New Release: Tor Browser 13.5 (Android, Windows, macOS, Linux) - tor-announce

20 Jun 2024

      Hi everyone,
Tor Browser 13.5 has now been published for all platforms. For details 
please see our blog post:
- https://blog.torproject.org/new-release-tor-browser-135/
Changelog:
...
Tor Browser 13.5 - June 17 2024

All Platforms
Bug 40856: Add a default for preferences in TorSettings [tor-browser]
Bug 40919: Consider dropping protection against line-height introduced in #23104 [tor-browser]
Bug 41114: Fix no-async-promise-executor on TorConnect [tor-browser]
Bug 41467: compat: beacon: re-enable the API but transform it to a no-op [tor-browser]
Bug 42153: Drop dom.enable_resource_timing = false preference [tor-browser]
Bug 42246: Migrate tor connection stuff from browser to toolkit [tor-browser]
Bug 42290: "DuckDuckGoOnion" is a weird naming format for onion search engines [tor-browser]
Bug 42302: The allowed ports string contains a typo [tor-browser]
Bug 42308: Update README for tor browser [tor-browser]
Bug 42315: compat: why is eventCounts undefined? [tor-browser]
Bug 42336: Review the relationship between TorSettings and the TorProvider [tor-browser]
Bug 42340: TorBridgeChanged notification sends out "[object Object]" as its data. [tor-browser]
Bug 42343: Consume pt_config.json in the browser [tor-browser]
Bug 42354: Refactor exclusions in ShouldSanitizePreference() to the pref list. [tor-browser]
Bug 42358: Separate the domain fronted requests from Moat [tor-browser]
Bug 42359: Handle firewall and proxy in TorSettings.setSettings [tor-browser]
Bug 42390: Betterboxing: make the decorator border disappear when the corners are flat [tor-browser]
Bug 42397: Change RFP-spoofed Timezone from UTC to a real-world, less discriminable one [tor-browser]
Bug 42437: Drop "torbrowser.version" preference [tor-browser]
Bug 42466: Drop the "Onion Logo" from trademark statement [tor-browser]
Bug 42479: Switch from localized strings to error codes in TorConnect errors [tor-browser]
Bug 42481: Modularize SecurityLevel [tor-browser]
Bug 42521: Remove unused onboarding strings [tor-browser]
Bug 42529: Try not to spoof system-ui in contexts exempt from RFP [tor-browser]
Bug 42537: Move Fluent files from "browser" to "toolkit" [tor-browser]
Bug 42538: Move onion icons to toolkit [tor-browser]
Bug 42549: Remove brand.dtd [tor-browser]
Bug 42604: Add some debug logs about circuits [tor-browser]
Bug 241: Move network.proxy.failover_direct=false pref to base-browser [mullvad-browser]
Bug 41111: Use Lyrebird to provide WebTunnel PT Client [tor-browser-build]

