3 descendants of dbb0c043213959ae
|
2026-10-16
| ||
| 18:14 |
build(deps): bump github.com/danmestas/go-libfossil in /
Bumps [github.com/danmestas/go-libfossil](https://github.com/danmestas/go-libfossil) in `/` from 0.11.1 to 0.12.0. Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0) Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0) Updates `github.com/danmestas/go-libfossil` from 0.11.1 to 0.12.0 - [Release notes](https://github.com/danmestas/go-libfossil/releases) - [Changelog](https://github.com/danmestas/go-libfossil/blob/main/CHANGELOG.md) - [Commits](https://github.com/danmestas/go-libfossil/compare/v0.11.1...v0.12.0) --- updated-dependencies: - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules - dependency-name: github.com/danmestas/go-libfossil dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go_modules ... Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: ba948a480d user: [email protected] tags: trunk, main, dependabot/go_modules/go_modules-cd07540e7f | |
|
2026-10-11
| ||
| 13:52 |
build(deps): bump github.com/danmestas/go-libfossil to v0.11.1 (#203)
v0.11.1 fixes GHSA-mvx3-6793-8x4r (the sync server sent content to requesters without read permission) and GHSA-3f8x-8fr5-mr98 (the HTTP client followed redirects from HTTPS to HTTP). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> leaf check-in: 0a4c779ae2 user: [email protected] tags: trunk, main | |
| 01:50 |
build(deps): bump the cargo group across 1 directory with 2 updates
Bumps the cargo group with 2 updates in the /iroh-sidecar directory: [hickory-resolver](https://github.com/hickory-dns/hickory-dns) and [rustls](https://github.com/rustls/rustls). Updates `hickory-resolver` from 0.26.1 to 0.26.3 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.3) Updates `rustls` from 0.23.43 to 0.23.45 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.43...v/0.23.45) --- updated-dependencies: - dependency-name: hickory-resolver dependency-version: 0.26.3 dependency-type: indirect dependency-group: cargo - dependency-name: rustls dependency-version: 0.23.45 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: 0f53f1d32b user: [email protected] tags: trunk, dependabot/cargo/iroh-sidecar/cargo-60501f734e | |
| 01:48 |
fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 (#201)
go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly. - agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials. The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: dbb0c04321 user: [email protected] tags: trunk, main | |