| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
Changelog:
Version 1.2 (2016-02-29)
Changelog:
- Inline media and avatars are no longer cached on disk
- Videos now indicate download progress showing a preview thumbnail
with a circular progress overlay
- We download higher-resolution avatars on HiDPI displays now
- The build system usage has seen a major refactoring an cleanup,
thanks to Rico Tzschichholz
- The sidebar is now at the top and dark
- Favorites now us a heart icon
- Sending tweets is now cancellable (e.g. when multiple images
are attached, in which case it might take a while)
- Inline media are now displayed "full-size", scaled to the
current window size.
- Instagram videos are now correctly marked as videos, instead
of was images
- If you have GTK+ >= 3.19, there's now a GtkShortcutsWindow
accessible from the app menuexplaining the various keyboard
shortcuts. Note that Corebird still compiles and runs with
GTK+ 3.16
- The big "add media" button in the compose window has been
replaced with a regular text button. The added images are
scaled down and displayed below it
- You can quote your own tweets now
- The settings dialog now contains a setting to hide
"inappropriate content", and it is enabled by default.
- The file selection dialog in the compose window now keeps
you from selecting files > 3MB.
Version 1.1 (2015-09-30)
Changelog:
- Tweets now get hidden/shown more correctly
- Corebird now saves an application-wide list of snippets that you can use to
insert common phrases or longer unicode emoticons. It can be found in the
application settings in the "Snippets" tab.
- Corebird now supports showing quote tweets in timelines as well as creating
quote tweets. This replaces the old "Quote" item for tweets which would
simply copy the original tweet's text.
- Media links and trailing hashtags can now be hidden via the "Tweets" tab in
the application settings.
- Profiles can now also show followers and followees
- Twitter removed the 140 char limit on Direct Messages and so did we
- Lots of other small enhancments and bug fixes
Version 1.0.1 (2015-07-17)
nothing...
Version 1.0 (2015-03-19)
- All dialogs now use client-side decrations if the environment dictates it, otherwise they fall back to server-side decorations. Note that the compose dialog is an exception, since we use the client-side decorations there also for progress indication (and other things in the future).
- Many layout updates
- The compose window now allows for up to 4 pictures to be uploaded.
- We now save additional information about the account which makes it possible for blocked users to be actually blocked, i.e. streamed tweets won't appear in your timeline anymore.
- When (un)following someone, we now also correctly show/hide their retweets in the stream.
- The DM page now sorts threads with unread messages first.
- The @handle completion known from the compose window is now also available when composing Direct Messages, as well as in the account settings for the description.
- Everything app-specific should now be hidpi ready, the only thing missing are assets loaded from Twitter directly, i.e. avatars and media.
- Notifications should now get withdrawn whenever it makes sense, i.e. if you read a Direct Message before dismissing the notification, it should get withdrawn automatically.
- The hover buttons moved to a right-click menu on every tweet.
- Plurals are properly localized.
- We now also respect muted users (even though there's no UI to mute someone)
- A user's verification status is now also shown in the tweet info page.
- Everything should now work when the user's @handle (aka screen_name) changes.
- Switching to the same page (i.e. going to a profile from the profile page) now works much better, including the swipe transition as well as proper equality checking.
- Invalid inline media (file size too big, 404, ...) should now be properly detected and reacted upon (i.e. remove the widget in the stream, add the link back).
- Underlines in @handles are now properly displayed in the app menu (i.e. the "open account" submenu)
- Animated gifs from Twitter are now also handled (just like other videos).
- Tweets in timelines are now single-click activated. This unifies the behavior with all other lists in the application. Since this interferes with certain user behaviors, there's a setting to switch back to double-click activation.