Windows + macOS + Linux
Bug 40843: Add a working state to the Internet test button in connection settings [tor-browser]
Bug 41621: Tweak about:torconnect styling [tor-browser]
Bug 41622: Convert onion site errors to the new neterror template [tor-browser]
Bug 41814: Change "vanilla bridge:" to "Tor bridge:" in bridge cards [tor-browser]
Bug 41916: Letterboxing preferences UI [tor-browser]
Bug 41917: Make the appearance of letterboxing look more intentional [tor-browser]
Bug 41918: Add option to reuse last window size when letterboxing is enabled [tor-browser]
Bug 41930: intl.accept_languages gets into a stuck modifed state [tor-browser]
Bug 41966: Cannot remove locales from the locale alternatives list [tor-browser]
Bug 42036: Design and build a user interface for Lox [tor-browser]
Bug 42192: Correctly round new windows when bookmarks toolbar is set to "Only Show on New Tab" [tor-browser]
Bug 42202: Fluent migration: crypto safety [tor-browser]
Bug 42203: Fluent migration: about dialog [tor-browser]
Bug 42204: Drop unused aboutTor.dtd [tor-browser]
Bug 42206: Fluent migration: about:rulesets [tor-browser]
Bug 42207: Fluent migration: preferences [tor-browser]
Bug 42209: Fluent migration: tor circuit [tor-browser]
Bug 42210: Fluent migration: download warning [tor-browser]
Bug 42211: Fluent migration: new identity [tor-browser]
Bug 42214: Fluent migration: security level [tor-browser]
Bug 42270: Implement design changes to QR code dialog [tor-browser]
Bug 42303: Remove unused "help" button logic in tor dialogs [tor-browser]
Bug 42319: Make all the wordmark of the same size [tor-browser]
Bug 42387: Visual noise in 13.5a4 letterboxing [tor-browser]
Bug 42389: Betterboxing: gradient is never shown [tor-browser]
Bug 42398: Include Alpha and Nightly in MOZ_APP_DISPLAYNAME (and possibly in other places) [tor-browser]
Bug 42405: Fix betterboxing + findbar horizontal bounce if the scrollbar is not an overlay [tor-browser]
Bug 42414: Show ellipsis when the tor bridge address overflows [tor-browser]
Bug 42415: Improve focus styling for forced focus in bridge settings [tor-browser]
Bug 42421: Remove bridge option should be hidden for Lox bridges [tor-browser]
Bug 42423: Move temporary Lox Fluent strings to new file [tor-browser]
Bug 42425: Improve accessibility of the bridge emoji cells [tor-browser]
Bug 42443: Shrink the window to match letterboxing size when the emtpy area is doble-clicked [tor-browser]
Bug 42446: Improve accessible descriptions in built-in dialog [tor-browser]
Bug 42457: Loading icon for bridge pass (Lox) invites [tor-browser]
Bug 42458: Update the "Submit Feedback" link in "About Tor Browser" [tor-browser]
Bug 42476: Only allow Lox (invites) in alpha and nightly builds [tor-browser]
Bug 42489: Lox module notifications [tor-browser]
Bug 42490: Install svg from branding theme to browser/chrome/icons/default [tor-browser]
Bug 42496: Moat refresh bug [tor-browser]
Bug 42500: When startup window is maximized per letterboxing.rememberSize on startup, the restore button shrinks it to its minimum size [tor-browser]
Bug 42504: TB Bookmarks: Add the Tor forum .onion to the bookmarks [tor-browser]
Bug 42510: SETCONF Tor control protocol command should not be used when system Tor is configured / TOR_SKIP_LAUNCH=1 is not honored [tor-browser]
Bug 42511: false positive message: browser tab bar shows "Not connected" even though connected in a system Tor etc. context [tor-browser]
Bug 42520: Correctly record new initial window size after auto-shrinking [tor-browser]
Bug 42533: Add Lox notification for activeLoxId [tor-browser]
Bug 42540: Fix gNetworkStatus.deinint typo [tor-browser]
Bug 42541: Circuit Display does not work when using Conjure pluggable transport [tor-browser]
Bug 42542: Quirks when onion authentication prompt is shared between two tabs [tor-browser]
Bug 42573: Tweak language notification to avoid formatValue [tor-browser]
Bug 42574: Exempt pdf.js from letterboxing [tor-browser]
Bug 42583: Modify moz-support-link [tor-browser]
Bug 262: Mouse-over long links causes the browser element to re-center relative to width of status tooltip [mullvad-browser]
Bug 289: The Letterboxing>Content Alignment heading doesn't follow the Firefox design document capitalization [mullvad-browser]
Bug 41149: Add be, bg and pt-PT translations to nightlies [tor-browser-build]

Windows + macOS
Bug 41405: Win ≤8.1 and macOS ≤10.14 not supported in ESR 128 [tor-browser]
Bug 42347: Add a banner warning users about the upcoming EOL for Win ≤8.1 and macOS ≤10.14 [tor-browser]
Bug 42586: Add support link to OS deprecation message [tor-browser]

Windows
Bug 41859: Font used for IPs in circuit display is illegible [tor-browser]
Bug 41901: windows: FontSubstitutes can leak system locale [tor-browser]
Bug 42163: Make the 3rd party DLL blocklist obey portable mode [tor-browser]

macOS
Bug 40569: Create build-specific installer for macOS [tor-browser-build]

