D 2026-10-11T01:39:11
T +sym-v0.11.0 59df292529218c3e16c63f8b282404aef05b904fe1e55c25490a5dee9fe5cb27 Release\sv0.11.0\n\nThis\srelease\sfixes\sfive\svulnerabilities.\sUpgrade,\sand\scheck\sexisting\srepositories'\s`nobody`\scapabilities\s(see\sthe\supgrade\snotes).\n\n-\sGHSA-2g5p-q5f3-477p\s(high):\sa\scaptured\slogin\scard\scould\sbe\sreplayed\swith\sany\srequest\sbody.\sThe\snonce\sis\snow\schecked\sagainst\sthe\sbody,\sas\sfossil\sdoes.\n-\sGHSA-44p2-whvx-9gwq\s(high):\snew\srepositories\slet\sanonymous\susers\spush\sand\sgave\sthem\sSetup,\sand\san\saccount\swith\sno\spassword\saccepted\sany\slogin.\sNew\srepositories\snow\sget\sfossil's\sdefault\susers\sand\scapabilities.\n-\sGHSA-9fq6-h6xw-274g\s(high):\stable-sync\srow\skeys\sfrom\sa\speer\swere\swritten\sinto\sSQL\sunchecked.\n-\sGHSA-p6w4-4xqc-jhq2\s(medium):\s`reqconfig`\sdisclosed\sany\sconfig\srow,\sincluding\s`project-code`,\sto\sanyone.\n-\sGHSA-j99p-mw22-69c8\s(medium):\smalformed\ssync\smessages\sfrom\sa\speer\scould\spanic,\sor\sexhaust\sthe\smemory\sof,\sthe\sclient\sor\sserver.\n\n-\s`Checkout.Merge`\smerges\sthe\sway\sfossil\sdoes,\sand\s`Commit`\srecords\sthe\smerge\swith\sits\sparents\s(#244).\n-\s`Repo.Annotate`\scredits\slines\sthe\sway\s`fossil\sannotate`\sdoes\s(#253,\s#256,\s#257).\n-\sClone\sand\ssync\sexchanges\sfollow\sthe\ssync\sdraft\s(#255).\n-\sCheck-in,\slink\sand\stag\srows\sare\sstored\sas\sfossil\sstores\sthem\s(#258).\n-\sA\spull-only\s`Sync`\sconverges\swhen\sthe\sclient\sholds\sartifacts\sthe\sserver\slacks\s(#277).\n-\sA\sconformance\ssuite\schecks\sgo-libfossil\sagainst\sthe\sFossil\sartifact\sand\sdelta\sdrafts\s(#262).\n\n-\sNew\srepositories\sno\slonger\slet\sanonymous\susers\spush.\s`nobody`\sgets\sfossil's\s`gjorz`.\n-\sLogins\sto\saccounts\swith\sno\sstored\spassword\sare\srefused.\n-\sThe\sCLI's\s`ci`\scommits\sthe\scheckout,\sand\sits\s`--parent`\sflag\sis\sgone\s(#244).\n\n-\sTo\sallow\sanonymous\spush,\sgrant\sit\sexplicitly,\se.g.\s`repo.SetCaps("nobody",\s"gijoryz")`,\sor\sgive\sclients\san\saccount\swith\sa\spassword.\n-\sExisting\srepositories\skeep\stheir\sstored\scapabilities.\sTighten\sones\screated\sby\searlier\sversions\swith\s`SetCaps("nobody",\s"gjorz")`.\n\n6279ad9\schore(release):\sv0.11.0\schangelog\s(#283)\n1f7116d\sfix:\sharden\ssync\sand\srepository\sdefaults\s(security)\s(#282)\n1fa00d3\sfix(sync):\sa\spull-only\ssync\sconverges\swhen\sthe\sserver\slacks\sthe\sclient's\sartifacts\s(#277)\s(#281)\n877f491\stest(conformance):\sdelta-format\sconformance\ssuite\s(#262)\s(#280)\n6c90ce8\stest(conformance):\sartifact-format\sconformance\ssuite\s(#263)\s(#276)\n5ddb0a9\stest(conformance):\sharness\sfor\san\sRFC\sconformance\ssuite\s(#262)\s(#264)\nf7481d6\sStore\scheck-in,\slink\sand\stag\srows\sas\sfossil\sdoes\s(#258)\s(#261)\n5b1d9e8\sClone\sand\ssync\sexchanges\sfollow\sthe\ssync\sdraft\s(#255)\s(#260)\n10a01b4\sfix(annotate):\scredit\slines\sthe\sway\sfossil\sannotate\sdoes\s(#256,\s#257)\s(#259)\nf80fa74\sfix(annotate):\scredit\slines\sthrough\sthe\sstart-version\smapping\s(#253)\s(#254)\nde9aedc\sfix(checkout):\smerge\sthe\sway\sfossil\sdoes,\sand\scommit\smerges\swith\stheir\sparent\s(#244)\s(#252)\nef6f656\sci(release):\sdrop\sthe\sdownstream\sdispatch\sto\sEdgeSync\s(#251)
U 93289084+danmestas@users.noreply.github.com
Z 2f6bf82696c54859700edf316bb533c8