D 2026-10-11T13:33:08
T +sym-v0.11.1 dbe626ea5d6eccb8e0bfbc102d96129247b7e58d541ab8658f961bea1f4f4d74 Release\sv0.11.1\n\nThis\srelease\sfixes\stwo\svulnerabilities\sin\sthe\ssync\sserver\sand\sclient.\sUpgrade\sif\syou\sserve\srepositories\sthat\smust\snot\sbe\sreadable\sanonymously,\sor\ssync\sover\sHTTPS.\n\n-\sGHSA-mvx3-6793-8x4r\s(medium):\sthe\ssync\sserver\ssent\sartifacts\sand\sunversioned\sfiles\sto\srequesters\swithout\sread\spermission.\s`gimme`\sis\snow\sanswered\sonly\sin\san\saccepted\spull\sor\sa\sclone,\sand\sthe\sunversioned\scatalog\sand\sfiles\sonly\sto\sreaders.\n-\sGHSA-3f8x-8fr5-mr98\s(low):\sthe\ssync\sclient\sfollowed\sa\sredirect\sfrom\sHTTPS\sto\splain\sHTTP,\sresending\sthe\slogin\scard\sin\scleartext.\sRedirects\snow\sfollow\sfossil's\srules\sand\snever\sdowngrade.\n\n-\s`pragma\sci-lock`\stakes\sor\sreports\sa\scheck-in\slock\sonly\sfor\sa\srequester\swith\sWrite.\sfossil\stakes\sa\slock\sfor\sany\srequester;\sfossil's\sown\sclient\sasks\sfor\sone\sonly\sbefore\sa\scommit,\swhich\sneeds\sWrite.\n-\sAn\sHTTP\sredirect\sis\sfollowed\sby\sre-POSTing\sthe\srequest,\sas\sfossil\sdoes,\srather\sthan\sswitching\sto\sGET.\n\nc1f3fc9\schore(release):\sv0.11.1\schangelog\s(#298)\n2992016\sfix(sync):\ssend\scontent\sonly\sto\sreaders;\snever\sfollow\sHTTPS\sto\sHTTP\s(security)\s(#297)\n1a8c243\stest(conformance):\srepository-state\sconformance\ssuite\s(#262)\s(#295)
U 93289084+danmestas@users.noreply.github.com
Z 44922a2847144427814850d567f6f109