Artifact 7017cd0071b2557370eb858788c2ed0502a0cd4deef29fd8a50c2b553fe42921:
This release fixes five vulnerabilities. Upgrade, and check existing repositories' `nobody` capabilities (see the upgrade notes).
- GHSA-2g5p-q5f3-477p (high): a captured login card could be replayed with any request body. The nonce is now checked against the body, as fossil does. - GHSA-44p2-whvx-9gwq (high): new repositories let anonymous users push and gave them Setup, and an account with no password accepted any login. New repositories now get fossil's default users and capabilities. - GHSA-9fq6-h6xw-274g (high): table-sync row keys from a peer were written into SQL unchecked. - GHSA-p6w4-4xqc-jhq2 (medium): `reqconfig` disclosed any config row, including `project-code`, to anyone. - GHSA-j99p-mw22-69c8 (medium): malformed sync messages from a peer could panic, or exhaust the memory of, the client or server.
- `Checkout.Merge` merges the way fossil does, and `Commit` records the merge with its parents (#244). - `Repo.Annotate` credits lines the way `fossil annotate` does (#253, #256, #257). - Clone and sync exchanges follow the sync draft (#255). - Check-in, link and tag rows are stored as fossil stores them (#258). - A pull-only `Sync` converges when the client holds artifacts the server lacks (#277). - A conformance suite checks go-libfossil against the Fossil artifact and delta drafts (#262).
- New repositories no longer let anonymous users push. `nobody` gets fossil's `gjorz`. - Logins to accounts with no stored password are refused. - The CLI's `ci` commits the checkout, and its `--parent` flag is gone (#244).
- To allow anonymous push, grant it explicitly, e.g. `repo.SetCaps("nobody", "gijoryz")`, or give clients an account with a password. - Existing repositories keep their stored capabilities. Tighten ones created by earlier versions with `SetCaps("nobody", "gjorz")`.
6279ad9 chore(release): v0.11.0 changelog (#283) 1f7116d fix: harden sync and repository defaults (security) (#282) 1fa00d3 fix(sync): a pull-only sync converges when the server lacks the client's artifacts (#277) (#281) 877f491 test(conformance): delta-format conformance suite (#262) (#280) 6c90ce8 test(conformance): artifact-format conformance suite (#263) (#276) 5ddb0a9 test(conformance): harness for an RFC conformance suite (#262) (#264) f7481d6 Store check-in, link and tag rows as fossil does (#258) (#261) 5b1d9e8 Clone and sync exchanges follow the sync draft (#255) (#260) 10a01b4 fix(annotate): credit lines the way fossil annotate does (#256, #257) (#259) f80fa74 fix(annotate): credit lines through the start-version mapping (#253) (#254) de9aedc fix(checkout): merge the way fossil does, and commit merges with their parent (#244) (#252) ef6f656 ci(release): drop the downstream dispatch to EdgeSync (#251)". by [email protected] on 2026-10-11 01:39:11.
