Tor Browser for PC Windows 8.5.2 Alpha Privacy Tool

All Platforms:
Update Torbutton to 1.9.7.6.
Fix dimensions of new windows on macOS.
Translations update.
Update HTTPS-Everywhere to 2017.8.31.
Update NoScript to 5.0.9.
Add new obfs4 bridge to the built-in ones.
Fix broken HTTPS-Everywhere on higher security levels.
NoScript settings break WebExtensions add-ons.

All Platforms:
Update Tor to 0.3.0.9.
Update HTTPS-Everywhere to 5.2.19.

All Platforms:
Update Firefox to 52.2.0esr.
Update Tor to 0.3.0.8.
Update Torbutton to 1.9.7.4
Bug: Security Settings window too small on macOS 10.12.
Update HTTPS-Everywhere to 5.2.18.
Bug: NoScript's XSS filter freezes the browser.
OS X:
Bug: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0.

All Platforms:
Update Firefox to 52.1.2esr.
Update Tor to 0.3.0.7.
Update Torbutton to 1.9.7.3.
Adjust our content policy white list for ff52-esr.
Allow resources loaded by view-source://.
Ignore HTTP 304 responses when checking redirects.
Adapt our use of the nsIContentPolicy to e10s mode.
Update our JIT preferences in the security slider.
Make 'New Tor Circuit for this Site' work in ESR52.
Fix handling of catch-all circuit.
Fix circuit display under e10s.
e10s compatibility for New Identity.
Remove window resize implementation for now.
Make Torbutton multi process compatible.
Translations update.
Update Tor Launcher to 0.2.12.2:
Linux 7.0a4 broken after update due to unix: lines in torrc.
Don't ignore additional SocksPorts.
Don't show locale selection dialog.
Mark Tor Launcher as multiprocess compatible.
Add a README file.
Translations update.
Update HTTPS-Everywhere to 5.2.17.
Update NoScript to 5.0.5.
Update Go to 1.8.3.
Fix crash on about:addons page.
Fix crash when the external application helper dialog is invoked.
Download is stalled in non-e10s mode.
Canvas prompt is not shown in Tor Browser based on ESR52.
Add first-party domain to Permissions key.
Don't allow collection of local IP addresses.
Work around audio fingerprinting by disabling the Web Audio API.
Disable Touch API and add fingerprinting resistance as fallback.
Disable Social API.
Disable SpeechSynthesis API.
Disable WebGL2 API for now.
Disable additional mDNS code to avoid proxy bypasses.
Don't expose navigator.AddonManager to content.
Clean-up system extensions shipped in Firefox 52.
Use preference name 'referrer.hideOnionSource' everywhere.
Don't ship ClearKey EME system and update EME preferences.
Spoof window.navigator.hardwareConcurrency.
Suppress MediaError.message.
Round times exposed by Animation API to nearest 100ms.
about:support is partially broken.
Keep Graphite support disabled.
Enable Mixed Content Blocking.
Disable remote new tab pages.
Disable captive portal detection.
Disable Microsoft Family Safety support.
Make sure Mozilla's experiments are disabled.
Disable newly added Safebrowsing capabilities.
Disable Kinto-based blocklist update mechanism.
Fix format error in our pipeline patch.
Hide TLS error reporting checkbox.
Don't ignore additional SocksPorts.
Rip out potentially unsafe Rust code.
Improve about:cache page.
Backport of patch for bug 1329521 to fix assertion failure.
Identify and backport new patches from Firefox.
Fix broken feeds on higher security levels.
Fix broken certificate error pages on higher security levels.
Fix broken error pages on higher security levels.
Fix broken `about:cache` page on higher security levels.
Enable e10s by default on all supported platforms.
Always use esr policies for e10s.
Fix resizing issues after moving to a direct Firefox patch.
Modal dialogs are maximized in ESR52 nightly builds.
SVG is not disabled in Tor Browser based on ESR52.
Hide Referrer when leaving a .onion domain (improved patch).
Uncaught exception when opening ip-check.info.
Uncaught exception when clicking items in Library.
Isolate Page Info media previews to first party domain.
Isolate tab list menu item favicons to first party domain.
View-source requests are not isolated by first party domain.
Double-key cookies.
Fix XML parsing error.
Neuter fingerprinting with Battery API.
16886: "Add-on compatibility check dialog" contains Firefox logo.
TBB zooms text when resizing browser window.
Untrust Blue Coat CA.
Avoid confusing warning that favicon load request got cancelled.
Backport fixes for memory leaks investigation.
ltn.com.tw is broken in Tor Browser.
Commenting on website is broken due to CAPTCHA not being displayed.
Re base Tor Browser patches to 52 ESR.
Add IPv6 address for Lisbeth:443 obfs4 bridge.
Add default obfs4 bridges frosty and dragon.
Windows:
Prevent access to file://.
Make use of HeapEnableTerminationOnCorruption.
Make sure our Windows updates can deal with the SSE2 requirement.
Fix build bustage with FIREFOX_52_0_2esr_RELEASE for Windows.
OS X:
Don't allow privilege escalation during update.
Fix broken default search engine on macOS.
Use our default bookmarks on OSX.
Non-admin users can't access Tor Browser on macOS.
Fix inconsistent generation of MOZ_MACBUNDLE_ID.
Make Firefox and Tor Browser distinct macOS apps.
Backport OSX SetupMacCommandLine updater fixes.
Don't download GMPs via the local fallback.
Linux:
Remove ClearKey related library stripping.
Fix update error during update to 7.0a3.
Fix use of hardened wrapper for Firefox build.
Fix runtime error on CentOS 6.
Don't download GMPs via the local fallback.
Android:
Disable RtspMediaResource stuff in Orfox.
Build system Windows:
Fix reproducibility of accessibility code for Windows.
Create patches to fix mingw-w64 compilation of Firefox ESR 52.
Bump mingw-w64 commit to help with sandbox compilation.
Use own Yasm for Firefox cross-compilation.
OS X:
Updating to clang 3.8.0
Remove old GCC tool chain and macOS SDK.
Remove unused macOS helper scripts.
Don't use old GCC tool chain anymore for utils.
Replace our old GCC tool chain in PT descriptor.
ESR52 based Tor Browser only runs on macOS 10.9+.
Remove clang PIE wrappers.
Linux:
NSS libraries are missing from mar-tools archive.
Adapt Linux Firefox descriptor to ESR52 (use GTK2).
Linux bundles based on ESR 52 are not reproducible anymore.
Fix broken ASan builds when switching to ESR 52.
Use hardening-wrapper when building GCC.
Fix hardening of libraries built in linux/gitian-utils.yml.

