This release fixes two vulnerabilities in the sync server and client. Upgrade if you serve repositories that must not be readable anonymously, or sync over HTTPS.

- GHSA-mvx3-6793-8x4r (medium): the sync server sent artifacts and unversioned files to requesters without read permission. `gimme` is now answered only in an accepted pull or a clone, and the unversioned catalog and files only to readers. - GHSA-3f8x-8fr5-mr98 (low): the sync client followed a redirect from HTTPS to plain HTTP, resending the login card in cleartext. Redirects now follow fossil's rules and never downgrade.

- `pragma ci-lock` takes or reports a check-in lock only for a requester with Write. fossil takes a lock for any requester; fossil's own client asks for one only before a commit, which needs Write. - An HTTP redirect is followed by re-POSTing the request, as fossil does, rather than switching to GET.

c1f3fc9 chore(release): v0.11.1 changelog (#298) 2992016 fix(sync): send content only to readers; never follow HTTPS to HTTP (security) (#297) 1a8c243 test(conformance): repository-state conformance suite (#262) (#295)". artifact: 738281c7fe user: [email protected]

libfossil is a pure-Go implementation of the Fossil SCM, reading and writing the same .fossil SQLite repository format as upstream Fossil.

This is the first public release of code that previously lived in a private repository. The module path is github.com/danmestas/libfossil and the binary is named libfossil to avoid $PATH collisions with upstream fossil.

Included: - Repo lifecycle (create, clone), checkout/checkin, timeline, merge, diff, annotate, shun, tag, branch, bisect, stash, undo/redo - Sync-over-HTTP protocol (client and handler) - Two SQLite drivers: modernc (pure Go, default) and ncruces (wasm-capable) - Observer interfaces (SyncObserver, CheckoutObserver) with an optional OpenTelemetry implementation in observer/otel (separate submodule) - Deterministic simulation testing harness with BUGGIFY fault injection - Kong-based embeddable CLI under cli/ and a standalone binary under cmd/libfossil/ check-in: f5744359d3 user: [email protected] tags: trunk