v0.5

Changed

• virtiofsd 1.13.0 floor for host mounts (#655). Host mounts
  need virtiofsd 1.13.0 or newer: the uid/gid translation and
  read-only enforcement the shares run on landed upstream there,
  and older builds refuse the daemon's arguments at start.
  msksd doctor now reads the version (a below-floor binary
  warns naming the gap and the MSKSD_VIRTIOFSD override —
  Linux Mint 22 ships 1.10.0), and a mount start on a too-old
  binary fails with the same named requirement instead of an
  "exited at start" log tail. See
  docs/mounts.md.

Fixed

• Host share mounts: git loose objects no longer fail with
  EACCES (#657). Creating a file without owner-write bits and
  writing through the same open file descriptor (git's
  loose-object path) failed on every virtiofs share. The share's
  xattr remapping now denies security.capability at the map
  and leaves the name unmapped, keeping file-capability clearing
  with the host kernel — and, whatever the daemon's privilege, a
  guest can neither set nor read the attribute through a share.
  Applies at each workspace start.

What's Changed

• Require virtiofsd >= 1.13.0 for host mounts (#655) by @mcdonc in #656
• Deny security.capability at the share xattr map (#657) by @mcdonc in #658

Full Changelog: v0.4...v0.5