Two security holes and a new library

"Two security holes and a new library" isn't a very descriptive title - even after glancing at the beginning of the message I'm not sure what project this is for

The daily journal at the end is a nice read.

git-annex is a tool to track large files in git without tracking their contents (like LFS I guess, though I've never used it).

Thank you I missed those completely.

quote: This is being particularly painful for the android build, [.. with] old libraries [.. and] many follow-on changes, and is not successfully building yet after 5 hours.

Seeing that developers with good domain knowledge have these problems too helps with confidence.

an update to the title would be nice. these security holes are for "git-annex" and the new library is "http-client-restricted". i don't think the library's name needs to be in the title, but at least "git-annex" should be.