1 file changed, 203 insertions, 0 deletions

diff --git a/CHANGELOG.txt b/CHANGELOG.txtindex 67b2670..c14bf3d 100644--- a/CHANGELOG.txt+++ b/CHANGELOG.txt@@ -5,6 +5,209 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here.  +v2.9.2 (2026-10-25)+-------------------++A polish release for narrow screens and for the finer details of the pages,+with the summary's columns lined up, a login that says when it failed and a+signed tag's signature folded away.++Added+.....++* A wrong username or password brings the login form back with a message+  saying so, where it used to come back empty. Both auth filters carry it, an+  unknown user is told the same as a wrong password, and the button now sits+  under the fields. The README names the hooks, form.login and p.login-error.+* A signed tag's signature, PGP, SSH or X.509, is folded away under the tag's+  message in details.signature, rather than printed as part of the message.+* The syntax highlighter colours CSS properties and pseudo-classes, which+  Scintillua's css lexer tags with names it had no colour for.+* Links, rows and buttons fade between colours, and the line highlight fades+  in, unless the reader asks for reduced motion.++Changed+.......++* On a narrow window the tabs stay on one row and scroll sideways with the+  active tab in view, rather than wrapping a tab or two onto a second row.+* On a narrow screen each commit detail sits under its label, and a phone+  leaves out the diffstat's file modes. The summary keeps its log counts on a+  phone, so its rows still line up.+* List rows highlight under a mouse only, so on a touch screen the last row+  tapped no longer stays highlighted.+* The logo is brighter in dark mode.+* The diffstat bars are drawn as SVG, so a strict Content Security Policy no+  longer has to allow inline styles, and the diffstat box has room inside its+  border.++Fixed+.....++* The summary's sections disagreed on how many columns its table had. With+  the default config the log and clone rows stopped short of the table's edge,+  on a phone the log rows did with any config, and the summary and refs pages+  were invalid HTML.+* A commit's branch and tag labels were joined to the last word of its subject,+  so a narrow cell broke the line before that word and stranded another.+* A download link and its signature could break across lines mid-name.+* The rule above the code on the blob and blame pages, and the line highlight,+  ended at the longest line of a short file rather than at the page's edge.+* A commit that changes no files drew an empty diffstat frame.+++v2.9.1 (2026-10-24)+-------------------++A bugfix release for the tree and blame pages, whose line numbers had drifted+away from the code since v2.0.0 in Safari and in every browser on a typical+Linux desktop, until the code sat dozens of lines below its number at the end+of a long file.++Added+.....++* A character a browser would start a new line at, though git does not, is+  shown as an escape sequence in span.escape on the tree and blame pages and+  by the syntax highlighter: a carriage return with no line feed after it, a+  vertical tab, a form feed, next line and the Unicode line and paragraph+  separators.++Changed+.......++* Patches end with the cgit version again, written as git writes its own, so+  this release signs them "cgit 2.9.1". The footer and the generator tag still+  carry no version.++Fixed+.....++* The code beside the line numbers was set in the browser's own monospace+  font, which made each of its lines a little taller than its number, by a+  pixel in Safari and on Linux, so the two columns drifted apart down every+  file.+* A lone carriage return started an extra line in every browser, and U+2028+  and U+2029 did in Safari, each pushing every later line below its number.+* The line highlight sat a pixel low, covered only the digits of each number,+  and ended at the edge of the view on a file scrolled sideways.+* Code in a readme took the browser's own monospace font, Courier in Chrome+  and Safari, rather than the theme's --font-mono.+++v2.9.0 (2026-10-17)+-------------------++A compatibility and hardening release. Lua 5.5 is supported, readmes render+closer to how GitHub shows them, the auth examples were overhauled, 32-bit+builds compile again, and two audits of the extensions and of the C code+closed what they found, from a cache lock that an exec filter let go of to+a log search that was never the literal match it claimed to be.++Added+.....++* Lua 5.5, detected when building and claimed by every extension, which+  needs luaossl 20260910 or later there.+* Stable markup hooks for site themes: a data-page attribute, named sections+  and a class per link kind.+* Readmes follow GitHub more closely: relative links lead into the tree at+  the readme's own ref, lines of a paragraph run together, a table may cut a+  paragraph short, a wrapped list item stays in its list, urls and addresses+  in angle brackets link, backslash escapes and character references are+  honoured, underscores inside words are left alone, and headings get the+  anchors GitHub gives them. Images and badges are left out.+* The auth examples bind a session to the account's password hash, so a+  changed password ends it, use a __Host- cookie where one can be set, turn+  down passwords past 256 bytes unchecked, spend a missing account's login on+  a real hash, load their libraries only when a request needs one, and say+  which hash kinds each system's crypt checks.