: Don't copy msvcr100.dll and libssp-0.dll twice
Georg Koppen's avatar
Georg Koppen committed
1744
    * Bug 26476: Work around Tor Browser crashes due to fix for bug 1467041
Georg Koppen's avatar
Georg Koppen committed
1745
    * Bug 18287: Use SHA-2 signature for Tor Browser setup executables
Georg Koppen's avatar
Georg Koppen committed
1746
    * Bug 16472: Update Binutils to 2.26.1
Georg Koppen's avatar
Georg Koppen committed
1747
1748
1749
1750
1751
1752
1753
  * OS X
    * Bug 24632: Update macOS toolchain for ESR 60
    * Bug 9711: Build our own cctools for macOS cross-compilation
    * Bug 25548: Update macOS SDK for Tor Browser builds to 10.11
    * Bug 26003: Clean up our mozconfig-osx-x86_64 file
    * Bug 26195: Use new cctools in our macosx-toolchain project
    * Bug 25975: Get a rust cross-compiler for macOS
Georg Koppen's avatar
Georg Koppen committed
1754
    * Bug 26475: Disable Stylo to make macOS build reproducible
Georg Koppen's avatar
Georg Koppen committed
1755
1756
1757
1758
  * Linux
    * Bug 26073: Patch tor-browser-build for transition to ESR 60
    * Bug 25540: Stop building and distributing sandboxed tor browser
    * Bug 25481: Rust support for tor-browser and tor
Georg Koppen's avatar
Georg Koppen committed
1759
    * Bug 16472: Update Binutils to 2.26.1
Georg Koppen's avatar
Georg Koppen committed
1760

Georg Koppen's avatar
Georg Koppen committed
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
Tor Browser 7.5.6 -- June 26 2018
 * All platforms
   * Update Firefox to 52.9.0esr
   * Update Tor to 0.3.3.7
   * Update Tor Launcher to 0.2.14.5
     * Bug 20890: Increase control port connection timeout
   * Update HTTPS Everywhere to 2018.6.21
     * Bug 26451: Prevent HTTPS Everywhere from freezing the browser
   * Update NoScript to 5.1.8.6
   * Bug 21537: Mark .onion cookies as secure
   * Bug 25938: Backport fix for cross-origin header leak (bug 1334776)
   * Bug 25721: Backport patches from Mozilla's bug 1448771
   * Bug 25147+25458: Sanitize HTML fragments for chrome documents
   * Bug 26221: Backport fix for leak in SHA256 in nsHttpConnectionInfo.cpp
 * Windows
   * Bug 26424: Disable UNC paths to prevent possible proxy bypasses

Georg Koppen's avatar
Georg Koppen committed
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
Tor Browser 8.0a8 -- June 10 2018
 * All platforms
   * Update Firefox to 52.8.1esr
   * Bug 26098: Remove amazon-meek

Tor Browser 7.5.5 -- June 10 2018
 * All platforms
   * Update Firefox to 52.8.1esr
   * Bug 26098: Remove amazon-meek

Georg Koppen's avatar
Georg Koppen committed
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
Tor Browser 8.0a7 -- May 9 2018
 * All platforms
   * Update Firefox to 52.8.0esr
   * Update Tor Launcher to 0.2.15.2
     * Bug 25807: Change front domain to unbreak Moat
     * Translations update
   * Bug 25973: Backport off-by-one fix (bug 1352073)
   * Bug 25938: Backport fix for cross-origin header leak (bug 1334776)
   * Bug 25458: Fix broken UI customization
   * Bug 25898: Make Youtube videos play automatically again
   * Bug 25980: Improve backport of bug 1448771 (fixes broken Orfox build)
 * OS X
   * Bug 26010: Change Snowflake rendezvous to use the Azure domain front
 * Linux
   * Bug 26010: Change Snowflake rendezvous to use the Azure domain front

