Timeline

Bumps [github.com/danmestas/go-libfossil](https://github.com/danmestas/go-libfossil) in `/` from 0.11.1 to 0.12.0.

Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0)

Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0)

Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0)

--- updated-dependencies: - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules ...

Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: ba948a480d user: [email protected] tags: trunk, main, dependabot/go_modules/go_modules-cd07540e7f

v0.11.1 fixes GHSA-mvx3-6793-8x4r (the sync server sent content to requesters without read permission) and GHSA-3f8x-8fr5-mr98 (the HTTP client followed redirects from HTTPS to HTTP).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> leaf check-in: 0a4c779ae2 user: [email protected] tags: trunk, main

Bumps the cargo group with 2 updates in the /iroh-sidecar directory: [hickory-resolver](https://github.com/hickory-dns/hickory-dns) and [rustls](https://github.com/rustls/rustls).

Updates `hickory-resolver` from 0.26.1 to 0.26.3 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.3)

Updates `rustls` from 0.23.43 to 0.23.45 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.43...v/0.23.45)

--- updated-dependencies: - dependency-name: hickory-resolver dependency-version: 0.26.3 dependency-type: indirect dependency-group: cargo - dependency-name: rustls dependency-version: 0.23.45 dependency-type: indirect dependency-group: cargo ...

Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: 0f53f1d32b user: [email protected] tags: trunk, dependabot/cargo/iroh-sidecar/cargo-60501f734e

go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly.

- agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials.

The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: dbb0c04321 user: [email protected] tags: trunk, main

Bumps go-libfossil from v0.9.0 to v0.10.0 in the root, bridge and leaf modules. The release fixes three data-loss bugs in the checkout API (Revert deleting never-committed files, Rename overwriting an existing file, Extract overwriting local edits on checkouts made by the fossil binary) and aligns checkout behavior with fossil. EdgeSync calls none of the affected functions except Extract via CreateCheckout, whose tests pass unchanged.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 087d06ceea user: [email protected] tags: trunk, main

bump-upstream.yml waited for an upstream-bump event from go-libfossil's release workflow. That path has been dead since the rename: go-libfossil sends repo=go-libfossil and module github.com/danmestas/go-libfossil, while this workflow only accepted libfossil and github.com/danmestas/libfossil and ignored anything else. The sending side has also failed with 401 since v0.8.1, because its token expired.

Dependabot now watches github.com/danmestas/go-libfossil and its driver modules in the root, bridge and leaf go.mod files, daily, and opens one pull request per module path across all three. No token is needed, and a broken update shows up in Dependabot's own status rather than as a dispatch nobody sees fail. Security updates for other dependencies are unaffected.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: a8beeb09dc user: [email protected] tags: trunk, main

The v0.2.0 handle-API migration gutted 14 sim test files to 4-line stubs; the Makefile/CI regexes kept matching zero tests and passed vacuously. DST and seed-sweep suites live in go-libfossil now.

- make test / CI sim job run the tests that actually exist - drop dead sim, sim-full, test-interop targets and ghost dst PHONYs - delete the stub files (originals in git history)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: e1882f5021 user: [email protected] tags: trunk, main

* chore: remove accidentally committed agent trace files, gitignore .agent-config

* ci: retrigger checks

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: a213a4a665 user: [email protected] tags: trunk, main

* chore(deps): migrate to go-libfossil v0.9.0 (renamed module path)

- import path danmestas/libfossil → danmestas/go-libfossil everywhere - CloneOpts.ProjectCode removed upstream; assert via CloneResult instead - Timeline now takes TimelineOpts (cursor pagination, newest-first) - testutil.HasFossil removed; check FossilBinary() != ""

* ci: retrigger checks

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 38efed7a12 user: [email protected] tags: trunk, main

* chore(deps): update Go, Hugo, and cargo dependencies

- nats.go 1.49→1.53.1, nats-server 2.12.6→2.14.5, otel 1.43→1.45, modernc sqlite 1.46→1.56, libfossil 0.6.2→0.6.3, hextra 0.12.2→0.12.3 - cargo update for iroh-sidecar; ed25519/pkcs8/signature pinned to the rc series required by iroh's ed25519-dalek 3.0.0-pre.1 - fix traceparent test: nats.go ≥1.50 preserves header case and Get is exact-match; assert via natshdr.Carrier - rustfmt pass on sidecar sources

* chore(deps): bump iroh 0.97→1.0.3, fixes hickory-proto security alerts

SecretKey::generate no longer takes an rng; drop now-unused rand dep. Verified with make test-iroh (peer sync + convergence e2e).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: eb4b6f52d0 user: [email protected] tags: trunk, main

Bumps the cargo group with 1 update in the /iroh-sidecar directory: [quinn-proto](https://github.com/quinn-rs/quinn).

