v0.11.1 fixes GHSA-mvx3-6793-8x4r (the sync server sent content to requesters without read permission) and GHSA-3f8x-8fr5-mr98 (the HTTP client followed redirects from HTTPS to HTTP).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> leaf check-in: 0a4c779ae2 user: [email protected] tags: trunk, main

Bumps the cargo group with 2 updates in the /iroh-sidecar directory: [hickory-resolver](https://github.com/hickory-dns/hickory-dns) and [rustls](https://github.com/rustls/rustls).

Updates `hickory-resolver` from 0.26.1 to 0.26.3 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.3)

Updates `rustls` from 0.23.43 to 0.23.45 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.43...v/0.23.45)

--- updated-dependencies: - dependency-name: hickory-resolver dependency-version: 0.26.3 dependency-type: indirect dependency-group: cargo - dependency-name: rustls dependency-version: 0.23.45 dependency-type: indirect dependency-group: cargo ...

Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: 0f53f1d32b user: [email protected] tags: trunk, dependabot/cargo/iroh-sidecar/cargo-60501f734e

TigerStyle: eliminate the shared mutable state instead of guarding it.

Move mux + http.Server construction from ServeHTTP into NewHub. After NewHub returns, h.httpServer and h.httpListener are immutable for the hubs lifetime — single writer (NewHub), many readers (ServeHTTP, Stop). No mutex, no atomic, no sync.Once required: the race is gone by construction.

Add a hub package-private assert helper and positive invariants at entry to ServeHTTP and Stop, surfacing programmer-bugs loudly instead of silently UB-ing on a nil httpServer.

Fixes the 3 data races in TestCrossSessionAutosync and the 3 in TestScope_Project_ConcurrentCommits under -race; hub package suite green at -race -count=3. leaf check-in: 8a18ec9ebe user: 41898282+github-actions[bot]@users.noreply.github.com tags: trunk, fix/hub-stop-servehttp-race-tigerstyle

The hub.Config.ProjectCode and hub.Config.SeedFromUpstream fields landed in #157 but were unreachable from the `edgesync hub serve` CLI. Wires them through and fixes a latent auth bug in seedFromUpstream that prevented it from cloning against the standard nobody-caps=gio deployment.

Changes: * cli/hub_serve.go — adds --project-code (40-char lowercase hex, format pre-validated for a friendlier error than libfossil's) and --seed-from-upstream (http(s) URL of upstream hub xfer endpoint). * hub/clone.go — drop bootstrapUser from the clone CloneOpts. Passing a local-creation user as the upstream-auth identity caused libfossil's clone to send a login card for a user the upstream had never heard of ("authentication failed"). Anonymous clone falls through to the upstream's "nobody" caps, matching the typical NobodyCaps:"gio" deploy. * hub/cross_leaf_test.go — adds TestCrossLeaf_SeedFromUpstream_PropagatesCommit covering the seed-then-sync path end-to-end (clone over HTTP, leaf-link, observe A→B commit propagation via NATS). leaf check-in: 001f82d3d2 user: 41898282+github-actions[bot]@users.noreply.github.com tags: trunk, feat/cli-project-code-and-seed-from-upstream

Pulls in the Agent.Commit ParentID/MergeParents fix (#125, PR #133). Without it, agent.Commit produces orphan checkins that fragment the timeline. Required so downstream consumers can pin to a root release exposing the fix. leaf check-in: ab5b55e3b0 user: [email protected] tags: trunk, chore/bump-leaf-v0.0.9

Adds Repo.SetUserCaps(login, caps) and a Hub delegate, wrapping libfossil's Repo.SetCaps. Lets consumers grant or change caps on existing users without leaving the hub package — primarily for the common bones case where the libfossil-pre-populated 'nobody' user needs 'gio' to allow unauthenticated clone/pull/push.

Also adds Config.NobodyCaps so the typical setup is one declarative field instead of a manual SetUserCaps call after every NewHub. NobodyCaps is applied at bootstrap by calling SetUserCaps("nobody", v) internally — no method-body duplication. Empty NobodyCaps leaves nobody at whatever libfossil set it to (idempotent re-open path preserves prior caps, doesn't overwrite).

Tests: - TestRepo_SetUserCaps_RoundTrip — set + read back - TestRepo_SetUserCaps_RejectsEmptyLogin - TestNewHub_NobodyCaps_AppliedAtBootstrap — Config field works - TestNewHub_NobodyCaps_Idempotent — re-running with same caps OK - TestNewHub_NobodyCaps_EmptyDoesNotOverwrite — empty doesn't reset

Closes #130 leaf check-in: a8e62ce82d user: [email protected] tags: trunk, feat/130-hub-setusercaps

Adds ParentID and MergeParents to agent.CommitOpts. When ParentID is 0, Agent.Commit auto-resolves the current trunk tip and uses that as the parent — matching `fossil ci`'s default behavior. On an empty repo (BranchTip returns sql.ErrNoRows), the resolution falls through to 0 and the commit is a legitimate orphan root (the first commit).

