NEWS for rsync 2.6.9 (unreleased)
Protocol: 29 (unchanged)
Changes since 2.6.8:

  BUG FIXES:

    - An rsync daemon that is receiving files with "use chroot = no" no longer
      sanitizes the symlink target strings.  This means that each symlink's
      value will now be accepted (and thus returned) with its symlink info
      intact.  Also, in order to keep things safe, any option that tells a
      non-chroot daemon to treat some symlinks as their referent (such as
      --copy-links or --keep-dirlinks) now manually checks the symlink chain
      to ensure that the symlinks do not try to escape past the top of the
      module's path.  Both these changes make a non-chroot daemon behave the
      same as a chroot daemon with regard to symlinks, and also avoids a
      potential problem where a pre-existing symlink could have escaped the
      module's hierarchy.

    - Fixed a overzealous sanitizing bug in the handling of the --*-dest
      options (--link-dest, --copy-dest, and --compare-dest): if the copy's
      destination dir is deeper than the top of the module's path, these
      options now accept a safe number of ../ (parent-dir) references (since
      these options are relative to the destination dir).  The old code
      incorrectly chopped off all "../" prefixes for these options, no matter
      how deep the destination directory was in the module's hierarchy.

    - Fixed a bug where a deferred info/error/log message could get sent
      directly to the sender instead of being handled by rwrite() in the
      generator.  This fixes an "unexpected tag 3" fatal error, and should
      also fix a potential problem where a deferred info/error message from
      the receiver might bypass the log file and get sent only to the client
      process.  (These problems could only affect an rsync daemon that was
      receiving files.)

    - Make sure that the --link-dest option can still do its job even when -I
      or --size-only is specified.

    - The daemon now calls more timezone-using functions prior to doing a
      chroot.  This should help some C libraries to generate proper timestamps
      from inside a chrooted daemon (and to not try to access /etc/timezone
      over and over again).

  ENHANCEMENTS:

    - ...

  DEVELOPER RELATED:

    - The acls.diff and xattrs.diff patches have received a bunch of work to
      make them much closer to being acceptable in the main distribution.

    - Updated config.guess and config.sub to their 2006-02-23 version.

    - Updated various files to include the latest FSF address and to have
      consistent opening comments.