Update to latest Tor please!

frustratedramp · July 20, 2026, 7:26am

We need the latest Tor to be compatible and communicate with nodes without issues. Tor is introducing some breaking changes from september if i remember thanks!

reuben · July 23, 2026, 1:12pm

On it.

github.com/firoorg/firo

Utils and libraries: Update Tor to 0.4.9.11 (#1876)

master ← codex/update-tor-0.4.9.11

opened 01:09PM - 23 Jul 26 UTC

reubenyap

+11 -60

## PR intention Update Firo's bundled C Tor from 0.4.8.9 to 0.4.9.11. Tor 0.4.…8 reached end of life on 1 June 2026, and the Tor Project plans to stop supporting 0.4.8 and earlier on the network from 1 September 2026. Those clients do not understand the descriptor formats that omit legacy TAP onion keys and carry the new family identifiers. Tor 0.4.9 implements those formats, so updating the bundled library keeps `-torsetup` compatible without adding a Firo-side protocol workaround. References: - [Tor 0.4.8 sunset and 1 September cutoff](https://blog.torproject.org/sunsetting-tor-048/) - [Tor 0.4.9.11 security release](https://forum.torproject.org/t/security-release-0-4-9-11/21786) - [Official 0.4.9.11 checksum](https://dist.torproject.org/tor-0.4.9.11.tar.gz.sha256sum) ## Code changes brief - Pin Tor 0.4.9.11 and its official SHA-256. - Build and stage Tor's upstream `libtor.a` target. - Remove Firo's hard-coded list of 42 internal Tor archives and the manual extraction/repack step. - Rebase the existing `configure.patch` hunk locations onto 0.4.9.11; its intended platform fixes are unchanged. The archive change is required because Tor 0.4.9 adds `src/ext/polyval/libpolyval.a`. The old manual list does not include it. Using Tor's aggregate target keeps the archive complete for configured and future internal libraries, uses the configured `AR`/`RANLIB`, and preserves Tor's Darwin archive handling. No Firo SOCKS or control-port code changes are needed: the September incompatibility is handled inside Tor's directory parser. Firo's existing `PROTOCOLINFO 1`, SAFECOOKIE, SOCKS5, and v3 `ADD_ONION` usage remains supported. ### Review guide The behavioral change is confined to `depends/packages/tor.mk`. `depends/patches/tor/configure.patch` only updates source blob IDs and hunk positions for the new release. The branch is one commit and two files: 11 additions, 60 deletions. ### Validation performed - Verified the downloaded tarball against the official SHA-256. - Applied `configure.patch` to the official 0.4.9.11 source with `patch --dry-run --fuzz=0 -p1`. - Built the patched upstream `libtor.a` target on Windows/MSYS and linked `src/app/tor.exe`. - Confirmed the archive contains `libpolyval_a-polyval.o` and exports `tor_main` and `tor_run_main`. - Confirmed the linked executable reports Tor 0.4.9.11. - Ran `git diff --check`. ### Suggested reviewer checks ```sh make -C depends -j"$(nproc)" tor make -C depends HOST=x86_64-w64-mingw32 -j"$(nproc)" tor ``` The normal CI Linux, Windows, macOS, and Guix Darwin builds provide the remaining platform coverage.

reuben · July 23, 2026, 6:55pm

Merged. Would be out in next release.