Timeline

v0.11.1 fixes GHSA-mvx3-6793-8x4r (the sync server sent content to requesters without read permission) and GHSA-3f8x-8fr5-mr98 (the HTTP client followed redirects from HTTPS to HTTP).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> leaf check-in: 0a4c779ae2 user: [email protected] tags: trunk, main

go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly.

- agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials.

The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: dbb0c04321 user: [email protected] tags: trunk, main

Bumps go-libfossil from v0.9.0 to v0.10.0 in the root, bridge and leaf modules. The release fixes three data-loss bugs in the checkout API (Revert deleting never-committed files, Rename overwriting an existing file, Extract overwriting local edits on checkouts made by the fossil binary) and aligns checkout behavior with fossil. EdgeSync calls none of the affected functions except Extract via CreateCheckout, whose tests pass unchanged.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 087d06ceea user: [email protected] tags: trunk, main

* chore(deps): migrate to go-libfossil v0.9.0 (renamed module path)

- import path danmestas/libfossil → danmestas/go-libfossil everywhere - CloneOpts.ProjectCode removed upstream; assert via CloneResult instead - Timeline now takes TimelineOpts (cursor pagination, newest-first) - testutil.HasFossil removed; check FossilBinary() != ""

* ci: retrigger checks

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 38efed7a12 user: [email protected] tags: trunk, main

* chore(deps): update Go, Hugo, and cargo dependencies

- nats.go 1.49→1.53.1, nats-server 2.12.6→2.14.5, otel 1.43→1.45, modernc sqlite 1.46→1.56, libfossil 0.6.2→0.6.3, hextra 0.12.2→0.12.3 - cargo update for iroh-sidecar; ed25519/pkcs8/signature pinned to the rc series required by iroh's ed25519-dalek 3.0.0-pre.1 - fix traceparent test: nats.go ≥1.50 preserves header case and Get is exact-match; assert via natshdr.Carrier - rustfmt pass on sidecar sources

* chore(deps): bump iroh 0.97→1.0.3, fixes hickory-proto security alerts

SecretKey::generate no longer takes an rng; drop now-unused rand dep. Verified with make test-iroh (peer sync + convergence e2e).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: eb4b6f52d0 user: [email protected] tags: trunk, main

Bumps the go_modules group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go_modules group with 1 update in the /bridge directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go_modules group with 1 update in the /leaf directory: [golang.org/x/crypto](https://github.com/golang/crypto).

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/net` from 0.52.0 to 0.54.0 - [Commits](https://github.com/golang/net/compare/v0.52.0...v0.54.0)

--- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules ...

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> check-in: eac9836302 user: [email protected] tags: trunk, main

libfossil#30 / EdgeSync#163 shipped consumer-side and upstream respectively. With libfossil v0.6.2 (PR #32, commit e6d34fb), Repo.Commit merges parent F-cards with supplied Files internally when ParentID > 0 — the exact behavior agent.mergeWithParent was emulating. Drop the duplicate.

Repo policy (CLAUDE.md "Upstream-fix policy") is unambiguous: when a fix lands in a repo we own, the workaround in the consuming repo should be removed, not left as defense-in-depth. libfossil is ours; a regression there gets fixed there.

Bumps: - root go.mod: v0.6.1 → v0.6.2 - leaf/go.mod: v0.5.0 → v0.6.2 (was lagging; auto-bump workflow has been failing per #146/#158) - bridge/go.mod: v0.5.0 → v0.6.2 (same)

Keeps the regression tests TestAgent_Commit_PreservesParentFiles and TestAgent_Commit_SuppliedFileOverridesParent — they assert behavior, not implementation, and now serve as integration coverage so any future libfossil regression on full-tree manifest emission surfaces in EdgeSync CI too.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: fabb4e3453 user: [email protected] tags: trunk

* chore: bump libfossil → v0.5.0

* chore: bump libfossil → v0.5.0 in leaf and bridge modules

The auto-generated bump-upstream PR only updated the root module's go.mod. The leaf and bridge modules pin libfossil independently and need the bump too — without this, the upcoming #112 cleanup (delete ridToUUID + simplify Agent.Diff using libfossil v0.5.0's UUIDFromRID + whole-checkin Diff) can't land on leaf since leaf's go.mod still resolves to v0.4.5.

