ikiwiki-3.20200202.3-bp155.1.5

- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

- update to 3.20200202.3
  * highlight: Adapt to API change in highlight >= 3.51
  * mdwn: Fix inverted footnote configuration when MultiMarkdown is
    enabled. Thanks, Giuseppe Bilotta
  * translation improvements
- Switch to python3-docutils since we do not have Python 2 anymore

- Remove BR of bzr ... we don't support it anymore, and there isn't any
  need for it: the testsuite just skips the test, if bzr is not
  available.

- update to 3.20190228
  * aggregate: Use LWPx::ParanoidAgent if available.
    Previously blogspam, openid and pinger used this module if available,
    but aggregate did not. This prevents server-side request forgery or
    local file disclosure, and mitigates denial of service when slow
    "tarpit" URLs are accessed.
    (CVE-2019-9187)
  * blogspam, openid, pinger: Use a HTTP proxy if configured, even if
    LWPx::ParanoidAgent is installed.
    Previously, only aggregate would obey proxy configuration. If a proxy
    is used, the proxy (not ikiwiki) is responsible for preventing attacks
    like CVE-2019-9187.
  * aggregate, blogspam, openid, pinger: Do not access non-http, non-https
    URLs.
    Previously, these plugins would have allowed non-HTTP-based requests if
    LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local
    file disclosure, and preventing other rarely-used URI schemes like
    gopher mitigates request forgery attacks.
  * aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly
    recommended.
    These plugins can request attacker-controlled URLs in some site
    configurations.
  * blogspam: Document LWPx::ParanoidAgent as desirable.
    This plugin doesn't request attacker-controlled URLs, so it's
    non-critical here.
  * blogspam, openid, pinger: Consistently use cookiejar if configured.
    Previously, these plugins would only obey this configuration if
    LWPx::ParanoidAgent was not installed, but this appears to have been
    unintended.
  * po: Always filter .po files.
    The po plugin in previous ikiwiki releases made the second and
    subsequent filter call per (page, destpage) pair into a no-op,
    apparently in an attempt to prevent *recursive* filtering (which as
    far as we can tell can't happen anyway), with the undesired effect
    of interpreting the raw .po file as page content (e.g. Markdown)
    if it was inlined into the same page twice, which is apparently
    something that tails.org does. Simplify this by deleting the code
    that prevented repeated filtering. Thanks, intrigeri
    (Closes: #911356)
- update to 3.20190207
  * graph: Add an optional "file" parameter
  * emailauth: When email can't be sent, show the error message
  * osm: Don't raise errors if tags don't have attached icons
  * cgi: Avoid C compiler warnings for waitpid() on NetBSD
  * Hide popup template content from documentation (Closes: #898836)
  * meta: Make [[!meta date]] show an error if dates are invalid or
    Date::Parse can't be loaded
  * inline: Cope with non-ASCII `rootpage` parameter.
    Thanks, Feng Shu
  * table: Cope with non-ASCII content in CSV format tables.
    Thanks, Feng Shu
  * trail: Allow unescaped punctuation in `pagenames` parameter
  * comments: Hide "add comment" link from print stylesheet.
    Thanks, Antoine Beaupré
  * recentchangesdiff, relativedate, toggle:
    Import JavaScript at the end of the page content, not the beginning,
    so that the browser can render content as soon as possible.
    Thanks, Antoine Beaupré
  * debian: Allow Breezy as an alternative to bzr
    Thanks, Jelmer Vernooij
  * inline: Add basic test coverage for [[!inline rootpage]]
  * table: Add basic test coverage
  * po: Add enough test coverage to reproduce Debian #911356
  * comments: Improve test coverage
  * tests: Exercise Unicode more
  * aggregate: Fix aggregation of posts without a title.
    Thanks, Alexandre Oliva
  * poll: Added postlink and posttrail options for better multi-page polls.
  * Fix permalink to comments.

