v0.14.14

This is a security release recommended for all users. Two distinct security
vulnerabilities have been corrected in this release. Either would let a
remote attacker, controlling a device that is already accepted by Syncthing,
perform arbitrary reads and writes to files outside the configured folders.

The first issue is that path validation was lacking in several places,
resulting in Syncthing accepting index entries for files like "../../foo",
thus resulting in a path above the configured folder.

The second issue is that where path validation was correct, symlinks could
be used to trick Syncthing. An attacker could create a symlink "foo ->
../../" and then request the contents of "foo/something", again escaping the
constraints of the folder.

Further resolved issues:

* #3753: The build no longer requires Go 1.7.
* #3769: The wording in the GUI around "last file received" is now clearer.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAABCAAGBQJYUO3dAAoJEEn1rsC85STHZ6wQAIXviMQqpHhVZ2/NkM84gnZR
nlnQgcIF8ArN9q6HFL9nQXESL+2eBm3dnPRukLnAqXus3YTzyhqH3OGSa1vwQLkQ
tyqFpmg5jruBOt4N2NKIr0TUnQNYQIruM7+hovAU/pq4uzSzL5tix0Si+gFMB+nF
rdF9sVon0mIq1rrbHF0J2iXMbuJtzH3B6fkUltEkpyoKXERUDhCv6r/bQDVFCGS5
J5Jot/4qw2C5uZhQBNB80EF5QasfBXVykycCBhFMe87IS9Gf7CK75ejfToo8Gy7F
E0+FU6l3zQxLNaX1lTFy06x5xpEwoUD9RvauLQskhqNCDb9CY64OSiAKBARRiWb5
Odqyara4LuzxRmAaawiLfDkiJCCQ+3FOIJcSS0P2qICM053LrsOy/kuUniemA7oe
3AT7OWkVt+bWgnAh32q4zsK8ylq9LIjK/rumfLGNIu9EIK2qxU6YEmpifMrbgni4
/CsGRX8s5bnwlnrpYoGYjb8dE0k+9+UjW7h4E5kj2sIc3v9DQkYvXTq19/Q4Hp/M
tTHkdvPeyXEbjSKcN2EUI0b7LOqd81DxJm/afOaUJS2OYQi+EmBd5/iAhbIuEFSs
KWLcThSmp+nTg4IsO59IJkh4uhXdD8Nb7v1Or6Y8b0MmJ/Ix3oNe5MlDquT9vnGD
la86TNYGn+Ckz54Pds4p
=2RcY
-----END PGP SIGNATURE-----