Georg Koppen's avatar
Georg Koppen committed
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
Tor Browser 7.5.4 -- May 9 2018
 * All platforms
   * Update Firefox to 52.8.0esr
   * Update HTTPS Everywhere to 2018.4.11
   * Update NoScript to 5.1.8.5
   * Bug 23439: Exempt .onion domains from mixed content warnings
   * Bug 22614: Make e10s/non-e10s Tor Browsers indistinguishable
   * Bug 22659: Changes to `intl.accept.languages` get overwritten after restart
   * Bug 25973: Backport off-by-one fix (bug 1352073)
   * Bug 25020: Add a tbb_version.json file

Georg Koppen's avatar
Georg Koppen committed
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
Tor Browser 8.0a6 -- April 19 2018
 * All platforms
   * Update Tor to 0.3.3.5-rc
   * Update OpenSSL to 1.0.2o
   * Update Torbutton to 1.9.9.1
     * Bug 25126: Make about:tor layout responsive
     * Translations update
   * Update HTTPS Everywhere to 2018.4.11
   * Update NoScript to 5.1.8.5
   * Bug 21537: Mark .onion cookies as secure
   * Bug 21850: Update about:tbupdate handling for e10s
   * Bug 25721: Backport patches from Mozilla's bug 1448771
 * Linux
   * Bug 20283: Tor Browser should run without a `/proc` filesystem.
 * Windows
   * Bug 13893: Make EMET compatible with Tor Browser
 * Build System
   * Windows
     * Bug 25420: Update GCC to 6.4.0
     * Bug 20302: Fix FTE compilation for Windows with GCC 6.4.0
   * Linux
     * Bug 25304: Update GCC to 6.4.0

1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
Tor Browser 8.0a5 -- March 27 2018
 * All platforms
   * Update Firefox to 52.7.3esr
   * Update HTTPS Everywhere to 2018.3.13
   * Bug 23439: Exempt .onion domains from mixed content warnings
 * OS X
   * Update Snowflake
     * Bug 21312+25579+25449: Fix crashes and memory/file descriptor leaks in go-webrtc
 * Linux
   * Update Snowflake
     * Bug 21312+25579+25449: Fix crashes and memory/file descriptor leaks in go-webrtc

Georg Koppen's avatar
Georg Koppen committed
1850
1851
1852
1853
1854
1855
Tor Browser 7.5.3 -- March 26 2018
 * All platforms
   * Update Firefox to 52.7.3esr
   * Update HTTPS Everywhere to 2018.3.13
     * Bug 25339: Adapt build system for Python 3.6 based build procedure

Georg Koppen's avatar
Georg Koppen committed
1856
1857
1858
1859
Tor Browser 8.0a4 -- March 17 2018
 * All platforms
   * Update Firefox to 52.7.2esr

1860
1861
1862
1863
Tor Browser 7.5.2 -- March 17 2018
 * All platforms
   * Update Firefox to 52.7.2esr

Georg Koppen's avatar
Georg Koppen committed
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
Tor Browser 8.0a3 -- March 13 2018
 * All platforms
   * Update Firefox to 52.7.0esr
   * Update Tor to 0.3.3.3-alpha
   * Update Tor Launcher to 0.2.15.1
     * Bug 23136: Moat integration (fetch bridges for the user)
     * Translations update
   * Update HTTPS Everywhere to 2018.2.26
     * Bug 25339: Adapt build system for Python 3.6 based build procedure
   * Bug 25356: Update obfs4proxy to v0.0.7
   * Bug 25147: Sanitize HTML fragments created for chrome-privileged documents
 * Windows
   * Bug 25112: No sandboxing on 64-bit Windows <= Vista

Georg Koppen's avatar
Georg Koppen committed
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
Tor Browser 7.5.1 -- March 13 2018
 * All platforms
   * Update Firefox to 52.7.0esr
   * Update Tor to 0.3.2.10
   * Update Torbutton to 1.9.8.6
     * Bug 24159: Version check does not deal with platform specific checks
     * Bug 25016: Remove 2017 donation banner
     * Translations update
   * Update Tor Launcher to 0.2.14.4
     * Bug 25089: Special characters are not escaped in proxy password
     * Translations update
   * Update NoScript to 5.1.8.4
   * Bug 25356: Update obfs4proxy to v0.0.7
   * Bug 25000: Add [System+Principal] to the NoScript whitelist
 * Windows
   * Bug 25112: Disable sandboxing on 64-bit Windows <= Vista