- run spec-cleaner
- update licence to GPL-2.0+ AND BSD-2-Clause as ikiwiki is
  licensed under GPL-2.0+ and the Python code in plugins directory
  is licensed under BSD-2-clause
- update description
- add w3m subpackage that holds w3mmode
- remove shebang for ikiwiki/plugins/rst
- update BuildRequires and Requires
- get cvs plugin back because File/chdir.pm is now available
- don't remove syslog.t test

- update to 3.20180311
  * Avoid unexpected full paths from find(1)
  * rst test: Probe for docutils Python 3 module, not Python 2
  * mdwn: Automatically detect which Discount flags to use, fixing
    regressions in 3.20180228 when using Discount < 2.2
  * Add a test asserting that no plugin is an empty file, to confirm
    that the build fixes in 3.20180228 were successful
- update to 3.20180228
  * core: Don't send relative redirect URLs when behind a reverse
    proxy
  * core: Escape backticks etc. in directive error messages as HTML
    entities so that the error message is not subsequently parsed as
    Markdown
  * mdwn: Enable fenced code blocks, PHP Markdown Extra-style
    definition lists and GitHub-style extensions to HTML tag syntax
    when used with Discount >= 2.2.0 (Closes: #888055)
  * img: Fix auto-detection of image format (if enabled, which is
    strongly discouraged) with ImageMagick >= 6.9.8-3
  * rst: Use Python 3 instead of Python 2
  * build: `set -e` before each `for` loop, so that errors are
    reliably trapped
  * build: Use if/then instead of `||` so that the `-e` flag works
  * build: Ensure that pm_to_blib finishes before rewriting shebang
    lines
  * t: Make the img test pass with ImageMagick >= 6.9.8-3
    (Closes: #891647)
  * debian: Remove unused Lintian overrides for duplicate word false
    positives
  * debian: Declare compliance with Debian Policy 4.1.3
- update to 3.20180105
  * emailauth: Fix cookie problem when user is on https and the cgiurl
    uses http, by making the emailed login link use https.
  * passwordauth: Use https for emailed password reset link when user
    is on https.
  * Remove openid provider icons from login selector, since openid
    providers are increasingly not working. Verisign retired theirs,
    and aol and yahoo/flickr are not commonly used for openid. Any
    users who still clicked those icons to login will need to instead
    enter their openid url.
  * Updated German basewiki and directives translation from
    Sebastian Kuhnert.
- update to 3.20171001
  * htmlscrubber: Add support for the video tag's loop and muted
    attributes. Those were not in the original html5 spec, but have
    been added in the whatwg html living standard and have wide
    browser support.
  * emailauth, passwordauth: Avoid leaving cgisess_* files in the
    system temp directory.
  * core: Don't decode the result of strftime if it is already tagged
    as UTF-8, as it might be since Perl >= 5.21.1. (Closes: #869240)
  * img: Strip metadata from resized images when the deterministic
    config option is set. Thanks, intrigeri
  * receive: Avoid asprintf() in IkiWiki::Receive, to avoid implicit
    declaration, potential misbehaviour on 64-bit platforms, and lack
    of portability to non-GNU platforms
  * t: Add a regression test for untrusted git push
  * receive: Fix untrusted git push with git (>= 2.11) by passing
    through the necessary environment variables to make the
    quarantine area work
  * debian: Declare compliance with Debian Policy 4.1.1
  * l10n: Fix the build with po4a 0.52, by ensuring that msgstr ends
    with a newline if and only if msgid does
- update to 3.20170622
  * t/git-cgi.t: Wait 1 second before doing a revert that should work.
    This hopefully fixes a race condition in which the test failed
    around 6% of the time. (Closes: 862494)
  * Guard against set-but-empty REMOTE_USER CGI variable on
    misconfigured nginx servers, and in general treat sessions with
    a set-but-empty name as if they were not signed in.
  * When the CGI fails, print the error to stderr, not "Died"
  * mdwn: Don't mangle <style> into <elyts> under some circumstances
  * mdwn: Enable footnotes by default when using the default Discount
    implementation. A new mdwn_footnotes option can be used to
    disable footnotes in MultiMarkdown and Discount.
  * mdwn: Don't enable alphabetically labelled ordered lists by
    default when using the default Discount implementation. A new
    mdwn_alpha_list option can be used to restore the old
    interpretation.
  * osm: Convert savestate hook into a changes hook. savestate is not
    the right place to write wiki content, and in particular this
    breaks websetup if osm's dependencies are not installed, even
    if the osm plugin is not actually enabled. (Closes: #719913)
  * toc: if the heading is of the form <h1 id="...">, use that for
    the link in the table of contents (but continue to generate
    <a name="index42"></a> in case someone was relying on it).
    Thanks, Antoine Beaupré
  * color: Do not leak markup into contexts that take only the plain
    text, such as toc
  * meta: Document [[!meta name="foo" content="bar"]]
  * debian: Use preferred https URL for Format of debian/copyright
  * debian: Declare compliance with Debian Policy 4.0.0

