Arti 2.2 enables HTTP CONNECT by default, enhances RPC features, and fixes security issues

Arti, the next-generation Tor implementation in Rust, has released version 2.2. The most prominent update is the integration of HTTP CONNECT protocol for accessing the Tor network. This feature, now active by default in full builds, allows clients to connect using HTTP CONNECT as an alternative to SOCKS. Both protocols are available over the same port, aiming to streamline connection methods and improve flexibility for various applications.

Alongside this networking update, the arti-rpc-client-core library introduces key improvements for developers. It now enables non-blocking requests and seamless integration with application event loops. Furthermore, the RPC system gains a new superuser facility, allowing administrative access to Arti instances directly via remote procedure calls. These changes can help advanced users and system integrators manage and automate Arti deployments more efficiently.

Addressing stability and security, Arti 2.2 fixes TROVE-2026-005, a low-severity vulnerability that could weaken denial-of-service resistance in some embedded build environments. Behind the scenes, the Tor team continues development on relay support, relay channel and circuit functionality, and directory server features like mirrors and authorities.