Age	Commit message (Collapse)	Author	Lines
2026-07-19	Release v2.1.0v2.1.0	Bryce Kwon	-1/+1
2026-07-19	Keep the version fallback in shallow builds	Bryce Kwon	-2/+8
	A checkout without tags made `git describe` fail and the empty result overwrote the fallback, so CI release binaries carried no version at all. The release workflow now also fetches tags so a tag build stamps its exact version.
2026-07-19	Run CI only on branch pushes	Bryce Kwon	-1/+2
2026-07-19	Even out font sizes and drop dead styles	Bryce Kwon	-116/+47
2026-07-19	Remove the owner filter hook	Bryce Kwon	-55/+3
2026-07-19	Declutter the interface on small screens	Bryce Kwon	-36/+32
2026-07-19	Follow the theme in the external tab icon	Bryce Kwon	-3/+13
2026-07-19	Highlight and center fragment-targeted lines	Bryce Kwon	-0/+79
2026-07-19	Move syntax highlighting to a Lua source filter	Bryce Kwon	-250/+247
2026-07-19	Stat oversized diffs instead of inlining them	Bryce Kwon	-3/+130
2026-07-19	Cap and paginate the ref listings	Bryce Kwon	-14/+189
2026-07-19	Add a help page with common workflows	Bryce Kwon	-0/+182
2026-07-19	Keep line structure in plaintext readmes	Bryce Kwon	-1/+29
2026-07-19	Submit option forms without inline handlers	Bryce Kwon	-6/+34
2026-07-16	Add security and fork-behaviour regression testsv2.0.0	Bryce Kwon	-0/+113
2026-07-16	Rewrite the README for the fork as `README.txt`	Bryce Kwon	-99/+144
2026-07-16	Point the fork's links and credits at itself	Bryce Kwon	-34/+42
	AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
2026-07-16	Add a post-update hook for HTTP clones	Bryce Kwon	-0/+18
	cgit's built-in clone support speaks the dumb HTTP protocol, which serves static files that only `git update-server-info` refreshes. Without this hook a clone can miss refs pushed after the repository was created.
2026-07-16	Add example web server configurations	Bryce Kwon	-0/+477
	The wiring has real pitfalls around PATH_INFO and the link base, so these ship as working commented configs. nginx needs the fcgiwrap bridge while apache and lighttpd run the CGI directly. The security headers live here rather than in cgit because they must also cover the static assets the server serves itself.
2026-07-16	Add a commented example configuration	Bryce Kwon	-0/+548
2026-07-16	Harden the auth filter headers and session cookie	Bryce Kwon	-10/+62
	The filters signed the request url and later wrote it into a Location header, and the signing step re-encoded a newline that the verifying step decoded back, so a crafted url could smuggle CR and LF into the response. The cookie HMAC was also checked with a short-circuiting comparison and carried no SameSite attribute.
2026-07-16	Prune and rename the filter extensions	Bryce Kwon	-461/+37
	The gentoo LDAP filter is distro specific, the owner example only restates what cgit already renders, and the about converters are superseded by the built-in markdown rendering. The two auth filters do the same job and differ only in where their accounts live, so they become `auth-inline` for accounts kept in the script and `auth-file` for accounts kept on disk.
2026-07-16	Convert the commit-links filter to Lua	Bryce Kwon	-28/+27
	Lua is becoming the one language for the filter extensions, and this was the last shell filter.
2026-07-16	Drop unused config and query fields	Bryce Kwon	-7/+0
2026-07-16	Key the cache on scheme and host	Bryce Kwon	-2/+15
	Clone urls and atom links are built from the request scheme and Host, but the cache key left them out, so a request with a spoofed Host could cache a page carrying a bogus clone url and serve it to other visitors.
2026-07-16	Close the layout on stat-only diffs	Bryce Kwon	-1/+4
	The stat-only diff path returned before the closing call, so the content wrapper, footer and closing tags were never emitted.
2026-07-16	Emit `updated` on an empty atom feed	Bryce Kwon	-0/+7
	The feed-level element was written only inside the commit loop, so a feed with no commits omitted an element the atom format requires.
2026-07-16	Fix diffstat and submodule diff output	Bryce Kwon	-7/+11
	The diffstat divided by zero when a commit changed no lines, and a submodule change was printed with a hardcoded length that dropped a digit of a sha-1 and most of a sha-256.
2026-07-16	URL-encode the repolist pager links	Bryce Kwon	-2/+2
	The pager html-escaped its search and sort values instead of url-encoding them, so a term with a hash or ampersand broke the link and dropped the active filter on the next page.
