Release Anole 0.1.3 · xuckless/anole

A security release. I found these while reviewing the API before 0.2.0. Please upgrade:

zig fetch --save git+https://github.com/xuckless/anole#v0.1.3

Security

res.sendFile could read files outside its directory. (GHSA-wmj5-wvf6-w55f) A .. segment or an absolute path in request input (a route or query parameter) opened any file the server could read. It now answers 404, as static routes already did. Static routes were not affected.
WebSocket Rooms could broadcast to a freed socket. (GHSA-8vq8-rhf6-gfw8) A socket that ended without calling leave stayed in its rooms. A socket now leaves every room when it is released, and a member closed for not keeping up has its connection ended (on Windows too).
C ABI: a handle from a destroyed server could act on the next one in the same process. (GHSA-5xpj-5v44-fx4p) Such handles are now always ANOLE_E_GONE.
Databases: a call that left a transaction open was treated as done. (GHSA-wf2w-hv3j-7jfm) On SQLite every later write joined that transaction; on PostgreSQL each statement committed on its own. Such a call is now rolled back and fails; a whole transaction in one call still works.
C ABI: drain or reload from another thread during shutdown could use freed memory. (GHSA-whjh-35m7-w456) These calls now wait for a live server or answer as documented.

Each advisory has the details, who is affected and a workaround.

C ABI 0.6: ANOLE_WT_FIN is now 2. It was 1, the same bit as ANOLE_BODY_BORROW, so a borrowed WebTransport write ended the stream. Rebuild against the new anole.h.

A conflicting route in the C ABI configuration is now ANOLE_E_CONFIG from anole_server_start instead of a crash of the host process.

Full list in CHANGELOG.md.