Orbot for Android 17.9.6

Top 10 changes since 17.9.5

1. Security audit fixes (ORB-02 series) from bitmold. These close the findings from the recent audit:

• High: Tor/VPN could be disabled because cleanup was incomplete (ORB-02-011).
• Medium: Kindness Mode restart could bypass consent (ORB-02-004).
• Medium: Android network hardening (ORB-02-005).
• Low: missing path traversal protection (ORB-02-008).
• Hardcoded AWS SQS credentials removed (ORB-02-014).
• Power receiver hardened (ORB-02-002).
• Camo mode now respects Kindness Mode notifications (ORB-02-010).

1. Other apps can no longer start Orbot from bitmold. External start was first turned off by default (ORB-02-013), then StartTorReceiver was deleted entirely. On Android 14+ that path would have thrown a

SecurityException anyway.

1. Kindness Mode onboarding redesign from Benjamin Erhart. The initial, testing, approved and declined screens were reworked, new explainer and warning screens were added, and landscape layout got better.

bitmold then split the testing dialog into three dialogs and fixed UI bugs.

1. Kindness Mode reliability from munzzyy (Cole Munz):

• Kindness Mode now comes back when the system shuts it down (#1799, #1783).
• The watchdog moved from WorkManager to JobScheduler.
• Snowflake proxy start/stop races are fixed, and UPnP mappings survive restarts (#1183, #1795).
• The network callback now follows the Wi-Fi setting.

Follow-ups:

• bitmold fixed the multiple-constraints bug and separated start/stop from the UI toggle.
• vbrekher fixed the Kindness preference listener (#1808).
• meenbeese (Kuzey Bilgin) made the weekly Snowflake count reset lazily by week.

1. Bridge parsing fixes and tests from munzzyy:

• Transport lines with no fingerprint now parse.
• The Bridge.doh getter was reading the dot parameter by mistake.
• Unicode spaces in custom bridge input are now normalized (#1695).
• New unit tests cover bridge line parsing.

1. Tor core and network data from n8fr8 and bitmold:

• Moved to the new tor-android release (tagged 17.9.6-BETA-1-tor-0.4.9.12).
• SSL libraries updated.
• Built-in bridges refreshed several times.
• GeoIP data updated to the IPFire location DB (2026/09/08).

1. Proxy, port and preference fixes:

• vbrekher: proxy ports are shown independently (#1134), and a PreferenceProvider crash is fixed (#1760).
• munzzyy: the IPv6 preference now applies to HTTPTunnelPort (#1420), and duplicated log lines are fixed.
• bitmold: regressions in app-based routing are fixed.

1. Toolchain and dependency upgrades from bitmold:

• AGP 9.3.0 9.4.0, Gradle 9.7.1, Kotlin 2.4.x.
• Compiles against API 37.1.
• NDK 30 LTS.
• AppCompat 1.8.0 and androidx navigation 2.10.1.
• hev-socks5-tunnel moved back and forth between 2.15, 2.16 and 2.17.1, with a native interface fix from n8fr8.

1. Code cleanup and lint mostly from bitmold:

• Many lint warnings fixed in OrbotService, including nullability annotations and replacing deprecated APIs.
• Legacy activity-result file I/O removed (inspired by meenbeese, #1800).
• Duplicate and unused strings and assets removed.
• All AlertDialogs now use AppCompat and the Orbot theme.
• meenbeese removed a dead handler callback interface.
• Private DNS status now shows under the connect button.

1. CI, UX polish and translations:

• meenbeese removed Bitrise CI and made unit tests run in GitHub Actions.
• syphyr switched the status bar to white icons.
• xhon-pelushi made the Kindness test dialog reachable at large font sizes.
• bitmold added Ukraine to the exit node list (#1764) and fixed the UK exit node and the Uzbekistan DNSTT config.
• Weblate translations came in for about 18 languages, including new Swahili. Contributors include Aindriu Mac Giolla Eoin, Sketch6580, Ecron, Random, jonnysemon, Akhil Raj and others.

