Greetings,
We just released tor 0.4.9.16. This is mostly an emergency release aimed at
fixing a problem at the directory authority problem and thus only affects them.
Here is the announcement:
https://forum.torproject.org/t/security-release-0-4-9-16/22372
ChangeLog below:
Changes in version 0.4.9.16 - 2026-11-04
This is an emergency release affecting only directory authorities. It
includes fixes to address the thundering herd caused by the new required
protover values introduced in the previous release.
o Major features (authority):
- Work around a bug where old clients did not, in fact, correctly
handle unparseable microdescriptors in the way that we had hoped
that they would. We triggered this bug by omitting TAP keys from
microdescriptors. To solve this issue, instead of omitting TAP
keys, we replace them with a dummy TAP key. (This is safe, because
nothing has used TAP since v2 onion services.)
- New consensus method 38 added for this TAP dummy key.
- Revert back the required protover version for both "Desc" and "Microdesc"
from 3 to 2 which is causing <= 0.4.8.x clients to exit(1).
o Minor features (fallbackdir):
- Regenerate fallback directories generated on November 04, 2026.
o Minor bugfixes (dirauth):
- Let dir auth fetches be twice as big, to allow for the fact that 9
votes can exceed 16MB even compressed. Part of 41471; bugfix
on 0.3.5.1-alpha.
Cheers!
David
--
UspxqdwTnlbyVc5mmC4WYzmMj1/0ZB5xPThRiZISYXE=
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ tor-announce mailing list -- tor-announce@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-announce-leave@xxxxxxxxxxxxxxxxxxxx