Linux
Bug 42438: Adapt the data import wizard to use the original $HOME on Linux [tor-browser]
Bug 41112: Fix indentation of projects/browser/RelativeLink/start-browser [tor-browser-build]
Bug 41136: Include *.deb in the list of files to gpg sign [tor-browser-build]

Android
Bug 41187: Improve Android's bridge settings UI [tor-browser]
Bug 41846: Disable new nimbus use in firefox-android 115 [tor-browser]
Bug 42017: TBA13: system/widget font tests: font-family not returned in getComputedStyle [tor-browser]
Bug 42248: Allow GeckoView to launch tor [tor-browser]
Bug 42249: Allow GeckoView to launch lyrebird [tor-browser]
Bug 42250: Allow Moat.sys.mjs to invoke lyrebird on Android [tor-browser]
Bug 42252: Plumb down TorConnect commands from firefox-android to GeckoView [tor-browser]
Bug 42253: Remove "New private tab" action and widget [tor-browser]
Bug 42259: Remove unused firefox branding from Tor Browser for Android [tor-browser]
Bug 42260: Add TBB artifacts to .gitignore [tor-browser]
Bug 42301: Make TorSettings interact with the old Android Settings [tor-browser]
Bug 42317: Update "Security Settings" menu item [tor-browser]
Bug 42323: Add a checkbox to enable the connect assist experiments on alpha [tor-browser]
Bug 42409: TTP-03-011 WP3: Potential DoS due to Deep Link abuse [tor-browser]
Bug 42427: Do not ship bridges as prefences anymore [tor-browser]
Bug 42486: firefox-android bridge settings sometimes dont save [tor-browser]
Bug 42522: The quick connect switch on Android seems too much on the right side [tor-browser]
Bug 42552: TBA: formatting APIs are en-US only [tor-browser]
Bug 42566: Remove 'Enable beta connection features' menu item in stable release channel [tor-browser]
Bug 42567: Remove 'Enable beta connection features' toggle [tor-browser]
Bug 42571: The new bootstrap on Android breaks if the browser goes in background [tor-browser]
Bug 42576: Backport Bug 1885171: use the private keyboard for prompts on Android [tor-browser]
Bug 42578: Reject Android "open in Tor Browser" intent [tor-browser]
Bug 42582: Accepted languages should use id and he on Android [tor-browser]
Bug 42593: Unable to disable bridges after they have been configured and successfully bootstrapped [tor-browser]
Bug 42618: Addons on Android have a stale cache [tor-browser]
Bug 42619: Cannot install Android addons from AMO [tor-browser]
Bug 42632: Don't display builtin bridges in provide bridge popup [tor-browser]
Bug 42636: A bad bridge line might get TBA stuck [tor-browser]
Bug 42648: Don't cancel tor bootstrap when opening settings from bootstrap [tor-browser]
Bug 41143: Enable multi-locales also on GeckoView [tor-browser-build]

Build System
All Platforms
Bug 42331: tb-dev fetch command is missing repository argument [tor-browser]
Bug 42516: Make tb-dev worktree-compatible [tor-browser]
Bug 42594: Update mach to work with Python 3.12 [tor-browser]
Bug 40852: Reproducible build of the the lox client library to wasm [tor-browser-build]
Bug 40983: Bump the various branches to 13.5 on main [tor-browser-build]
Bug 41001: Create Release Prep MR generating script [tor-browser-build]
Bug 41037: Set time on signing machine before starting signing [tor-browser-build]
Bug 41038: Add RPM dependencies to README [tor-browser-build]
Bug 41045: Dump more information about build times on Firefox [tor-browser-build]
Bug 41048: Drop the kcp-go project [tor-browser-build]
Bug 41073: Update documention about required packages for container-less build [tor-browser-build]
Bug 41081: Update detailsURL in tools/signing/nightly/update-responses-base-config.yml [tor-browser-build]
Bug 41148: Update projects/browser/Bundle-Data/Docs/Licenses/NoScript.txt [tor-browser-build]
Bug 41153: Update README for Ubuntu 24.04 unprivileged user namespace changes [tor-browser-build]
Bug 41154: Update keyring/boklm.gpg for new subkeys [tor-browser-build]
Bug 41161: Explicitly fetch tags in the release preparation script [tor-browser-build]
Bug 40071: Add an option to create zip files using 7z [rbm]
Bug 40073: We should remove ./ when using 7-zip for zip files [rbm]
Bug 40076: Correctly refresh file when computing input_files_id and a file is set as refresh_input [rbm]