Commit counts (merges excluded): bitmold 108, munzzyy/Cole Munz 10, Benjamin Erhart 9, n8fr8 8, meenbeese/Kuzey Bilgin 5, vbrekher 3, syphyr 1, xhon-pelushi 1, plus about 25 translators and dependabot.

7b2bb2571 (HEAD -> master, origin/master, origin/HEAD) update bridges b3259f357 update ssl libs 158223e54 (tag: 17.9.6-BETA-1-tor-0.4.9.12) update to tor-android 0.4.8.12 bfda8fbe9 Merge branch 'master' of github.com:guardianproject/orbot 0397c9b17 update versioncode d89c41dcf Merge pull request #1823 from weblate/weblate-guardianproject-orbot 668e5eada Added translation using Weblate (Swahili) 809c4eaea use constants defined in TorControlCommand.java from jtorctl c063f132f use latest LTS NDK toolchain in app/build.gradle.kts NDK Version 29.0.14206865 -> 30.0.16248370 6720b85c7 Ran ./gradlew updateBuiltinBridges to prepare for a new Orbot release 7857fb5fb formatted libs.versions.toml with ./gradlew versionCatalogFormat 8b1685053 Update geoip files to match ipfire location db, 2026/09/08. https://gitlab.torproject.org/tpo/core/tor/-/commit/cace84c1d65dbf493053c3ad33ed53d34e28d46b c799fb475 Merge pull request #1821 from weblate/weblate-guardianproject-orbot 206a0a28e Translated using Weblate (French) 831d8bf4e removed more - unused java pathways 74a5d9833 clean up manifest, and remove empty,text-less string resource from Mali (linter catch!) 3ae39bc55 (origin/no-background-starts) Remove StartTorReceiver and the vestigial way of having other app's start Orbot - Deletes StartTorReceiver, Various String Resources - Starting with Android 14, Orbot would either have had to be the primary VPN app OR have obtained the SCHEDULE_EXACT_ALARMS permission from the user at runtime - if neither of these things are true, then Orbot would throw a SecurityException for starting a ForegroundService - Relates to ORB-02-013 WP3, wherein this feature was turned on by default. This was removed in e2a935547c6ae78d35dd59d7de11f5d43c5addda, however at this point it makes more sense to just get rid of the whole thing d3abb7c07 native interface needs to be fixed for hev-socks5-tunnel 2.17.1 f3b79e3ce bump hev-socks5-tunnel to 2.17.1 f3b7c647a fixed remaining regressions (see last commit) 96ebd6f45 Fixed regression introduced after last build with app based routing 436c2c411 - Fixed issue with multiple kindness mode constraints - Decoupled start/stop from the UI toggle f82ca6f8a Merge branch 'kindness-stays-on' 3afb29a13 - added even more logs - remove unhelpful and cluttering log from recent work in PreferenceProvider.kt c54260643 Re: #1805, the logic for sonwflake prefernce change doesnt need to exist in its own file 2fa7b4e58 Cleanups on #1807 PR regaridng stuck kindness mode 120c6c506 add Ukraine {UA} to exit node dropdown, closes #1764 2c731e58b cleanups/linting for #1807 d5b58765e Merge branch 'master' into kindness-stays-on 1150ec3c9 add annotations to OrbotVpnManager.java to satisfy linker after reviewing and merging #1814 da8810ad5 Merge remote-tracking branch 'meenbeese/handler' ae5b0cf67 Merge pull request #1820 from weblate/weblate-guardianproject-orbot 6cd8464fc Translated using Weblate (French) 57793b053 Merge remote-tracking branch 'weblategithub/weblate-guardianproject-orbot' dde6f35aa Translated using Weblate (French) 0380e343b Merge pull request #1818 from weblate/weblate-guardianproject-orbot 943a5ee0e Translated using Weblate (French) a9fb84482 weblate git trouble