Georg Koppen's avatar
Georg Koppen committed
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
Tor Browser 8.0a2 -- February 23 2018
 * All Platforms
   * Update Tor to 0.3.3.2-alpha
   * Update Torbutton to 1.9.9
     * Bug 24159: Version check does not deal with platform specific checks
     * Bug 25016: Remove 2017 donation banner
     * Translations update
   * Update Tor Launcher to 0.2.15
     * Bug 25089: Special characters are not escaped in proxy password
     * Translations update
   * Update HTTPS Everywhere to 2018.1.29
   * Update NoScript to 5.1.8.4
   * Update meek to 0.29
   * Bug 25215: Revert bug 18619 (we are not disabling IndexedDB any longer)
   * Bug 19910: Rip out optimistic data socks handshake variant (#3875)
   * Bug 22659: Changes to `intl.accept.languages` get overwritten after restart
   * Bug 25000: Add [System+Principal] to the NoScript whitelist
   * Bug 15599: Disable Range requests used by pdfjs as they are not isolated
   * Bug 22614: Make e10s/non-e10s Tor Browsers indistinguishable
   * Bug 13575: Disable randomised Firefox HTTP cache decay user tests
   * Bug 25020: Add a tbb_version.json file
   * Bug 24995: Include git hash in tor --version
 * OS X
   * Bug 22794: Don't open AF_INET/AF_INET6 sockets when AF_LOCAL is configured
 * Linux
   * Bug 22794: Don't open AF_INET/AF_INET6 sockets when AF_LOCAL is configured
 * Windows:
   * Bug 25266: PT config should include full names of executable files
 * Build System
   * Windows
     * Bug 25111: Don't compile Yasm on our own anymore for Windows Tor Browser

Georg Koppen's avatar
Georg Koppen committed
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
Tor Browser 8.0a1 -- January 23 2018
 * All Platforms
   * Update Firefox to 52.6.0esr
   * Update Tor to 0.3.2.9
   * Update Torbutton to 1.9.8.5
     * Bug 21245: Add da translation to Torbutton and keep track of it
     * Bug 24702: Remove Mozilla text from banner
     * Translations update
   * Update Tor Launcher to 0.2.14.3
     * Translations update
   * Update HTTPS Everywhere to 2018.1.11
   * Bug 24756: Add noisebridge01 obfs4 bridge configuration
   * Bug 23916: Add new MAR signing key
   * Bug 22548: Firefox downgrades VP9 videos to VP8 for some users
 * Windows
   * Bug 24197: Fix win64 sandbox compile issues
 * Build System
   * Windows
     * Bug 18691: switch Windows builds from precise to jessie
   * Linux
     * Bug 23892: Include Firefox and Tor debug files in final build directory
     * Bug 24842: include libasan.so.2 and libubsan.so.0 in debug builds

