v0.2.11

New Features

Nothing to report this release.

Changed or Fixed Behavior

• Fixes a set of reachable HTTP/2 and TLS security bugs inherited from the Go 1.27.2 toolchain upgrade. Verified via govulncheck (run against an actual Go 1.27.1 toolchain on the pre-release code) that all nine fixed standard-library vulnerabilities are genuinely reachable from websyncd's own code paths — both the webhook/heartbeat HTTP server in internal/app/app_servers.go and the sync HTTP(S)/HTTP-3 client in internal/httpclient and internal/syncer. These are real behavior fixes, not theoretical: an HTTP/2 HPACK-encoder race that could crash the heartbeat/webhook server (GO-2026-6617), an HTTP/2 double flow-control refund and a repeated-SETTINGS CPU-exhaustion issue affecting both server and client (GO-2026-6612, GO-2026-6611), an HTTP/2 Trailer-header memory-exhaustion issue on the server (GO-2026-6603), malformed HTTP/2 framing headers previously accepted by the transport (GO-2026-6610), an HTTP/1 request-smuggling/desync risk after a 2xx CONNECT response on the server side (GO-2026-6613) and after a rejected CONNECT on the client side (GO-2026-6605), a MIME-header memory-limit bypass in net/textproto/mime/multipart (GO-2026-6608), and a malformed-ECH-extension handling gap in crypto/tls (GO-2026-6607). No configuration changes are required — simply running the updated binary closes these.
• Inherited from the golang.org/x/net transitive upgrade (pulled in alongside the quic-go bump): the same HTTP/2 Trailer-header, flow-control, framing, and HPACK-race issues listed above are also fixed at the module level (golang.org/x/net v0.59.0 → v0.61.0, fix landed in v0.60.0).
• Inherited from the quic-go upgrade (v0.62.0 → v0.64.0): HTTP/3 response header/trailer buffers now grow as data arrives instead of being pre-sized from the peer-advertised HEADERS length, removing a memory-amplification vector a malicious or misbehaving server could trigger against websyncd's HTTP/3 client. Path MTU discovery now restarts correctly after connection migration/NAT rebinding, and unanswered PATH_CHALLENGEs are retried with exponential backoff — both improve sync resilience on changing networks. Writes to an already-closed stream now correctly return quic.ErrStreamClosed instead of a less specific error.

Architectural Changes

Nothing to report this release.

Dependency Updates

• Go toolchain: 1.27.1 → 1.27.2 (security + bug-fix point release).
• github.com/quic-go/quic-go (core dependency): v0.62.0 → v0.64.0 (via intermediate v0.63.0). See quic-go's GitHub Releases for v0.63.0 and v0.64.0 for the congestion-control, http3 buffer-sizing, and PATH_CHALLENGE/PMTU fixes summarized above. v0.63.0 also contains server-side http3 breaking changes (URL.Scheme/URL.Host handling, stricter :path validation) that do not affect websyncd, which only uses quic-go's http3.Transport as a client.
• golang.org/x/crypto v0.57.0 → v0.58.0, golang.org/x/net v0.59.0 → v0.61.0, golang.org/x/sys v0.48.0 → v0.49.0, golang.org/x/text v0.42.0 → v0.43.0 (all transitive, via quic-go/Go toolchain).

CVEs fixed by this update batch (mechanically diffed via grype worktree comparison of v0.2.10 vs. HEAD, plus govulncheck run against an actual Go 1.27.1 toolchain to confirm reachability — all nine are confirmed reachable from websyncd's own code, not just present in the dependency tree):

• GO-2026-6603 — HTTP/2 server memory exhaustion via Trailer headers (net/http, golang.org/x/net)
• GO-2026-6605 — HTTP/1 client connection desync after CONNECT rejection (net/http)
• GO-2026-6607 — malformed ECH outer-extension handling (crypto/tls)
• GO-2026-6608 — MIME-header memory-limit bypass (net/textproto, mime/multipart)
• GO-2026-6610 — HTTP/2 transport accepts malformed framing headers (net/http, golang.org/x/net)
• GO-2026-6611 — excessive CPU use from repeated HTTP/2 window-size changes (net/http, golang.org/x/net)
• GO-2026-6612 — HTTP/2 double flow-control refund (net/http, golang.org/x/net)
• GO-2026-6613 — HTTP/1 server connection desync after 2xx CONNECT response (net/http)
• GO-2026-6617 — HTTP/2 HPACK-encoder race causing server crash (net/http, golang.org/x/net)

No new vulnerabilities were introduced by this update batch (HEAD's dependency tree has zero IDs that weren't already present at v0.2.10, aside from the one documented exception below).

