This release fixes five vulnerabilities. Upgrade, and check existing repositories' `nobody` capabilities (see the upgrade notes).

- GHSA-2g5p-q5f3-477p (high): a captured login card could be replayed with any request body. The nonce is now checked against the body, as fossil does. - GHSA-44p2-whvx-9gwq (high): new repositories let anonymous users push and gave them Setup, and an account with no password accepted any login. New repositories now get fossil's default users and capabilities. - GHSA-9fq6-h6xw-274g (high): table-sync row keys from a peer were written into SQL unchecked. - GHSA-p6w4-4xqc-jhq2 (medium): `reqconfig` disclosed any config row, including `project-code`, to anyone. - GHSA-j99p-mw22-69c8 (medium): malformed sync messages from a peer could panic, or exhaust the memory of, the client or server.

- `Checkout.Merge` merges the way fossil does, and `Commit` records the merge with its parents (#244). - `Repo.Annotate` credits lines the way `fossil annotate` does (#253, #256, #257). - Clone and sync exchanges follow the sync draft (#255). - Check-in, link and tag rows are stored as fossil stores them (#258). - A pull-only `Sync` converges when the client holds artifacts the server lacks (#277). - A conformance suite checks go-libfossil against the Fossil artifact and delta drafts (#262).

- New repositories no longer let anonymous users push. `nobody` gets fossil's `gjorz`. - Logins to accounts with no stored password are refused. - The CLI's `ci` commits the checkout, and its `--parent` flag is gone (#244).

- To allow anonymous push, grant it explicitly, e.g. `repo.SetCaps("nobody", "gijoryz")`, or give clients an account with a password. - Existing repositories keep their stored capabilities. Tighten ones created by earlier versions with `SetCaps("nobody", "gjorz")`.

6279ad9 chore(release): v0.11.0 changelog (#283) 1f7116d fix: harden sync and repository defaults (security) (#282) 1fa00d3 fix(sync): a pull-only sync converges when the server lacks the client's artifacts (#277) (#281) 877f491 test(conformance): delta-format conformance suite (#262) (#280) 6c90ce8 test(conformance): artifact-format conformance suite (#263) (#276) 5ddb0a9 test(conformance): harness for an RFC conformance suite (#262) (#264) f7481d6 Store check-in, link and tag rows as fossil does (#258) (#261) 5b1d9e8 Clone and sync exchanges follow the sync draft (#255) (#260) 10a01b4 fix(annotate): credit lines the way fossil annotate does (#256, #257) (#259) f80fa74 fix(annotate): credit lines through the start-version mapping (#253) (#254) de9aedc fix(checkout): merge the way fossil does, and commit merges with their parent (#244) (#252) ef6f656 ci(release): drop the downstream dispatch to EdgeSync (#251)". artifact: 7017cd0071 user: [email protected]

libfossil is a pure-Go implementation of the Fossil SCM, reading and writing the same .fossil SQLite repository format as upstream Fossil.

This is the first public release of code that previously lived in a private repository. The module path is github.com/danmestas/libfossil and the binary is named libfossil to avoid $PATH collisions with upstream fossil.

Included: - Repo lifecycle (create, clone), checkout/checkin, timeline, merge, diff, annotate, shun, tag, branch, bisect, stash, undo/redo - Sync-over-HTTP protocol (client and handler) - Two SQLite drivers: modernc (pure Go, default) and ncruces (wasm-capable) - Observer interfaces (SyncObserver, CheckoutObserver) with an optional OpenTelemetry implementation in observer/otel (separate submodule) - Deterministic simulation testing harness with BUGGIFY fault injection - Kong-based embeddable CLI under cli/ and a standalone binary under cmd/libfossil/ check-in: f5744359d3 user: [email protected] tags: trunk