- update to 3.20170111
  * passwordauth: prevent authentication bypass via multiple name
    parameters (CVE-2017-0356, OVE-20170111-0001)
  * passwordauth: avoid userinfo forgery via repeated email parameter
    (also in the scope of CVE-2017-0356)
  * CGI, attachment, passwordauth: harden against repeated parameters
    (not believed to have been a vulnerability)
  * remove: make it clearer that repeated page parameter is OK here
  * t/passwordauth.t: new automated test for passwordauth
- update to 3.20170110
  * wrappers: Correctly escape quotes in git_wrapper_background_command
  * git: use an explicit function parameter for the directory to work
    in. Previously, we used global state that was not restored correctly
    on catching exceptions, causing an unintended log message
    "cannot chdir to .../ikiwiki-temp-working: No such file or directory"
    with versions >= 3.20161229 when an attempt to revert a change fails
    or is disallowed
  * git: don't run "git rev-list ... -- -- ..." which would select the
    wrong commits if a file named literally "--" is present in the
    repository
  * check_canchange: log "bad file name whatever", not literal string
    "bad file name %s"
  * t/git-cgi.t: fix a race condition that made the test fail
    intermittently
  * t/git-cgi.t: be more careful to provide a syntactically valid
    author/committer name and email, hopefully fixing this test on
    ci.debian.net
  * templates, comments, passwordauth: use rel=nofollow microformat
    for dynamic URLs
  * templates: use rel=nofollow microformat for comment authors
  * news: use Debian security tracker instead of MITRE for security
    references. Thanks, anarcat
  * Set package format to 3.0 (native)
  * d/copyright: re-order to put more specific stanzas later, to get the
    intended interpretation
  * d/source/lintian-overrides: override obsolete-url-in-packaging for
    OpenID Selector, which does not seem to have any more current URL
    (and in any case our version is a fork)
  * docwiki.setup: exclude TourBusStop from offline documentation.
    It does not make much sense there.
  * d/ikiwiki.lintian-overrides: override script-not-executable warnings
  * d/ikiwiki.lintian-overrides: silence false positive spelling warning
    for Moin Moin
  * d/ikiwiki.doc-base: register the documentation with doc-base
  * d/control: set libmagickcore-6.q16-3-extra as preferred
    build-dependency, with virtual package libmagickcore-extra as an
    alternative, to help autopkgtest to do the right thing
- update to 3.20161229.1
  * git: Attribute reverts to the user doing the revert, not the wiki
    itself.
  * git: Do not disable the commit hook while preparing a revert.
- update to 3.20161229
  * Security: force CGI::FormBuilder->field to scalar context where
    necessary, avoiding unintended function argument injection
    analogous to CVE-2014-1572. In ikiwiki this could be used to
    forge commit metadata, but thankfully nothing more serious.
    (CVE-2016-9646)
  * Security: try revert operations in a temporary working tree before
    approving them. Previously, automatic rename detection could result in
    a revert writing outside the wiki srcdir or altering a file that the
    reverting user should not be able to alter, an authorization bypass.
    (CVE-2016-10026 represents the original vulnerability.)
    The incomplete fix released in 3.20161219 was not effective for git
    versions prior to 2.8.0rc0.
    (CVE-2016-9645 represents that incomplete solution.)
  * Add CVE references for CVE-2016-10026
  * Add automated test for using the CGI with git, including
    CVE-2016-10026
  - Build-depend on libipc-run-perl for better build-time test coverage
  * Add missing ikiwiki.setup for the manual test for CVE-2016-10026
  * git: don't issue a warning if the rcsinfo CGI parameter is undefined
  * git: do not fail to commit changes with a recent git version
    and an anonymous committer
- update to 3.20161219
  * inline: Prevent creating a file named ".mdwn" when the
    postform is submitted with an empty title.
  * Security: tell `git revert` not to follow renames. If it does, then
    renaming a file can result in a revert writing outside the wiki srcdir
    or altering a file that the reverting user should not be able to alter,
    an authorization bypass. Thanks, intrigeri. (CVE-2016-10026)
  * cgitemplate: remove some dead code. Thanks, blipvert
  * Restrict CSS matches against header class to not break
    Pandoc tables with header rows. Thanks, karsk
  * Make pagestats output more deterministic. Thanks, intrigeri
- update to 3.20160905
  * Fix installation when prefix includes a string metacharacter.
    Thanks, Sam Hathaway.
  * Use git log --no-renames to generate recentchanges, fixing the git
    test-case with git 2.9 (Closes: #835612)