- Based on a user's protection status, we now disable (or hide) retweet buttons of tweets.
|
|
Upstream changes:
1.19 August 26, 2015
! #106665 Correct the version manually, no autoversioning, and the maintainer screwed up
1.18 August 25, 2015
! Fix a couple of cases where undefined values were being passed to functions [github/redhotpenguin]
! Do not set content_length for compressed request [github/bor]
! Add test for check return of send_receive(), add titles for some tests [github/bor]
1.17 July 30, 2015
! #106051 Fix utf8 encoding for CGI test (thanks cpan/ETHER for tips)
1.16 July 23, 2015
! Fix empty release. Note to self - do not release code when wife is in early labor
1.15 July 21, 2015
+ Preventing "billion laughs" exponential entity expansion attack [github/thilo-fester]
|
|
2.7.0 (2016-02-14):
* Remove sexplib.syntax, type_conv deps and camlp4 transitive dependency
* Add ppx_sexp_conv dependency
* Require OCaml 4.02.2+
* Add `Ipaddr.Prefix.subset`, `Ipaddr.V4.Prefix.subset` and `Ipaddr.V6.subset`
predicates to test containment of subnets (#52 from @seliopou)
2.6.1 (2015-02-20):
* Fix findlib requires in oasis to restore pre-4.02.1 compatibility
2.6.0 (2015-02-19):
* Change IPv6 link-local address prefix from fe80::/10 to fe80::/64. (#39)
* Remove type bytes = string alias (potentially breaking)
* Turn on -safe-string (#41)
* {V4,V6}.to_bytes_raw now uses Bytes.t rather than string (potentially breaking)
* Add multicast MAC conversions from RFC 1112 and RFC 2464
* Add to_domain_name conversions to DNS label lists (in-addr.arpa and ip6.arpa)
* Add V6.interface_routers, V6.site_routers, and V6.Prefix.solicited_node
* Add V6.link_address_of_mac to convert a MAC into a link local IP address
|
|
What's New
Bug Fixes
The following vulnerabilities have been fixed:
* [1]wnpa-sec-2016-01
DLL hijacking vulnerability. [2]CVE-2016-2521
* [3]wnpa-sec-2016-03
DNP dissector infinite loop. ([4]Bug 11938) [5]CVE-2016-2523
* [6]wnpa-sec-2016-10
RSL dissector crash. ([7]Bug 11829) [8]CVE-2016-2530
[9]CVE-2016-2531
* [10]wnpa-sec-2016-11
LLRP dissector crash. ([11]Bug 12048) [12]CVE-2016-2532
* [13]wnpa-sec-2016-14
GSM A-bis OML dissector crash. ([14]Bug 11825)
* [15]wnpa-sec-2016-15
ASN.1 BER dissector crash. ([16]Bug 12106)
* [17]wnpa-sec-2016-18
ASN.1 BER dissector crash. ([18]Bug 11822)
The following bugs have been fixed:
* Questionable calling of ethernet dissector by encapsulating
protocol dissectors. ([19]Bug 9933)
* Improper RPC reassembly ([20]Bug 11913)
* GTPv1 Dual Stack with one static and one Dynamic IP. ([21]Bug
11945)
* Failed to parse M3AP IE (TNL information). ([22]Bug 12070)
* Wrong interpretation of Instance ID value in OSPFv3 packet.
([23]Bug 12072)
* MP2T Dissector does parse RTP properly in 2.0.1. ([24]Bug 12099)
* editcap does not adjust time for frames with absolute timestamp 0 <
t < 1 secs. ([25]Bug 12116)
Windows installers and PortableApps® packages are now dual signed using
SHA-1 and SHA-256 in order to comply with [26]Microsoft Authenticode
policy. Windows 7 and Windows Server 2008 R2 users should ensure that
[27]update 3123479 is installed. Windows Vista and Windows Server 2008
users should ensure that [28]hotfix 2763674 is installed.
Updated Protocol Support
ASN.1 BER, BATADV, DNP3, E100, EIGRP, GSM A DTAP, GSM SMS, GTP, HiQnet,
InfiniBand, LLRP, M3AP, MP2T, NFS, OSPF, RoHC, RPC, RSL, TRILL, VXLAN,
and X.509AF
|
|
|
|
version upstream.
|
|
The default stable version is 2.0.2.
Wireshark is a network traffic analyzer, or "sniffer", for Unix and
Unix-like operating systems. It uses GTK+, a graphical user interface
library, and libpcap, a packet capture and filtering library.
