Diff options
Diffstat (limited to '')
| -rw-r--r-- | CHANGE.txt | 197 |
1 file changed, 197 insertions, 0 deletions
@@ -5,6 +5,203 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here. +v2.11.1 (2026-10-31) +-------------------- + +A bugfix release for v2.11.0, which crashed on the log and summary pages of +any repository with enable-mailmap on. + +Fixed +..... + +* The log and summary pages of a repository with enable-mailmap on crashed, + as releasing the walk also freed the mailmap cgit keeps for the whole + request. The patch and stats pages could free memory twice when git failed + to start their walk. +* The syntax highlighter left a file whose extension is in capitals, such as + MAIN.C, without colour. +* A page served uncached because its cache slot could not be written showed + its title twice. +* A scan logged "Unable to read the owner" with "Success" as the reason for + each repository whose owner has no passwd entry. +* tools/build-development.sh probed the compiler named by CC for sanitizers + but built with cc, and tools/build-release.sh left its probe files behind + in the temporary directory. +* Some tests with an exec filter failed now and then, depending on whether + cgit or the filter ran first. + + +v2.11.0 (2026-10-31) +-------------------- + +A release that cuts cgit back to a lean core. Nearly 300 commits take out dead +code, repeated logic and stale comments across the sources, the stylesheet, +the extensions, the tests and the docs, and fix the bugs found on the way. The +caches now lock with flock throughout, so read the two upgrade notes under +Changed before deploying, above all on a cache-root shared between hosts. + +Added +..... + +* tools/build-release.sh builds on macOS as well as on Linux and the BSDs. It + probes its linker flags as it already did its compiler flags, and keeps full + RELRO wherever the linker offers it. +* tools/build-development.sh uses whichever sanitizers the compiler offers, + falling back to UndefinedBehaviorSanitizer alone where AddressSanitizer is + missing, as on OpenBSD. +* make get-git fetches, checks and unpacks git's tarball with the tools each + system ships, curl, wget, fetch or ftp, and sha256sum, shasum, sha256 or + openssl, piping xz to tar where tar cannot read it. + +Changed +....... + +* The page cache and the cached repository list take the same lock, an flock + on a lock file opened close-on-exec. A request that finds a slot or the list + being rebuilt by another no longer logs "Unable to lock slot", while a real + failure to open, lock or write a lock file is logged with its path. +* Upgrade note for Linux: a scan by the old binary still running when the new + one starts holds an fcntl lock that flock does not see, so one rebuild of + the repository list can be written by two processes at once. Delete the + rc-* files under cache-root once the new binary is in place, or upgrade + while no scan runs. +* Upgrade note for NFS: on a mount with local_lock=flock or local_lock=all, + flock stays on each client, so hosts sharing one cache-root can rebuild the + same repository list at once, as the page cache always could. Give each + host a cache-root of its own on local disk. +* The command line switches --repo, --page, --head, --oid and --ofs are gone. + They were undocumented, --query covers them, and --repo never selected a + repository. +* syntax-highlight.lua colours a file only when Scintillua's detect() names a + lexer for it, and no longer guesses from the file extension. A Scintillua + without detect() leaves every file uncoloured but escaped. +* about-render.lua no longer puts a data-lang attribute on fenced code or a + manpage class on man pages, since nothing styled or read either. +* A line range such as #n10-n20 scrolls to where a single line lands, rather + than three quarters of the way down the window. +* The truncation link of a side-by-side diff is underlined like the unified + one, and the login error takes the colour of the other error messages. +* An empty repository's page no longer draws a Clone heading over no rows when + clone-url expands to nothing, which matches the summary page. +* A corrupt repository whose root tree is missing lists as empty instead of + answering 404. +* The diff page names a revision that is not a commit as the request wrote + it, and --version prints cgit in lower case. +* The test suite writes its configs through shared helpers, and its duplicate + checks are gone. + +Fixed +..... + +* The sample cgitrc placed scan-path ahead of about 30 settings that must + come before it, so uncommenting it where it stood silently dropped those + settings for every scanned repository. +* With enable-commit-graph and follow both on, the log labelled the age column + Graph and lost its Age header. +* The stats page dropped commits made on the window's first day earlier than + the time of the request. +* The stats page handed a path starting with a colon to git as pathspec + magic, which the log, patch