All Platforms:
Update Firefox to 45.9.0esr.
Update HTTPS-Everywhere to 5.2.14.
Update NoScript to 5.0.2.
Don't remove Authorization header on subdomains (e.g. Twitter).
Make sure our Windows updates can deal with the SSE2 requirement.
Add new obfs4 bridges.
Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend.
Windows:
Fix Tor Browser crashing on github.com.

All Platforms:
Update Firefox to 45.8.0esr.
Tor to 0.2.9.10.
OpenSSL to 1.0.2k.
Update Torbutton to 1.9.6.14.
Allow leaking of resource/chrome URIs (off by default).
Add link for zh manual and create manual links dynamically.
Non-usable scrollbar appears in tor browser security settings.
Translation updates.
Update HTTPS-Everywhere to 5.2.11.
Restore W^X JIT implementation removed from ESR45.
Remove scramblesuit bridge.
Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge.
Linux:
Update the "Using a system-installed Tor" section in start script.

# All Platforms
- Update Firefox to 45.7.0esr.
- Tor to 0.2.9.9.
- OpenSSL to 1.0.2j.
# Update Torbutton to 1.9.6.12.
- Timezone spoofing moved to tor-browser.git.
- Move referrer spoofing for .onion domains into tor-browser.git.
- Block addon resource and url fingerprinting with nsIContentPolicy.
- Allow the directory listing stylesheet in the content policy.
- Whitelist internal URLs that Firefox requires for media.
- Avoid SOCKS auth and NEWNYM collisions when sharing a tor client.
- Improve external app launch handling and associated warnings.
- Remove/synchronize Torbutton SOCKS pref logic.
- GETINFO response parser doesn't handle AF_UNIX entries + IPv6.
- Make "JavaScript disabled" more visible in Security Slider.
- Use pt-BR strings from now on.
- Add links to Tor Browser User Manual.
- Fix non-rendering arrow on OS X.
- Fix bad preferences.xul dimensions.
- Use DuckDuckGo on about:tor.
- Hide the update check menu entry when running under the sandbox.
- Move resizing code to tor-browser.git.
- Change security slider to 3 options.
- Enhance security slider's custom mode.
- Disable remote jar on all security levels.
- Move privacy checkboxes to about:preferences#privacy.
- Add tooltips to explain our privacy checkboxes.
- Allow security settings dialog to resize.
- Remove 'Restore Defaults' button.
- Prevent redundant dialogs opening.
- Remove helpdesk link from about:tor.
- Add links for pt, es, and fr Tor Browser manuals.
- Remove obsolete StartPage locale strings.
- Remove 2016 donation banner.
- Remove obsolete toolbar button code.
- Remove unused Torbutton code and strings.
- Code clean-up.
- Translation updates
# Update Tor Launcher to 0.2.10.3.
- Set CurProcD for Thunderbird/Instantbird.
- Remove special handling for Instantbird/Thunderbird.
- Translation updates.
# Update HTTPS-Everywhere to 5.2.9.
# Update NoScript to 2.9.5.3.
- Spoof timezone with Firefox patch.
- Spoof referrer when leaving a .onion domain.
- Write C++ patch for external app launch handling.
- Size new windows to 1000x1000 or nearest 200x100 (Firefox patch).
- Mark JIT pages as non-writable.
- Always block remote jar files.
- Reduce timing precision for AudioContext, HTMLMediaElement, and MediaStream.
- Remove support for SHA-1 HPKP pins.
- KeyboardEvents are only rounding to 100ms.
- Isolate preconnect requests to URL bar domain.
- Prevent millisecond resolution leaks in File API.
- Allow javascript: links from HTTPS first party pages.
- Move privacy checkboxes to about:preferences#privacy.
- Fix broken preferences tab in non-en-US alpha bundles.
- Fix wrong update URL in alpha bundles.
- Point the update URL to aus1.torproject.org.
