Release notes v2.1.14

This is an important security update which includes the latest Tor security release and fixes vulnerabilities identified during our recent security audit.
Updating to this version is required to continue trading.

Tor security update

Update to latest Tor security release v0.4.9.14

Bisq Easy Trade Validation

Requests to take an offer must match the maker's current offer and price before the trade is stored.
Buyers enforce seller reputation limits when creating or taking offers, including trades initiated through the API or a mobile node running this version.
Bitcoin URI and Lightning invoice amounts are validated against the agreed trade amount.

Stronger Network Integrity and Tor Privacy

New storage signatures protect version information, ordering fields, and payloads. Owner-specific storage keys prevent publishers from interfering with each other's data.
Tor isolates outgoing connections between identities and uses fresh isolation credentials for each HTTP connection.
Stricter limits apply to network message sizes and pending queues.

Desktop and Connected Devices

Support chat gains Markdown support and clearer link destinations. Mentions and private-chat navigation are improved.
Bisq Easy trade history adds CSV export and an action to contact the trading peer. Language settings add country and currency selection.
Bisq Connect adds device listing, device revocation, and session expiry.
APIs expand support for chat, contacts, alerts, and payment accounts. They no longer return private keys for existing identities.

More Reliable Storage

Storage files are replaced only after the new file is ready, preserving the previous file until then. Write failures are now reported correctly.
Invalid records no longer prevent remaining records from being processed during startup replay or bonded-role revalidation.
Unreadable storage files are retained for 90 days, and the desktop app lists the affected files.

Security Notice: Do Not Share Old Log Files

Log files created by Bisq versions 2.1.3 through 2.1.13 contain the onion private keys for all identities on the node. On nodes with the API enabled, they also contain user-profile private keys.

On its first start, Bisq 2.1.14 redacts these keys from log files in its data directory. Other copies remain exposed, including previously shared logs, backups, and output captured by docker logs. Do not share these copies.

Mandatory Update Before November 25, 2026

All nodes must update to Bisq 2.1.14 or later before November 25, 2026.

From that time, updated nodes will require V2 storage signatures. Older versions will experience network connectivity and data transmission issues and will no longer be supported.

Note that there is an issue with the in-app macOS download now that both Intel and Apple Silicon are supported.
To ensure that in-app updates work correctly for Apple Silicon users, we renamed Bisq-aarch64-2.1.13.dmg to Bisq-2.1.13.dmg.
As a result, users on Intel-based Macs may receive an incompatible version through the in-app download process and will need to download the correct Intel build manually.

Installation

macOS

Bisq does not use Apple's notarization process (see why).
For that reason you will see that (misleading) alert:

Grant permissions by:

run sudo xattr -rd com.apple.quarantine /Applications/Bisq2.app in a terminal (type Terminal in the Apple search box)
open Bisq2 again

More details can be found here.

Windows

For similar reasons you will get that warning at Windows: Windows protected your PC

Click the More info button when prompted
Click the Run anyway button when prompted