2026-07-16	Bound the authenticate-post length safely	Bryce Kwon	-3/+4
	The POST length was clamped with a signed comparison, so a very large Content-Length could turn negative and slip past the limit into the fixed-size buffer.
2026-07-16	Compare repository idle times by sign	Bryce Kwon	-1/+7
	The idle-sort comparator returned a 64-bit time difference truncated to int, which could flip sign and leave the ordering inconsistent.
2026-07-16	Date repositories from HEAD and guard its branch	Bryce Kwon	-2/+27
	The index derived a repository's age from `refs/heads/master` alone, so a repository on any other default branch showed no age. HEAD is repo-controlled and the age stat walks under `refs/heads`, so a branch name carrying a parent-directory component is rejected.
2026-07-16	Respect the cgitrc order of sections	Bryce Kwon	-4/+4
	The default sorted the sections and the repositories within them by name, so the order written in the cgitrc file was ignored.
2026-07-16	Keep snapshots working under a global git config	Bryce Kwon	-1/+7
	cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a `~` in `core.excludesfile`. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot came out undecompressable.
2026-07-16	Reject option-like revisions in the log walk	Bryce Kwon	-0/+12
	The log page passed the `id` query parameter to git's revision parser without resolving it and ahead of the end-of-options marker. A value like `id=--output=/path` was then parsed as an option, so an unauthenticated request could create or truncate any file the server user could write. No valid ref or object name begins with a dash.
2026-07-16	Clamp the log offset to bound history walks	Bryce Kwon	-1/+11
	A crafted `ofs` could send cgit walking most of the history for one request.
2026-07-16	Require a boundary in the about-path prefix check	Bryce Kwon	-1/+7
	The about subpath was confined to the readme directory with a plain byte-prefix match, so a sibling directory sharing the base name as a prefix passed the check and its files were served.
2026-07-15	Build the tree line gutter in one buffer	Bryce Kwon	-2/+5
	The line-number gutter did one allocation and one write per line.
2026-07-15	Check `max-blob-size` before reading, default 10 MB	Bryce Kwon	-10/+37
	Only the tree view honoured the limit, and only after loading the whole object. The raw blob, plain, blame and readme paths now check the size before reading, and the default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole, with zero still the opt-out.
2026-07-15	Harden the blob view error paths	Bryce Kwon	-13/+27
	A blob requested by ref with an unknown path fell through to the commit object and was served with a 200 instead of a 404, two error pages passed a null pointer to a %s format when the request carried no object id, and the error pages left the layout open.
2026-07-15	Keep an overlong path out of the tab title	Bryce Kwon	-4/+15
	`fmt()` aborts the request rather than truncate, so a very long path fed into a context-sensitive tab title took down page rendering.
2026-07-15	Fix the stats year label and a missing author	Bryce Kwon	-2/+4
	The year period rendered without its label, and a commit with no author line crashed the view.
2026-07-15	Cast signed chars before ctype calls	Bryce Kwon	-6/+6
	A plain char is undefined in the ctype functions for negative values, which a high byte produces wherever char is signed.
2026-07-15	Avoid an out-of-bounds read on short scan paths	Bryce Kwon	-1/+1
	A relative path shorter than five bytes made the `/.git` suffix test read before the buffer.
2026-07-15	Bail out on a read error in `read_first_line`	Bryce Kwon	-2/+11
	`read_in_full` returns a signed -1 on error, which became SIZE_MAX once stored in the size_t length and then wrote a terminator far out of bounds.
2026-07-15	Tolerate a missing or empty repository URL	Bryce Kwon	-2/+4
	`trim_end()` returns NULL when a repo url is empty or all slashes and the later newline trim dereferenced it. The legacy `r=` and `p=about` path also read the last byte of the url without checking it was set.
2026-07-15	Clamp negative ages in the age refresher	Bryce Kwon	-0/+6
2026-07-15	Escape non-markdown readmes without a filter	Bryce Kwon	-2/+16
	A readme that is not markdown was written to the about page as raw HTML when no about-filter was configured, so an untrusted repository could inject script.
2026-07-15	Render README markdown in the browser	Bryce Kwon	-322/+313
	cgit had no markdown support of its own, so a readme was rendered through an external python filter or not at all. Escaping the source and formatting it in cgit.js keeps the work in the browser like the blob highlighter, and the page stays readable as plain text without scripting.
2026-07-15	Add built-in syntax highlighting	Bryce Kwon	-181/+247
	Highlighting previously required a source filter shelling out to something like Pygments. A configured source filter still takes precedence, every character is preserved so the line gutter stays aligned, and large files are skipped.

• [next]