The Wireshark distribution also comes with TShark, which is a
line-oriented sniffer (similar to Sun's snoop, or tcpdump) that uses the
same dissection, capture-file reading and writing, and packet filtering
code as Wireshark, and with editcap, which is a program to read capture
files and write the packets from that capture file, possibly in a
different capture file format, and with some packets possibly removed
from the capture.
|
|
|
|
What's New
Bug Fixes
The following vulnerabilities have been fixed:
* [1]wnpa-sec-2016-01
DLL hijacking vulnerability. [2]CVE-2016-2521
* [3]wnpa-sec-2016-02
ASN.1 BER dissector crash. ([4]Bug 11828) [5]CVE-2016-2522
* [6]wnpa-sec-2016-03
DNP dissector infinite loop. ([7]Bug 11938) [8]CVE-2016-2523
* [9]wnpa-sec-2016-04
X.509AF dissector crash. ([10]Bug 12002) [11]CVE-2016-2524
* [12]wnpa-sec-2016-05
HTTP/2 dissector crash. ([13]Bug 12077) [14]CVE-2016-2525
* [15]wnpa-sec-2016-06
HiQnet dissector crash. ([16]Bug 11983) [17]CVE-2016-2526
* [18]wnpa-sec-2016-07
3GPP TS 32.423 Trace file parser crash. ([19]Bug 11982)
[20]CVE-2016-2527
* [21]wnpa-sec-2016-08
LBMC dissector crash. ([22]Bug 11984) [23]CVE-2016-2528
* [24]wnpa-sec-2016-09
iSeries file parser crash. ([25]Bug 11985) [26]CVE-2016-2529
* [27]wnpa-sec-2016-10
RSL dissector crash. ([28]Bug 11829) [29]CVE-2016-2530
[30]CVE-2016-2531
* [31]wnpa-sec-2016-11
LLRP dissector crash. ([32]Bug 12048) [33]CVE-2016-2532
* [34]wnpa-sec-2016-12
Ixia IxVeriWave file parser crash. ([35]Bug 11795)
* [36]wnpa-sec-2016-13
IEEE 802.11 dissector crash. ([37]Bug 11818)
* [38]wnpa-sec-2016-14
GSM A-bis OML dissector crash. ([39]Bug 11825)
* [40]wnpa-sec-2016-15
ASN.1 BER dissector crash. ([41]Bug 12106)
* [42]wnpa-sec-2016-16
SPICE dissector large loop. ([43]Bug 12151)
* [44]wnpa-sec-2016-17
NFS dissector crash.
* [45]wnpa-sec-2016-18
ASN.1 BER dissector crash. ([46]Bug 11822)
The following bugs have been fixed:
* HTTP 302 decoded as TCP when "Allow subdissector to reassemble TCP
streams" option is enabled. ([47]Bug 9848)
* Questionable calling of ethernet dissector by encapsulating
protocol dissectors. ([48]Bug 9933)
* [Qt & Legacy & probably TShark too] Delta Time Conversation column
is empty. ([49]Bug 11559)
* extcap: abort when validating capture filter for DLT 147. ([50]Bug
11656)
* Missing columns in Qt Flow Graph. ([51]Bug 11710)
* Interface list doesn't show well when the list is very long.
([52]Bug 11733)
* Unable to use saved Capture Filters in Qt UI. ([53]Bug 11836)
* extcap: Capture interface options snaplen, buffer and promiscuous
not being used. ([54]Bug 11865)
* Improper RPC reassembly ([55]Bug 11913)
* GTPv1 Dual Stack with one static and one Dynamic IP. ([56]Bug
11945)
* Wireshark 2.0.1 MPLS dissector not decoding payload when control
word is present in pseudowire. ([57]Bug 11949)
* "...using this filter" turns white (not green or red). Plus
dropdown arrow does nothing. ([58]Bug 11950)
* EIGRP field eigrp.ipv4.destination does not show the correct
destination. ([59]Bug 11953)
* tshark -z conv,type[,filter] swapped frame / byte values from / to
columns. ([60]Bug 11959)
* The field name nstrace.tcpdbg.tcpack should be
nstrace.tcpdbg.tcprtt. ([61]Bug 11964)
* 6LoWPAN IPHC traffic class not decompressed correctly. ([62]Bug
11971)
* Crash with snooping NFS file handles. ([63]Bug 11972)
* 802.11 dissector fails to decrypt some broadcast messages. ([64]Bug
11973)
* Wireshark hangs when adding a new profile. ([65]Bug 11979)
* Issues when closing the application with a running capture without
packets. ([66]Bug 11981)
* New Qt UI lacks ability to step through multiple TCP streams with
Analyze > Follow > TCP Stream. ([67]Bug 11987)
* GTK: plugin_if_goto_frame causes Access Violation if called before
capture file is loaded. ([68]Bug 11989)
* Wireshark 2.0.1 crash on start. ([69]Bug 11992)
* Wi-Fi 4-way handshake 4/4 is displayed as 2/4. ([70]Bug 11994)
* ACN: acn.dmx.data has incorrect type. ([71]Bug 11999)
* editcap packet comment won't add multiple comments. ([72]Bug 12007)
* DICOM Sequences no longer able to be expanded. ([73]Bug 12011)
* Wrong TCP stream when port numbers are reused. ([74]Bug 12022)
* SSL decryption fails in presence of a Client certificate. ([75]Bug
12042)
* LUA: TVBs backing a data source is freed too early. ([76]Bug 12050)
* PIM: pim.group filter have the same name for IPv4 and IPv6.