Worth fixing the bump-upstream workflow separately to walk every go.mod under the repo, but treating that as a follow-up rather than blocking this PR on it.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dan Mestas <[email protected]> check-in: c52b0b3b44 user: [email protected] tags: trunk

The auto-generated bump-upstream PR only updated the root module's go.mod. The leaf and bridge modules pin libfossil independently and need the bump too — without this, the upcoming #112 cleanup (delete ridToUUID + simplify Agent.Diff using libfossil v0.5.0's UUIDFromRID + whole-checkin Diff) can't land on leaf since leaf's go.mod still resolves to v0.4.5.

Worth fixing the bump-upstream workflow separately to walk every go.mod under the repo, but treating that as a follow-up rather than blocking this PR on it. leaf check-in: c299ef11e2 user: [email protected] tags: trunk, chore/bump-libfossil-v0.5.0

chore: bump libfossil v0.4.3 → v0.4.5 check-in: c77ecea4f7 user: [email protected] tags: trunk, v0.0.7

Pulls in fixes from two libfossil releases:

- v0.4.4 (libfossil#14): hub xfer handler no longer panics with "content.MakePublic: rid must be positive" when a client cancels mid-transfer. Affects EdgeSync hubs that serve concurrent clones.

- v0.4.5 (libfossil#17, libfossil#18): sync.Clone now converges against a hub being written to during the clone session. Three compounding root causes fixed: server-side rid cap (snapshot via CookieCard), client-side CloneSeqNoCard cursor emission, and cookie roundtrip. Wire-format compatible with older peers.

No EdgeSync source changes required — both fixes are libfossil-internal.

Closes #86. leaf check-in: 6c16b3e646 user: [email protected] tags: trunk, chore/bump-libfossil-v0.4.5

pre-public: LICENSE, IP placeholders, module READMEs, WASM build fix check-in: 83d2a03038 user: [email protected] tags: trunk

go.mod: pin sub-module deps to real tags so EdgeSync/cli is consumable check-in: 0d8829ccf1 user: [email protected] tags: trunk, v0.0.5

Replace v0.0.0-00010101 placeholders with leaf v0.0.3 and bridge v0.0.2 in the root and bridge go.mod files. Local replace directives stay so intra-repo development against unreleased changes still works; the real version pins make EdgeSync/cli consumable by external repos via `go get`.

Without this, `go get github.com/danmestas/EdgeSync/cli` fails with "unknown revision 000000000000" when the consumer tries to resolve EdgeSync/bridge. check-in: e6c688849f user: [email protected] tags: trunk

deps: bump libfossil v0.1.0 → v0.4.3 across all modules check-in: efeaf4c90f user: [email protected] tags: trunk, v0.0.3, leaf/v0.0.3, bridge/v0.0.2

Picks up four releases worth of upstream fixes and surface additions:

- v0.4.0 → v0.4.3: xfer protocol fix (always emit project-code on push/pull cards, libfossil#12), diff byte-fidelity ("\\ No newline at end of file", libfossil#10), repo.ResolveVersion + ReadFileAt for symbolic version lookups (libfossil#11). - v0.2.0 / v0.3.0: prior 5xx error mapping, transport rewrites, repo admin surface, content cache, observer rework — all consumed transitively without code changes here.

`go build ./...` clean. `make test` green across leaf/, bridge/, sim/, notify, telemetry. No code changes needed in EdgeSync — the libfossil public API stayed stable across these releases.

This bump is needed by the sibling agent-infra repo, which already pins libfossil v0.4.2 directly for chat/workspace and was relying on the local `replace ../EdgeSync/leaf` directive to mask the version drift. With this bump and a follow-up tag (leaf/v0.0.3), agent-infra can drop the replace and pin clean module versions. check-in: 7db3317617 user: [email protected] tags: trunk

docs: Hugo+hextra docs site with Cloudflare Workers deploy check-in: d59e2dece9 user: [email protected] tags: trunk, v0.0.2

Two copies of natsHeaderCarrier existed (leaf/agent/nats.go and leaf/agent/notify/pubsub.go), both carrying the same latent case-sensitive Get bug that was fixed in Task 6. Extract the type to leaf/agent/internal/natshdr so the next bug can be fixed once.

While consolidating, drop the 4-tier fallback in Get in favor of a single EqualFold scan. Header maps are tiny (typically 3 entries) and tiers 1-3 were subsumed by tier 4 anyway. The new implementation is demonstrably correct and easier to read. check-in: b53032d01f user: [email protected] tags: trunk, leaf/v0.0.2

Fix the case-sensitive module path to match the actual GitHub repo URL (danmestas/EdgeSync). Remove tracked leaf/leaf binary and ignore .claude/skills/ scratchpad dirs. check-in: eda7960b81 user: [email protected] tags: trunk, v0.0.1, leaf/v0.0.1, bridge/v0.0.1