and feed pages refuse. +* A snapshot of a repository whose url is ".git" or empty read past a buffer + while working out the snapshot's name. +* The age labels skipped every other age when they moved to a coarser unit, + leaving some stale until the next pass. +* post-receive.cgit-age printed an error and exited non-zero when it could not + write the age file. Like the other hooks it now says nothing and exits 0. +* The auth filters failed every login on Lua 5.3 and later when + session_seconds was not a whole number, and accepted a few malformed + spellings of a valid cookie. +* Filters and snapshot compressors inherited a stray copy of a cache slot's + lock, a refresh that could not take its lock went unlogged, and a slot whose + key could not be written stayed locked through the uncached render. +* On FreeBSD, NetBSD and OpenBSD the build left Lua out, because those systems + name its package lua-5.4 or lua54. +* Small leaks on the tree, refs, page header, log, snapshot and history walk + paths are closed. +* The docs stated a few defaults and behaviours wrongly. virtual-root now + reads as defaulting to SCRIPT_NAME followed by a slash, and + enable-version-info, project-list and the server configs' asset links are + described as they work. +* Two filter tests passed without their filter running, and several checks + matched text other than what they were after. + + +v2.10.0 (2026-10-29) +-------------------- + +A release that squares off the interface and brings its colours up to WCAG +AA, with a readme renderer that copes with more of what projects ship and an +example hook that keeps the commit-graph current. + +Added +..... + +* enable-version-info, off by default, puts cgit's version in the footer, the + generator tag and the signature of patches, with git's beside it in the + footer. +* custom/hooks/post-receive.commit-graph writes the commit-graph and its + changed path filters after each push, which speeds up the log, blame and + graph pages and any log limited to one file. +* The readme renderer makes a heading of a paragraph underlined with equals + signs or dashes, starts a code block at four spaces or a tab, and keeps an + escaped pipe inside its table cell. +* tools/build-development.sh builds cgit for debugging, unoptimised and held + to git's developer warnings, with AddressSanitizer and + UndefinedBehaviorSanitizer linked in. With clang and ctags it also leaves a + compilation database and a tags file in build/. + +Changed +....... + +* Controls, tabs and labels have square corners. The radius tokens stay, set + to zero, so a theme can still round them. +* Every text colour reaches 4.5:1 on the backgrounds it sits on, row stripes + included, and links inside running text are underlined. +* Form controls have a border of 3:1 contrast, and every link and control + shows the same focus ring. +* Every framed box and table grid has the same mid grey border. +* The diff and stat options panel has its caption as a header strip, with + the selects and the button sharing one column. +* Page titles name the page first, then the repository and the site, so + tabs, history and search results can tell the pages apart. +* A signed tag's signature prints as part of its message again, as it did up + to v2.9.1, rather than folded away. +* The syntax highlight colours are tokens, so a theme can change them like + the rest. +* The scripts load with defer. A site script placed after cgit.js can still + call window.cgit. +* The post-receive.cgit-cache hook drops only the pushed repository's pages + and the index. It finds the repository's url from scan-path or + hooks.cgiturl, and clears everything as before when it has neither. +* The example server configs name the release they were written for, nginx + 1.30, Apache httpd 2.4 and lighttpd 1.4. +* tools/release-build.sh is now tools/build-release.sh, and CHANGELOG.txt is + now CHANGE.txt. + +Fixed +..... + +* A long hash or download name made the whole page scroll sideways on a + phone. Both may now break. +* A readme holding a NUL byte lost everything after it. Each NUL now shows as + U+FFFD. +* A markdown link opening with a mix of slashes and backslashes, which a + browser follows to another site, now renders as text, as one opening with + two slashes already did. +* Man pages written by DocBook, pod2man or by hand leaked roff onto the page. + Their escapes, comments and preambles now draw nothing, the common named + characters render, and .EX, .Vb, .TP and the alternating font macros lay + out as intended. +* In forced colours, such as a Windows high contrast theme, the active tab + and the lines a URL names had no mark. They now take the reader's Highlight + colour. +* A screen reader announced the graph and links columns with no name. +* The commit page offered diff options for an octopus merge, which draws no + diff. +* Error text such as "Path not found" sat further in than the rest of the + page. + + v2.9.2 (2026-10-25) ------------------- |