Georg Koppen's avatar
Georg Koppen committed
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
Tor Browser 7.5 -- January 23 2018
 * All Platforms
   * Update Firefox to 52.6.0esr
   * Update Tor to 0.3.2.9
   * Update OpenSSL to 1.0.2n
   * Update Torbutton to 1.9.8.5
     * Bug 21847: Update copy for security slider
     * Bug 21245: Add da translation to Torbutton and keep track of it
     * Bug 24702: Remove Mozilla text from banner
     * Bug 10573: Replace deprecated nsILocalFile with nsIFile (code clean-up)
     * Translations update
   * Update Tor Launcher to 0.2.14.3
     * Bug 23262: Implement integrated progress bar
     * Bug 23261: implement configuration portion of new Tor Launcher UI
     * Bug 24623: Revise "country that censors Tor" text
     * Bug 24624: tbb-logo.svg may cause network access
     * Bug 23240: Retrieve current bootstrap progress before showing progress bar
     * Bug 24428: Bootstrap error message sometimes lost
     * Bug 22232: Add README on use of bootstrap status messages
     * Bug 10573: Replace deprecated nsILocalFile with nsIFile (code clean-up)
     * Translations update
   * Update HTTPS Everywhere to 2018.1.11
   * Update NoScript to 5.1.8.3
   * Bug 23104: CSS line-height reveals the platform Tor Browser is running on
   * Bug 24398: Plugin-container process exhausts memory
   * Bug 22501: Requests via javascript: violate FPI
   * Bug 24756: Add noisebridge01 obfs4 bridge configuration
 * Windows
   * Bug 16010: Enable content sandboxing on Windows
   * Bug 23230: Fix build error on Windows 64
 * OS X
   * Bug 24566: Avoid white flashes when opening dialogs in Tor Browser
   * Bug 23025: Add some hardening flags to macOS build
 * Linux
   * Bug 23970: Make "Print to File" work with sandboxing enabled
   * Bug 23016: "Print to File" is broken on some non-english Linux systems
   * Bug 10089: Set middlemouse.contentLoadURL to false by default
   * Bug 18101: Suppress upload file dialog proxy bypass (linux part)
 * Android
   * Bug 22084: Spoof network information API
 * Build System
   * All Platforms
     * Switch from gitian/tor-browser-bundle to rbm/tor-browser-build
   * Windows
     * Bug 22563: Update mingw-w64 to fix W^X violations
     * Bug 20929: Bump GCC version to 5.4.0
   * Linux
     * Bug 20929: Bump GCC version to 5.4.0
     * Bug 23892: Include Firefox and Tor debug files in final build directory
     * Bug 24842: include libasan.so.2 and libubsan.so.0 in debug builds

Georg Koppen's avatar
Georg Koppen committed
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
Tor Browser 7.5a10 -- December 19 2017
 * All Platforms
   * Update Tor to 0.3.2.7-rc
   * Update OpenSSL to 1.0.2n
   * Update Torbutton to 1.9.8.4
     * Bug 21847: Update copy for security slider
     * Bug 10573: Replace deprecated nsILocalFile with nsIFile (code clean-up)
     * Translations update
   * Update Tor Launcher to 0.2.14.2
     * Bug 24623: Revise "country that censors Tor" text
     * Bug 24428: Bootstrap error message sometimes lost
     * Bug 24624: tbb-logo.svg may cause network access
     * Bug 10573: Replace deprecated nsILocalFile with nsIFile (code clean-up)
     * Translations update
   * Update NoScript to 5.1.8.3
   * Bug 23104: CSS line-height reveals the platform Tor Browser is running on
   * Bug 24398: Plugin-container process exhausts memory
 * OS X
   * Bug 24566: Avoid white flashes when opening dialogs in Tor Browser
 * Linux
   * Bug 23970: Make "Print to File" work with sandboxing enabled
   * Bug 23016: "Print to File" is broken on some non-english Linux systems
 * Android
   * Bug 22084: Spoof network information API

2026
Tor Browser 7.5a9 -- December 09 2017
Georg Koppen's avatar
Georg Koppen committed
2027
 * All Platforms
Georg Koppen's avatar
Georg Koppen committed
2028
2029
   * Update Firefox to 52.5.2esr
   * Update Tor to 0.3.2.6-alpha
2030
   * Update HTTPS-Everywhere to 2017.12.6
Georg Koppen's avatar
Georg Koppen committed
2031
   * Update NoScript to 5.1.8.1
Georg Koppen's avatar
Georg Koppen committed
2032
2033
   * Update sandboxed-tor-browser to 0.0.16

Georg Koppen's avatar
Georg Koppen committed
2034
2035
2036
2037
2038
2039
2040
Tor Browser 7.0.11 -- December 09 2017
 * All Platforms
   * Update Firefox to 52.5.2esr
   * Update Tor to 0.3.1.9
   * Update HTTPS-Everywhere to 2017.12.6
   * Update NoScript to 5.1.8.1