- Start using pt-BR instead of pt-PT for Portuguese.
- Backport fix for local path disclosure after drag and drop.
- Backport fix for broken MP3-playback.
- Isolate SharedWorker script requests to first party.
- Add script to run all Tor Browser regression tests.
- DuckDuckGo does not work with JavaScript disabled.
- Enhance about:tbupdate page.
- Code clean-up.
# Windows
- On Windows, check TZ for timezone first.
- Maximizing window and restarting leads to non-rounded window size.
- Rounded inner window accidentally grows to non-rounded size.
# OS X
- Badly resized window due to security slider notification bar on OS X.
- Make the build PIE on OSX.
# Linux
- Updater breaks if unix domain sockets are used.
- Weird resizing dance on Tor Browser startup.
# Build system
* All platforms
- Upgrade Go to 1.7.4.
- Make the downloads.json file reproducible.
- Don't apply OpenSSL patch anymore.
- Set MOZ_BUILD_DATE based on Firefox version.
- Remove some uses of libfaketime.
- Make zip and tar helpers generate reproducible archives.
# OS X
- Make OS X Tor archive reproducible again.
- Make OS X builds reproducible (use clang for compiling tor).
- Make OS X builds reproducible (getting libfaketime back).
- Fix incremental updates by taking signatures into account.
- In dmg2mar, extract old mar file to copy permissions to the new one.

# All Platforms
* Update Firefox to 45.6.0esr.
* Update Tor to 0.2.8.11.
* Update Torbutton to 1.9.5.13.
- Donation banner improvements.
* Update HTTPS-Everywhere to 5.2.8.
* Use non-/html search engine URL for DuckDuckGo search plugins.
* Activate iat-mode for certain obfs4 bridges.
* Uncomment NX01 default obfs4 bridge.
* Rotate ports a third time for default obfs4 bridges.

# All Platforms
- Update Firefox to 45.5.1esr.
- Update NoScript to 2.9.5.2.

# All Platforms
* Update Firefox to 45.5.0esr.
* Update Tor to 0.2.8.9.
* Update OpenSSL to 1.0.1u.
* Update Torbutton to 1.9.5.12.
- Bug: Add donation banner on about:tor for 2016 campaign.
- Translation updates.
* Update Tor Launcher to 0.2.9.4.
- Bug: Do not open progress window if tor doesn't get started.
- Bug: Wrong location for meek browser profile on OS X.
* Update HTTPS-Everywhere to 5.2.7.
* Update meek to 0.25.
- Bug: Wrong location for meek browser profile on OS X.
- Bug: Shut down meek-http-helper cleanly if built with Go > 1.5.4.
* Bug: Add dgoulet's bridge and add another one commented out.
* Bug: Rotate ports again for default obfs4 bridges.
* Bug: Switch default search engine to DuckDuckGo.
* Bug: Don't unpack HTTPS Everywhere anymore.
# Windows
- Bug: Add tor-gencert.exe to expert bundle.
# OS X
- Bug: Windows don't drag on macOS Sierra anymore.
- Bug: Meek fails on macOS Sierra if built with Go < 1.7.
# Build system
* All platforms.
- Bug: Upgrade Go to 1.7.3.

# All Platforms
- Update Firefox to 45.4.0esr
- Update Tor to 0.2.8.7
- Update Torbutton to 1.9.5.7
* Bug: Clear site security settings during New Identity
* Bug: "Maximizing Tor Browser" Notification can exist multiple times
- Update HTTPS-Everywhere to 5.2.4
* Bug: Rotate ports for default obfs4 bridges
* Bug: Add update support for unpacked HTTPS Everywhere
# Windows
- Bug: Remove old updater files left on disk after upgrade to 6.x
# Linux
- Bug: Remove old updater files left on disk after upgrade to 6.x
# Android
- Bug: Store browser data in the app home directory
# Build system
* All platforms
- Upgrade Go to 1.4.3

# All Platforms
- Update Tor to 0.2.8.6.
- Update NoScript to 2.9.0.14.
- Bug: Disable installation of system addons.