v3.2
====

- spice-webdavd: close the local client connection when the host drops
  it, instead of leaving the webdav client waiting for the end of the
  response or reusing a dropped connection, which led to dropped
  frames and hangs
- spice-webdavd: announce the local mDNS service on loopback only, and
  run as an unprivileged user in the systemd unit
- libphodav: add debug tracing for the request lifecycle, the streamed
  response pulls and the spice mux frames, silent unless G_MESSAGES_DEBUG
  is set
- Windows testing fixes: read the virtual-dir server port from a file
  to avoid the carriage return of the text-mode standard handles, and
  run the Wine tests with their output to regular files, which a stray
  "explorer.exe /desktop" process cannot keep open
- Update Georgian translation

v3.1
====

Security fixes:

- CVE-2026-114417 - reject the encoded slashes in the COPY/MOVE
  Destination header, which allowed writing outside of the shared
  directory
- CVE-2026-114418 - don't handle PUT when the request was already
  rejected: with digest authentication configured, an unauthenticated
  client could create or overwrite any file of the share
- CVE-2026-114419 - chezdav: check the digest password, any password
  was accepted for a user listed in the htdigest file
- refuse the oversized request bodies with 413, including the chunked
  ones, and don't run the method handler of an already rejected request
- fix crash and hangs on invalid If headers
- fix a crash on PROPFIND/PROPPATCH requests without any property

New features:

- chezdav: serve the share over HTTPS with --tls-cert/--tls-key
- chezdav: listen on a Unix socket with --socket, including on Windows 10
- chezdav: optional upload size limit with --max-upload
- chezdav: --verbose enables the debug messages
- chezdav: MSI: bundle libsoup 3, the Windows installer works again
- get: serve byte-range requests
- get: answer conditional requests with Not Modified
- put: implement If-Match and If-None-Match conditionals
- server: allow constructing with an existing SoupServer, add
  max-upload and base-path properties, add phodav_server_stop() to
  unregister the DAV handler and cancel the in-flight requests, and
  leave the handlers of a shared server alone when an auth domain is
  configured
- virtual-dir: report a modification time and etag
- virtual-dir: implement the GFile URI, dup, prefix and relative path
  operations
- spice-webdavd: add a --mux-path option
- libphodav: gobject-introspection support, language bindings become
  possible

DAV fixes:

- lock: enforce the lock timeouts, reject conflicting locks on
  collection members, accept the tokens submitted for covered
  resources, accept any If header form when refreshing, reject requests
  without locktype or lockscope, and canonicalize the lock table keys
- put: answer the upload once the file is committed, discard the
  partial file when the upload fails, return Conflict when the parent
  collection is missing
- propfind: answer each requested property once, read the dead
  property values unescaped, fix the creationdate and getlastmodified
  formats
- proppatch: fix a crash when removing properties
- multistatus and directory listing hrefs are URI-escaped
- reject invalid Depth headers and bad request paths with 400, answer
  the unknown methods with 501
- harden the directory listings (error path, nosniff, CSP), and fall
  back to a default content type
- fix several leaks (locks, paths, GFileInfo, options, xattr values)

spice-webdavd:

- give the mux clients increasing ids, the connection ids could be
  reused or truncated on Win64
- fix and harden the systemd unit: restart on failure, sandboxing

Build, documentation and tests:

- requires GLib >= 2.80 and meson >= 1.0
- switch API documentation to gi-docgen, man page to scdoc
- use SPDX license identifiers
- clang-format and gobject-linter compliance, pre-commit hooks
- extensive new test suite: unit tests, DAV end-to-end tests, TLS and
  digest authentication tests, spice-webdavd multiplexing test
- run litmus with meson test, building it as a subproject when not
  installed
- add libFuzzer targets for the DAV request parsers
- CI: coverage (line and branch), clang static analyzer, sanitizers,
  -Werror and gobject-linter jobs, Windows tests under Wine

v3.0
====

- !27 - Port to libsoup3
- !26 - forbid PUT method on a read-only shared folder
- !25 - Add chezdav --realm runtime flag
- !24 - Build on OSX/Darwin
- !22 - Add chezdav --no-mdns runtime flag
- !19 - Allow specifying systemd/udev directories
- !18 - man pages updates
- CI, tests and build fixes
- translations updates

v2.5
====

- !16 - add PhodavVirtualDir & related API (Jakub Janků)
- various misc build and code fixes
- CI improved (litmus check)

v2.4
====

- Requires GIO >= 2.44
- !2 - Added udev option to meson
- spice-webdavd:
  - !3 : several improvements and fixes including some leaks
  - !4 : disconnect the client gracefully
  - !5 : code refcatory to improve performance and error handling
  - !6 : avahi fixes on registering and unregistering service
  - !7 : Fixes DAV:quota-used-bytes in resource is not in root fs

- Translations
  - Added Basque
  - Added Dutch
  - Added Finnish

v2.3
====

- replace autotools with meson
- spice-webdavd: switch to GTask
- chezdav: add --local & --public to specify interfaces to listen on
- translations updates

v2.2
====

- adjust to GLIb's GUuid
- update Danish translation

v2.1
====

- spice-webdavd updates: (Lukas Venhoda)
  - win32: auto-mount shared folder
  - win32: adds --no-service argument (now needs both --no-server and DEBUG env)
  - mdns: hide client folder when sharing is disabled
  - more error handling
- translations updates
- various build fixes

v2.0
====

- updated to fit with libsoup 2.50 API;
  make the server not run its own thread, but let the client decide
  how best to run the Soup server, as a result some API have been
  removed, and the library is now libphodav-2.0
- add a read-only mode
- fixed spice-webdavd service to keep running when client is
  disconnected

v0.4
====

- now a public library, stable API/ABI, versioned etc
- first release in Fedora

v0.2
====

- don't return slow properties by default
- handle PUT by chunks (to avoid large libsoup buffering)
- chezdav: add a man page
- compatible with <2.38 glib versions
- spice-webdavd: add systemd unit files
- spice-webdavd: wait for host channel to be connected
- spice-webdavd: add windows MSI installer
- a lot more translations!

v0.1
====

- initial release
- passes litmus tests (minus a minor one, to be fixed)
- provides "chezdav", a tool to announce and share a directory
- provides a private libphodav library with no API stability yet,
  suitable for submodule inclusion for other projects to use
