Top 10 changes since 17.9.5
-
Security audit fixes (ORB-02 series) from bitmold. These close the findings from the recent audit:
- High: Tor/VPN could be disabled because cleanup was incomplete (ORB-02-011).
- Medium: Kindness Mode restart could bypass consent (ORB-02-004).
- Medium: Android network hardening (ORB-02-005).
- Low: missing path traversal protection (ORB-02-008).
- Hardcoded AWS SQS credentials removed (ORB-02-014).
- Power receiver hardened (ORB-02-002).
- Camo mode now respects Kindness Mode notifications (ORB-02-010).
-
Other apps can no longer start Orbot from bitmold. External start was first turned off by default (ORB-02-013), then StartTorReceiver was deleted entirely. On Android 14+ that path would have thrown a
SecurityException anyway. -
Kindness Mode onboarding redesign from Benjamin Erhart. The initial, testing, approved and declined screens were reworked, new explainer and warning screens were added, and landscape layout got better.
bitmold then split the testing dialog into three dialogs and fixed UI bugs. -
Kindness Mode reliability from munzzyy (Cole Munz):
- Kindness Mode now comes back when the system shuts it down (#1799, #1783).
- The watchdog moved from WorkManager to JobScheduler.
- Snowflake proxy start/stop races are fixed, and UPnP mappings survive restarts (#1183, #1795).
- The network callback now follows the Wi-Fi setting.
Follow-ups:
- bitmold fixed the multiple-constraints bug and separated start/stop from the UI toggle.
- vbrekher fixed the Kindness preference listener (#1808).
- meenbeese (Kuzey Bilgin) made the weekly Snowflake count reset lazily by week.
-
Bridge parsing fixes and tests from munzzyy:
- Transport lines with no fingerprint now parse.
- The Bridge.doh getter was reading the dot parameter by mistake.
- Unicode spaces in custom bridge input are now normalized (#1695).
- New unit tests cover bridge line parsing.
-
Tor core and network data from n8fr8 and bitmold:
- Moved to the new tor-android release (tagged 17.9.6-BETA-1-tor-0.4.9.12).
- SSL libraries updated.
- Built-in bridges refreshed several times.
- GeoIP data updated to the IPFire location DB (2026/09/08).
-
Proxy, port and preference fixes:
-
Toolchain and dependency upgrades from bitmold:
- AGP 9.3.0 → 9.4.0, Gradle 9.7.1, Kotlin 2.4.x.
- Compiles against API 37.1.
- NDK 30 LTS.
- AppCompat 1.8.0 and androidx navigation 2.10.1.
- hev-socks5-tunnel moved back and forth between 2.15, 2.16 and 2.17.1, with a native interface fix from n8fr8.
-
Code cleanup and lint mostly from bitmold:
- Many lint warnings fixed in OrbotService, including nullability annotations and replacing deprecated APIs.
- Legacy activity-result file I/O removed (inspired by meenbeese, #1800).
- Duplicate and unused strings and assets removed.
- All AlertDialogs now use AppCompat and the Orbot theme.
- meenbeese removed a dead handler callback interface.
- Private DNS status now shows under the connect button.
-
CI, UX polish and translations:
- meenbeese removed Bitrise CI and made unit tests run in GitHub Actions.
- syphyr switched the status bar to white icons.
- xhon-pelushi made the Kindness test dialog reachable at large font sizes.
- bitmold added Ukraine to the exit node list (#1764) and fixed the UK exit node and the Uzbekistan DNSTT config.
- Weblate translations came in for about 18 languages, including new Swahili. Contributors include Aindriú Mac Giolla Eoin, Sketch6580, Ecron, Random, jonnysemon, Akhil Raj and others.
Commit counts (merges excluded): bitmold 108, munzzyy/Cole Munz 10, Benjamin Erhart 9, n8fr8 8, meenbeese/Kuzey Bilgin 5, vbrekher 3, syphyr 1, xhon-pelushi 1, plus about 25 translators and dependabot.
