Diff options
| -rw-r--r-- | CHANGE.txt | 95 | |
| -rw-r--r-- | Makefile | 2 |
2 files changed, 96 insertions, 1 deletion
@@ -5,6 +5,101 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here. +v2.11.0 (2026-10-31) +-------------------- + +A release that cuts cgit back to a lean core. Nearly 300 commits take out dead +code, repeated logic and stale comments across the sources, the stylesheet, +the extensions, the tests and the docs, and fix the bugs found on the way. The +caches now lock with flock throughout, so read the two upgrade notes under +Changed before deploying, above all on a cache-root shared between hosts. + +Added +..... + +* tools/build-release.sh builds on macOS as well as on Linux and the BSDs. It + probes its linker flags as it already did its compiler flags, and keeps full + RELRO wherever the linker offers it. +* tools/build-development.sh uses whichever sanitizers the compiler offers, + falling back to UndefinedBehaviorSanitizer alone where AddressSanitizer is + missing, as on OpenBSD. +* make get-git fetches, checks and unpacks git's tarball with the tools each + system ships, curl, wget, fetch or ftp, and sha256sum, shasum, sha256 or + openssl, piping xz to tar where tar cannot read it. + +Changed +....... + +* The page cache and the cached repository list take the same lock, an flock + on a lock file opened close-on-exec. A request that finds a slot or the list + being rebuilt by another no longer logs "Unable to lock slot", while a real + failure to open, lock or write a lock file is logged with its path. +* Upgrade note for Linux: a scan by the old binary still running when the new + one starts holds an fcntl lock that flock does not see, so one rebuild of + the repository list can be written by two processes at once. Delete the + rc-* files under cache-root once the new binary is in place, or upgrade + while no scan runs. +* Upgrade note for NFS: on a mount with local_lock=flock or local_lock=all, + flock stays on each client, so hosts sharing one cache-root can rebuild the + same repository list at once, as the page cache always could. Give each + host a cache-root of its own on local disk. +* The command line switches --repo, --page, --head, --oid and --ofs are gone. + They were undocumented, --query covers them, and --repo never selected a + repository. +* syntax-highlight.lua colours a file only when Scintillua's detect() names a + lexer for it, and no longer guesses from the file extension. A Scintillua + without detect() leaves every file uncoloured but escaped. +* about-render.lua no longer puts a data-lang attribute on fenced code or a + manpage class on man pages, since nothing styled or read either. +* A line range such as #n10-n20 scrolls to where a single line lands, rather + than three quarters of the way down the window. +* The truncation link of a side-by-side diff is underlined like the unified + one, and the login error takes the colour of the other error messages. +* An empty repository's page no longer draws a Clone heading over no rows when + clone-url expands to nothing, which matches the summary page. +* A corrupt repository whose root tree is missing lists as empty instead of + answering 404. +* The diff page names a revision that is not a commit as the request wrote + it, and --version prints cgit in lower case. +* The test suite writes its configs through shared helpers, and its duplicate + checks are gone. + +Fixed +..... + +* The sample cgitrc placed scan-path ahead of about 30 settings that must + come before it, so uncommenting it where it stood silently dropped those + settings for every scanned repository. +* With enable-commit-graph and follow both on, the log labelled the age column + Graph and lost its Age header. +* The stats page dropped commits made on the window's first day earlier than + the time of the request. +* The stats page handed a path starting with a colon to git as pathspec + magic, which the log, patch and feed pages refuse. +* A snapshot of a repository whose url is ".git" or empty read past a buffer + while working out the snapshot's name. +* The age labels skipped every other age when they moved to a coarser unit, + leaving some stale until the next pass. +* post-receive.cgit-age printed an error and exited non-zero when it could not + write the age file. Like the other hooks it now says nothing and exits 0. +* The auth filters failed every login on Lua 5.3 and later when + session_seconds was not a whole number, and accepted a few malformed + spellings of a valid cookie. +* Filters and snapshot compressors inherited a stray copy of a cache slot's + lock, a refresh that could not take its lock went unlogged, and a slot whose + key could not be written stayed locked through the uncached render. +* On FreeBSD, NetBSD and OpenBSD the build left Lua out, because those systems + name its package lua-5.4 or lua54. +* Small leaks on the tree, refs, page header, log, snapshot and history walk + paths are closed. +* The docs stated a few defaults and behaviours wrongly. virtual-root now + reads as defaulting to SCRIPT_NAME followed by a slash, and + enable-version-info, project-list and the server configs' asset links are + described as they work. +* Two filter tests passed without their filter running, and several checks + matched text other than what they were after. + + v2.10.0 (2026-10-29) -------------------- @@ -31,7 +31,7 @@ GIT_TARBALL = git-$(GIT_VERSION).tar.xz # The defaults compiled into cgit and the directories make install writes to, # all overridable through cgit.conf. -CGIT_VERSION = v2.10.0 +CGIT_VERSION = v2.11.0 CGIT_SCRIPT_NAME = cgit.cgi CGIT_SCRIPT_PATH = /var/www/htdocs/cgit CGIT_DATA_PATH = $(CGIT_SCRIPT_PATH) |