Below are the major changes of the released versions and links to more detailed release notes.
Stable
Today, we released stable version 0.4.9.12 to address a series of high-severity security issues and some minor new features.
We expect to make the related tickets public roughly one week from today. Until then, the only publicly available details about these security issues can be found in the ReleaseNotes file (see below).
We strongly recommend updating as soon as possible. Debian packages are already available here, and packages for other distributions should follow shortly after this announcement.
Final note: We are actively working on additional important security issues, so starting today, we are moving C-tor releases to a two-week cadence. This means that the next release, 0.4.9.13, is expected around September 22.
Nothing is set in stone, however, as the recent flurry of security issues may require us to adapt quickly.
Yeah this does not seem to get better. The webtunnel images also contain an old tor version again. How oft do we have to complain until this gets automated or part of the process? I even created a PR for webtunnel but it has been ignored for month. Does the project want us to stop webtunnels? There seem to be no reasonable way to run them with docker images. The docs give you outdated versions.
I’m not sure what image you’re using, but at least for thetorproject/webtunnel-bridge:latest it’s very easy to upgrade to your own thanks to the nature of Debian.
I agree that also docker images should be provided apriori when there is need of the latest version due security reasons, webtunnel-server they tagged to v0.0.7 so if there will be this week 0.4.9.13 per last messages there is no reason why not make them than. On the other side I do not understand position I could make own but will shutdown until official … still, it could be a lever to create them, that’s true I moved from officials to my own due performance reasons, so I am only curious to check if a need of updating my dockerfiles and all this was on the beginning due missing new versions
I run this on various Kubernetes clusters next to some real websites borrowing a subdomain or path (with agreement from the owners). Unfortunately, there is no common image repository between those. So I would have to publish the image somewhere or build that infrastructure or build it once per cluster. Nothing I am willing to do for that purpose alone. Currently, I automate updates with renovate bot but that requires that upsteam updates their images. Having proper tags on the image would be a plus but just pinning latest with a digest also works.
@jabdoa2 did your WebTunnel bridges come back after the June shutdown, and if so, what changed: the official image got updated, or you built your own? @mittar same question for your own image: how often do you end up rebuilding it?
Trying to understand how operators keep these patched between releases.
(Drafted with help from Claude, an AI assistant; the questions are mine.)
Afaik there is no update yet. Webtunnel images are basically unmaintained. I would not recommend running them to anyone. In my opinion running containers is the modern way of hosting things so this is pretty bad. I stepped down as operator for the time beeing.
Originally, I intended to respond only to the release of new versions (Tor or webtunnel-server)… but after testing the build process, I am now checking the libraries as well. Since I am not a developer, I had to learn how to compile from source code; it took several attempts before I was satisfied with the result, but I believe I now have the final version of the Dockerfile. Going forward, I will simply update the version tags and build the final runtime image, thereby returning to my original plan: performing updates only upon new releases or if a security vulnerability is discovered in the libraries used by Tor.
I moved from officials to my own due performance reasons, so I am only curious to check if a need of updating my dockerfiles and all this was on the beginning due missing new versions 