Georg Koppen's avatar
Georg Koppen committed
2041
Tor Browser 7.5a8 -- November 15 2017
Georg Koppen's avatar
Georg Koppen committed
2042
2043
2044
2045
2046
2047
2048
2049
 * All Platforms
   * Update Firefox to 52.5.0esr
   * Update Tor to 0.3.2.4-alpha
   * Update Torbutton to 1.9.8.3
     * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi
     * Bug 23949: Fix donation banner display
     * Update locales with translated banner
     * Translations update
2050
   * Update Tor Launcher to 0.2.14.1
Georg Koppen's avatar
Georg Koppen committed
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
     * Bug 23262: Implement integrated progress bar
     * Bug 23261: implement configuration portion of new Tor Launcher UI
     * Translations update
   * Update HTTPS-Everywhere to 2017.10.30
   * Update NoScript to 5.1.5
     * Bug 23968: NoScript icon jumps to the right after update
   * Update sandboxed-tor-browser to 0.0.15
 * Windows
   * Bug 20636+10026: Create 64bit Tor Browser for Windows
   * Bug 24052: Block file:// redirects early
Georg Koppen's avatar
Georg Koppen committed
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076

Tor Browser 7.0.10 -- November 14 2017
 * All Platforms
   * Update Firefox to 52.5.0esr
   * Update Tor to 0.3.1.8
   * Update Torbutton to 1.9.7.10
     * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi
     * Translations update
   * Update HTTPS-Everywhere to 2017.10.30
     * Bug 24178: Use make.sh for building HTTPS-Everywhere
   * Update NoScript to 5.1.5
     * Bug 23968: NoScript icon jumps to the right after update
 * Windows
   * Bug 23582: Enable the Windows DLL blocklist for mingw-w64 builds
   * Bug 23396: Update the msvcr100.dll we ship
   * Bug 24052: Block file:// redirects early
Georg Koppen's avatar
Georg Koppen committed
2077

2078
2079
2080
2081
2082
2083
2084
Tor Browser 7.5a7 -- November 4 2017
 * OS X
   * Bug 24052: Streamline handling of file:// resources
 * Linux
   * Bug 24052: Streamline handling of file:// resources

Tor Browser 7.0.9 -- November 3 2017
2085
2086
2087
2088
2089
 * OS X
   * Bug 24052: Streamline handling of file:// resources
 * Linux
   * Bug 24052: Streamline handling of file:// resources

2090
2091
2092
2093
2094
2095
2096
Tor Browser 7.0.8 -- October 25 2017
 * All Platforms
   * Update Torbutton to 1.9.7.9
     * Bug 23949: Fix donation banner display
     * Update locales with translated banner
     * Translations update

Georg Koppen's avatar
Georg Koppen committed
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
Tor Browser 7.5a6 -- October 19 2017
 * All Platforms
   * Update Firefox to 52.4.1esr
   * Update Tor to 0.3.2.2-alpha
   * Update Torbutton to 1.9.8.2
     * Bug 23887: Update banner locales and Mozilla text
     * Translations update
   * Update HTTPS-Everywhere to 2017.10.4
   * Update NoScript to 5.1.2
     * Bug 23723: Loading entities from NoScript .dtd files is blocked
     * Bug 23724: NoScript update breaks Security Slider and its icon disappears
2108
   * Update sandboxed-tor-browser to 0.0.14
Georg Koppen's avatar
Georg Koppen committed
2109
2110
2111
2112
2113
2114
2115
   * Bug 23745: Tab crashes when using Tor Browser to access Google Drive
   * Bug 23694: Update the detailsURL in update responses
   * Bug 22501: Requests via javascript: violate FPI
 * OS X
   * Bug 23807: Tab crashes when playing video on High Sierra
   * Bug 23025: Add some hardening flags to macOS build

