1 file changed, 112 insertions, 0 deletions

diff --git a/CHANGELOG.txt b/CHANGELOG.txtindex 67b2670..bdc4690 100644--- a/CHANGELOG.txt+++ b/CHANGELOG.txt@@ -5,6 +5,118 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here.  +v2.9.0 (2026-10-17)+-------------------++A compatibility and hardening release. Lua 5.5 is supported, readmes render+closer to how GitHub shows them, the auth examples were overhauled, 32-bit+builds compile again, and two audits of the extensions and of the C code+closed what they found, from a cache lock that an exec filter let go of to+a log search that was never the literal match it claimed to be.++Added+.....++* Lua 5.5, detected when building and claimed by every extension, which+  needs luaossl 20260910 or later there.+* Stable markup hooks for site themes: a data-page attribute, named sections+  and a class per link kind.+* Readmes follow GitHub more closely: relative links lead into the tree at+  the readme's own ref, lines of a paragraph run together, a table may cut a+  paragraph short, a wrapped list item stays in its list, urls and addresses+  in angle brackets link, backslash escapes and character references are+  honoured, underscores inside words are left alone, and headings get the+  anchors GitHub gives them. Images and badges are left out.+* The auth examples bind a session to the account's password hash, so a+  changed password ends it, use a __Host- cookie where one can be set, turn+  down passwords past 256 bytes unchecked, spend a missing account's login on+  a real hash, load their libraries only when a request needs one, and say+  which hash kinds each system's crypt checks.+* Avatars are looked up by SHA-256, offered at twice the size to dense+  screens, marked decorative, and left out when luaossl is missing.+* The syntax highlighter finds a script's lexer from its shebang line.+* make get-git checks the Git tarball against the SHA-256 kernel.org lists.+* The dumb transport answers HEAD from the ref store and the index dates a+  repository from its reftable, so reftable repositories clone and age.++Changed+.......++* enable-trailers is now enable-commit-trailers.+* The bundled Git is 2.56.0.+* The pages carry no version number, and the Lua-less build is checked by+  the suite as well.+* Any path below the about page answers 404, the about filter is handed the+  tree url its links need, and the about redirect keeps the query string.+* The dumb transport serves only what a clone asks for, a loose object, a+  pack with its index and info/http-alternates, sends each file with its+  size and keeps none of them in the cache.+* A page behind an auth filter is marked private, and every page that+  follows a branch takes cache-dynamic-ttl.+* summary-branches, summary-tags and max-ref-count read a negative value as+  no limit, and the feed refuses pathspec magic as the log does.+* patch, rawdiff and signature downloads hold to max-blob-size, and a+  readme past it says so on the about page.+* Diffs no longer ask xdiff for a minimal result, which cost quadratic time+  on a reordered file, and tar.xz snapshots are compressed on one thread.+* The cache slot lock is an flock, which outlasts an exec filter's swap of+  stdout where the record lock did not.+* Git is built without translations or Tcl, the release script builds with+  the compiler it probed, the two builds no longer share vendor/git at once,+  sparse checks the sources as gnu17, and a musl build is documented.+* The example tracker links in link-commits.lua and link-trailers.lua ship+  commented out, so an unedited copy links object names alone.+* The manual, README and sample cgitrc say what the code does: every page+  and query parameter, every file make install puts in place, the defaults+  and value syntax, and which filters get the repository variables.++Fixed+.....++* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.+* The log search matched as a regular expression after all, so a term with+  a bracket in it answered a 500 and a crafted one took the memory of the+  box.+* A pushed date or zone outside what git's date code accepts, and a notes+  ref pointing at anything but a tree, ended the summary, refs, log, commit+  and feed pages of the repository.+* A snapshot name led to a branch spelled like the tag's stem, members+  of a snapshot named by its suffix alone started at a slash, and a missing+  PATH refused every compressed snapshot.