+* Avatars are looked up by SHA-256, offered at twice the size to dense+  screens, marked decorative, and left out when luaossl is missing.+* The syntax highlighter finds a script's lexer from its shebang line.+* make get-git checks the Git tarball against the SHA-256 kernel.org lists.+* The dumb transport answers HEAD from the ref store and the index dates a+  repository from its reftable, so reftable repositories clone and age.++Changed+.......++* enable-trailers is now enable-commit-trailers.+* The bundled Git is 2.56.0.+* The pages carry no version number, and the Lua-less build is checked by+  the suite as well.+* Any path below the about page answers 404, the about filter is handed the+  tree url its links need, and the about redirect keeps the query string.+* The dumb transport serves only what a clone asks for, a loose object, a+  pack with its index and info/http-alternates, sends each file with its+  size and keeps none of them in the cache.+* A page behind an auth filter is marked private, and every page that+  follows a branch takes cache-dynamic-ttl.+* summary-branches, summary-tags and max-ref-count read a negative value as+  no limit, and the feed refuses pathspec magic as the log does.+* patch, rawdiff and signature downloads hold to max-blob-size, and a+  readme past it says so on the about page.+* Diffs no longer ask xdiff for a minimal result, which cost quadratic time+  on a reordered file, and tar.xz snapshots are compressed on one thread.+* The cache slot lock is an flock, which outlasts an exec filter's swap of+  stdout where the record lock did not.+* Git is built without translations or Tcl, the release script builds with+  the compiler it probed, the two builds no longer share vendor/git at once,+  sparse checks the sources as gnu17, and a musl build is documented.+* The example tracker links in link-commits.lua and link-trailers.lua ship+  commented out, so an unedited copy links object names alone.+* The manual, README and sample cgitrc say what the code does: every page+  and query parameter, every file make install puts in place, the defaults+  and value syntax, and which filters get the repository variables.++Fixed+.....++* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.+* The log search matched as a regular expression after all, so a term with+  a bracket in it answered a 500 and a crafted one took the memory of the+  box.+* A pushed date or zone outside what git's date code accepts, and a notes+  ref pointing at anything but a tree, ended the summary, refs, log, commit+  and feed pages of the repository.+* A snapshot name led to a branch spelled like the tag's stem, members+  of a snapshot named by its suffix alone started at a slash, and a missing+  PATH refused every compressed snapshot.+* The plain view answered twice for duplicate tree entries and read a freed+  mimetype on the way, a control byte in a file name made the web server+  refuse the download, a scanned defbranch could name a path outside the+  repository, and the error page resolved the very id it had refused.+* A fill whose last flush failed to write, on a full disk for one, left the+  visitor a blank response, a cache ttl in the tens of millions of minutes+  overflowed, and an empty list reached qsort as a null, which glibc's+  sanitizer build aborted on.+* Links built from the repository url and the feed link's branch were not+  encoded, a readme vanished behind an annotated tag, a followed log lost+  its root commit and paged by the wrong name, a Lua build crashed when git+  wrote before cgit's own setup, text was cut inside a multibyte character,+  and the tag page offered snapshots of trees and blobs.+* An absolute symlink target was linked as a path inside the tree, a chain+  of single directories ended in a dangling separator, a repository without+  a path was dated from a file named "(null)", a NUL ended a config comment+  early, and a tree row was left open when a link target could not be read.+* An empty repo.url is ignored, a readme ending in a colon is gated like a+  path on disk, an error mid capture keeps its message, date-format=+  local-local renders, an indented comment in the mimetype file is skipped,+  types that only spell xml get no charset, the sendfile loop stops at a+  short slot, slot keys and pages are read and written in full, and the+  stats page stops after its error page.+* auth-file.lua refuses every repository when it cannot read its repos file,+  cookie, readme and avatar parsing run in linear time, the cache hook keeps+  its rm errors from pushers, the age hook leaves its directory writable to+  the group, a Lua script may write while it loads, and every Lua filter+  failure is named in the log.+* Git read the global config for its trace settings before cgit isolated+  the environment, so every request probed $HOME/.gitconfig, which the+  home-access test caught only once it ran on a real x86_64 kernel.+* make DEVELOPER=1 passes: string literals sit behind const pointers and+  callbacks are passed by address.++ v2.8.0 (2026-09-16) ------------------- 
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 67b2670..c14bf3d 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -5,6 +5,209 @@ Notable changes to this fork, newest release first. History before v2.0.0
 belongs to upstream cgit and is not covered here.