7b2bb25 (HEAD -> master, origin/master, origin/HEAD) update bridges
b3259f3 update ssl libs
158223e (tag: 17.9.6-BETA-1-tor-0.4.9.12) update to tor-android 0.4.8.12
bfda8fb Merge branch 'master' of github.com:guardianproject/orbot
0397c9b update versioncode
d89c41d Merge pull request #1823 from weblate/weblate-guardianproject-orbot
668e5ea Added translation using Weblate (Swahili)
809c4ea use constants defined in TorControlCommand.java from jtorctl
c063f13 use latest LTS NDK toolchain in app/build.gradle.kts NDK Version 29.0.14206865 -> 30.0.16248370
6720b85 Ran ./gradlew updateBuiltinBridges to prepare for a new Orbot release
7857fb5 formatted libs.versions.toml with ./gradlew versionCatalogFormat
8b16850 Update geoip files to match ipfire location db, 2026/09/08. https://gitlab.torproject.org/tpo/core/tor/-/commit/cace84c1d65dbf493053c3ad33ed53d34e28d46b
c799fb4 Merge pull request #1821 from weblate/weblate-guardianproject-orbot
206a0a2 Translated using Weblate (French)
831d8bf removed more - unused java pathways
74a5d98 clean up manifest, and remove empty,text-less string resource from Mali (linter catch!)
3ae39bc (origin/no-background-starts) Remove StartTorReceiver and the vestigial way of having other app's start Orbot - Deletes StartTorReceiver, Various String Resources - Starting with Android 14, Orbot would either have had to be the primary VPN app OR have obtained the SCHEDULE_EXACT_ALARMS permission from the user at runtime - if neither of these things are true, then Orbot would throw a SecurityException for starting a ForegroundService - Relates to ORB-02-013 WP3, wherein this feature was turned on by default. This was removed in e2a9355, however at this point it makes more sense to just get rid of the whole thing
d3abb7c native interface needs to be fixed for hev-socks5-tunnel 2.17.1
f3b79e3 bump hev-socks5-tunnel to 2.17.1
f3b7c64 fixed remaining regressions (see last commit)
96ebd6f Fixed regression introduced after last build with app based routing
436c2c4 - Fixed issue with multiple kindness mode constraints - Decoupled start/stop from the UI toggle
f82ca6f Merge branch 'kindness-stays-on'
3afb29a - added even more logs - remove unhelpful and cluttering log from recent work in PreferenceProvider.kt
c542606 Re: #1805, the logic for sonwflake prefernce change doesnt need to exist in its own file
2fa7b4e Cleanups on #1807 PR regaridng stuck kindness mode
120c6c5 add Ukraine {UA} to exit node dropdown, closes #1764
2c731e5 cleanups/linting for #1807
d5b5876 Merge branch 'master' into kindness-stays-on
1150ec3 add annotations to OrbotVpnManager.java to satisfy linker after reviewing and merging #1814
da8810a Merge remote-tracking branch 'meenbeese/handler'
ae5b0cf Merge pull request #1820 from weblate/weblate-guardianproject-orbot
6cd8464 Translated using Weblate (French)
57793b0 Merge remote-tracking branch 'weblategithub/weblate-guardianproject-orbot'
dde6f35 Translated using Weblate (French)
0380e34 Merge pull request #1818 from weblate/weblate-guardianproject-orbot
943a5ee Translated using Weblate (French)
a9fb844 weblate git trouble
f800ca1 Merge remote-tracking branch 'weblate/master'
d04d6cb Translated using Weblate (French)
790b5f3 Merge pull request #1816 from weblate/weblate-guardianproject-orbot
4f7f11a fixed casing
4578d31 Translated using Weblate (Afrikaans)
85bd38f Translated using Weblate (French)
fce2348 Remove dead handler callback interface
b33440e Use hev-socks-tunnel from master
c27d1c8 Merge branch 'master' into HEAD
71398bf Cleanups in kindness mode notificaiton logic made when testing #1805
fb32f79 Merge remote-tracking branch 'munzzyy/kindness-callback-respects-wifi-pref'
54d9382 Some cleanups to #1802 - the PR where the weekly snowflakes served worker is removed...
