Diff options
| -rw-r--r-- | CHANGELOG.txt | 112 | |
| -rw-r--r-- | Makefile | 2 |
2 files changed, 113 insertions, 1 deletion
diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 67b2670..bdc4690 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -5,6 +5,118 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here. +v2.9.0 (2026-10-17) +------------------- + +A compatibility and hardening release. Lua 5.5 is supported, readmes render +closer to how GitHub shows them, the auth examples were overhauled, 32-bit +builds compile again, and two audits of the extensions and of the C code +closed what they found, from a cache lock that an exec filter let go of to +a log search that was never the literal match it claimed to be. + +Added +..... + +* Lua 5.5, detected when building and claimed by every extension, which + needs luaossl 20260910 or later there. +* Stable markup hooks for site themes: a data-page attribute, named sections + and a class per link kind. +* Readmes follow GitHub more closely: relative links lead into the tree at + the readme's own ref, lines of a paragraph run together, a table may cut a + paragraph short, a wrapped list item stays in its list, urls and addresses + in angle brackets link, backslash escapes and character references are + honoured, underscores inside words are left alone, and headings get the + anchors GitHub gives them. Images and badges are left out. +* The auth examples bind a session to the account's password hash, so a + changed password ends it, use a __Host- cookie where one can be set, turn + down passwords past 256 bytes unchecked, spend a missing account's login on + a real hash, load their libraries only when a request needs one, and say + which hash kinds each system's crypt checks. +* Avatars are looked up by SHA-256, offered at twice the size to dense + screens, marked decorative, and left out when luaossl is missing. +* The syntax highlighter finds a script's lexer from its shebang line. +* make get-git checks the Git tarball against the SHA-256 kernel.org lists. +* The dumb transport answers HEAD from the ref store and the index dates a + repository from its reftable, so reftable repositories clone and age. + +Changed +....... + +* enable-trailers is now enable-commit-trailers. +* The bundled Git is 2.56.0. +* The pages carry no version number, and the Lua-less build is checked by + the suite as well. +* Any path below the about page answers 404, the about filter is handed the + tree url its links need, and the about redirect keeps the query string. +* The dumb transport serves only what a clone asks for, a loose object, a + pack with its index and info/http-alternates, sends each file with its + size and keeps none of them in the cache. +* A page behind an auth filter is marked private, and every page that + follows a branch takes cache-dynamic-ttl. +* summary-branches, summary-tags and max-ref-count read a negative value as + no limit, and the feed refuses pathspec magic as the log does. +* patch, rawdiff and signature downloads hold to max-blob-size, and a + readme past it says so on the about page. +* Diffs no longer ask xdiff for a minimal result, which cost quadratic time + on a reordered file, and tar.xz snapshots are compressed on one thread. +* The cache slot lock is an flock, which outlasts an exec filter's swap of + stdout where the record lock did not. +* Git is built without translations or Tcl, the release script builds with + the compiler it probed, the two builds no longer share vendor/git at once, + sparse checks the sources as gnu17, and a musl build is documented. +* The example tracker links in link-commits.lua and link-trailers.lua ship + commented out, so an unedited copy links object names alone. +* The manual, README and sample cgitrc say what the code does: every page + and query parameter, every file make install puts in place, the defaults + and value syntax, and which filters get the repository variables. + +Fixed +..... + +* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled. +* The log search matched as a regular expression after all, so a term with + a bracket in it answered a 500 and a crafted one took the memory of the + box. +* A pushed date or zone outside what git's date code accepts, and a notes + ref pointing at anything but a tree, ended the summary, refs, log, commit + and feed pages of the repository. +* A snapshot name led to a branch spelled like the tag's stem, members + of a snapshot named by its suffix alone started at a slash, and a missing + PATH refused every compressed snapshot. +* The plain view answered twice for duplicate tree entries and read a freed + mimetype on the way, a control byte in a file name made the web server + refuse the download, a scanned defbranch could name a path outside the + repository, and the error page resolved the very id it had refused. +* A fill whose last flush failed to write, on a full disk for one, left the + visitor a blank response, a cache ttl in the tens of millions of minutes + overflowed, and an empty list reached qsort as a null, which glibc's + sanitizer build aborted on. +* Links built from the repository url and the feed link's branch were not + encoded, a readme vanished behind an annotated tag, a followed log lost + its root commit and paged by the wrong name, a Lua build crashed when git + wrote before cgit's own setup, text was cut inside a multibyte character, + and the tag page offered snapshots of trees and blobs. +* An absolute symlink target was linked as a path inside the tree, a chain + of single directories ended in a dangling separator, a repository without + a path was dated from a file named "(null)", a NUL ended a config comment + early, and a tree row was left open when a link target could not be read. +* An empty repo.url is ignored, a readme ending in a colon is gated like a + path on disk, an error mid capture keeps its message, date-format= + local-local renders, an indented comment in the mimetype file is skipped, + types that only spell xml get no charset, the sendfile loop stops at a + short slot, slot keys and pages are read and written in full, and the + stats page stops after its error page. +* auth-file.lua refuses every repository when it cannot read its repos file, + cookie, readme and avatar parsing run in linear time, the cache hook keeps + its rm errors from pushers, the age hook leaves its directory writable to + the group, a Lua script may write while it loads, and every Lua filter + failure is named in the log. +* Git read the global config for its trace settings before cgit isolated + the environment, so every request probed $HOME/.gitconfig. +* make DEVELOPER=1 passes: string literals sit behind const pointers and + callbacks are passed by address. + + v2.8.0 (2026-09-16) ------------------- @@ -35,7 +35,7 @@ GIT_TARBALL = git-$(GIT_VERSION).tar.xz # Compiled-in cgit defaults, all overridable through cgit.conf. Every one # carries the CGIT_ prefix except CACHE_ROOT, which is inherited from upstream # under that name. -CGIT_VERSION = v2.8.0 +CGIT_VERSION = v2.9.0 CGIT_SCRIPT_NAME = cgit.cgi CGIT_SCRIPT_PATH = /var/www/htdocs/cgit CGIT_DATA_PATH = $(CGIT_SCRIPT_PATH) |