Before this fix, agent.Commit always passed ParentID=0 to libfossil, producing P-card-less manifests. Every commit became its own root, fragmenting the timeline and breaking trunk-based development for downstream consumers (notably bones).

Tests added: - TestAgent_Commit_ChainsOntoTrunkTipByDefault — two consecutive Commit calls produce a chained pair with linked Parents. - TestAgent_Commit_ExplicitParentIDOverride — caller-supplied ParentID is used verbatim.

The hub-leaf e2e test (sim/hub_leaf_test.go) was reading by "trunk" tip on the hub; switched to reading by the explicit RevID returned from Agent.Commit so the test exercises the transport contract (file lands on hub) without coupling to branch-tip resolution semantics on the hub side after sync — which appears to be a separate concern worth its own investigation.

Closes #125 leaf check-in: 93966ff081 user: [email protected] tags: trunk, fix/125-commit-parent-id

The auto-generated upstream-bump PR for libfossil v0.5.0 (#121) only updated the root go.mod. leaf/go.mod and bridge/go.mod independently pin libfossil and stayed on v0.4.5 until I extended the PR by hand.

Walk every go.mod file in the repo, skip ones that don't depend on the target module (so go get doesn't add it as a new dep), then run go get + go mod tidy in each. Verify-build and the git-add for the commit also iterate the same set.

The find-based discovery automatically picks up future modules — when the hub package is promoted to its own go.mod (#118) or any other new module is added, no workflow change is needed.

Verified by dry-running the find/grep logic locally against this repo's main: correctly identifies ./, leaf/, bridge/ as libfossil dependants and skips ./docs/site/ (Hugo site, no libfossil).

Closes #127 leaf check-in: a6d596273d user: [email protected] tags: trunk, feat/127-bump-walk-all-gomods

Adds sim/hub_leaf_test.go: a real *hub.Hub bound to auto-allocated ports, a real *agent.Agent built against a leaf repo cloned from the hub, and a round-trip Commit + SyncTo + Hub.ReadAt that exercises the HTTP-xfer path end-to-end.

Without this test, the kind of cross-component regression bones surfaced in #120 (the SetMaxOpenConns deadlock under concurrent clones) only shows up downstream. With it, EdgeSync's own CI catches it.

Wired into the existing 'Sim serve tests' step (Makefile + test.yml) alongside TestServeHTTP/TestLeafToLeaf/TestAgentServe so the test runs on every PR.

Closes #113 leaf check-in: 7275783d59 user: [email protected] tags: trunk, feat/113-hub-leaf-e2e

Pulls in the SetMaxOpenConns(1) deadlock fix (#120/PR #122) and the libfossil v0.5.0 baseline (PR #121).

This is the version downstream consumers should pin to instead of v0.0.7 (which deterministically deadlocks under concurrent clones). leaf check-in: 89133cefa6 user: [email protected] tags: trunk, chore/bump-leaf-v0.0.8

The auto-generated bump-upstream PR only updated the root module's go.mod. The leaf and bridge modules pin libfossil independently and need the bump too — without this, the upcoming #112 cleanup (delete ridToUUID + simplify Agent.Diff using libfossil v0.5.0's UUIDFromRID + whole-checkin Diff) can't land on leaf since leaf's go.mod still resolves to v0.4.5.

Worth fixing the bump-upstream workflow separately to walk every go.mod under the repo, but treating that as a follow-up rather than blocking this PR on it. leaf check-in: c299ef11e2 user: [email protected] tags: trunk, chore/bump-libfossil-v0.5.0

Pulls in the libfossil-hidden Agent code-artifact API (Commit, Sync, SyncTo, Read, Files, Diff, Tip, ExtractTo, Config, plus internal SQLite tuning) and the libfossil-hidden notify Service methods (ListThreads, ReadThread, MessageCount, AddDevice/ListDevices/RemoveDevice, CreatePairingToken/ValidateToken). Carries through the v0.0.5/v0.0.6 fixes for sync-error classification and the notify Subscriber race.

Required so downstream consumers (bones) can pin to a root EdgeSync release that exposes the new agent surface.

Supersedes the in-flight chore/bump-leaf-v0.0.6 branch. leaf check-in: 94b10802bf user: [email protected] tags: trunk, chore/bump-leaf-v0.0.7

Pulls in fixes from two libfossil releases:

- v0.4.4 (libfossil#14): hub xfer handler no longer panics with "content.MakePublic: rid must be positive" when a client cancels mid-transfer. Affects EdgeSync hubs that serve concurrent clones.

- v0.4.5 (libfossil#17, libfossil#18): sync.Clone now converges against a hub being written to during the clone session. Three compounding root causes fixed: server-side rid cap (snapshot via CookieCard), client-side CloneSeqNoCard cursor emission, and cookie roundtrip. Wire-format compatible with older peers.

No EdgeSync source changes required — both fixes are libfossil-internal.

Closes #86. leaf check-in: 6c16b3e646 user: [email protected] tags: trunk, chore/bump-libfossil-v0.4.5