a9178f3 Merge remote-tracking branch 'meenbeese/work'
a1d0c1f add comments to SnowflakeProxyServiceTest for tests pertaining to #1808 and #1810
ed63008 Merge remote-tracking branch 'vbrekher/fix/1808-kindness-preference-listener'
8b97e6d Dealt with many Java lint warnings in OrbotService - explicitly use @nonnull @nullable when trivial to do so, for cleaner kotlin interop + just makes things more sane - removed synthetic accessors generated by compiler for OrbotService's many inner classes - replaced two deprecated android methods (stopForeground() and a method used to update notification locale changes) with the correct, non-deprecated alternative
c2538f1 verified that #1809 fixes #1404, added comment
e31011b comments tidying up recently merged #1809
bfe9edf Merge remote-tracking branch 'munzzyy/fix-log-duplication'
060ccab Additional small cleanups re #1812 - use constant for the -1 when HTTP/SOCKS/etc ports aren't set, instead of a lot of magic nums in OrbotActivity/MoreFragment
ad313a6 Cleanup around #1812
4e7f03e Merge remote-tracking branch 'vbrekher/fix/1134-independent-proxy-ports'
8d0ecef use correct gradlew for running unit tests in github actions, re: #1813
15ad3a0 Merge remote-tracking branch 'meenbeese/workflow'
d35a6e6 mistakenly committed something re #1811
a7ee6e6 mistakenly committed something re #1811
b6616d3 log for failure case of #1811
82fc287 removed unneeded type arguement in #1811 preference provider crash fix
07e87b1 runtests.sh shortcut
48c6503 Merge remote-tracking branch 'vbrekher/fix/1760-preference-provider-crash'
95807ff Revert "native interface needs to be fixed for hev-socks5-tunnel 2.17.1"
a32f98d --service flag for view_logs_tmux.sh
a77f413 revert hev-socks5-tunnel to 2.16.0
9ea7e16 update builtin bridges from torproject
54a302a androidx.navigation:navigation-fragment-ktx:2.10.0 (androidx-navigation-fragment-ktx) -> 2.10.1
ee80928 Run units tests from actions
40dfb72 Show configured proxy ports independently
8fa6457 fix preference provider crash
516db21 fix kindness preference listener
b081bb9 Fix log lines being stored in duplicate
76dc4c9 use serialization kotlin plugin for v 2.4.20 of language
fea59ea use geoip and geoip6 from tor-0.4.9.12
580950d Merge pull request #1804 from syphyr/white_icon
2a074f9 Merge pull request #1806 from weblate/weblate-guardianproject-orbot
2cc1be6 kindness: run the watchdog on JobScheduler instead of WorkManager
d6f7ecc bring kindness mode back when the system takes it down #1799 #1783
c6274e1 fix snowflake proxy start/stop races and remember UPnP mappings across restarts #1183 #1795
bfc3d40 Translated using Weblate (Persian)
72de133 Register the kindness network callback per the Wi-Fi pref
34502c7 Use white icons in the status bar
9ad81f2 Merge pull request #1803 from weblate/weblate-guardianproject-orbot
a5a888c Translated using Weblate (Ukrainian)
74f2788 Reset weekly snowflake count lazily by week
7a6c43f Remove start activity result methods for restoring backups in client auth and onion service activities. Removes now unused DiskUtils.createReadFileIntent Inspired by #1800
9f25f8d Remove legacy write file via activity result API. Inspired by @meenbeese work in #1800. Also removes the need for hte method DiskUtils.createWriteFileIntent
9b54e25 Clenaups related to #1800 - Fragment code for client auth activity result isn't necessary, removed. - Changed visibility of some fields from private to pkg private, linter said the compiler was creating a synthetic accessor... (fields are only used in an internal class)
a3e97c9 fix typo in unused SQL edge case for updating the local SQL that says if client authorizaiton for an onion service is enabled/disabled (credit to @meenbeese re #1800)
a519c5c Fix ORB-02-004 WP1: Consent Bypass via Kindness Mode Restart (Medium)
551cdd4 Fix ORB-02-008 WP3: Lack of Path Traversal Protection (Low)
313539d ORB-02-005 WP3: Android Network Hardening Recommendations (Medium)
e2a9355 Fix ORB-02-013 WP3: External Tor Activation Enabled by Default (Low) Disable default behavior of allowing other apps to send Orobt a start intent
69d2f1a Fix ORB-02-011 WP1/3: Tor/VPN Disablement via Incomplete Cleanup (High)
326c48c Use AGP 9.4.0 (for android application plugin)
952af9d Fix: ORB-02-014 WP3: Hardcoded AWS SQS Credentials
f65a9e5 Hardened Snowflake Kindness Mode Power (Dis)Connected Receiver ORB-02-002 The receiver has an intent filter for the two system power connected events, but explicitly check the action in the receiver implementation
f51120b Camo mode also respects kindness mode notifications, ORB-02-010
2db8e85 - Correctly use UK exit node in exit node dialog - Uzbekistan's DNSTT config is correctly loaded
98a0cf3 - Fixes Wi-Fi option being ignored off by default (#1798) - Kindness Mode's network receiver only needs to subscribe to Wi-Fi events, fixes edge case where wifi is ignored when tor's vpn is active...)