 
 
+v2.9.2 (2026-10-25)
+-------------------
+
+A polish release for narrow screens and for the finer details of the pages,
+with the summary's columns lined up, a login that says when it failed and a
+signed tag's signature folded away.
+
+Added
+.....
+
+* A wrong username or password brings the login form back with a message
+  saying so, where it used to come back empty. Both auth filters carry it, an
+  unknown user is told the same as a wrong password, and the button now sits
+  under the fields. The README names the hooks, form.login and p.login-error.
+* A signed tag's signature, PGP, SSH or X.509, is folded away under the tag's
+  message in details.signature, rather than printed as part of the message.
+* The syntax highlighter colours CSS properties and pseudo-classes, which
+  Scintillua's css lexer tags with names it had no colour for.
+* Links, rows and buttons fade between colours, and the line highlight fades
+  in, unless the reader asks for reduced motion.
+
+Changed
+.......
+
+* On a narrow window the tabs stay on one row and scroll sideways with the
+  active tab in view, rather than wrapping a tab or two onto a second row.
+* On a narrow screen each commit detail sits under its label, and a phone
+  leaves out the diffstat's file modes. The summary keeps its log counts on a
+  phone, so its rows still line up.
+* List rows highlight under a mouse only, so on a touch screen the last row
+  tapped no longer stays highlighted.
+* The logo is brighter in dark mode.
+* The diffstat bars are drawn as SVG, so a strict Content Security Policy no
+  longer has to allow inline styles, and the diffstat box has room inside its
+  border.
+
+Fixed
+.....
+
+* The summary's sections disagreed on how many columns its table had. With
+  the default config the log and clone rows stopped short of the table's edge,
+  on a phone the log rows did with any config, and the summary and refs pages
+  were invalid HTML.
+* A commit's branch and tag labels were joined to the last word of its subject,
+  so a narrow cell broke the line before that word and stranded another.
+* A download link and its signature could break across lines mid-name.
+* The rule above the code on the blob and blame pages, and the line highlight,
+  ended at the longest line of a short file rather than at the page's edge.
+* A commit that changes no files drew an empty diffstat frame.
+
+
+v2.9.1 (2026-10-24)
+-------------------
+
+A bugfix release for the tree and blame pages, whose line numbers had drifted
+away from the code since v2.0.0 in Safari and in every browser on a typical
+Linux desktop, until the code sat dozens of lines below its number at the end
+of a long file.
+
+Added
+.....
+
+* A character a browser would start a new line at, though git does not, is
+  shown as an escape sequence in span.escape on the tree and blame pages and
+  by the syntax highlighter: a carriage return with no line feed after it, a
+  vertical tab, a form feed, next line and the Unicode line and paragraph
+  separators.
+
+Changed
+.......
+
+* Patches end with the cgit version again, written as git writes its own, so
+  this release signs them "cgit 2.9.1". The footer and the generator tag still
+  carry no version.
+
+Fixed
+.....
+
+* The code beside the line numbers was set in the browser's own monospace
+  font, which made each of its lines a little taller than its number, by a
+  pixel in Safari and on Linux, so the two columns drifted apart down every
+  file.
+* A lone carriage return started an extra line in every browser, and U+2028
+  and U+2029 did in Safari, each pushing every later line below its number.
+* The line highlight sat a pixel low, covered only the digits of each number,
+  and ended at the edge of the view on a file scrolled sideways.
+* Code in a readme took the browser's own monospace font, Courier in Chrome
+  and Safari, rather than the theme's --font-mono.
+
+
+v2.9.0 (2026-10-17)
+-------------------
+
+A compatibility and hardening release. Lua 5.5 is supported, readmes render
+closer to how GitHub shows them, the auth examples were overhauled, 32-bit
+builds compile again, and two audits of the extensions and of the C code
+closed what they found, from a cache lock that an exec filter let go of to
+a log search that was never the literal match it claimed to be.
+
+Added
+.....
+
+* Lua 5.5, detected when building and claimed by every extension, which
+  needs luaossl 20260910 or later there.
+* Stable markup hooks for site themes: a data-page attribute, named sections
+  and a class per link kind.
+* Readmes follow GitHub more closely: relative links lead into the tree at
+  the readme's own ref, lines of a paragraph run together, a table may cut a
+  paragraph short, a wrapped list item stays in its list, urls and addresses
+  in angle brackets link, backslash escapes and character references are
+  honoured, underscores inside words are left alone, and headings get the
+  anchors GitHub gives them. Images and badges are left out.
+* The auth examples bind a session to the account's password hash, so a
+  changed password ends it, use a __Host- cookie where one can be set, turn
+  down passwords past 256 bytes unchecked, spend a missing account's login on
+  a real hash, load their libraries only when a request needs one, and say
+  which hash kinds each system's crypt checks.