2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
Tor Browser 7.0.7 -- October 19 2017
 * All Platforms
   * Update Firefox to 52.4.1esr
   * Update Torbutton to 1.9.7.8
     * Bug 23887: Update banner locales and Mozilla text
     * Bug 23526: Add 2017 Donation banner text
     * Bug 23483: Donation banner on about:tor for 2017 (testing mode)
     * Bug 22610: Avoid crashes when canceling external helper app related downloads
     * Bug 22472: Fix FTP downloads when external helper app dialog is shown
     * Bug 22471: Downloading pdf files via the PDF viewer download button is broken
     * Bug 22618: Downloading pdf file via file:/// is stalling
     * Translations update
   * Update HTTPS-Everywhere to 2017.10.4
   * Update NoScript to 5.1.2
     * Bug 23723: Loading entities from NoScript .dtd files is blocked
     * Bug 23724: NoScript update breaks Security Slider and its icon disappears
   * Bug 23745: Tab crashes when using Tor Browser to access Google Drive
   * Bug 22610: Avoid crashes when canceling external helper app related downloads
   * Bug 22472: Fix FTP downloads when external helper app dialog is shown
   * Bug 22471: Downloading pdf files via the PDF viewer download button is broken
   * Bug 22618: Downloading pdf file via file:/// is stalling
   * Bug 23694: Update the detailsURL in update responses
 * OS X
   * Bug 23807: Tab crashes when playing video on High Sierra
 * Linux
   * Bug 22692: Enable content sandboxing on Linux

2143
Tor Browser 7.5a5 -- September 28 2017
Georg Koppen's avatar
Georg Koppen committed
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
 * All Platforms
   * Update Firefox to 52.4.0esr
   * Update Tor to 0.3.2.1-alpha
   * Update Torbutton to 1.9.8.1
     * Bug 20375: Warn users after entering fullscreen mode
     * Bug 22989: Fix dimensions of new windows on macOS
     * Bug 23526: Add 2017 Donation banner text
     * Bug 23483: Donation banner on about:tor for 2017 (testing mode)
     * Translations update
   * Update Tor Launcher to 0.2.13
     * Bug 23240: Retrieve current bootstrap progress before showing progress bar
     * Bug 22232: Add README on use of bootstrap status messages
     * Translations update
   * Update HTTPS-Everywhere to 2017.9.12
   * Update NoScript to 5.0.10
   * Update sandboxed-tor-browser to 0.0.13
   * Bug 23393: Don't crash all tabs when closing one tab
   * Bug 23166: Add new obfs4 bridge to the built-in ones
   * Bug 23258: Fix broken HTTPS-Everywhere on higher security levels
   * Bug 21270: NoScript settings break WebExtensions add-ons
   * Bug 23104: CSS line-height reveals the platform Tor Browser is running on
 * Windows
   * Bug 16010: Enable content sandboxing on Windows
   * Bug 23582: Enable the Windows DLL blocklist for mingw-w64 builds
   * Bug 23396: Update the msvcr100.dll we ship
   * Bug 23230: Fix build error on Windows 64
 * OS X
   * Bug 23404: Add missing Noto Sans Buginese font to the macOS whitelist
 * Linux
   * Bug 10089: Set middlemouse.contentLoadURL to false by default
   * Bug 22692: Enable content sandboxing on Linux
   * Bug 18101: Suppress upload file dialog proxy bypass (linux part)
 * Build System
   * All Platforms
     * Switch from gitian/tor-browser-bundle to rbm/tor-browser-build

2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
Tor Browser 7.0.6 -- September 28 2017
 * All Platforms
   * Update Firefox to 52.4.0esr
   * Update Tor to 0.3.1.7
   * Update Torbutton to 1.9.7.7
     * Bug 22542: Security Settings window too small on macOS 10.12 (fixup)
     * Bug 20375: Warn users after entering fullscreen mode
   * Update HTTPS-Everywhere to 2017.9.12
   * Update NoScript to 5.0.10
   * Bug 21830: Copying large text from web console leaks to /tmp
   * Bug 23393: Don't crash all tabs when closing one tab
 * OS X
   * Bug 23404: Add missing Noto Sans Buginese font to the macOS whitelist

