Release v2.12.1 HEAD v2.12.1 main

1 file changed, 62 insertions, 0 deletions

diff --git a/CHANGE.txt b/CHANGE.txtindex 7200c32..2d294aa 100644--- a/CHANGE.txt+++ b/CHANGE.txt@@ -5,6 +5,68 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here.  +v2.12.1 (2026-11-08)+--------------------++A testing and hardening release. The test suite now fails a page that breaks+instead of passing anything that does not crash, the mailmap is held to+max-blob-size, and a review of the tests closed the bugs it found, from a+followed diff that took in small.cpp with small.c to clone urls split in two at+a space. Logins now need virtual-root to be a path, so read the upgrade note+under Changed before deploying.++Added+.....++* make test runs every script and ends on one summary line for the whole run,+  rather than stopping at the first script that fails, and README says how to+  run the tests.+* CGIT_TEST_REQUIRE names prerequisites a run must not skip, so a release run+  fails where a tool it relies on is missing.+* tools/build-release.sh passes further arguments on to make, so its binary can+  be tested as built and a Lua that pkg-config cannot find can be named for it.++Changed+.......++* Upgrade note: the auth filters send a visitor back only to a target that+  starts with a single slash, so logins need virtual-root to be a path, as it is+  by default.+* The tests check the status, the error log and the end of each page they+  request, and the tests that could not fail as written now can.+* MANUAL says the message and description limits count bytes and names the notes+  and .gitmodules as read whole.++Fixed+.....++* The auth filters' redirect check looked at the first two characters alone, so+  it accepted https://evil.example/ and javascript:x. That was safe only because+  cgit signs no url outside virtual-root.+* A mailmap was read whole on every page, so a pusher could make every page of a+  repository read as much as they liked. It is now held to max-blob-size.+* A followed diff took in every path that began with the one asked for, so+  following small.c also showed small.cpp. Whatever path was given, its+  diffstat header read (limited to '').+* A repository url with a space in it was listed as two clone urls, and the+  links of clone urls and submodules carried spaces and bytes past ASCII+  unencoded.+* The plain, snapshot and blob pages sent a download name past ASCII raw, which+  a client may read as ISO-8859-1. It now also goes as filename*,+  percent-encoded in UTF-8.+* about-render gave a heading such as "Twice 1" the same anchor as the second of+  two headings "Twice", so a link to the later one landed on the earlier.+* The index page came out short for a negative offset.+* A directory named as a cgitrc or include was refused only when reading it+  failed, which not every system guarantees.+* A max-stats value that names no period turned the statistics page off without+  a warning.+* The cache hook left pages asked for with an escaped url, such as+  url=foo%2bbar.git/, cached and stale until their ttl ran out.+* The age hook, run by hand from a terminal, waited on a question no one could+  see and then kept the old date.++ v2.12.0 (2026-11-07) -------------------- 
diff --git a/CHANGE.txt b/CHANGE.txt
index 7200c32..2d294aa 100644
--- a/CHANGE.txt
+++ b/CHANGE.txt
@@ -5,6 +5,68 @@ Notable changes to this fork, newest release first. History before v2.0.0
 belongs to upstream cgit and is not covered here.
 
 
+v2.12.1 (2026-11-08)
+--------------------
+
+A testing and hardening release. The test suite now fails a page that breaks
+instead of passing anything that does not crash, the mailmap is held to
+max-blob-size, and a review of the tests closed the bugs it found, from a
+followed diff that took in small.cpp with small.c to clone urls split in two at
+a space. Logins now need virtual-root to be a path, so read the upgrade note
+under Changed before deploying.
+
+Added
+.....
+
+* make test runs every script and ends on one summary line for the whole run,
+  rather than stopping at the first script that fails, and README says how to
+  run the tests.
+* CGIT_TEST_REQUIRE names prerequisites a run must not skip, so a release run
+  fails where a tool it relies on is missing.
+* tools/build-release.sh passes further arguments on to make, so its binary can
+  be tested as built and a Lua that pkg-config cannot find can be named for it.
+
+Changed
+.......
+
+* Upgrade note: the auth filters send a visitor back only to a target that
+  starts with a single slash, so logins need virtual-root to be a path, as it is
+  by default.
+* The tests check the status, the error log and the end of each page they
+  request, and the tests that could not fail as written now can.
+* MANUAL says the message and description limits count bytes and names the notes
+  and .gitmodules as read whole.
+
+Fixed
+.....
+
+* The auth filters' redirect check looked at the first two characters alone, so
+  it accepted https://evil.example/ and javascript:x. That was safe only because
+  cgit signs no url outside virtual-root.
+* A mailmap was read whole on every page, so a pusher could make every page of a
+  repository read as much as they liked. It is now held to max-blob-size.
+* A followed diff took in every path that began with the one asked for, so
+  following small.c also showed small.cpp. Whatever path was given, its
+  diffstat header read (limited to '').
+* A repository url with a space in it was listed as two clone urls, and the
+  links of clone urls and submodules carried spaces and bytes past ASCII
+  unencoded.
+* The plain, snapshot and blob pages sent a download name past ASCII raw, which
+  a client may read as ISO-8859-1. It now also goes as filename*,
+  percent-encoded in UTF-8.
+* about-render gave a heading such as "Twice 1" the same anchor as the second of
+  two headings "Twice", so a link to the later one landed on the earlier.
+* The index page came out short for a negative offset.
+* A directory named as a cgitrc or include was refused only when reading it
+  failed, which not every system guarantees.
+* A max-stats value that names no period turned the statistics page off without
+  a warning.
+* The cache hook left pages asked for with an escaped url, such as
+  url=foo%2bbar.git/, cached and stale until their ttl ran out.
+* The age hook, run by hand from a terminal, waited on a question no one could
+  see and then kept the old date.
+
+
 v2.12.0 (2026-11-07)
 --------------------