Hi Peter,

Please consider update Tor to 0.4.8.21 or a newer version, the current version
0.4.8.16 is obsolete and no longer recommended by directory authorities.

https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes

Thanks!

Package: tor
Version: 0.4.8.16-1
Severity: critical

The security package like this should be updated regularly. Why
torproject can't help maintaing this package on deb.debian.org? They
surely have enough donation money than us who run Tor relays, no?

(See also #1121333)

I see that tor 0.4.8.21 has landed in Debian testing.

I'm wondering would it be possible to get it into trixie-backports too?
(and also bookworm-backports).

It seems to rebuild cleanly and work on Trixie just fine (via debuild),
so I guess it should not be that hard to push it (well, technically
at least. I have no idea about intricacies of administrative part)

Any idea who should be contacted for that to happen (if this bug
report isn't enough)?
Or is it perhaps already in the process of happening?

Cheers,
Matija

0.4.8.21 seems to have landed in trixie-backports (and forky), but
bookworm-backports is still stuck on old 0.4.8.14-1~bpo12+1

So it is time to upgrade those oldstable tor routers...

It's in oldstable-backports-sloppy (as it's not coming from the next
release as far as bookworm is concerned).

Package: tor
Version: 0.4.8.16-1

I'm using latest Debian 13.2. Isn't this the latest version?
https://packages.debian.org/trixie/tor still listing "0.4.8.16-1" as
last version.

How can I contribute pushing deb packages on deb.debian.org because the
steps listed in debian website are not writing things clearly. I know
how to use git or build things. Why is this so hard to update in 2026?

No, it is not "the latest". That is JUST the latest Debian "Stable"
point release, which may (or may not, as it seems) be what you want.

E.g. Debian "Testing" is more up-to-date version of Debian (what
people would call "rolling release" - with all of advantages and
disadvantages of that, and then there is "Unstable" which is even
more up-to-date (and more prone to breakage).

People preferring to use (mostly) Stable packages, should use at least
"stable" and "debian-security" repositories, but depending on their
needs and risk averseness, might also be interested in one or more of
the following repositories:

- "stable-updates"
- "stable-proposed-updates"
- "stable-backports"
- "stable-backports-sloppy"

Only you can know your exact volatility preference; which is the
reason why those repositories are separated - so you can choose
combination best suiting YOUR specific case.
(You can also use /etc/apt/preferences.d for APT-pinning too if you
prefer more control over what should be installed from where)

And https://packages.debian.org/trixie-backports/tor lists
"0.4.8.21-1~bpo13+2" (or newer) as the last version, yes?

If so, it is as it should be.

For reasoning why Stable does NOT regularly get new versions (but only
has security fixes backported to old version of the app), see e.g.
https://www.debian.org/doc/manuals/debian-faq/getting-debian.en.html#updatestable

The rest of the FAQ might be informative too (especially the part
about choosing the distribution).

You seem to have misunderstood something, there is no need for any of
that, assuming your purpose is related to this bug report (i.e.
having new version of TOR in your system).

--------------------------------------------------------------------------

TL;DR:

Just add "trixie-backports" to your sources.list and choose to install
"tor" package specifically from there (using e.g. aptitude or
"apt -t trixie-backports install tor").

After that is done once, all further updates for that package will
automatically be fetched from backports for the duration of the
stable release.

See https://backports.debian.org/Instructions/ for details