Updates `quinn-proto` from 0.11.14 to 0.11.16 - [Release notes](https://github.com/quinn-rs/quinn/releases) - [Commits](https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.14...quinn-proto-0.11.16)

--- updated-dependencies: - dependency-name: quinn-proto dependency-version: 0.11.16 dependency-type: indirect dependency-group: cargo ...

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> check-in: 4d402f6972 user: [email protected] tags: trunk, main

Bumps the go_modules group with 2 updates in the /leaf directory: [golang.org/x/net](https://github.com/golang/net) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).

Updates `golang.org/x/net` from 0.54.0 to 0.55.0 - [Commits](https://github.com/golang/net/compare/v0.54.0...v0.55.0)

Updates `google.golang.org/grpc` from 1.80.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.82.1)

--- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect dependency-group: go_modules ...

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> check-in: 51f9b5e893 user: [email protected] tags: trunk, main

Bumps the go_modules group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go_modules group with 1 update in the /bridge directory: [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the go_modules group with 1 update in the /leaf directory: [golang.org/x/crypto](https://github.com/golang/crypto).

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/crypto` from 0.49.0 to 0.52.0 - [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.52.0)

Updates `golang.org/x/net` from 0.52.0 to 0.54.0 - [Commits](https://github.com/golang/net/compare/v0.52.0...v0.54.0)

--- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: indirect dependency-group: go_modules ...

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> check-in: eac9836302 user: [email protected] tags: trunk, main

TigerStyle: eliminate the shared mutable state instead of guarding it.

Move mux + http.Server construction from ServeHTTP into NewHub. After NewHub returns, h.httpServer and h.httpListener are immutable for the hubs lifetime — single writer (NewHub), many readers (ServeHTTP, Stop). No mutex, no atomic, no sync.Once required: the race is gone by construction.

Add a hub package-private assert helper and positive invariants at entry to ServeHTTP and Stop, surfacing programmer-bugs loudly instead of silently UB-ing on a nil httpServer.

Fixes the 3 data races in TestCrossSessionAutosync and the 3 in TestScope_Project_ConcurrentCommits under -race; hub package suite green at -race -count=3.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 3b6306fdc2 user: [email protected] tags: trunk, main

TigerStyle: eliminate the shared mutable state instead of guarding it.

Move mux + http.Server construction from ServeHTTP into NewHub. After NewHub returns, h.httpServer and h.httpListener are immutable for the hubs lifetime — single writer (NewHub), many readers (ServeHTTP, Stop). No mutex, no atomic, no sync.Once required: the race is gone by construction.

Add a hub package-private assert helper and positive invariants at entry to ServeHTTP and Stop, surfacing programmer-bugs loudly instead of silently UB-ing on a nil httpServer.

Fixes the 3 data races in TestCrossSessionAutosync and the 3 in TestScope_Project_ConcurrentCommits under -race; hub package suite green at -race -count=3. leaf check-in: 8a18ec9ebe user: 41898282+github-actions[bot]@users.noreply.github.com tags: trunk, fix/hub-stop-servehttp-race-tigerstyle

* fix(hub): resolve TestNotifyCLIPairAndDevices flake (closes #170)

Each of the 4 tests in cmd/edgesync/notify_test.go independently invoked `go build` for the edgesync binary inside its own body. Under cold build cache or parallel test load, this build storm pushed the package's total runtime past `go test -short -timeout=30s ./...` (the pre-push hook gate) and the suite-level timeout fired — surfacing as a hang on os/exec.Wait since the inner `go build` child was still running when the supervisor killed the test process.

Move the build into TestMain so the binary is built once and reused. With -timeout=30s on cold cache, cmd/edgesync drops from ~9s to ~3s and the target test from ~2.8s to ~0.07s — comfortably clear of the timeout.

No production-code change. No sleep band-aids. Verified 200/200 passes (50× per test in the package) and 80/80 under -race.

* fix(test): clean up temp dir before os.Exit (Ousterhout follow-up to PR 186)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 37780572c3 user: [email protected] tags: trunk, main