Diff options
Diffstat (limited to 'CHANGE.txt')
| -rw-r--r-- | CHANGE.txt | 103 |
1 file changed, 103 insertions, 0 deletions
@@ -5,6 +5,109 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here. +v2.12.0 (2026-11-07) +-------------------- + +A usability release. The README gains a quick start, cgit warns about more +config mistakes, the pages are easier to use by keyboard and screen reader +without looking any different, and an audit closed the bugs it found, from diffs +that showed a renamed file added whole to avatar icons that leaked the page's +url. The server configs shrink to short generic drop-ins and the scan cache +starts afresh, so read the two upgrade notes under Changed before deploying. + +Added +..... + +* README has a quick start, the packages the build needs, a map of the source + tree, how to check a setup from a shell, and the options renamed since + upstream cgit. +* MANUAL has a contents list, and its entries say what 0 and negative values + do, which global settings a repository can override, which settings have to + come before scan-path, what the log's count columns cost and when a + commit-graph file speeds up the log. +* cgit logs a warning naming the file and line, or the path, for a cgitrc or + include it cannot read, a word where a setting expects a number, a snapshot + format name that matches nothing and a repository that will not open. +* The login form says when logins are unavailable, when a signed-in visitor + has no access to the repository and when the page is not served over https. + The auth filters log a failed login with the name but never the password, + and every extension logs a Lua module it falls back without. +* The server configs show HTTPS and smart HTTP clone and push through + git-http-backend as commented examples. +* A repository listed in cgitrc without repo.desc shows the first line of its + description file, as a scanned one already did. +* The index marks its sorted column with aria-sort, a keyboard can reach and + scroll the hex dump and the stats table, and forced colours mark the changed + lines of a side-by-side diff. + +Changed +....... + +* The server configs in custom/servers are short generic drop-ins included + from the server's own main config: an nginx server block, an Apache virtual + host and a lighttpd snippet. The standalone configs, with their compression, + catch-all hosts, security headers and per-distribution setup, are gone. +* Upgrade note: a site built on the old server configs keeps working, so + compare the new ones before replacing them. +* The cached scan is keyed on every setting the scan uses, so configs that + scan differently keep lists of their own. +* Upgrade note: the first request after upgrading scans again, and the old + rc-* files under cache-root are no longer read and can be deleted. +* scan-path lists repositories in path order, compared as case-sensitive-sort + says, rather than in the order the directory hands them back. +* A negative cache-scan-ttl keeps a scanned list for good, and a negative + cache-size turns the scan cache off along with the page cache. +* cgit.conf is read before Git's Makefile as well as after it, so a Git option + such as NO_REGEX set there takes effect. A += line in it now appends twice, + which repeats a flag but does no harm. +* A snapshot link for a ref with a slash in its name uses a dash in its place, + as in demo-release-2.0.tar.gz, and the archive unpacks into the + repository's own prefix. +* The tree view shows at most the first 64 KB of a binary file as a hex dump, + with a link to the whole file. +* Blame is offered only for regular text files within max-blob-size. +* An error page's title leads with the error, and a page pinned to a commit + names it with the page, as in "tree @ abc1234 - repo - site". +* The tag table heads its second column Commit when the repository has no + snapshot formats, and the logo's alt text is root-title. +* A protected repository's login page shows the site's description instead of + the repository's, names no owner and asks not to be indexed. +* A Lua filter's print writes where html does, so its output lands in place. + +Fixed +..... + +* The diff, rawdiff and patch of a renamed file showed it added whole. +* The patch link of a large diff between two commits led to a patch of the + newer commit alone. +* The blame page's folder crumbs, and its "^" link on lines from the commit + that created a file, led to 404 pages. +* Snapshot links for a ref with a slash in its name answered 404. +* Two configs sharing a cache-root read one scanned list, so strict-export and + trust-scan-config could leak from one to the other. The cached list also + dropped a repository's own branch-sort, module links and turned-off filters, + and wrote the description placeholder as a description. +* A negative cache-scan-ttl rescanned on every request. +* An empty repository's Atom feed was an HTML page. +* A mistyped repository url said "No repositories found", a submodule path said + "Bad object id", and a log search with no match showed an empty table. +* While the auth filters' state directory was missing, the login form came out + without fields and with its error inside an attribute. +* auth-inline.lua's docs pointed auth-filter at the copy make install + overwrites, which made protected repositories public again on the next + install, and both auth filters' docs said repository name where they match + the url. +* Avatar icons sent the page's url to Gravatar or Libravatar as the Referer. +* On phones, long ref labels, email addresses and paths pushed the page + sideways, and listing dates split at a hyphen, which also happened at + tablet width. +* about-render restarted a numbered list at 1 after a blank line or a code + block. +* robots.txt also blocked files whose names start with blame or snapshot. +* The build claimed to link a named Lua that pkg-config could not find, and + gave no reason when it left Lua out. + + v2.11.1 (2026-10-31) -------------------- |