This is our first alpha release based on Firefox ESR 140. Now would be a
good time to verify your packaging/automation scripts still work before
15.0 stabilizes in September! :)
Changelog:
> Tor Browser 15.0a1 - July 29 2025
> * All Platforms
> * Updated NoScript to 13.0.8
> * Updated OpenSSL to 3.5.1
> * Bug 43397: Click to play should override "Any capability blocked in the top document must be blocked in its subdocuments too" [tor-browser]
> * Bug 43772: Do not use official branding for BB/TB/MB [tor-browser]
> * Bug 43783: Tighten up the SecurityLevel module to enforce new UX flow [tor-browser]
> * Bug 43784: Get confirmation from NoScript that settings are applied [tor-browser]
> * Bug 43853: DomainFrontedRequests: setData is no longer a function [tor-browser]
> * Bug 43880: Update moat's domain front url [tor-browser]
> * Bug 43993: Backport Security Fixes from Firefox 141 [tor-browser]
> * Bug 44000: Rebase Tor Browse Alpha onto 140.1.0esr [tor-browser]
> * Bug 41502: Application services build is failing on isNetworkAllowed() [tor-browser-build]
> * Bug 41508: Switch built-in meek bridge to meek-unredacted [tor-browser-build]
> * Bug 41515: Bump version of Conjure to include P173 improvements [tor-browser-build]
> * Windows + macOS + Linux
> * Updated Firefox to 140.1.0esr
> * Bug 42738: Tidy up the commit structure for browser updates UI [tor-browser]
> * Bug 43590: Move letterboxing rules out of browser/base/content/browser.css [tor-browser]
> * Bug 43610: Use newer CSS variable names for ESR 140 [tor-browser]
> * Bug 43629: All migrations in _migrateUIBB are run for new profiles [tor-browser]
> * Bug 43635: Console noise due to the x-load capability not being localized [tor-browser]
> * Bug 43638: Fix up our `<command>` elements [tor-browser]
> * Bug 43765: Temporarily disable Lox [tor-browser]
> * Bug 43766: Only save the relevant TorSettings changes to preferences. [tor-browser]
> * Bug 43776: Set branding files for l10n merging [tor-browser]
> * Bug 43782: Add new UX flow for changing security level (Desktop) [tor-browser]
> * Bug 43879: tor-branding.css declarations are overwritten [tor-browser]
> * Bug 43886: Fix new tab for ESR 140 [tor-browser]
> * Bug 43905: base-browser.ftl missing from about:addons [tor-browser]
> * Bug 43906: Extension.sys.mjs change in the wrong commit [tor-browser]
> * Bug 43913: Bizarre right-clicking issues: menu items blanked out and/or not working; too many items in the right-click menu; different right-clicking menu displayed initially for links [tor-browser]
> * Bug 43929: two about:tor pages opened after update [tor-browser]
> * Bug 43930: Onionize toggle not centre aligned in about:tor [tor-browser]
> * Bug 43947: Console error from ContentBlockingPrefs.init [tor-browser]
> * Bug 43989: Switch off AI chatbot preference [tor-browser]
> * Android
> * Updated GeckoView to 140.1.0esr
> * Bug 43577: Flush settings fails on Android [tor-browser]
> * Bug 43786: Add new UX flow for changing security level (Android) [tor-browser]
> * Bug 43855: brand.properties merging on Android is broken in 140 [tor-browser]
> * Bug 44029: Search/url bar doesn't work on android after ESR 140 [tor-browser]
> * Bug 44036: Crash on opening "Search Settings" on android [tor-browser]
> * Bug 41494: Update GeckoView build scripts for ESR140 [tor-browser-build]
> * Build System
> * All Platforms
> * Bug 43615: Add Gitlab Issue and Merge request templates [tor-browser]
> * Bug 43616: Customize Gitlab Issue and Merge templates [tor-browser]
> * Bug 43777: Disable ./mach telemetry [tor-browser]
> * Bug 43891: Update the translation CI to use the new mozilla versions [tor-browser]
