Artifact 738281c7fec1b6a672499cc22bb1c51dce4e57c401638ed9060e6c4f0e33d778:
This release fixes two vulnerabilities in the sync server and client. Upgrade if you serve repositories that must not be readable anonymously, or sync over HTTPS.
- GHSA-mvx3-6793-8x4r (medium): the sync server sent artifacts and unversioned files to requesters without read permission. `gimme` is now answered only in an accepted pull or a clone, and the unversioned catalog and files only to readers. - GHSA-3f8x-8fr5-mr98 (low): the sync client followed a redirect from HTTPS to plain HTTP, resending the login card in cleartext. Redirects now follow fossil's rules and never downgrade.
- `pragma ci-lock` takes or reports a check-in lock only for a requester with Write. fossil takes a lock for any requester; fossil's own client asks for one only before a commit, which needs Write. - An HTTP redirect is followed by re-POSTing the request, as fossil does, rather than switching to GET.
c1f3fc9 chore(release): v0.11.1 changelog (#298) 2992016 fix(sync): send content only to readers; never follow HTTPS to HTTP (security) (#297) 1a8c243 test(conformance): repository-state conformance suite (#262) (#295)". by [email protected] on 2026-10-11 13:33:08.
D 2026-10-11T13:33:08 T +sym-v0.11.1 dbe626ea5d6eccb8e0bfbc102d96129247b7e58d541ab8658f961bea1f4f4d74 Release\sv0.11.1\n\nThis\srelease\sfixes\stwo\svulnerabilities\sin\sthe\ssync\sserver\sand\sclient.\sUpgrade\sif\syou\sserve\srepositories\sthat\smust\snot\sbe\sreadable\sanonymously,\sor\ssync\sover\sHTTPS.\n\n-\sGHSA-mvx3-6793-8x4r\s(medium):\sthe\ssync\sserver\ssent\sartifacts\sand\sunversioned\sfiles\sto\srequesters\swithout\sread\spermission.\s`gimme`\sis\snow\sanswered\sonly\sin\san\saccepted\spull\sor\sa\sclone,\sand\sthe\sunversioned\scatalog\sand\sfiles\sonly\sto\sreaders.\n-\sGHSA-3f8x-8fr5-mr98\s(low):\sthe\ssync\sclient\sfollowed\sa\sredirect\sfrom\sHTTPS\sto\splain\sHTTP,\sresending\sthe\slogin\scard\sin\scleartext.\sRedirects\snow\sfollow\sfossil's\srules\sand\snever\sdowngrade.\n\n-\s`pragma\sci-lock`\stakes\sor\sreports\sa\scheck-in\slock\sonly\sfor\sa\srequester\swith\sWrite.\sfossil\stakes\sa\slock\sfor\sany\srequester;\sfossil's\sown\sclient\sasks\sfor\sone\sonly\sbefore\sa\scommit,\swhich\sneeds\sWrite.\n-\sAn\sHTTP\sredirect\sis\sfollowed\sby\sre-POSTing\sthe\srequest,\sas\sfossil\sdoes,\srather\sthan\sswitching\sto\sGET.\n\nc1f3fc9\schore(release):\sv0.11.1\schangelog\s(#298)\n2992016\sfix(sync):\ssend\scontent\sonly\sto\sreaders;\snever\sfollow\sHTTPS\sto\sHTTP\s(security)\s(#297)\n1a8c243\stest(conformance):\srepository-state\sconformance\ssuite\s(#262)\s(#295) U [email protected] Z 44922a2847144427814850d567f6f109