+* Avatars are looked up by SHA-256, offered at twice the size to dense
+  screens, marked decorative, and left out when luaossl is missing.
+* The syntax highlighter finds a script's lexer from its shebang line.
+* make get-git checks the Git tarball against the SHA-256 kernel.org lists.
+* The dumb transport answers HEAD from the ref store and the index dates a
+  repository from its reftable, so reftable repositories clone and age.
+
+Changed
+.......
+
+* enable-trailers is now enable-commit-trailers.
+* The bundled Git is 2.56.0.
+* The pages carry no version number, and the Lua-less build is checked by
+  the suite as well.
+* Any path below the about page answers 404, the about filter is handed the
+  tree url its links need, and the about redirect keeps the query string.
+* The dumb transport serves only what a clone asks for, a loose object, a
+  pack with its index and info/http-alternates, sends each file with its
+  size and keeps none of them in the cache.
+* A page behind an auth filter is marked private, and every page that
+  follows a branch takes cache-dynamic-ttl.
+* summary-branches, summary-tags and max-ref-count read a negative value as
+  no limit, and the feed refuses pathspec magic as the log does.
+* patch, rawdiff and signature downloads hold to max-blob-size, and a
+  readme past it says so on the about page.
+* Diffs no longer ask xdiff for a minimal result, which cost quadratic time
+  on a reordered file, and tar.xz snapshots are compressed on one thread.
+* The cache slot lock is an flock, which outlasts an exec filter's swap of
+  stdout where the record lock did not.
+* Git is built without translations or Tcl, the release script builds with
+  the compiler it probed, the two builds no longer share vendor/git at once,
+  sparse checks the sources as gnu17, and a musl build is documented.
+* The example tracker links in link-commits.lua and link-trailers.lua ship
+  commented out, so an unedited copy links object names alone.
+* The manual, README and sample cgitrc say what the code does: every page
+  and query parameter, every file make install puts in place, the defaults
+  and value syntax, and which filters get the repository variables.
+
+Fixed
+.....
+
+* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.
+* The log search matched as a regular expression after all, so a term with
+  a bracket in it answered a 500 and a crafted one took the memory of the
+  box.
+* A pushed date or zone outside what git's date code accepts, and a notes
+  ref pointing at anything but a tree, ended the summary, refs, log, commit
+  and feed pages of the repository.
+* A snapshot name led to a branch spelled like the tag's stem, members
+  of a snapshot named by its suffix alone started at a slash, and a missing
+  PATH refused every compressed snapshot.
+* The plain view answered twice for duplicate tree entries and read a freed
+  mimetype on the way, a control byte in a file name made the web server
+  refuse the download, a scanned defbranch could name a path outside the
+  repository, and the error page resolved the very id it had refused.
+* A fill whose last flush failed to write, on a full disk for one, left the
+  visitor a blank response, a cache ttl in the tens of millions of minutes
+  overflowed, and an empty list reached qsort as a null, which glibc's
+  sanitizer build aborted on.
+* Links built from the repository url and the feed link's branch were not
+  encoded, a readme vanished behind an annotated tag, a followed log lost
+  its root commit and paged by the wrong name, a Lua build crashed when git
+  wrote before cgit's own setup, text was cut inside a multibyte character,
+  and the tag page offered snapshots of trees and blobs.
+* An absolute symlink target was linked as a path inside the tree, a chain
+  of single directories ended in a dangling separator, a repository without
+  a path was dated from a file named "(null)", a NUL ended a config comment
+  early, and a tree row was left open when a link target could not be read.
+* An empty repo.url is ignored, a readme ending in a colon is gated like a
+  path on disk, an error mid capture keeps its message, date-format=
+  local-local renders, an indented comment in the mimetype file is skipped,
+  types that only spell xml get no charset, the sendfile loop stops at a
+  short slot, slot keys and pages are read and written in full, and the
+  stats page stops after its error page.
+* auth-file.lua refuses every repository when it cannot read its repos file,
+  cookie, readme and avatar parsing run in linear time, the cache hook keeps
+  its rm errors from pushers, the age hook leaves its directory writable to
+  the group, a Lua script may write while it loads, and every Lua filter
+  failure is named in the log.
+* Git read the global config for its trace settings before cgit isolated
+  the environment, so every request probed $HOME/.gitconfig, which the
+  home-access test caught only once it ran on a real x86_64 kernel.
+* make DEVELOPER=1 passes: string literals sit behind const pointers and
+  callbacks are passed by address.
+
+
 v2.8.0 (2026-09-16)
 -------------------