| Comment: | build(deps): bump github.com/danmestas/go-libfossil to v0.10.0 (#200)
Bumps go-libfossil from v0.9.0 to v0.10.0 in the root, bridge and leaf modules. The release fixes three data-loss bugs in the checkout API (Revert deleting never-committed files, Rename overwriting an existing file, Extract overwriting local edits on checkouts made by the fossil binary) and aligns checkout behavior with fossil. EdgeSync calls none of the affected functions except Extract via CreateCheckout, whose tests pass unchanged. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk | main |
| Files: | files | file ages | folders |
| SHA3-256: |
087d06ceea051bc80a0edb53d668cbd5 |
| User & Date: | [email protected] on 2026-10-03 19:00:23.000 |
| Other Links: | branch diff | manifest | tags |
|
2026-10-11
| ||
| 01:48 |
fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 (#201)
go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly. - agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials. The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: dbb0c04321 user: [email protected] tags: trunk, main | |
|
2026-10-03
| ||
| 19:00 |
build(deps): bump github.com/danmestas/go-libfossil to v0.10.0 (#200)
Bumps go-libfossil from v0.9.0 to v0.10.0 in the root, bridge and leaf modules. The release fixes three data-loss bugs in the checkout API (Revert deleting never-committed files, Rename overwriting an existing file, Extract overwriting local edits on checkouts made by the fossil binary) and aligns checkout behavior with fossil. EdgeSync calls none of the affected functions except Extract via CreateCheckout, whose tests pass unchanged. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 087d06ceea user: [email protected] tags: trunk, main | |
| 19:00 |
ci: track go-libfossil with Dependabot instead of a release dispatch (#199)
bump-upstream.yml waited for an upstream-bump event from go-libfossil's release workflow. That path has been dead since the rename: go-libfossil sends repo=go-libfossil and module github.com/danmestas/go-libfossil, while this workflow only accepted libfossil and github.com/danmestas/libfossil and ignored anything else. The sending side has also failed with 401 since v0.8.1, because its token expired. Dependabot now watches github.com/danmestas/go-libfossil and its driver modules in the root, bridge and leaf go.mod files, daily, and opens one pull request per module path across all three. No token is needed, and a broken update shows up in Dependabot's own status rather than as a dispatch nobody sees fail. Security updates for other dependencies are unaffected. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: a8beeb09dc user: [email protected] tags: trunk, main | |