- removed patch (fixed upstream)
  * ikiwiki-skip-img-test.diff
- update to 3.20160728
  * Explicitly remove current working directory from Perl's library
    search path, mitigating CVE-2016-1238 (see #588017)
  * wrappers: allocate new environment dynamically, so we won't overrun
    the array if third-party plugins add multiple environment variables.
  * Standards-Version: 3.9.8 (no changes required)
- update to 3.20160509
  * img: ignore the case of the extension when detecting image format,
    fixing the regression that *.JPG etc. would not be displayed
    since 3.20160506
  * img: parse img_allowed_formats case-insensitively, as was done in
    3.20141016.3
  * inline: restore backwards compat for show=-1 syntax, which
    worked before 3.20160121
  * Remove a spurious changelog entry from 3.20160506 (the relevant
    change was already in 3.20150614)
  * Add CVE-2016-4561 reference to 3.20160506 changelog
  * Set high urgency to get the CVE-2016-4561 fix and CVE-2016-3714
    mitigation into testing
- update to 3.20160506
  * HTML-escape error messages, in one case avoiding potential cross-site
    scripting (CVE-2016-4561, OVE-20160505-0012)
  * Mitigate ImageMagick vulnerabilities such as CVE-2016-3714:
  - img: force common Web formats to be interpreted according to extension,
    so that "allowed_attachments: '*.jpg'" does what one might expect
  - img: restrict to JPEG, PNG and GIF images by default, again mitigating
    CVE-2016-3714 and similar vulnerabilities
  - img: check that the magic number matches what we would expect from
    the extension before giving common formats to ImageMagick
  * img: Add back support for SVG images, bypassing ImageMagick and
    simply passing the SVG through to the browser, which is supported by all
    commonly used browsers these days.
    SVG scaling by img directives has subtly changed; where before
    size=wxh would preserve aspect ratio, this cannot be done when passing
    them through and so specifying both a width and height can change
    the SVG's aspect ratio.
  * loginselector: When only openid and emailauth are enabled, but
    passwordauth is not, avoid showing a "Other" box which opens an
    empty form.
  * mdwn: Process .md like .mdwn, but disallow web creation.
  * git: Correctly handle filenames starting with a dash in add/rm/mv.
- update to 3.20160121
  * meta: Fix [[!meta name=foo]] by closing the open quote.
  * Avoid unescaped "{" in regular expressions
  * meta test: Add tests for many behaviors of the directive.
  * img test: Bail gracefully when ImageMagick is not present.
  * emailauth: Added emailauth_sender config.
  * Modified page.tmpl to to set html lang= and dir= when
    values have been specified for them, which the po plugin does.
  * Specifically license the javascript underlay under the permissive
    basewiki license.
  * git: if no committer identity is known, set it to
    "IkiWiki <ikiwiki.info>" in .git/config. This resolves commit errors
    in versions of git that require a non-trivial committer identity.
  * inline, trail: rename show, feedshow parameters to limit, feedlimit
    (with backwards compatibility)
  * pagestats: add "show" option to show meta fields. Thanks, Louis
  * inline: force RSS <comments> to be a fully absolute URL as required
    by the W3C validator. Please use Atom feeds if relative URLs are
    desirable on your site.
  * inline: add <atom:link rel="self"> to RSS feeds as recommended by
    the W3C validator
  * inline: do not produce links containing /./ or /../
  * syslog: accept and encode UTF-8 messages
  * syslog: don't fail to log if the wiki name contains %s
  * Change dependencies from transitional package perlmagick
    to libimage-magick-perl (Closes: #789221)
  * debian/copyright: update for the rename of openid-selector to
    login-selector
  * d/control: remove leading article from Description
    (lintian: description-synopsis-starts-with-article)
  * d/control: Standards-Version: 3.9.6, no changes required
  * Wrap and sort control files (wrap-and-sort -abst)
  * Silence "used only once: possible typo" warnings for variables
    that are part of modules' APIs
  * Run autopkgtest tests using autodep8 and the pkg-perl team's
    infrastructure
  * Add enough build-dependencies to run all tests, except for
    non-git VCSs
  * tests: consistently use done_testing instead of no_plan
  * t/img.t: do not spuriously skip
  * img test: skip testing PDFs if unsupported
  * img test: use the right filenames when testing that deletion occurs
- update to 3.20150614
  * inline: change default sort order from age to "age title" for
    determinism, partially fixing deterministic build for git-annex,
    ikiwiki-hosting etc. (Closes: #785757)
  * img: avoid ImageMagick misinterpreting filenames containing a colon
  * img test: set old timestamp on source file that will change, so that
    the test will pass even if it takes less than 1 second