+* The plain view answered twice for duplicate tree entries and read a freed+  mimetype on the way, a control byte in a file name made the web server+  refuse the download, a scanned defbranch could name a path outside the+  repository, and the error page resolved the very id it had refused.+* A fill whose last flush failed to write, on a full disk for one, left the+  visitor a blank response, a cache ttl in the tens of millions of minutes+  overflowed, and an empty list reached qsort as a null, which glibc's+  sanitizer build aborted on.+* Links built from the repository url and the feed link's branch were not+  encoded, a readme vanished behind an annotated tag, a followed log lost+  its root commit and paged by the wrong name, a Lua build crashed when git+  wrote before cgit's own setup, text was cut inside a multibyte character,+  and the tag page offered snapshots of trees and blobs.+* An absolute symlink target was linked as a path inside the tree, a chain+  of single directories ended in a dangling separator, a repository without+  a path was dated from a file named "(null)", a NUL ended a config comment+  early, and a tree row was left open when a link target could not be read.+* An empty repo.url is ignored, a readme ending in a colon is gated like a+  path on disk, an error mid capture keeps its message, date-format=+  local-local renders, an indented comment in the mimetype file is skipped,+  types that only spell xml get no charset, the sendfile loop stops at a+  short slot, slot keys and pages are read and written in full, and the+  stats page stops after its error page.+* auth-file.lua refuses every repository when it cannot read its repos file,+  cookie, readme and avatar parsing run in linear time, the cache hook keeps+  its rm errors from pushers, the age hook leaves its directory writable to+  the group, a Lua script may write while it loads, and every Lua filter+  failure is named in the log.+* Git read the global config for its trace settings before cgit isolated+  the environment, so every request probed $HOME/.gitconfig.+* make DEVELOPER=1 passes: string literals sit behind const pointers and+  callbacks are passed by address.++ v2.8.0 (2026-09-16) ------------------- 
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 67b2670..bdc4690 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -5,6 +5,118 @@ Notable changes to this fork, newest release first. History before v2.0.0
 belongs to upstream cgit and is not covered here.
 
 
+v2.9.0 (2026-10-17)
+-------------------
+
+A compatibility and hardening release. Lua 5.5 is supported, readmes render
+closer to how GitHub shows them, the auth examples were overhauled, 32-bit
+builds compile again, and two audits of the extensions and of the C code
+closed what they found, from a cache lock that an exec filter let go of to
+a log search that was never the literal match it claimed to be.
+
+Added
+.....
+
+* Lua 5.5, detected when building and claimed by every extension, which
+  needs luaossl 20260910 or later there.
+* Stable markup hooks for site themes: a data-page attribute, named sections
+  and a class per link kind.
+* Readmes follow GitHub more closely: relative links lead into the tree at
+  the readme's own ref, lines of a paragraph run together, a table may cut a
+  paragraph short, a wrapped list item stays in its list, urls and addresses
+  in angle brackets link, backslash escapes and character references are
+  honoured, underscores inside words are left alone, and headings get the
+  anchors GitHub gives them. Images and badges are left out.
+* The auth examples bind a session to the account's password hash, so a
+  changed password ends it, use a __Host- cookie where one can be set, turn
+  down passwords past 256 bytes unchecked, spend a missing account's login on
+  a real hash, load their libraries only when a request needs one, and say
+  which hash kinds each system's crypt checks.
+* Avatars are looked up by SHA-256, offered at twice the size to dense
+  screens, marked decorative, and left out when luaossl is missing.
+* The syntax highlighter finds a script's lexer from its shebang line.
+* make get-git checks the Git tarball against the SHA-256 kernel.org lists.
+* The dumb transport answers HEAD from the ref store and the index dates a
+  repository from its reftable, so reftable repositories clone and age.
+
+Changed
+.......
+
+* enable-trailers is now enable-commit-trailers.
+* The bundled Git is 2.56.0.
+* The pages carry no version number, and the Lua-less build is checked by
+  the suite as well.