> * Bug 43954: Update tb-dev to handle lightweight tags [tor-browser]
> * Bug 43962: update tb-dev auto-fixup for git 2.50 [tor-browser]
> * Bug 34434: Remove unused variables from rbm.conf [tor-browser-build]
> * Bug 40994: Add support in do-all-signing to sign release for some archs only [tor-browser-build]
> * Bug 41227: Update projects/common/list_toolchain_updates-common-firefox-geckoview to include check for binutils [tor-browser-build]
> * Bug 41432: Bump OpenSSL to >= 3.5.0 [tor-browser-build]
> * Bug 41434: Go updates shouldn't target all platforms until macOS is on legacy in the changelogs [tor-browser-build]
> * Bug 41435: Skip update-responses update entries for versions without incremental or full update mar [tor-browser-build]
> * Bug 41444: Build artifacts to support artifact builds of Tor/Muillvad/Base Browser [tor-browser-build]
> * Bug 41448: Update toolchains for Firefox ESR 140 [tor-browser-build]
> * Bug 41449: Add prefix to update-responses xml files [tor-browser-build]
> * Bug 41451: When update-responses contains multiple versions, .htaccess only has one no-update.xml redirect [tor-browser-build]
> * Bug 41459: Update taskcluster/ci paths in README and comments [tor-browser-build]
> * Bug 41460: Add brizental to the list of people who can sign Tor Browser and Mullvad Browser tags [tor-browser-build]
> * Bug 41465: Disable development artifacts generation by default, keep it enabled for nightly builds [tor-browser-build]
> * Bug 41467: Remove list_toolchain_updates-firefox-android from Makefile [tor-browser-build]
> * Bug 41477: Update keyring/boklm.gpg for new subkeys (2025) [tor-browser-build]
> * Bug 41478: Add vim and others missing basic tools to base container image [tor-browser-build]
> * Bug 41486: Track bundletool and osslicenses-plugin versions in list_toolchain_updates_checks [tor-browser-build]
> * Bug 41496: Clean up unused projects [tor-browser-build]
> * Bug 41498: Update keyring/morgan.gpg with updated public key [tor-browser-build]
> * Bug 41501: cargo_vendor generated archive maintains timestamps [tor-browser-build]
> * Bug 41514: Remove var/build_go_lib from projects/go/config [tor-browser-build]
> * Bug 40084: Always use bash for the debug terminal [rbm]
> * Windows + macOS + Linux
> * Bug 41452: Skip update-responses xml files for versions which don't have incrementals [tor-browser-build]
> * Bug 41457: Set mar IDs as env variables in tor-browser-build [tor-browser-build]
> * Windows + Linux + Android
> * Updated Go to 1.23.11
> * macOS
> * Bug 41503: Error 403 when downloading macOS SDK [tor-browser-build]
> * Linux
> * Bug 41458: Ship geckodriver only on Linux [tor-browser-build]
> * Bug 41488: Disable sys/random.h for Node.js [tor-browser-build]
> * Android
> * Bug 43984: Update android build scripts and docs for ESR 140 [tor-browser]
> * Bug 43987: 140 Android is not reproducible [tor-browser]
> * Bug 41280: download-android-<arch>.json does not get updated for android-only releases [tor-browser-build]
> * Bug 41453: Update application-services and uniffi-rs for ESR140 [tor-browser-build]
> * Bug 41483: geckoview_example-withGeckoBinaries-....apk doesn't exist anymore in Firefox 140 [tor-browser-build]
> * Bug 41484: Create a fork of application-services [tor-browser-build]
> * Bug 41499: Android nightly builds are broken [tor-browser-build]
> * Bug 41500: Optimize tor and its dependencies for size on Android [tor-browser-build]
> * Bug 41506: Use appilcation-services branch for nightlies builds [tor-browser-build]
> * Bug 41507: Single-arch build fails because artifacts don't have arch subdirectories [tor-browser-build]
