2 files changed, 114 insertions, 1 deletion
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 67b2670..5c9d6fe 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -5,6 +5,119 @@ Notable changes to this fork, newest release first. History before v2.0.0
 belongs to upstream cgit and is not covered here.
 
 
+v2.9.0 (2026-10-17)
+-------------------
+
+A compatibility and hardening release. Lua 5.5 is supported, readmes render
+closer to how GitHub shows them, the auth examples were overhauled, 32-bit
+builds compile again, and two audits of the extensions and of the C code
+closed what they found, from a cache lock that an exec filter let go of to
+a log search that was never the literal match it claimed to be.
+
+Added
+.....
+
+* Lua 5.5, detected when building and claimed by every extension, which
+  needs luaossl 20260910 or later there.
+* Stable markup hooks for site themes: a data-page attribute, named sections
+  and a class per link kind.
+* Readmes follow GitHub more closely: relative links lead into the tree at
+  the readme's own ref, lines of a paragraph run together, a table may cut a
+  paragraph short, a wrapped list item stays in its list, urls and addresses
+  in angle brackets link, backslash escapes and character references are
+  honoured, underscores inside words are left alone, and headings get the
+  anchors GitHub gives them. Images and badges are left out.
+* The auth examples bind a session to the account's password hash, so a
+  changed password ends it, use a __Host- cookie where one can be set, turn
+  down passwords past 256 bytes unchecked, spend a missing account's login on
+  a real hash, load their libraries only when a request needs one, and say
+  which hash kinds each system's crypt checks.
+* Avatars are looked up by SHA-256, offered at twice the size to dense
+  screens, marked decorative, and left out when luaossl is missing.
+* The syntax highlighter finds a script's lexer from its shebang line.
+* make get-git checks the Git tarball against the SHA-256 kernel.org lists.
+* The dumb transport answers HEAD from the ref store and the index dates a
+  repository from its reftable, so reftable repositories clone and age.
+
+Changed
+.......
+
+* enable-trailers is now enable-commit-trailers.
+* The bundled Git is 2.56.0.
+* The pages carry no version number, and the Lua-less build is checked by
+  the suite as well.
+* Any path below the about page answers 404, the about filter is handed the
+  tree url its links need, and the about redirect keeps the query string.
+* The dumb transport serves only what a clone asks for, a loose object, a
+  pack with its index and info/http-alternates, sends each file with its
+  size and keeps none of them in the cache.
+* A page behind an auth filter is marked private, and every page that
+  follows a branch takes cache-dynamic-ttl.
+* summary-branches, summary-tags and max-ref-count read a negative value as
+  no limit, and the feed refuses pathspec magic as the log does.
+* patch, rawdiff and signature downloads hold to max-blob-size, and a
+  readme past it says so on the about page.
+* Diffs no longer ask xdiff for a minimal result, which cost quadratic time
+  on a reordered file, and tar.xz snapshots are compressed on one thread.
+* The cache slot lock is an flock, which outlasts an exec filter's swap of
+  stdout where the record lock did not.
+* Git is built without translations or Tcl, the release script builds with
+  the compiler it probed, the two builds no longer share vendor/git at once,
+  sparse checks the sources as gnu17, and a musl build is documented.
+* The example tracker links in link-commits.lua and link-trailers.lua ship
+  commented out, so an unedited copy links object names alone.
+* The manual, README and sample cgitrc say what the code does: every page
+  and query parameter, every file make install puts in place, the defaults
+  and value syntax, and which filters get the repository variables.
+
+Fixed
+.....
+
+* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.
+* The log search matched as a regular expression after all, so a term with
+  a bracket in it answered a 500 and a crafted one took the memory of the
+  box.
+* A pushed date or zone outside what git's date code accepts, and a notes
+  ref pointing at anything but a tree, ended the summary, refs, log, commit
+  and feed pages of the repository.
+* A snapshot name led to a branch spelled like the tag's stem, members
+  of a snapshot named by its suffix alone started at a slash, and a missing
+  PATH refused every compressed snapshot.
+* The plain view answered twice for duplicate tree entries and read a freed
+  mimetype on the way, a control byte in a file name made the web server
+  refuse the download, a scanned defbranch could name a path outside the
+  repository, and the error page resolved the very id it had refused.
+* A fill whose last flush failed to write, on a full disk for one, left the
+  visitor a blank response, a cache ttl in the tens of millions of minutes
+  overflowed, and an empty list reached qsort as a null, which glibc's
+  sanitizer build aborted on.
+* Links built from the repository url and the feed link's branch were not
+  encoded, a readme vanished behind an annotated tag, a followed log lost
+  its root commit and paged by the wrong name, a Lua build crashed when git
+  wrote before cgit's own setup, text was cut inside a multibyte character,
+  and the tag page offered snapshots of trees and blobs.
+* An absolute symlink target was linked as a path inside the tree, a chain
+  of single directories ended in a dangling separator, a repository without
+  a path was dated from a file named "(null)", a NUL ended a config comment
+  early, and a tree row was left open when a link target could not be read.
+* An empty repo.url is ignored, a readme ending in a colon is gated like a
+  path on disk, an error mid capture keeps its message, date-format=
+  local-local renders, an indented comment in the mimetype file is skipped,
+  types that only spell xml get no charset, the sendfile loop stops at a
+  short slot, slot keys and pages are read and written in full, and the
+  stats page stops after its error page.
+* auth-file.lua refuses every repository when it cannot read its repos file,
+  cookie, readme and avatar parsing run in linear time, the cache hook keeps
+  its rm errors from pushers, the age hook leaves its directory writable to
+  the group, a Lua script may write while it loads, and every Lua filter
+  failure is named in the log.
+* Git read the global config for its trace settings before cgit isolated
+  the environment, so every request probed $HOME/.gitconfig, which the
+  home-access test caught only once it ran on a real x86_64 kernel.
+* make DEVELOPER=1 passes: string literals sit behind const pointers and
+  callbacks are passed by address.
+
+
 v2.8.0 (2026-09-16)
 -------------------
 
diff --git a/Makefile b/Makefile
index 2564bcc..c4dd7c8 100644
--- a/Makefile
+++ b/Makefile
@@ -35,7 +35,7 @@ GIT_TARBALL = git-$(GIT_VERSION).tar.xz
 # Compiled-in cgit defaults, all overridable through cgit.conf. Every one
 # carries the CGIT_ prefix except CACHE_ROOT, which is inherited from upstream
 # under that name.
-CGIT_VERSION = v2.8.0
+CGIT_VERSION = v2.9.0
 CGIT_SCRIPT_NAME = cgit.cgi
 CGIT_SCRIPT_PATH = /var/www/htdocs/cgit
 CGIT_DATA_PATH = $(CGIT_SCRIPT_PATH)