Advisories Flagged but Not Applicable:

• GO-2026-5932 — golang.org/x/crypto/openpgp flagged as unmaintained/unsafe-by-design. websyncd never imports or calls openpgp; it is pulled in only transitively via quic-go's TLS internals. Re-confirmed unreachable via govulncheck at HEAD. (Already documented in .claude/release-notes.yml; no change needed.)

CI Updates

Nothing to report this release.

Full Changelog: v0.2.10...v0.2.11

v0.2.10

New Features

Nothing to report this release.

Changed or Fixed Behavior

Nothing to report this release. quic-go (the core dependency) is unchanged at v0.62.0, so there are no inherited changes.

Architectural Changes

Nothing to report this release.

Dependency Updates

Indirect (transitive) module bumps, with no direct dependency or toolchain changes (Go stays at 1.27.1, quic-go stays at v0.62.0):

• golang.org/x/crypto v0.56.0 -> v0.57.0
• golang.org/x/net v0.58.0 -> v0.59.0
• golang.org/x/sys v0.47.0 -> v0.48.0
• golang.org/x/text v0.41.0 -> v0.42.0

No CVEs were fixed by this update batch. A grype diff of v0.2.9 against HEAD shows identical ID sets.

Advisories Flagged but Not Applicable

• GO-2026-5932: grype flags it at both v0.2.9 and HEAD. It concerns golang.org/x/crypto/openpgp, which websyncd never imports. govulncheck ./... at HEAD reports 0 affected vulnerabilities, and the one module-level finding is not called by the code.

CI Updates

Nothing to report this release.

Full Changelog: v0.2.9...v0.2.10

v0.2.9

New Features

Nothing to report this release. (Inherited from the quic-go v0.62.0 upgrade: RFC 9218 stream-priority support and an HTTP/3 TryWriteAll API were added, but websyncd's client only issues single HEAD/GET requests per origin and doesn't expose or rely on stream prioritization, so this brings no observable change for websyncd users.)

Changed or Fixed Behavior

• Bumped the quic-go/http3 client library from v0.61.0 to v0.62.0. Inherited from this upgrade: fixes to HTTP/3 request validation (userinfo-in-authority, duplicate Host headers, scheme normalization, CONNECT handling), 0-RTT rejection when server settings changed, and a race in connection-ID retirement/path closure — all of which make websyncd's automatic HTTP/3 upgrade path (ENABLE_HTTP3) more robust against non-conformant or flaky servers. (quic-go v0.62.0 release notes)
• Note: quic-go v0.62.0 now requires Go 1.26+; this is already satisfied since websyncd's toolchain was bumped to Go 1.27.1 in the same batch (see Dependency Updates), so no action is needed.

Architectural Changes

• The repo's release-notes procedure was replaced with a pointer to a shared release-notes Claude Code agent (sourced from github.com/TomTonic/go-project-defaults), with project-specific parameters now living in .claude/release-notes.yml. This only affects contributors/maintainers preparing releases, not the shipped binary.

Dependency Updates

• Go toolchain: 1.27.0 → 1.27.1.
• github.com/quic-go/quic-go (direct): v0.61.0 → v0.62.0.
• golang.org/x/crypto (indirect, pulled in via quic-go): v0.55.0 → v0.56.0.
• github.com/stretchr/testify (indirect, test-only): v1.11.1 → v1.12.1; its own gopkg.in/yaml.v3 dependency was replaced by go.yaml.in/yaml/v3 v3.0.5.

CVEs fixed by this update batch:

• GO-2026-6354 — DoS via deadlock on an undecided SSH channel in golang.org/x/crypto/ssh, fixed by the x/crypto v0.56.0 bump.
• GO-2026-6355 — DoS via deadlock on an established SSH channel in golang.org/x/crypto/ssh, fixed by the same bump.
  (Confirmed via grype diff between the v0.2.8 and HEAD checkouts, and independently by govulncheck. Both are in the SSH package, which websyncd's own code never calls — govulncheck reports them as unreachable both before and after the fix — but they're listed here since a dependency-tree scan flags them regardless of reachability.)
• No other CVEs were found fixed in quic-go itself between v0.61.0 and v0.62.0 (a worktree-diff scan of the quic-go repo at both tags produced identical vulnerability ID sets).

