update tor from 0.4.9.13-r0 to 0.4.9.14-r0 (#168)
security release (TROVE-2026-062, TROVE-2026-064, TROVE-2026-067), relevant changes:
- onion service: restore `HiddenServiceAllowUnknownPorts` logic, which had been inverted
- onion service: fix memory leak for "unix:" stream requests
- onion service client: update intro point auth key when re-extending after a NACK
- no longer ignore the MiddleOnly flag on non-authorities (MiddleOnly relays were used in onion service circuits)
- treat descriptors with expired family certificates as expired
- relay: only accept CONFLUX_LINK on plain OR circuits (client-triggerable assertion crash)
- fix abandoned circuit build timeout entries blocking timeout updates (connectivity failures)
- only replace guard connections on actual first-hop timeouts
- harden lzma2 streaming against infinite loops
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.9/ReleaseNotes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