- update to 3.20150610
  * The new "emailauth" plugin allows users to authenticate using an email
    address, without otherwise creating an account.
  * The openid plugin now enables emailauth by default. Please include
    emailauth in the disable_plugins setting if this is not desired.
    Conversely, if emailauth is required on a wiki that does not enable
    openid, you can list it in the enable_plugins setting.

- skip syslog test for systems <= 13.2

- ran spec-cleaner and specfile cleanup
- added patch for skipping the imagemagick test: ikiwiki-img-test.diff
- update to 3.20150329
  * Fix NULL ptr deref on ENOMEM in wrapper. (Thanks, igli)
  * Really don't double-decode CGI submissions, even on Perl versions that
    bundle an old enough Encode.pm for that not to be a problem: the
    system might have a newer Encode.pm installed separately, like Fedora 20.
    (Closes: #776181; thanks, Anders Kaseorg)
  * If neither timezone nor TZ is set, set both to :/etc/localtime if
    we're on a GNU system and that file exists, or GMT otherwise
  * t/inline.t: accept translations of "Add a new post titled:"
    (Closes: #779365)
  * Consistently document command-line options as e.g. --refresh, not -refresh
  * In VCS-committed anonymous comments, link to url.
  * Fix XSS in openid selector. Thanks, Raghav Bisht. (Closes: #781483)
- update to 3.20150107
  * Added ikiwiki-comment program.
  * Add missing build-depends on libcgi-formbuilder-perl, needed for
    t/relativity.t
  * openid: Stop suppressing the email field on the Preferences page.
  * Set Debian package maintainer to Simon McVittie as I'm retiring from
    Debian.
  * calendar: add calendar_autocreate option, with which "ikiwiki --refresh"
    can mostly supersede the ikiwiki-calendar command.
    Thanks, Louis Paternault
  * search: add more classes as a hook for CSS. Thanks, sajolida
  * core: generate HTML5 by default, but keep avoiding new elements
    like <section> that require specific browser support unless html5 is
    set to 1.
  * Tell mobile browsers to draw our pages in a device-sized viewport,
    not an 800-1000px viewport designed to emulate a desktop/laptop browser.
  * Add new responsive_layout option which can be set to 0 if your custom
    CSS only works in a large viewport.
  * style.css, actiontabs, blueview, goldtype, monochrome: adjust layout
    below 600px ("responsive layout") so that horizontal scrolling is not
    needed on smartphone browsers or other small viewports.
  * core: new libdirs option alongside libdir. Thanks, Louis Paternault
  * core: log a debug message before waiting for the lock.
    Thanks, Mark Jason Dominus
  * build: in po/Makefile, use the same $(MAKE) as the rest of the build.
    Thanks, ttw
  * blogspam: use the 2.0 JSON API (the 1.0 XML-RPC API has been EOL'd).
    Closes: #774441
  * po: If msgmerge falls over on a problem po file, print a warning
    message, but don't let this problem crash ikiwiki entirely.
- update to 3.20141016
  * Fix crash that can occur when only_committed_changes is set and a
    file is deleted from the underlay.
  * core: avoid dangerous use of CGI->param in list context, which led
    to a security flaw in Bugzilla; as far as we can tell, ikiwiki
    is not vulnerable to a similar attack, but it's best to be safe
  * core: new reverse_proxy option prevents ikiwiki from trying to detect
    how to make self-referential URLs by using the CGI environment variables,
    for instance when it's deployed behind a HTTP reverse proxy
    (Closes: #745759)
  * core: the default User-Agent is now "ikiwiki/$version" to work around
    ModSecurity rules assuming that only malware uses libwww-perl
  * core: use protocol-relative URLs (e.g. //www.example.com/wiki) so that
    https stays on https and http stays on http, particularly if the
    html5 option is enabled
  * core: avoid mixed content when a https cgiurl links to http static pages
    on the same server (the static pages are assumed to be accessible via
    https too)
  * core: force the correct top URL in w3mmode
  * google plugin: Use search form
  * docwiki: replace Paypal and Flattr buttons with text links
  * comments: don't record the IP address in the wiki if the user is
    logged in via passwordauth or httpauth
  * templates: add ARIA roles to some page elements, if html5 is enabled.
    Thanks, Patrick
  * debian: build-depend on libmagickcore-6.q16-2-extra | libmagickcore-extra
    so we can thumbnail SVGs in the docwiki
  * debian: explicitly depend and build-depend on libcgi-pm-perl
  * debian: drop unused python-support dependency
  * debian: rename debian/link to debian/links so the intended symlinks appear
  * debian: fix some wrong paths in the copyright file
- update to 3.20140916
  * Don't double-decode CGI submissions with Encode.pm >= 2.53,
    fixing "Error: Cannot decode string with wide characters".
    Thanks, Antoine Beaupré
  * Avoid making trails depend on everything in the wiki by giving them
    a better way to sort the pages
  * Don't let users post comments that won't be displayed
  * Fix encoding of Unicode strings in Python plugins.
    Thanks, chrysn
  * Improve performance and correctness of the [[!if]] directive
  * Let [[!inline rootpage=foo postform=no]] disable the posting form
  * Switch default [[!man]] shortcut to manpages.debian.org. Closes: #700322
  * Add UUID and TIME variables to edittemplate. Closes: #752827
    Thanks, Jonathon Anderson
  * Display pages in linkmaps as their pagetitle (no underscore escapes).
    Thanks, chrysn
  * Fix aspect ratio when scaling small images, and add support for
    converting SVG and PDF graphics to PNG.
    Thanks, chrysn
  - suggest ghostscript (required for PDF-to-PNG thumbnailing)
    and libmagickcore-extra (required for SVG-to-PNG thumbnailing)