([77]Bug 12061)
* Failed to parse M3AP IE (TNL information). ([78]Bug 12070)
* Wrong interpretation of Instance ID value in OSPFv3 packet.
([79]Bug 12072)
* MP2T Dissector does parse RTP properly in 2.0.1. ([80]Bug 12099)
* editcap does not adjust time for frames with absolute timestamp 0 <
t < 1 secs. ([81]Bug 12116)
* Guard Interval is not consistent between Radiotap & wlan_radio.
([82]Bug 12123)
* Calling dumpcap -i- results in access violation. ([83]Bug 12143)
* Qt: Friendly Name and Interface Name columns should not be
editable. ([84]Bug 12146)
* PPTP GRE call ID not always decoded. ([85]Bug 12149)
* Interface list does not show device description anymore. ([86]Bug
12156)
* Find Packet does not highlight the matching tree item or packet
bytes. ([87]Bug 12157)
* "total block length ... is too large" error when opening pcapng
file with multiple SHB sections. ([88]Bug 12167)
* http.request.full_uri is malformed if an HTTP Proxy is used.
([89]Bug 12176)
* SNMP dissector fails at msgSecurityParameters with long length
encoding. ([90]Bug 12181)
Windows installers and PortableApps® packages are now dual signed using
SHA-1 and SHA-256 in order to comply with [91]Microsoft Authenticode
policy. Windows 7 and Windows Server 2008 R2 users should ensure that
[92]update 3123479 is installed. Windows Vista and Windows Server 2008
users should ensure that [93]hotfix 2763674 is installed.
Updated Protocol Support
6LoWPAN, ACN, ASN.1 BER, BATADV, DICOM, DNP3, DOCSIS INT-RNG-REQ, E100,
EIGRP, GSM A DTAP, GSM SMS, GTP, HiQnet, HTTP, HTTP/2, IEEE 802.11,
IKEv2, InfiniBand, IPv4, IPv6, LBMC, LLRP, M3AP, MAC LTE, MP2T, MPLS,
NFS, NS Trace, OSPF, PIM, PPTP, RLC LTE, RoHC, RPC, RSL, SNMP, SPICE,
SSL, TCP, TRILL, VXLAN, WaveAgent, and X.509AF
New and Updated Capture File Support
3GPP TS 32.423 Trace, iSeries, Ixia IxVeriWave, pcap, and pcapng
|
|
|
|
|
|
set IPv6 Hop limit to 10
fix HOST: header of event notifications in IPv6
be more compliant on 64bit machines : ui4 in [0;2^32-1]
|
|
|
|
===========================
Bugfixes:
---------
- DNSSEC: Allow import of duplicate private key into the KASP
- DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer
- Fix server crash when an incomming transfer is in progress and reload is issued
- Fix socket polling when configured with many interfaces and threads
- Fix compilation against Nettle 3.2
Improvements:
-------------
- Select correct source address for UDP messages recieved on ANY address
- Extend documentation of knotc commands
Knot DNS 2.1.0 (2016-01-14)
===========================
Features:
---------
- Per-thread UDP socket binding using SO_REUSEPORT on Linux
- Support for dynamic configuration database
- DNSSEC: Support for cryptographic tokens via PKCS #11 interface
- DNSSEC: Experimental support for online signing
Improvements:
-------------
- Support for zone file name patterns
- Configurable location of zone timer database
- Non-blocking network operations and better timeout handling
- Caching of Critical configuration values for better performance
- Logging of ACL failures
- RRL: Add rate-limit-slip zero support to drop all responses
- RRL: Document behavior for different rate-limit-slip options
- kdig: Warning instead of error on TSIG validation failure
- Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec)
- Remove possibly insecure server control over a network socket
- Remove implementation limit for the number of network interfaces
Bugfixes:
---------
- synth-record module: Fix application of default configuration options
- TSIG: Allow compressed TSIG name when forwarding DDNS updates
- Schedule zone bootstrap after slave zone fails to load from disk
|
|
|
|
Sayaka is a light-weight terminal specific twitter client which
supports userstream and sixel graphics etc.