+* Any path below the about page answers 404, the about filter is handed the
+  tree url its links need, and the about redirect keeps the query string.
+* The dumb transport serves only what a clone asks for, a loose object, a
+  pack with its index and info/http-alternates, sends each file with its
+  size and keeps none of them in the cache.
+* A page behind an auth filter is marked private, and every page that
+  follows a branch takes cache-dynamic-ttl.
+* summary-branches, summary-tags and max-ref-count read a negative value as
+  no limit, and the feed refuses pathspec magic as the log does.
+* patch, rawdiff and signature downloads hold to max-blob-size, and a
+  readme past it says so on the about page.
+* Diffs no longer ask xdiff for a minimal result, which cost quadratic time
+  on a reordered file, and tar.xz snapshots are compressed on one thread.
+* The cache slot lock is an flock, which outlasts an exec filter's swap of
+  stdout where the record lock did not.
+* Git is built without translations or Tcl, the release script builds with
+  the compiler it probed, the two builds no longer share vendor/git at once,
+  sparse checks the sources as gnu17, and a musl build is documented.
+* The example tracker links in link-commits.lua and link-trailers.lua ship
+  commented out, so an unedited copy links object names alone.
+* The manual, README and sample cgitrc say what the code does: every page
+  and query parameter, every file make install puts in place, the defaults
+  and value syntax, and which filters get the repository variables.
+
+Fixed
+.....
+
+* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.
+* The log search matched as a regular expression after all, so a term with
+  a bracket in it answered a 500 and a crafted one took the memory of the
+  box.
+* A pushed date or zone outside what git's date code accepts, and a notes
+  ref pointing at anything but a tree, ended the summary, refs, log, commit
+  and feed pages of the repository.
+* A snapshot name led to a branch spelled like the tag's stem, members
+  of a snapshot named by its suffix alone started at a slash, and a missing
+  PATH refused every compressed snapshot.
+* The plain view answered twice for duplicate tree entries and read a freed
+  mimetype on the way, a control byte in a file name made the web server
+  refuse the download, a scanned defbranch could name a path outside the
+  repository, and the error page resolved the very id it had refused.
+* A fill whose last flush failed to write, on a full disk for one, left the
+  visitor a blank response, a cache ttl in the tens of millions of minutes
+  overflowed, and an empty list reached qsort as a null, which glibc's
+  sanitizer build aborted on.
+* Links built from the repository url and the feed link's branch were not
+  encoded, a readme vanished behind an annotated tag, a followed log lost
+  its root commit and paged by the wrong name, a Lua build crashed when git
+  wrote before cgit's own setup, text was cut inside a multibyte character,
+  and the tag page offered snapshots of trees and blobs.
+* An absolute symlink target was linked as a path inside the tree, a chain
+  of single directories ended in a dangling separator, a repository without
+  a path was dated from a file named "(null)", a NUL ended a config comment
+  early, and a tree row was left open when a link target could not be read.
+* An empty repo.url is ignored, a readme ending in a colon is gated like a
+  path on disk, an error mid capture keeps its message, date-format=
+  local-local renders, an indented comment in the mimetype file is skipped,
+  types that only spell xml get no charset, the sendfile loop stops at a
+  short slot, slot keys and pages are read and written in full, and the
+  stats page stops after its error page.
+* auth-file.lua refuses every repository when it cannot read its repos file,
+  cookie, readme and avatar parsing run in linear time, the cache hook keeps
+  its rm errors from pushers, the age hook leaves its directory writable to
+  the group, a Lua script may write while it loads, and every Lua filter
+  failure is named in the log.
+* Git read the global config for its trace settings before cgit isolated
+  the environment, so every request probed $HOME/.gitconfig.
+* make DEVELOPER=1 passes: string literals sit behind const pointers and
+  callbacks are passed by address.
+
+
 v2.8.0 (2026-09-16)
 -------------------