* Security fixes
- Upgrade Tor Browser to 6.0.7 (build3) based on Firefox 45.5.1.
- Upgrade gstreamer0.10-based packages to 0.10.31-3+nmu4+deb8u2.
- Upgrade imagemagick-based packages to 8:6.8.9.9-5+deb8u6.
- Upgrade libicu52 to 52.1-8+deb8u4.
- Upgrade vim-based packages to 2:7.4.488-7+deb8u1.

* Minor improvements
- Reserve 64 MiB for the kernel and 128 MiB for privileged
processes before the memory is wiped. We hope that this might
help (but not solve, sadly) some crashes experienced while
wiping the memory.

* Build system
- Make the wiki shipped inside Tails build deterministically
(Closes: #11966):
* Enable ikiwiki's "deterministic" option, and require it when
building.
* Use our custom backport of discount (2.2.1-1~bpo8+1~0.tails1),
to fix reproducibility issues (Debian#782315). This can be
dropped once our ISO builders use Stretch.
* Install ikiwiki from our builder-jessie APT suite, to make the
pagestats plugin output deterministic.
- refresh-translations: don't update PO files unless something
other than POT-Creation-Date was changed. (Closes: #11967)
- Fix Vagrant's is_release? check. Per auto/build, we consider it
a release when we build from detached head, and HEAD is tagged.
- Enforce `cleanall` when building a release. I.e. don't allow the
user supplied options to override this behaviour. This is
important since Vagrant caches wiki builds, and we do not want
leftovers from a previous builds ending up in a release. Also,
this is required for making Tails images build reproducibly.
- Make the build system's `cleanall` option really clean
everything. At the moment it doesn't clean the cached wiki
build (which basically was its only job).
- import-package: support contrib and non-free sections.

* Test suite
- Wait a bit between opening the shutdown applet menu, and
clicking one of its widgets. (Closes: #11616).
- Adapt Icedove test after removing the amnesia branding add-on.
(Closes: #11906)
- Replace --pause-on-fail with --interactive-debugging. It does
the same thing, but also offers an interactive Ruby shell, via
pry, with the Cucumber world context.

-- Tails developers <tails@boum.org> Wed, 30 Nov 2016 17:27:37 +0100

* Security fixes
- Upgrade to Linux 4.7. (Closes: #11885, #11818)
- Upgrade to Tor 0.2.8.9. (Closes: #11832, #11891)
- Upgrade Tor Browser to 6.0.6 based on Firefox 45.5. (Closes: #11910)
- Upgrade Icedove to 1:45.4.0-1~deb8u1+tails1. (Closes: #11854,
#11860)
- Upgrade imagemagick to 8:6.8.9.9-5+deb8u5.
- Upgrade openssl to 1.0.1t-1+deb8u5.
- Upgrade libarchive to 3.1.2-11+deb8u3.
- Upgrade bind9 to 1:9.9.5.dfsg-9+deb8u8.
- Upgrade libav to 6:11.8-1~deb8u1.
- Upgrade ghostscript to 9.06~dfsg-2+deb8u3.
- Upgrade c-ares to 1.10.0-2+deb8u1.
- Upgrade nspr to 2:4.12-1+debu8u1.
- Upgrade nss to 2:3.26-1+debu8u1.
- Upgrade tar to 1.27.1-2+deb8u1.
- Upgrade curl to 7.38.0-4+deb8u5.
- Upgrade libgd3 to 2.1.0-5+deb8u7.
- Upgrade opendjk-7 to 7u111-2.6.7-2~deb8u1.
- Upgrade mat to 0.5.2-3+deb8u1.
- Upgrade libxslt to 1.1.28-2+deb8u2.
- Upgrade pillow to 2.6.1-2+deb8u3.

* Minor improvements
- Ship Let's encrypt intermediate certificate to prepare the
the next certificate renewal of our website. Also unify the
way our upgrades and security checkers verify this SSL
certificate using our dedicated perl lib code. (Closes: #11810)

* Bugfixes
- Fix multiarch support in Synaptic. (Closes: #11820)
- Set default spelling language to en_US in Icedove. (Closes: #11037)

* Build system
- Disable debootstrap merged-usr option. (Closes: #11903)

* Test suite
- Add test for incremental upgrades. (Closes: #6309)
- Add tests for Icedove. (Closes: #6304)
- Decrease timeout to Tails Greeter to speed up testing of branches
where it is broken. (Closes: #11449)
- Add a ID field to the remote shell responses to filter out
unrelated ones. (Closes: #11846)
- Reliabily wait for the Greeter PostLogin script. (Closes: #5666)
- Reliabily type the kernel command line in the prompt at the boot
menu to ensure the remote shell is started. (Closes: #10777)
- Remove DVDROM device when not used, to workaround QEMU/Libvirt
compatibility issue. (Closes: #11874)

-- Tails developers <tails@boum.org> Sun, 13 Nov 2016 14:46:04 +0100

6bad9f9124e682f3872e74296b96b9ed tails-i386-2.7.1.iso