D 2026-10-11T01:39:11
T +sym-v0.11.0 59df292529218c3e16c63f8b282404aef05b904fe1e55c25490a5dee9fe5cb27 Release\sv0.11.0\n\nThis\srelease\sfixes\sfive\svulnerabilities.\sUpgrade,\sand\scheck\sexisting\srepositories'\s`nobody`\scapabilities\s(see\sthe\supgrade\snotes).\n\n-\sGHSA-2g5p-q5f3-477p\s(high):\sa\scaptured\slogin\scard\scould\sbe\sreplayed\swith\sany\srequest\sbody.\sThe\snonce\sis\snow\schecked\sagainst\sthe\sbody,\sas\sfossil\sdoes.\n-\sGHSA-44p2-whvx-9gwq\s(high):\snew\srepositories\slet\sanonymous\susers\spush\sand\sgave\sthem\sSetup,\sand\san\saccount\swith\sno\spassword\saccepted\sany\slogin.\sNew\srepositories\snow\sget\sfossil's\sdefault\susers\sand\scapabilities.\n-\sGHSA-9fq6-h6xw-274g\s(high):\stable-sync\srow\skeys\sfrom\sa\speer\swere\swritten\sinto\sSQL\sunchecked.\n-\sGHSA-p6w4-4xqc-jhq2\s(medium):\s`reqconfig`\sdisclosed\sany\sconfig\srow,\sincluding\s`project-code`,\sto\sanyone.\n-\sGHSA-j99p-mw22-69c8\s(medium):\smalformed\ssync\smessages\sfrom\sa\speer\scould\spanic,\sor\sexhaust\sthe\smemory\sof,\sthe\sclient\sor\sserver.\n\n-\s`Checkout.Merge`\smerges\sthe\sway\sfossil\sdoes,\sand\s`Commit`\srecords\sthe\smerge\swith\sits\sparents\s(#244).\n-\s`Repo.Annotate`\scredits\slines\sthe\sway\s`fossil\sannotate`\sdoes\s(#253,\s#256,\s#257).\n-\sClone\sand\ssync\sexchanges\sfollow\sthe\ssync\sdraft\s(#255).\n-\sCheck-in,\slink\sand\stag\srows\sare\sstored\sas\sfossil\sstores\sthem\s(#258).\n-\sA\spull-only\s`Sync`\sconverges\swhen\sthe\sclient\sholds\sartifacts\sthe\sserver\slacks\s(#277).\n-\sA\sconformance\ssuite\schecks\sgo-libfossil\sagainst\sthe\sFossil\sartifact\sand\sdelta\sdrafts\s(#262).\n\n-\sNew\srepositories\sno\slonger\slet\sanonymous\susers\spush.\s`nobody`\sgets\sfossil's\s`gjorz`.\n-\sLogins\sto\saccounts\swith\sno\sstored\spassword\sare\srefused.\n-\sThe\sCLI's\s`ci`\scommits\sthe\scheckout,\sand\sits\s`--parent`\sflag\sis\sgone\s(#244).\n\n-\sTo\sallow\sanonymous\spush,\sgrant\sit\sexplicitly,\se.g.\s`repo.SetCaps("nobody",\s"gijoryz")`,\sor\sgive\sclients\san\saccount\swith\sa\spassword.\n-\sExisting\srepositories\skeep\stheir\sstored\scapabilities.\sTighten\sones\screated\sby\searlier\sversions\swith\s`SetCaps("nobody",\s"gjorz")`.\n\n6279ad9\schore(release):\sv0.11.0\schangelog\s(#283)\n1f7116d\sfix:\sharden\ssync\sand\srepository\sdefaults\s(security)\s(#282)\n1fa00d3\sfix(sync):\sa\spull-only\ssync\sconverges\swhen\sthe\sserver\slacks\sthe\sclient's\sartifacts\s(#277)\s(#281)\n877f491\stest(conformance):\sdelta-format\sconformance\ssuite\s(#262)\s(#280)\n6c90ce8\stest(conformance):\sartifact-format\sconformance\ssuite\s(#263)\s(#276)\n5ddb0a9\stest(conformance):\sharness\sfor\san\sRFC\sconformance\ssuite\s(#262)\s(#264)\nf7481d6\sStore\scheck-in,\slink\sand\stag\srows\sas\sfossil\sdoes\s(#258)\s(#261)\n5b1d9e8\sClone\sand\ssync\sexchanges\sfollow\sthe\ssync\sdraft\s(#255)\s(#260)\n10a01b4\sfix(annotate):\scredit\slines\sthe\sway\sfossil\sannotate\sdoes\s(#256,\s#257)\s(#259)\nf80fa74\sfix(annotate):\scredit\slines\sthrough\sthe\sstart-version\smapping\s(#253)\s(#254)\nde9aedc\sfix(checkout):\smerge\sthe\sway\sfossil\sdoes,\sand\scommit\smerges\swith\stheir\sparent\s(#244)\s(#252)\nef6f656\sci(release):\sdrop\sthe\sdownstream\sdispatch\sto\sEdgeSync\s(#251)
U [email protected]
Z 2f6bf82696c54859700edf316bb533c8