  - build-depend on ghostscript so the test for scalable images can be run
  * In the CGI wrapper, incorporate $config{ENV} into the environment
    before executing Perl code, so that PERL5LIB can point to a
    non-system-wide installation of IkiWiki.
    Thanks, Lafayette Chamber Singers Webmaster
  * filecheck: accept MIME types not containing ';'
  * autoindex: index files in underlays if the resulting pages aren't
    going to be committed. Closes: #611068
  * Add [[!templatebody]] directive so template pages don't have to be
    simultaneously a valid template and valid HTML
  * Add myself to Uploaders and release to Debian
- update to 3.20140831
  * Make --no-gettime work in initial build. Closes: #755075
- update to 3.20140815
  * Add google back to openid selector. Apparently this has gotten a stay
    of execution until April 2015. (It may continue to work until 2017.)
  * highlight: Add compatibility with highlight 3.18, while still supporting
    3.9+. Closes: #757679
    Thanks, David Bremner
  * highlight: Add support for multiple language definition directories
    Closes: #757680
    Thanks, David Bremner
- update to 3.20140613
  * only_committed_changes could fail in a git repository merged
    with git merge -s ours.
  * Remove google from openid selector, per http://xkcd.com/1361/
- update to 3.20140227
  * Added useragent config setting. Closes: #737121
    Thanks, Tuomas Jormola
  * po: Add html_lang_code and html_lang_dir template variables
    for the language code and direction of text.
    Thanks, Mesar Hameed
  * Allow up to 8 levels of nested directives, rather than previous 3
    in directive infinite loop guard.
  * git diffurl: Do not escape / in paths to changed files, in order to
    interoperate with cgit (gitweb works either way)
    Thanks, intrigeri.
  * git: Explicity push master branch, as will be needed by git 2.0's
    change to push.default=matching by default.
    Thanks, smcv
  * Deal with nasty issue with gettext clobbering $@ while printing
    error message containing it.
    Thanks, smcv
  * Cleanup of the openid login widget, including replacing of hotlinked
    images from openid providers with embedded, freely licensed artwork.
    Thanks, smcv
  * Improve templates testing.
    Thanks, smcv
  * python proxy: Avoid utf-8 related crash.
    Thanks, Antoine Beaupré
  * Special thanks to Simon McVittie for being the patchmeister for this
    release.
- update to 3.20140125
  * inline: Allow overriding the title of the feed. Closes: #735123
    Thanks, Christophe Rhodes
  * osm: Escape name parameter. Closes: #731797
- update to 3.20140102
  * aggregate: Improve display of post author.
  * poll: Fix behavior of poll buttons when inlined.
  * Fixed unncessary tight loop hash copy in saveindex where a pointer
    can be used instead. Can speed up refreshes by nearly 50% in some
    circumstances.
  * Optimized loadindex by caching the page name in the index.
  * Added only_committed_changes config setting, which speeds up wiki
    refresh by querying git to find the files that were changed, rather
    than looking at the work tree. Not enabled by default as it can
    break some setups where not all files get committed to git.
  * comments: Write pending moderation comments to the transient underlay
    to avoid conflict with only_committed_changes.
  * search: Added google_search option, which makes it search google
    rather than using the internal xapain database.
    (googlesearch plugin is too hard to turn on when xapain databases
    corrupt themselves, which happens all too frequently).
  * osm: Remove invalid use of charset on embedded javascript tags.
    Closes: #731197
  * style.css: Add compatibility definitions for more block-level
    html5 elements. Closes: #731199
  * aggregrate: Fix several bugs in handling of empty and colliding
    titles when generating filenames.
- update to 3.20130904.1
  * Fix cookiejar default setting.
- update to 3.20130904
  * calendar: Display the popup mouseover when there is only 1 page for a
    given day, for better UI consistency.
  * meta: Can now be used to add an enclosure to a page, which is a fancier
    way to do podcasting than just inlining the media files directly;
    this way you can write a post about the podcast episode with show notes,
    author information, etc.
    (schmonz)
  * aggregate: Show author in addition to feedname, if different.
    (schmonz)
  * Consistently configure LWP::UserAgent to allow use of http_proxy
    and no_proxy environment variables, as well as ~/.ikiwiki/cookies
    (schmonz)
  * Fix test suite to work with perl 5.18. Closes: #719969
- update to 3.20130711
  * Deal with git behavior change in 1.7.2 and newer that broke support
    for commits with an empty commit message.
  * Pass --no-edit when used with git 1.7.8 and newer.
- update to 3.20130710
  * blogspam: Fix encoding issue in RPC::XML call.
    Thanks, Changaco
  * comments: The formats allowed to be used in comments can be configured
    using comments_allowformats.
    Thanks, Michal Sojka
  * calendar: When there are multiple pages for a given day, they're
    displayed in a popup on mouseover.
    Thanks, Louis
  * osm: Remove trailing slash from KML maps icon.
  * page.tmpl: omit searchform, trails, sidebar and most metadata in CGI
    (smcv)
  * openid: Automatically upgrade openid_realm to https when
    accessed via https.
  * The ip() pagespec can now contain glob characters to match eg, a subnet
    full of spammers.
  * Fix crash that could occur when a needsbuild hook returned a file
    that does not exist.
  * Fix python proxy to not crash when fed unicode data in getstate
    and setstate.
    Thanks, chrysn
  * Fix committing attachments when using svn.