Advisories Flagged but Not Applicable:

• GO-2026-5932 — "golang.org/x/crypto/openpgp is unmaintained, unsafe by design" — present in x/crypto both before and after this release's bump (not newly introduced, not fixed). govulncheck ./... confirms websyncd's code never reaches the flagged openpgp symbols (x/crypto is only pulled in transitively for QUIC/TLS internals via quic-go).

CI Updates

Nothing to report this release.

Full Changelog: v0.2.8...v0.2.9

v0.2.8

v0.2.8

Source Code Updates

• Bumped the Go toolchain from 1.26.6 to 1.27.0. This is a feature release, not a security patch —
  no CVEs are fixed by this jump (1.26.6 already carried all fixes current at the time). Notable
  changes relevant to this project's operation:
  • Small-object memory allocation is up to 30% faster for allocations under 80 bytes, giving a
    modest overall throughput improvement with no code changes required.
  • A new goroutineleak profile (runtime/pprof, /debug/pprof/goroutineleak) is available for
    diagnosing goroutines blocked on unreachable concurrency primitives, useful when debugging
    long-running sync daemons like websyncd.
  • The minimum macOS build target rises to macOS 13 (Ventura). This does not affect websyncd's
    distributed binaries, since CI only builds Linux targets (amd64, arm64, armv7, armv6).

Full Changelog: v0.2.7...v0.2.8

v0.2.7

v0.2.7

Source Code Updates

• Bumped the Go toolchain from 1.26.5 to 1.26.6, closing several CVEs relevant to websyncd:
  • CVE-2026-33818 (encoding/asn1, CVSS 7.5): a stack-exhaustion denial-of-service when
    unmarshaling deeply nested, recursive structures. Relevant because crypto/tls parses X.509
    certificates via encoding/asn1 during TLS/QUIC handshakes.
  • CVE-2026-56860 (net/url): quadratic-time complexity when resolving paths containing
    crafted .. segments, allowing a denial-of-service via pathological input. net/url is used
    directly by websyncd.
  • CVE-2026-56864 and CVE-2026-56865 (Go toolchain / module sumdb verification, CVSS 7.5
    and 8.4): a malicious GOPROXY or GOSUMDB could previously smuggle unverified module
    content into the local module cache during go build/go mod download. Fixed by building
    with the updated toolchain.
  • Two further CVEs fixed in 1.26.6 (encoding/xml, html/template) do not affect websyncd, as
    neither package is used by this codebase.
• Updated github.com/quic-go/quic-go from v0.60.0 to v0.61.0. No CVE, but http3 no longer
  includes invalid header values in validation errors, avoiding accidental exposure of sensitive
  values when errors are logged.
• Updated indirect dependencies golang.org/x/crypto (v0.54.0 → v0.55.0), golang.org/x/net
  (v0.57.0 → v0.58.0), and golang.org/x/text (v0.40.0 → v0.41.0) to stay current with the
  toolchain and quic-go's requirements. No additional CVE fixes were identified specific to
  this version range.
• govulncheck reports no vulnerabilities reachable from websyncd's code after the update. One
  advisory (GO-2026-5932, unmaintained/unsafe golang.org/x/crypto/openpgp package) remains in
  the dependency tree but is not imported by websyncd and has no available fix.

CI Updates

• Upgraded the actions/setup-go GitHub Action from v6 to v7 in the CI workflow.

Full Changelog: v0.2.6...v0.2.7

v0.2.6

What's changed

Updated Go to v1.26.5 and code dependencies:

• golang.org/x/crypto to v0.54.0
• golang.org/x/net to v0.57.0
• golang.org/x/sys to v0.47.0
• golang.org/x/text to v0.40.0

Full Changelog: v0.2.5...v0.2.6

v0.2.5

v0.2.5

Source Code Updates

• The Docker runtime base image has been updated from Alpine 3.23 to Alpine 3.24, which includes the latest OS-level security patches and library updates. Users running the official Docker image automatically benefit from these fixes without any configuration changes.

CI Updates

• actions/checkout has been updated from v6.0.3 to v7.0.0 in both the CI and release workflows (PRs #7, #8).

v0.2.4

Update indirect code dependencies for golang.org/x/crypto and golang.org/x/net to v0.53.0 and v0.56.0 respectively

Full Changelog: v0.2.3...v0.2.4

v0.2.3

Software supply chain-based security fixes.

Full Changelog: v0.2.2...v0.2.3

v0.2.2

What Changed

• Fix polling interval, update POLL_INTERVAL default to 1 hour, and enforce minimum value of 5 seconds

Full Changelog: v0.2.1...v0.2.2