07f6a40 Merge pull request #1792 from munzzyy/fix/httptunnelport-ipv6pref
31f7e54 Add comments with URL for torproject DNSTT email paste bug issue (#1695)
7d8ce05 Merge pull request #1791 from munzzyy/fix/bridge-unicode-spaces
17d0ba8 Merge pull request #1793 from weblate/weblate-guardianproject-orbot
e264f4f Translated using Weblate (Malayalam)
7111dbd Translated using Weblate (Catalan)
862a0ff normalize unicode spaces in custom bridge input #1695
8187d62 add ipv6Pref to HTTPTunnelPort in torrc #1420
f491597 bump androidx navigation to 2.10.0: - androidx.navigation:navigation-fragment-ktx:2.9.8 (androidx-navigation-fragment-ktx) -> 2.10.0 - androidx.navigation:navigation-ui-ktx:2.9.8 (androidx-navigation-ui-ktx) -> 2.10.0
11967d2 Merge pull request #1790 from weblate/weblate-guardianproject-orbot
957a1bc Translated using Weblate (Malayalam)
c0ed1b2 add note about bridge parsing unit tests to README.md
88b1044 Merge pull request #1789 from munzzyy/add-bridge-parsing-tests
d40d65b kotlin 2.4.10 lint
113674a bump application and library plugins to 9.3.2
91f5e1b add unit tests for bridge line parsing
629221f Merge pull request #1786 from munzzyy/fix-bridge-transport-parsing-no-fingerprint
d88b75e linting
bf04488 use gradle 9.7.1
0ede9a8 Merge pull request #1785 from meenbeese/bitrise
e65d921 Merge pull request #1787 from xhon-pelushi/fix/1779-kindness-testing-dialog-scroll
14a87da Merge pull request #1788 from weblate/weblate-guardianproject-orbot
b57002e Translated using Weblate (Catalan)
9e0ed89 native interface needs to be fixed for hev-socks5-tunnel 2.17.1
25218d2 bump hev socks 5 tunnel 2.17.1
b00bd9a bump app compat 1.7.1 -> 1.8.0
3aa73fe Fix Kindness Mode connection-test dialog being unreachable at large font sizes
032cac6 Fix Bridge parsing for transport lines with no fingerprint
7bc970c Remove the now-unused Bitrise CI
521d18a Merge pull request #1784 from weblate/weblate-guardianproject-orbot
0fb5181 Translated using Weblate (Arabic)
437ed98 update built in bridges from torproject
ee93939 Merge pull request #1780 from munzzyy/fix/bridge-doh-getter
db30585 Merge pull request #1782 from weblate/weblate-guardianproject-orbot
94caade Translated using Weblate (Indonesian)
d3a7af8 fix Bridge.doh getter reading the dot parameter
5a498ee bump to version catalog updater that is configuration cache compatible/AGP10 compatible
5123cf7 Merge pull request #1775 from weblate/weblate-guardianproject-orbot
2f4b0ee Translated using Weblate (Italian)
18ecb56 update latest geoip from torproject
c7133fa Merge pull request #1770 from weblate/weblate-guardianproject-orbot
4ea5bcd bump android gradle plugin 9.3.1
1b30cc6 Translated using Weblate (English (United Kingdom))
9143cbf Translated using Weblate (Irish)
8c0faaa Translated using Weblate (Chinese (Simplified Han script))
48005a6 Translated using Weblate (Japanese)
0f8361d Translated using Weblate (Japanese)
2f420fa Merge pull request #1769 from weblate/weblate-guardianproject-orbot
caa74fc Translated using Weblate (Italian)
3f61bc7 Translated using Weblate (Italian)
5fdb44c Update strings.xml
7e88a9b Merge pull request #1766 from weblate/weblate-guardianproject-orbot
49f6d00 Translated using Weblate (Catalan)
a9fbf23 Merge pull request #1765 from weblate/weblate-guardianproject-orbot
de06626 Translated using Weblate (Hebrew)
e1b423e Translated using Weblate (Irish)
1d8e3b2 Translated using Weblate (French)
08e5169 Translated using Weblate (Hebrew)
f0071a2 Translated using Weblate (Arabic)
0f87a1a Translated using Weblate (Chinese (Simplified Han script))
8ad2684 compile against newly released API 37.1 instead of 37.0
70d2b2e bump hev-socks5-tunnel to 2.16.0
acc36e8 Merge pull request #1763 from weblate/weblate-guardianproject-orbot
be85557 Translated using Weblate (Irish)
6faa9be lint warning in client auth dialog, fixed by inflating view the correct way the hosted services idalog does
e923ff5 remove unused drawable resouce ic_launcher_monochrome.xml, the real monochrome alt icon is a mipmap
673ec3c Removed unused string "an app wants to open a hidden service on port X..." from old netcipher integration
6e77a28 Remove unused assets introduced in PR #1676, keep the graphical changes for the bottom selector
983c728 String "I Understand, Start Test" aka R.string.test_risk_consent is now unused after merging in PR #1742, deleting it and its trnaslations
fb831eb Merge branch 'master' into impr/kindness_mode_ux
8cefdb8 Merge pull request #1761 from weblate/weblate-guardianproject-orbot
d5e97ba Improved landscape usability for fragment_testing_initial.xml and fragment_testing_confirm.xml.