There are two variants (PHP based version and and Vala based version)
in the sayaka distribution and this package uses the newer Vala based one.
|
|
Upstream changes:
* cannot preview instagram pictures
* twitter authentication on the first startup didn't work with
some library version
Remarks:
OAuth::RequestToken#build_authorize_url is broken in the latest
oauth gem 0.5.0:
https://github.com/oauth-xx/oauth-ruby/pull/108
|
|
|
|
|
|
pkgsrc changes:
o Take the MAINTAINERship
Changes:
2016.02.22:
o [animeondemand] Add extractor (#8518)
o [noz] Add new extractor
o [screenjunkies] Add new extractor
o [arte:magazine] Add extractor
o Misc bug fixes and improvements.
|
|
|
|
reallocarray(3) is guarded.
|
|
|
|
|
|
They all build, I checked :)
|
|
|
|
IO::Socket provides a way to set a timeout on the socket, but the
timeout will be used only for connection, not for reading/writing
operations.
This module provides a way to set a timeout on read/write operations
on an IO::Socket instance, or any IO::Socket::* modules, like
IO::Socket::INET.
|
|
Bumps PKGREVISION.
|
|
|
|
This VNC client makes use of the net/gtk-vnc library, providing a client
implemented with the Gtk+ toolkit. It is part of the DeforaOS desktop
environment.
|
|
* Save the initial working directory and change to it just before
running any scripts.
This avoids scripts putting files accidently where they shouldn't.
* Strip trailing dot from search and domain names.
* man page improvements.
|
|
Thanks and noticed by wiz@.
|
|
Upstream changes:
* postbox was not dismissed after post in some case
* line breaks were not drawn during selecting tweet characters by mouse drag
|
|
Do not update xserver used, still 1.17.2.
Release notes:
TigerVNC 1.6.0 is now available. This release is mostly about fixing
various bugs and polishing existing features, but there are some
notable new things:
* Multi-head support in the Java viewer
* Better certificate handling in the Java viewer, including host
name verification
|
|
#453: Fixed a bug during a 0.2.7 to 0.3.1 upgrade if a users' me-card was set. (@untitaker).
Ships with sabre/dav 3.1.1
|
|
Ride on the coattails of that version bump.
|
|
Upstream changes:
v0.4.6
* Fix multiple RPC error generation
* Add support for cancel-commit and persist param
* Add more examples
v0.4.5
* Add Huawei device support
* Add cli command support for hpcomware v7 devices
* Add H3C support, Support H3C CLI,Action,Get_bulk,Save,Rollback,etc.
* Add alcatel lucent support
* Rewrite multiple error handling
* Add coveralls support, with shield in README.md
* Set severity level to higher when multiple
* Simplify logging and multi-error reporting
* Keep stacktrace of errors
* Check for known hosts on hostkey_verify only
* Add check for device sending back null error_text
* Fix RPC.raise_mode
* Specifying hostkey_verify=False should not load_known_hosts
* Check the correct field on rpc-error element
v0.4.3
* Nexus exec_command operation
* Allow specifying multiple cmd elements in Cisco Nexus
* Update rpc for nested rpc-errors
* Prevent race condition in threading
* Prevent hanging in session close
v0.4.2
* Support for paramiko ProxyCommand via ~/.ssh/config parsing
* Add Juniper-specific commit operations
* Add Huawei devices support
* Tests/Travis support
* ioproc transport support for Juniper devices
* Update Cisco CSR device handler
* Many minor and major fixes
|
|
Upstream changes:
1.3.1:
* Bugfix: Not to suppress exception under Config util context manager.