- update to 3.20130518
  * Fix test suite to not fail when XML::Twig is not installed.
    Closes: #707436
  * theme: Now <TMPL_IF THEME_$NAME> can be used in all templates when
    a theme is enabled.
  * notifyemail: Fix bug that caused duplicate emails to be sent when
    site was rebuilt.
  * bzr: bzr rm no longer has a --force option, remove
  * Allow dots in directive parameter names. (tango)
  * Add missing plugin section, and deal with missing sections with a warning.
  * Detect plugins with a broken getsetup and warn.
  * map: Correct reversion introduced in version 3.20110225 that could
    generate invalid html. (smcv)
  * Makefile.PL: overwrite theme style.css instead of appending
    (Thanks, Mikko Rapeli)
  * meta: Fix anchors used to link to the page's license and copyright.
    Closes: #706437
  * htmlscrubber: Allow the bitcoin URI scheme.
  * htmlscrubber: Allow the URI schemes of major VCS's.
  * aggregate: When run with --aggregate, if an aggregation is already
    running, don't go on and --refresh.
  * trail: Avoid excess dependencies between pages in the trail
    and the page defining the trail. Thanks, smcv.
  * opendiscussion: Don't allow editing discussion pages if discussion pages
    are disabled. (smcv)
  * poll: Add expandable option to allow users to easily add new choices to
    a poll.
  * trail: Avoid massive slowdown caused by pagetemplate hook when displaying
    dynamic cgi pages, which cannot use trail anyway.
  * Deal with empty diffurl in configuration.
  * cvs: Various fixes. (schmonz)
  * highlight: Now adds a span with class highlight-<extension> around
    highlighted content, allowing for language-specific css styling.

