v3.2
====

- spice-webdavd: close the local client connection when the host drops
  it, instead of leaving the webdav client waiting for the end of the
  response or reusing a dropped connection, which led to dropped
  frames and hangs
- spice-webdavd: announce the local mDNS service on loopback only, and
  run as an unprivileged user in the systemd unit
- libphodav: add debug tracing for the request lifecycle, the streamed
  response pulls and the spice mux frames, silent unless G_MESSAGES_DEBUG
  is set
- Windows testing fixes: read the virtual-dir server port from a file
  to avoid the carriage return of the text-mode standard handles, and
  run the Wine tests with their output to regular files, which a stray
  "explorer.exe /desktop" process cannot keep open
- Update Georgian translation

v3.1
====

Security fixes:

- CVE-2026-114417 - reject the encoded slashes in the COPY/MOVE
  Destination header, which allowed writing outside of the shared
  directory
- CVE-2026-114418 - don't handle PUT when the request was already
  rejected: with digest authentication configured, an unauthenticated
  client could create or overwrite any file of the share
- CVE-2026-114419 - chezdav: check the digest password, any password
  was accepted for a user listed in the htdigest file
- refuse the oversized request bodies with 413, including the chunked
  ones, and don't run the method handler of an already rejected request
- fix crash and hangs on invalid If headers
- fix a crash on PROPFIND/PROPPATCH requests without any property

New features:

- chezdav: serve the share over HTTPS with --tls-cert/--tls-key
- chezdav: listen on a Unix socket with --socket, including on Windows 10
- chezdav: optional upload size limit with --max-upload
- chezdav: --verbose enables the debug messages
- chezdav: MSI: bundle libsoup 3, the Windows installer works again
- get: serve byte-range requests
- get: answer conditional requests with Not Modified
- put: implement If-Match and If-None-Match conditionals
- server: allow constructing with an existing SoupServer, add
  max-upload and base-path properties, add phodav_server_stop() to
  unregister the DAV handler and cancel the in-flight requests, and
  leave the handlers of a shared server alone when an auth domain is
  configured
- virtual-dir: report a modification time and etag
- virtual-dir: implement the GFile URI, dup, prefix and relative path
  operations
- spice-webdavd: add a --mux-path option
- libphodav: gobject-introspection support, language bindings become
  possible

DAV fixes:

- lock: enforce the lock timeouts, reject conflicting locks on
  collection members, accept the tokens submitted for covered
  resources, accept any If header form when refreshing, reject requests
  without locktype or lockscope, and canonicalize the lock table keys
- put: answer the upload once the file is committed, discard the
  partial file when the upload fails, return Conflict when the parent
  collection is missing
- propfind: answer each requested property once, read the dead
  property values unescaped, fix the creationdate and getlastmodified
  formats
- proppatch: fix a crash when removing properties
- multistatus and directory listing hrefs are URI-escaped
- reject invalid Depth headers and bad request paths with 400, answer
  the unknown methods with 501
- harden the directory listings (error path, nosniff, CSP), and fall
  back to a default content type
- fix several leaks (locks, paths, GFileInfo, options, xattr values)

spice-webdavd:

- give the mux clients increasing ids, the connection ids could be
  reused or truncated on Win64
- fix and harden the systemd unit: restart on failure, sandboxing

Build, documentation and tests:

- requires GLib >= 2.80 and meson >= 1.0
- switch API documentation to gi-docgen, man page to scdoc
- use SPDX license identifiers
- clang-format and gobject-linter compliance, pre-commit hooks
- extensive new test suite: unit tests, DAV end-to-end tests, TLS and
  digest authentication tests, spice-webdavd multiplexing test
- run litmus with meson test, building it as a subproject when not
  installed
- add libFuzzer targets for the DAV request parsers
- CI: coverage (line and branch), clang static analyzer, sanitizers,
  -Werror and gobject-linter jobs, Windows tests under Wine