Georg Koppen's avatar
Georg Koppen committed
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
Tor Browser 7.0.5 -- September 4 2017
 * All Platforms
   * Update Torbutton to 1.9.7.6
     * Bug 22989: Fix dimensions of new windows on macOS
     * Translations update
   * Update HTTPS-Everywhere to 2017.8.31
   * Update NoScript to 5.0.9
   * Bug 23166: Add new obfs4 bridge to the built-in ones
   * Bug 23258: Fix broken HTTPS-Everywhere on higher security levels
   * Bug 21270: NoScript settings break WebExtensions add-ons

boklm's avatar
boklm committed
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
Tor Browser 7.5a4 -- August 9 2017
 * All Platforms
   * Update Firefox to 52.3.0esr
   * Update Tor to 0.3.1.5-alpha
   * Update OpenSSL to 1.0.2l
   * Update Torbutton to 1.9.8
     * Bug 22610: Avoid crashes when canceling external helper app related downloads
     * Bug 22472: Fix FTP downloads when external helper app dialog is shown
     * Bug 22471: Downloading pdf files via the PDF viewer download button is broken
     * Bug 22618: Downloading pdf file via file:/// is stalling
     * Bug 22542: Resize slider window to work without scrollbars
     * Bug 21999: Fix display of language prompt in non-en-US locales
Georg Koppen's avatar
Georg Koppen committed
2217
     * Bug 18913: Don't let about:tor have chrome privileges
boklm's avatar
boklm committed
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
     * Bug 22535: Search on about:tor discards search query
     * Bug 21948: Going back to about:tor page gives "Address isn't valid" error
     * Code clean-up
     * Translations update
   * Update Tor Launcher to 0.2.12.3
     * Bug 22592: Default bridge settings are not removed
     * Translations update
   * Update HTTPS-Everywhere to 5.2.21
   * Update NoScript to 5.0.8.1
     * Bug 22362: Remove workaround for XSS related browser freezing
     * Bug 22067: NoScript Click-to-Play bypass with embedded videos and audio
   * Update sandboxed-tor-browser to 0.0.12
   * Bug 22610: Avoid crashes when canceling external helper app related downloads
   * Bug 22472: Fix FTP downloads when external helper app dialog is shown
   * Bug 22471: Downloading pdf files via the PDF viewer download button is broken
   * Bug 22618: Downloading pdf file via file:/// is stalling
   * Bug 21321: Exempt .onions from HTTP related security warnings
   * Bug 21830: Copying large text from web console leaks to /tmp
   * Bug 22073: Disable GetAddons option on addons page
   * Bug 22884: Fix broken about:tor page on higher security levels
   * Bug 22829: Remove default obfs4 bridge riemann.
 * Windows
   * Bug 21617: Fix single RWX page on Windows (included in 52.3.0esr)
 * OS X
   * Bug 22831: Enable Snowflake for mac
 * Linux
   * Bug 22832: Don't include monthly timestamp in libwebrtc build output
   * Bug 20848: Deploy Selfrando in 32bit Linux builds
 * Build system
   * Windows
     * Bug 22563: Update mingw-w64 to fix W^X violations
     * Bug 20929: Bump GCC version to 5.4.0
   * Linux
     * Bug 20929: Bump GCC version to 5.4.0

2253
2254
2255
2256
2257
2258
Tor Browser 7.0.4 -- August 8 2017
 * All Platforms
   * Update Firefox to 52.3.0esr
   * Update Tor to 0.3.0.10
   * Update Torbutton to 1.9.7.5
     * Bug 21999: Fix display of language prompt in non-en-US locales
Georg Koppen's avatar
Georg Koppen committed
2259
     * Bug 18913: Don't let about:tor have chrome privileges
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
     * Bug 22535: Search on about:tor discards search query
     * Bug 21948: Going back to about:tor page gives "Address isn't valid" error
     * Code clean-up
     * Translations update
   * Update Tor Launcher to 0.2.12.3
     * Bug 22592: Default bridge settings are not removed
     * Translations update
   * Update HTTPS-Everywhere to 5.2.21
   * Update NoScript to 5.0.8.1
     * Bug 22362: Remove workaround for XSS related browser freezing
     * Bug 22067: NoScript Click-to-Play bypass with embedded videos and audio
   * Bug 21321: Exempt .onions from HTTP related security warnings
   * Bug 22073: Disable GetAddons option on addons page
   * Bug 22884: Fix broken about:tor page on higher security levels
 * Windows
   * Bug 22829: Remove default obfs4 bridge riemann.
   * Bug 21617: Fix single RWX page on Windows (included in 52.3.0esr)
 * OS X
   * Bug 22829: Remove default obfs4 bridge riemann.

