Highlights:
* Support for ECDSA and Ed25519 SSH keys
* Fix vulnerability that allowed SSH authentication to be circumvented
* Explicitly disable requesting optional client TLS certificates
* Copy-to-clipboard button is back and working
* Minimal required Java version is Java 8
While old DSA SSH host keys can still be used, a new Gitblit installation will no longer
generate a DSA host key. The default set of host keys is now RSA, ECDSA and Ed25519.
Snapshot builds of the current master branch are now available as Docker containers on
Docker Hub under the "Nightly" tag.
Note
This release fixes a vulnerability allowing an attacker to circumvent authentication on the SSH transport. Users are urged to update to this version.
Should you have disabled the Flash-based copy-to-clipboard function because it wasn't working anymore (`web.allowFlashCopyToClipboard = false`), you may want to rethink this and enable it again. The configuration property has the same name, but the mechanism was exchanged. Flash is gone, and a modern JavaScript solution is now used to copy text directly to the clipboard (via clipboard.js).
The setting `server.requireClientCertificates` now has three values: `required`, `optional` and `none`. While `required` is synonymous to the old `true` value, and `optional` is synonymous to the old `false` value, the new `none` value results in the server never asking the client to present any client certificate at all. The old values `true` and `false` can still be used and keep their meaning.
From 1.10.0 on Gitblit requires Java 8 as minimal Java version.