1.3.0:
* Feature add: support "private" and "dynamic" database access #301 #458.
* Feature enhancements:
- Support for Feature Velocity releases #442
- Multiple RPC support #338 #453
- Merged Table/View pull requests from user. #441
- Facts gathering to raise only warning in case of exception #459
* Bugfixes:
- Raise RpcTimeoutError in commit_check #437
- Config load not throwing RpcTimeoutError #443 #444
- Prevented AttributeError upon XML comment #448 #447
- Facts gathering fix for QFX and other specific software releases #450 #463
1.2.3:
* Bugfixes:
- Software upgrade for multi RE and multi VC #429
- single chassis (EX8208 1EA-2RE) software installation was broken.
- Facts gathering on VMx & Qfabric #313
- SCP & SW progress to print proper log messages #422, #421
- TXP facts broken #417
- Prefer explicitly defined ssh_private_key_file to sshconfig #418
* Feature ehnancements:
- Implement context manager for Device #433
- JSON as format option to RPC calls for Junos >= 14.2
- Merged Table/View pull requests from users.
1.2.2:
* Bugfixes:
- Suppress paramiko logger warnings #363
- A few places warnings similar to
No handlers could be found for logger "paramiko.transport"
would be displayed.
- Device password setter did not work #400
- dev.password = 'newpass'
- Facts gather for EX8200 standalone failing #402
- JSON dump of RPC XML failing when contents include XML comment #406
- SCP logger not enabled by default #362
1.2.1:
* Bugfixes:
- Unable to use get() multiple times with Tables
- Add increased timeout value for remote_checksum
- Ability to set options in CfgTable definition
- Domain Fact
- Put RPC inside try block
- Search inherited version of config
- Update support of swver fact for Junos 15.1
1.2.0:
* New features:
* Enhanced exception handling:
* XML Normalization Support:
* OpTables normalization
* Mixed Mode Virtual Chassis Upgrade Support
* Add sync, force_sync, full, detail to Config.commit(),
* Configuration Table Support
* Support for SSH ProxyCommand in SCP
* Set minimum paramiko version to 1.15.2
* Bugfixes:
- Facts
- MX Virtual Chassis
- All physical RE's are now accounted for in facts in the
format Device-RE => 'RE1-RE0'
- Master fact is same format as other VC systems.
- Domain
- Domain lookup now checks configuration first before attempting
to parse /etc/resolv.conf or /var/etc/resolv.conf
- 2RE
- Fixed false positive of 2RE on vc_capable systems
- StartShell root user
- Utils.start_shell now supports the user root
- utils.fs multiple RE support
- Fixed bug affecting multiple RE systems
- OpTables loading from XML files and objects
- OpTables were not properly loading when passing in a XML
file path or lxml object
1.1.2:
* Bugfixes:
- onbox Device()
1.1.1:
* Bugfixes:
- Device _auth_user overwritten after device open.
This was breaking SCP
1.1.0:
* New features:
* Enhanced Exception Handling
* Per execution timeout
* Serialization of Junos facts
* Composite table key support for missing XPATH
* Regex support for View boolean values
* OS Install force-host
* Added display_xml_rpc command
* ncclient proxycommand support
* Added support for pipe (union) operator in Table keys
* Format optional for configuration strings
* Bugfixes:
* JSON Output
- Views that had compound keys failed to dump.
- RPC command output failed to dump.
* FutureWarning
- Config utility would output a FutureWarning
1.0.2:
* Bugfixes:
* XML Templates not properly loading
* Templates without a file extension no longer assumed to be XML
|
|
1.74 Mon Feb 15 16:00 2016
- gtld_new update as per latest IANA db entries
|
|
Interoperation with syncthing-android is still very important, but
some have told me that they use syncthing among POSIXish systems
without android as a replacement for rsync/unison, more or less. Keep
the notion of deferring major upgrades to stay in sync with f-droid.