Windows + macOS + Linux
Bug 42305: (Semi-)Automatically merge translation resources across tor browser releases (desktop) [tor-browser]
Bug 42501: Move `--disable-eme` to OS- and architecture-specific mozconfigs [tor-browser]
Bug 42519: Update the profile directory patch to check both for `system-install` and for `is-packaged-app` file [tor-browser]
Bug 41057: make fetch is not fetching mullvad repo [tor-browser-build]
Bug 41078: pt_config.json not touch'd before adding to omni.ja, resulting in build non-determinism [tor-browser-build]
Bug 41088: Remove use of projects/browser/run_scripts [tor-browser-build]

Windows
Bug 40606: Use Clang to compile NSIS [tor-browser-build]
Bug 40900: Update NSIS to 3.09 [tor-browser-build]
Bug 41065: Do a cleanup of the NSIS script [tor-browser-build]
Bug 41076: Include the ShellLink plugin in NSIS [tor-browser-build]
Bug 41097: authenticode-timestamping.sh fails to run again because tmp-timestamp already exists [tor-browser-build]
Bug 41150: Do not check for SSE2 on the Windows installer [tor-browser-build]

macOS
Bug 41084: $app_bundle is missing the final .app in projects/firefox/build [tor-browser-build]
Bug 41124: Since TB/MB 13.5a5 macos signed installers contain all .DS_Store [tor-browser-build]

Linux
Bug 42491: Add mozconfig-linux-aarch64 [tor-browser]
Bug 41046: Use the final path for Linux debug symbols [tor-browser-build]
Bug 41126: Make deb and rpm packages for Tor Browser [tor-browser-build]
Bug 41137: Build gcc-cross and tor-expert-bundle for linux-aarch64 [tor-browser-build]
Bug 41160: Enable build of Tor Browser rpm/deb packages for nightly only [tor-browser-build]

Android
Bug 40502: Do not recommend addons on Tor Browser [tor-browser]
Bug 42399: Re-enable minimization of JS for Android [tor-browser]
Bug 42568: Remove legacy tor dependencies from firefox-android [tor-browser]
Bug 42569: Remove tor-onion-proxy-library and and tor-android-service deployment/ingestion steps from firefox-android dev tools/scripts [tor-browser]
Bug 42570: Add tor-expert-bundle aar depoyment/ingestion step to firefox-android dev tools/scripts [tor-browser]
Bug 42581: Check if a file exists before trying to sign it in tools/tba-sign-devbuild.sh [tor-browser]
Bug 41080: Re-pack omni.ja with 7-zip on Android [tor-browser-build]
Bug 41082: Package tor expert bundle on android as .aar that firefox-android can use in lieu of tor-android-service with geckoview bootstrap [tor-browser-build]
Bug 41092: Use an uncompressed omni.ja to improve final apk compression. [tor-browser-build]
Bug 41093: Sign unsigned APKs instead of the QA-signed ones [tor-browser-build]
Bug 41127: Android testbuilds fail because of the too early MOZ_BUILD_DATE [tor-browser-build]
Bug 41139: Remove tor-android-service and tor-onion-proxy-library dependencies and ingestion steps from firefox-android config and build script [tor-browser-build]
Bug 41140: Remove tor-onion-proxy-library and tor-android-service projects from tor-browser-build [tor-browser-build]
Bug 41141: Add tor-expert-bundle aar dependency to firefox-android [tor-browser-build]
Bug 42201: Make the script sign all the channels for local builds [tor-browser]
Bug 42258: Replace the current boring "fiery android" icon we use for dev with the cool nightly icon [tor-browser]

best
-richard