Age	Commit message (Collapse)	Author	Lines
9 days	Keep the version numbers off the pagesHEADmain	Bryce Kwon	-14/+7
	The generator meta, the footer and the patch signature named the exact cgit and git versions on every response, which only helps someone matching a site against an advisory. The shipped server configs already hide the server's own version for the same reason, and `cgit --version` still answers on the host.
9 days	Mark a page behind an auth filter private	Bryce Kwon	-14/+42
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
9 days	Pin the advisory classes with tests and name an empty author	Bryce Kwon	-6/+120
	Each class behind cgit's published advisories now has a check against the current code, from a newline in a file name to shell syntax handed to a filter. The feed also treated an ident with an empty name and an empty address as present and wrote an empty person, which Atom forbids.
9 days	End a request quietly when the client has gone	Bryce Kwon	-4/+50
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
9 days	Send a charset only with a text type	Bryce Kwon	-15/+19
	Archives, packs and the HEAD file went out as octet-stream or gzip with a UTF-8 charset on the end, since only the blob page cleared it. The headers now decide from the type itself, so the two places that cleared the charset by hand no longer need to.
9 days	Word the blob size and binary errors alike	Bryce Kwon	-11/+7
	The four pages that refuse a blob over max-blob-size each said it in their own way, two of them in lower case, and the blame page ended its binary notice with a full stop no other error carries.
9 days	Leave a branch spelled like an option out of the switcher	Bryce Kwon	-0/+11
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
9 days	Replace the stray bytes of text that is not UTF-8	Bryce Kwon	-43/+99
	A commit whose encoding header names something iconv cannot convert, or whose text is labelled UTF-8 without being it, reached a page declared UTF-8 with its bytes untouched. The atom feed already replaced them, so its UTF-8 reader moves to shared.c and every ident, subject, message and tag text passes through it.
9 days	Walk a path on the blob page from any commit the id names	Bryce Kwon	-8/+29
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
9 days	Keep the query string across the about redirects	Bryce Kwon	-12/+68
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
9 days	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+21
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
9 days	Limit rawdiff to the requested path	Bryce Kwon	-13/+35
	The diff and patch pages honour the path in the url, which the parameter table documents for every page, but rawdiff never handed it to git and answered with the whole diff.
9 days	Send a clone file with its size in whole batches	Bryce Kwon	-4/+33
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
9 days	Keep clone files and oversized responses out of the cache	Bryce Kwon	-15/+124
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
9 days	Keep the builder's home directory out of the binary	Bryce Kwon	-2/+11
	Git's Makefile defaults `prefix` to `$HOME` and compiles it into `exec-cmd.o` as the fallback runtime prefix, so each build embedded the path of whoever ran it and no two builders could produce the same bytes. The release script also maps the build directory out of the debug info, which otherwise differs between checkouts.
9 days	Gate html serving behind trust-scan-config	Bryce Kwon	-24/+67
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
9 days	Keep the Lua-less build compiling	Bryce Kwon	-2/+81
	`cgit_abort_filters` unhooks the Lua write interposer under NO_LUA too, where neither the hook nor its state exists, so `make NO_LUA=1` and the default mode of `tools/release-build.sh` have not compiled since the die path learned to take stdout back from a filter. The suite now builds that variant into `build/nolua` and runs it, and a `lua:` filter in such a build is refused with a message naming the cause instead of an unknown filter type.
13 days	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-52/+53
2026-09-26	Add stable markup hooks for site themes	Bryce Kwon	-174/+398
2026-09-22	Release v2.8.0v2.8.0	Bryce Kwon	-3/+57
2026-09-22	Align with spaces instead of tabs	Bryce Kwon	-58/+62
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-472/+468
2026-09-21	Test the hardening pass	Bryce Kwon	-30/+501
2026-09-21	Harden the page renderers	Bryce Kwon	-350/+658
2026-09-21	Harden the request path, scan and error recovery	Bryce Kwon	-223/+564
2026-09-21	Answer 404 for a repository whose path is missing	Bryce Kwon	-8/+29
2026-09-21	Link builds reproducibly	Bryce Kwon	-0/+4
2026-09-21	Read the encoding header without its newline	Bryce Kwon	-1/+1
	The newline made the charset name unknown to the converter, so a message in another charset was left unconverted.
2026-09-21	Read every query parameter	Bryce Kwon	-1/+3
	A parameter without a value swallowed the parameter after it.
2026-09-21	Log a cache slot that cannot be published	Bryce Kwon	-2/+14
2026-09-21	Fail cleanly when a filter cannot run	Bryce Kwon	-5/+20
	A filter program that could not be run answered with two responses, and a filter that exited without reading its input ended cgit with the page half written.
2026-09-21	Name the tagged object under its full id	Bryce Kwon	-47/+55
2026-09-15	Keep the hash rows out of the column widths	Bryce Kwon	-8/+20
2026-09-15	Gate scanned filters with `trust-scan-filters`	Bryce Kwon	-81/+99
2026-09-15	Map trailer idents and print bare lines as written	Bryce Kwon	-22/+57
2026-09-15	Apply the mailmap at HEAD to every ident	Bryce Kwon	-8/+153
2026-09-15	Add the link-trailers extension	Bryce Kwon	-0/+245
2026-09-15	Split trailers out of the commit message	Bryce Kwon	-7/+315
2026-09-15	Lay the tag table out like the commit table	Bryce Kwon	-32/+93
2026-09-08	Release v2.7.1v2.7.1	Bryce Kwon	-1/+15
2026-09-08	Settle the snapshot v-prefix from the tag list	Bryce Kwon	-8/+69
	`compose_snapshot_prefix` dropped the leading v of a tag only when just one of the names 1.2, v1.2 and V1.2 resolved as a tag, so that the shorter snapshot name could always be traced back to one tag. Those probes went through ref lookups, and on a case-insensitive filesystem a lookup for V1.2 finds the loose file of v1.2, so every freshly made tag counted as ambiguous and kept its v. Once git packed the refs the lookups became exact and the same tag quietly changed its snapshot names. The claimants on a stripped name are now counted over the tag list itself with exact string comparison, so the answer no longer depends on how a ref is stored or on the filesystem underneath. Two tags that really differ only by the letter's case still both keep it.
2026-09-08	Release v2.7.0v2.7.0	Bryce Kwon	-11/+58
2026-09-06	Clean up the whole tree	Bryce Kwon	-1317/+762
2026-09-06	Harden the lua filter failure paths	Bryce Kwon	-5/+31
2026-09-06	Give the login inputs explicit field types	Bryce Kwon	-3/+4
2026-09-06	Refresh the server configs and drop `unsafe-inline`	Bryce Kwon	-96/+87
	The inline handlers and the auto-submitting selects are gone, so `script-src` no longer needs it, and t0004 now checks that the three configs pin the same policy.
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-942/+652
2026-09-06	Remove the auto-submitting selects	Bryce Kwon	-37/+16
2026-09-06	Remove the theme toggle	Bryce Kwon	-163/+13
2026-09-06	Extend the html validity checks	Bryce Kwon	-1/+26

• [next]