The mid-July mirror set refresh has landed
The two older addresses in the current set have been rotated out and their replacements are up.
The mid-July rotation the operator flagged on Dread last week has completed. Two of the three addresses in the previous set have been retired and their replacements have been live long enough that the introduction points are stable across the usual guard picks. If you were opening the storefront from a bookmark of one of the retired addresses, that bookmark now points at nothing useful and you should replace it with a bookmark of this directory instead.
What rotated
Two addresses out, two addresses in. The remaining address from the previous set is unchanged and continues to serve. The new addresses were introduced on the storefront the day before the operator's Dread post and ran in parallel with the outgoing ones for about thirty-six hours before the outgoing set was pulled. That overlap is the same pattern every rotation has followed since launch.
Why now
The two retired addresses had been in the set since the middle of spring and had accumulated enough introduction-point wear that the operator preferred to run them out on the usual schedule rather than push a compressed rotation later. Nothing in the retirement reflects a security concern with the addresses themselves.
What to do
Nothing, if you land on this directory before you type an onion. The addresses at the top of the home page are already the current set. Replace any personal bookmarks that pointed directly at onion strings with a bookmark of this directory, so future rotations do not leave you stranded on retired addresses that phishing operations sometimes pick up shortly after retirement.
Verifying the new addresses
The Dread post is signed with the operator PGP key. Pulling the post and running gpg --verify against it produces the plain text of the address set and a signature status line. If both new addresses appear in that verified plain text, they are genuine. If either does not, the version of the post you fetched has been altered and you should refetch from a fresh source before touching either address.