boklm's avatar
boklm committed
2280
2281
2282
2283
2284
2285
2286
2287
2288
Tor Browser 7.5a3 -- July 28 2017
 * Linux
   * Bug 23044: Don't allow GIO supported protocols by default

Tor Browser 7.0.3 -- July 27 2017
 * Linux
   * Bug 23044: Don't allow GIO supported protocols by default
   * Bug 22829: Remove default obfs4 bridge riemann.

boklm's avatar
boklm committed
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
Tor Browser 7.5a2 -- July 6 2017
 * All Platforms
   * Update Tor to 0.3.1.4-alpha
   * Update HTTPS-Everywhere to 5.2.19
 * Linux
   * Update sandboxed-tor-browser to 0.0.9

Tor Browser 7.0.2 -- July 3 2017
 * All Platforms
   * Update Tor to 0.3.0.9, fixing bug #22753
   * Update HTTPS-Everywhere to 5.2.19

2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
Tor Browser 7.5a1 -- June 14 2017
 * All Platforms
   * Update Firefox to 52.2.0esr
   * Update Tor to 0.3.1.3-alpha
   * Update Torbutton to 1.9.7.4
     * Bug 22542: Security Settings window too small on macOS 10.12
     * Bug 22104: Adjust our content policy whitelist for ff52-esr
     * Bug 22457: Allow resources loaded by view-source://
     * Bug 21627: Ignore HTTP 304 responses when checking redirects
     * Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode
     * Translations update
   * Update Tor Launcher to 0.2.12.2
     * Bug 22283: Linux 7.0a4 is broken after update due to unix: lines in torrc
     * Translations update
   * Update HTTPS-Everywhere to 5.2.18
   * Update NoScript to 5.0.5
   * Update sandboxed-tor-browser to 0.0.7
   * Bug 22362: NoScript's XSS filter freezes the browser
   * Bug 21766: Fix crash when the external application helper dialog is invoked
   * Bug 21886: Download is stalled in non-e10s mode
   * Bug 22333: Disable WebGL2 API for now
   * Bug 21861: Disable additional mDNS code to avoid proxy bypasses
   * Bug 21684: Don't expose navigator.AddonManager to content
   * Bug 21431: Clean-up system extensions shipped in Firefox 52
   * Bug 22320: Use preference name 'referer.hideOnionSource' everywhere
   * Bug 16285: Don't ship ClearKey EME system and update EME preferences
   * Bug 21972: about:support is partially broken
   * Bug 21323: Enable Mixed Content Blocking
   * Bug 22415: Fix format error in our pipeline patch
   * Bug 21862: Rip out potentially unsafe Rust code
   * Bug 16485: Improve about:cache page
   * Bug 22462: Backport of patch for bug 1329521 to fix assertion failure
   * Bug 22458: Fix broken `about:cache` page on higher security levels
   * Bug 18531: Uncaught exception when opening ip-check.info
   * Bug 18574: Uncaught exception when clicking items in Library
   * Bug 22327: Isolate Page Info media previews to first party domain
   * Bug 22452: Isolate tab list menuitem favicons to first party domain
   * Bug 15555: View-source requests are not isolated by first party domain
   * Bug 5293: Neuter fingerprinting with Battery API
   * Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge
   * Bug 22468: Add default obfs4 bridges frosty and dragon
 * Windows
   * Bug 22419: Prevent access to file://
   * Bug 21617: Fix single RWX page on Windows
 * OS X
   * Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0

 * Linux
   * Bug 16285: Remove ClearKey related library stripping
   * Bug 21852: Don't use jemalloc4 anymore
 * Android
   * Bug 19078: Disable RtspMediaResource stuff in Orfox

boklm's avatar
boklm committed
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469