f800ca158 Merge remote-tracking branch 'weblate/master' d04d6cb41 Translated using Weblate (French) 790b5f361 Merge pull request #1816 from weblate/weblate-guardianproject-orbot 4f7f11a6d fixed casing 4578d31e9 Translated using Weblate (Afrikaans) 85bd38fc9 Translated using Weblate (French) fce2348be Remove dead handler callback interface b33440e0e Use hev-socks-tunnel from master c27d1c806 Merge branch 'master' into HEAD 71398bfb7 Cleanups in kindness mode notificaiton logic made when testing #1805 fb32f79b6 Merge remote-tracking branch 'munzzyy/kindness-callback-respects-wifi-pref' 54d938216 Some cleanups to #1802 - the PR where the weekly snowflakes served worker is removed... a9178f3e7 Merge remote-tracking branch 'meenbeese/work' a1d0c1f59 add comments to SnowflakeProxyServiceTest for tests pertaining to #1808 and #1810 ed6300833 Merge remote-tracking branch 'vbrekher/fix/1808-kindness-preference-listener' 8b97e6d53 Dealt with many Java lint warnings in OrbotService - explicitly use @NonNull @Nullable when trivial to do so, for cleaner kotlin interop + just makes things more sane - removed synthetic accessors generated by compiler for OrbotService's many inner classes - replaced two deprecated android methods (stopForeground() and a method used to update notification locale changes) with the correct, non-deprecated alternative c2538f148 verified that #1809 fixes #1404, added comment e31011b1b comments tidying up recently merged #1809 bfe9edf4b Merge remote-tracking branch 'munzzyy/fix-log-duplication' 060ccab41 Additional small cleanups re #1812 - use constant for the -1 when HTTP/SOCKS/etc ports aren't set, instead of a lot of magic nums in OrbotActivity/MoreFragment ad313a655 Cleanup around #1812 4e7f03e1b Merge remote-tracking branch 'vbrekher/fix/1134-independent-proxy-ports' 8d0ecefbf use correct gradlew for running unit tests in github actions, re: #1813 15ad3a0c7 Merge remote-tracking branch 'meenbeese/workflow' d35a6e6e4 mistakenly committed something re #1811 a7ee6e68e mistakenly committed something re #1811 b6616d3e7 log for failure case of #1811 82fc287ec removed unneeded type arguement in #1811 preference provider crash fix 07e87b1d8 runtests.sh shortcut 48c650309 Merge remote-tracking branch 'vbrekher/fix/1760-preference-provider-crash' 95807ff1e Revert "native interface needs to be fixed for hev-socks5-tunnel 2.17.1" a32f98d17 --service flag for view_logs_tmux.sh a77f41331 revert hev-socks5-tunnel to 2.16.0 9ea7e1628 update builtin bridges from torproject 54a302aa3 androidx.navigation:navigation-fragment-ktx:2.10.0 (androidx-navigation-fragment-ktx) -> 2.10.1 ee8092878 Run units tests from actions 40dfb729c Show configured proxy ports independently 8fa6457c4 fix preference provider crash 516db21a6 fix kindness preference listener b081bb997 Fix log lines being stored in duplicate 76dc4c958 use serialization kotlin plugin for v 2.4.20 of language fea59ea75 use geoip and geoip6 from tor-0.4.9.12 580950d76 Merge pull request #1804 from syphyr/white_icon 2a074f9fc Merge pull request #1806 from weblate/weblate-guardianproject-orbot 2cc1be656 kindness: run the watchdog on JobScheduler instead of WorkManager d6f7ecc82 bring kindness mode back when the system takes it down #1799 #1783 c6274e13b fix snowflake proxy start/stop races and remember UPnP mappings across restarts #1183 #1795 bfc3d406f Translated using Weblate (Persian) 72de1337e Register the