0640a19 Merge branch 'master' into impr/kindness_mode_ux
7daf419 Fixed minor linter warning.
94bb048 Translated using Weblate (Chinese (Simplified Han script))
a6d54a0 Translated using Weblate (Italian)
8ad08e2 uise kotlin 2.4, clean gradle.properties. last bit of house keeping
2da3a68 removed more deprecation warnings
b31c0c2 removed values-21 directory, it gets merged in always since min api is 24, and it has nothign
86a9e8c bump kotlin serialization to use kotlin 2.4.10
794d54c Removed now deprecated lint config from build.gradle.kts, addressed a few lint issues
1460379 The string hide_apps and secure_your_connection_subtitle had the SAME EXACT string, one was used in XML, the other programmatically
d37c2cf The string "Choose apps" was included twice, once with a lowercase a, and another as "Choose Apps" I deleted the title string, removing an identical string resources. There is kotlin that capitalizes "Apps" based off locale. Plus, I reused the translation for many locales that had one but not the other, actually localizing the app a fair bit
3d3d152 ran android lint with stricter settings
98f1c69 bump android gradle plugin from 9.2.1->9.3.0, for android-application plugin
2846caa Prefs changes from another branch:
4fd8859 touchup before merging
3de5bfb Merge branch 'master' into private-dns
66669ab remove translations for strings that were removed in this PR
59b4618 - Fix various UI bugs in snowflake proxy ux improvements - breakout testing dialog into 3 dialogs, the testing dialog strictly handles testing
22a983d use proper ... char
ef68a91 WiFi -> Wi-Fi
ddbdcc1 Removed accidentally checked-in code just used for development.
7c1972d Kindness Mode: Reworked declined scene.
b77aa08 Kindness Mode: Reworked approved scene.
cfa6593 Kindness Mode: Reworked testing scene.
6667373 Kindness Mode: Added warning scene.
8f8377f Kindness Mode: Added explainer scene.
42f1ab3 Kindness Mode: Reworked initial scene as per design.
c7d9caf Merge pull request #1756 from guardianproject/dependabot/bundler/excon-1.5.0
8ebf6d5 Bump excon from 0.112.0 to 1.5.0
c858621 Merge pull request #1754 from weblate/weblate-guardianproject-orbot
eab711d Translated using Weblate (Irish)
51cd007 Translated using Weblate (Chinese (Simplified Han script))
2f69446 Translated using Weblate (Spanish)
0f93478 set hev-socks5-tunnel to 2.15.0
46cec36 Merge pull request #1751 from weblate/weblate-guardianproject-orbot
37d4864 Merge pull request #1750 from meenbeese/warning
1bd7645 Translated using Weblate (Irish)
46703f1 Translated using Weblate (Spanish)
ac1c8a4 Fix small warning with unused i
c7ca128 fix snowflake proxy issue with region locked areas @n8fr8 identified on scrum
b6b7f1a properly deal with action status and progress bar
703526b - Consistently style all AlertDialogs with Orbot theme - Required some changes to legacy java activities beyond normal XML tweaks - All AlertDialogs will be subsequently styled by default!
1da897c Use androidx.appcompat.app.AlertDialog which we should have been using in place of android.app.AlertDialog for some time
1ce728e add release info for 17.9.5