Major changes

• Upgrade Linux to 4.19.28-1 (Closes: #16390, #16469, #16552).

• Upgrade Tor Browser to 8.0.7 (Closes: #16559).

• Upgrade Thunderbird to 65.1.0 (Closes: #16422).

• Security fixes

• Upgrade LDB to 2:1.1.27-1+deb9u1 (DSA-4397-1).

• Upgrade OpenJPEG to 2.1.2-1.1+deb9u3 (DSA-4405-1).

• Upgrade OpenSSL 1.0 to 1.0.2r-1~deb9u1 (DSA-4400-1).

• Upgrade OpenSSH to 1:7.4p1-10+deb9u6 (DSA-4387-2).

• Bugfixes

• Upgrade tor to 0.3.5.8-1~d90.stretch+1 (Closes: #16348).

• Ensure Additional Software doesn't try to download packages that are
  in persistent cache (Closes: #15957).

• Improve chances of recovering a lost persistence configuration
  (Closes: #10976).

• Tor Launcher: add langpacks to enable localization again
  (Closes: #16338).

• Migrate away from buggy Chinese input method: switch from ibus-pinyin
  to ibus-libpinyin + ibus-chewing (Closes: #11292).

• Fix crash in Whisperback when additional persistent APT repositories
  are configured (Closes: #16563).

• Give visual feedback while starting Whisperback (Closes: #16333).

• Minor improvements and updates

• Add feedback when opening VeraCrypt Mounter (Closes: #16334).

• Improve consistency in Additional Software's accessibility
  (Closes: #16110).

• Fix missing accessibility support when opening a browser from a
  notification (Closes: #16475).

• Refresh ublock-origin patch to apply cleanly on top of 1.18.4+dfsg-1
  (Closes: #16451)

• Upgrade intel-microcode to 3.20180807a.2~deb9u1.
  Fixes CVE-2018-3615, CVE-2018-3620, CVE-2018-3646, CVE-2018-3639,
  CVE-2018-3640, CVE-2017-5753, CVE-2017-5754.

• Build system

• Lower memory requirements when building Zero Trace Pen by limiting the memory
  used by mksquashfs to 512M (Closes: #16177).

• Remove obsolete check on Thunderbird addons (Closes: #16045).

• Update Zero Trace Pen' APT GnuPG key expiration (Closes: #16420).

• Optimize Git operations (share resources, fetch only the needed
  objects).

• Clone submodules from the host's local repositories (Closes: #16476).

• Drop useless manual initramfs update (Closes: #16452).

• Add a sanity check on the size of the initramfs (Closes: #16452).

• Test suite

• Add automated tests for Additional Software GUI (Closes: #14576,

  14596).

• Add automated tests on the backup persistence configuration
  (Closes: #16461).

• Adjust test for Thunderbird 60.5.1 (Closes: #16555).