(This is in no way a complaint about the previous minor upgrade, which
was most welcome; it just caused me to look at this and notice my
previous text was too strong.)
CVS: ----------------------------------------------------------------------
CVS: CVSROOT cvs.NetBSD.org:/cvsroot
CVS: please use "PR category/123" to have the commitmsg appended to PR 123
|
|
|
|
v0.12.19
- Return "No such object in the index" when /rest/db/file gets
called on something that doesn't exist (@calmh)
- Swap the corsMiddleware and the csrfMiddleware to the unauthenticated
OPTIONS requests are first processed. (@letiemble)
- Report versioning usage in usage report (@calmh)
|
|
Changes:
v0.16
-----
* Completely revised HTTP2 implementation based on hyper-h2 (Thomas
Kriechbaumer)
* Export flows as cURL command, Python code or raw HTTP (Shadab Zafar)
* Fixed compatibility with the Android Emulator (Will Coster)
* Script Reloader: Inline scripts are reloaded automatically if modified
(Matthew Shao)
* Inline script hooks for TCP mode (Michael J. Bazzinotti)
* Add default ciphers to support iOS9 App Transport Security (Jorge
Villacorta)
* Basic Authentication for mitmweb (Guillem Anguera)
* Exempt connections from interception based on TLS Server Name Indication
(David Weinstein)
* Provide Python Wheels for faster installation
* Numerous bugfixes and minor improvements
|
|
Changes (from the commit messages):
0.16
----
o Migrate to hyperframe
o Various bugfixes and improvements
|
|
Changes:
2.1.0 (2016-02-02)
------------------
**API Changes (Backward Compatible)**
- Added new ``InvalidTableIndex`` exception, a subclass of
``HPACKDecodingError``.
- Instead of throwing ``IndexError`` when encountering invalid encoded integers
HPACK now throws ``HPACKDecodingError``.
- Instead of throwing ``UnicodeDecodeError`` when encountering headers that are
not UTF-8 encoded, HPACK now throws ``HPACKDecodingError``.
- Instead of throwing ``IndexError`` when encountering invalid table offsets,
HPACK now throws ``InvalidTableIndex``.
- Added ``raw`` flag to ``decode``, allowing ``decode`` to return bytes instead
of attempting to decode the headers as UTF-8.
**Bugfixes**
- ``memoryview`` objects are now used when decoding HPACK, improving the
performance by avoiding unnecessary data copies.
|
|
The following security issues are fixed with this update:
* Resolve buffer overflow when handling "config" file requests (CVE-2016-2054)
* Restrict "config" files to regular files inside the $XYMONHOME/etc/ directory
(symlinks disallowed) (CVE-2016-2055). Also, require that the initial filename
end in '.cfg' by default
* Resolve shell command injection vulnerability in useradm and chpasswd CGIs
(CVE-2016-2056)
* Tighten permissions on the xymond BFQ used for message submission to restrict
access to the xymon user and group. It is now 0620. (CVE-2016-2057)
* Restrict javascript execution in current and historical status messages by
the addition of appropriate Content-Security-Policy headers to prevent XSS
attacks. (CVE-2016-2058)
* Fix CVE-2015-1430, a buffer overflow in the acknowledge.cgi script.
Thank you to Mark Felder for noting the impact and Martin Lenko
for the original patch.
* Mitigate CVE-2014-6271 (bash 'Shell shock' vulnerability) by
eliminating the shell script CGI wrappers
Please refer to
https://sourceforge.net/projects/xymon/files/Xymon/4.3.25/Changes/download
for further information on fixes and new features.
|
|
Baïkal 0.3.1 is now the recommended version of Baïkal. This release
fixes the most reported issues with Baikal, and also:
Upgrades sabre/dav from version 1.8 to 3.1.
Supports PHP 7.
Makes the minimum PHP version 5.5.
Adds support for calendar/addressbook export.
Adds support for WebDAV-Sync.
Upgrade instructions are here:
http://sabre.io/baikal/upgrade/
|
|
|
|
Adjust PLIST accordingly.
Bump PKGREVISION.
|