kindness network callback per the Wi-Fi pref 34502c753 Use white icons in the status bar 9ad81f2b0 Merge pull request #1803 from weblate/weblate-guardianproject-orbot a5a888cbf Translated using Weblate (Ukrainian) 74f2788ba Reset weekly snowflake count lazily by week 7a6c43fc7 Remove start activity result methods for restoring backups in client auth and onion service activities. Removes now unused DiskUtils.createReadFileIntent Inspired by #1800 9f25f8d21 Remove legacy write file via activity result API. Inspired by @meenbeese work in #1800. Also removes the need for hte method DiskUtils.createWriteFileIntent 9b54e25f8 Clenaups related to #1800 - Fragment code for client auth activity result isn't necessary, removed. - Changed visibility of some fields from private to pkg private, linter said the compiler was creating a synthetic accessor... (fields are only used in an internal class) a3e97c96e fix typo in unused SQL edge case for updating the local SQL that says if client authorizaiton for an onion service is enabled/disabled (credit to @meenbeese re #1800) a519c5c49 Fix ORB-02-004 WP1: Consent Bypass via Kindness Mode Restart (Medium) 551cdd429 Fix ORB-02-008 WP3: Lack of Path Traversal Protection (Low) 313539d37 ORB-02-005 WP3: Android Network Hardening Recommendations (Medium) e2a935547 Fix ORB-02-013 WP3: External Tor Activation Enabled by Default (Low) Disable default behavior of allowing other apps to send Orobt a start intent 69d2f1a39 Fix ORB-02-011 WP1/3: Tor/VPN Disablement via Incomplete Cleanup (High) 326c48c2e Use AGP 9.4.0 (for android application plugin) 952af9dc2 Fix: ORB-02-014 WP3: Hardcoded AWS SQS Credentials f65a9e5a7 Hardened Snowflake Kindness Mode Power (Dis)Connected Receiver ORB-02-002 The receiver has an intent filter for the two system power connected events, but explicitly check the action in the receiver implementation f51120b56 Camo mode also respects kindness mode notifications, ORB-02-010 2db8e8520 - Correctly use UK exit node in exit node dialog - Uzbekistan's DNSTT config is correctly loaded 98a0cf3ea - Fixes Wi-Fi option being ignored off by default (#1798) - Kindness Mode's network receiver only needs to subscribe to Wi-Fi events, fixes edge case where wifi is ignored when tor's vpn is active...) 07f6a40cb Merge pull request #1792 from munzzyy/fix/httptunnelport-ipv6pref 31f7e54fc Add comments with URL for torproject DNSTT email paste bug issue (#1695) 7d8ce05bb Merge pull request #1791 from munzzyy/fix/bridge-unicode-spaces 17d0ba8fa Merge pull request #1793 from weblate/weblate-guardianproject-orbot e264f4fe7 Translated using Weblate (Malayalam) 7111dbdb4 Translated using Weblate (Catalan) 862a0ffe7 normalize unicode spaces in custom bridge input #1695 8187d62c7 add ipv6Pref to HTTPTunnelPort in torrc #1420 f491597ca bump androidx navigation to 2.10.0: - androidx.navigation:navigation-fragment-ktx:2.9.8 (androidx-navigation-fragment-ktx) -> 2.10.0 - androidx.navigation:navigation-ui-ktx:2.9.8 (androidx-navigation-ui-ktx) -> 2.10.0 11967d2af Merge pull request #1790 from weblate/weblate-guardianproject-orbot 957a1bc58 Translated using Weblate (Malayalam) c0ed1b21b add note about bridge parsing unit tests to README.md 88b1044be Merge pull request #1789 from munzzyy/add-bridge-parsing-tests d40d65b49 kotlin 2.4.10 lint 113674aca bump application and library plugins to 9.3.2 91f5e1b86 add unit tests for bridge line parsing