- 3.20121212
  * lots of bugfixes and new features
  * fixes CVE-2012-0220 and CVE-2011-1408
  * support Text::Markdown::Discount for speedup
  * requires YAML::XS instead of YAML

- 3.20110431
  * Danish translation update. Closes: #625721
  * Danish underlay translation update. Closes: #625765 (Thanks, Jonas Smedegaard)
  * Support YAML::XS by not passing decoded unicode to Load. Closes: #625713
  * openid, aggregate, pinger: Use Net::INET6Glue if available to support making ipv6 connections. (Note that if LWPx::ParanoidAgent is installed, it defeats this for openid.)
  * Add additional directive quoting styles, to better support nested directives. Both triple-single-quote and heredoc quotes can be used. (Thanks, Timo Paulssen)
  * Changed license of madduck's python plugins from GPL-2 to BSD-2-clause.
  * po: support language codes in the form of 'es_AR', and 'arn'. (intrigeri) Closes: #627844
  * po: Make po4a warn, not error on a malformed document. (intrigeri)
  * Support the Hiawatha web server which sets HTTPS=off rather than not setting it. (There does not seem to be a standard here.)

- new version 3.20110430 (http://ikiwiki.info/news/)
  * don't allow alternative stylesheets to be added on pages where the
    htmlscrubber is enabled (CVE-2011-1401)
- now requires perl-YAML

- new version 3.20110225
  - editpage: Avoid inheriting internal page types.
  - htmltidy: Avoid breaking the sidebar when websetup is running.
  - transient: New utility plugin that allows transient pages to be stored in
    .ikiwiki/transient/ (smcv)
  - aggregate: Aggregated content is stored in the transient underlay.
    (Existing aggregated content is not moved, since it will eventually expire
    and be removed) (smcv)
  - autoindex, tag: Added autoindex_commit and tag_autocreate_commit that can
    be unset to make index files and tags respectively not be committed, and
    instead be stored in the transient underlay. (smcv)
  - autoindex: Adapted to use add_autofile. Slight behavior changes in edge
    cases that are probably really bug fixes. (smcv)
  - recentchanges: Use transient underlay (smcv)
  - map: Avoid unnecessary ul's in maps with nested directories. (Giuseppe
    Bilotta)
  - Fix broken baseurl in cgi mode when usedirs is disabled. Bug introduced in
    3.20101231.
  - inline: Fix link to nested inlined pages's feeds. (Giuseppe Bilotta)
  - inline: Add 'id' parameter that can be used when styling individual
    feedlinks and postforms. (Giuseppe Bilotta)

- suggest perl(Net::OpenID::Consumer) and perl(LWPx::ParanoidAgent)

- new version 3.20110124
  - fix regression in previous version

- new version 3.20110123
  - fix XSS issue (CVE-2011-0428)

- new version 3.20100804
  - template: Fix dependency tracking. Broken in version 3.20100427.
  - po: The po_slave_languages setting is now a list, so the order of
    translated languages can be controlled. (intrigeri)
  - git: Fix gitweb historyurl examples so "diff to current" links work.
    (Thanks jrayhawk)
  - meta: Allow syntax closer to html meta to be used.
  - Add new disable hook, allowing plugins to perform cleanup after they have
    been disabled.
  - Use Digest::SHA built into perl rather than external Digest::SHA1 to
    simplify dependencies. Closes: #591040
  - Fixes a bug that prevented matching deleted pages when using the page()
    PageSpec.