Age	Commit message (Collapse)	Author	Lines
3 days	Say where the commit-filter applies	Bryce Kwon	-1/+2
3 days	Say that an about page needs a readme line	Bryce Kwon	-2/+3
	Without one a repository has no about tab and its about url redirects to the summary, so a site that sets only about-filter never sees the renderer run.
4 days	Say which trailers the shipped filter links	Bryce Kwon	-2/+3
	link-trailers.lua has shipped its Closes and Bug rules commented out since b4e780a, as they need a tracker address, but both docs still promised those links.
5 days	Suggest a Markdown file for root-readme	Bryce Kwon	-3/+4
5 days	Warn that a repository listed twice shows twice	Bryce Kwon	-0/+2
5 days	Say strict-export applies only to a scan	Bryce Kwon	-1/+1
5 days	State once that cgitrc is read in order	Bryce Kwon	-0/+4
	The rule was written down only under scan-path, so a setting such as enable-blame=1 added at the end of cgitrc silently did nothing.
5 days	List a theme after cgit.css	Bryce Kwon	-3/+5
	Any css or js line replaces the default rather than adding to it, so a theme set with a single css line, as the README implied, left every page unstyled.
7 days	Say the auth filters match a repository's url	Bryce Kwon	-4/+5
	A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public.
7 days	Say where an edited auth filter belongs	Bryce Kwon	-2/+5
	make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user.
8 days	Describe a negative section-from-path in cgitrc	Bryce Kwon	-2/+3
8 days	Correct two fallbacks the sample config states	Bryce Kwon	-3/+3
	cgit_snapshot_prefix falls back to the basename of the repository url, and print_object sends a binary blob as application/octet-stream.
8 days	Point the source-filter sample at its notes	Bryce Kwon	-3/+2
8 days	Write five compound terms one way in the docs	Bryce Kwon	-2/+2
	Each takes the form its option name or most of the prose already uses, as in case-sensitive-sort and side-by-side-diffs.
8 days	Spell HTML in capitals as most of the docs do	Bryce Kwon	-1/+1
	The head section loses its capitals too, since HEAD elsewhere in the manual is git's.
8 days	Spell url the way the tree mostly does	Bryce Kwon	-1/+1
	Names keep their own spelling, so the URL trailer and CGIT_REPO_URL stay in capitals.
10 days	Rewrap the max-ref-count comment	Bryce Kwon	-2/+1
10 days	Spell customisation and uncoloured the British way	Bryce Kwon	-1/+2
10 days	Leave the filter prefixes to the filter preamble	Bryce Kwon	-12/+7
	The preamble above the filters explains lua: and exec:, and the repo.* filter entries already read "Value is a command."
10 days	Say minutes once in the cache ttl comments	Bryce Kwon	-12/+9
10 days	Drop the filter note from the cgitrc header	Bryce Kwon	-4/+0
	The filter section names about-render.lua and the source-filter itself.
10 days	Name the guarded settings in one place	Bryce Kwon	-5/+4
10 days	Say each css and js line holds one url	Bryce Kwon	-3/+3
10 days	Say which versions enable-version-info names	Bryce Kwon	-4/+3
	Only the footer carries the git version. The reason the versions stay out by default is left to MANUAL, which already gives it.
10 days	Document virtual-root's default of SCRIPT_NAME	Bryce Kwon	-2/+2
	cgit falls back to SCRIPT_NAME followed by a slash when virtual-root is unset, so its links always take the path form and none take the ?url= form the docs described.
10 days	Move scan-path below the settings it inherits	Bryce Kwon	-4/+5
	The quick start says to uncomment scan-path, and in its old place a scanned repository missed every setting below it, among them the filters, the snapshots and the enable flags.
12 days	Offer the versions as an option	Bryce Kwon	-0/+6
	enable-version-info brings back the cgit and git versions that 872bd7c took off the footer and the generator tag, for a site that wants them, and the version f7d2b83 put on the signature of patches now follows it too. It stays off by default for the reason 872bd7c gave.
13 days	Load the scripts with defer	Bryce Kwon	-2/+3
	A plain script in the head held up parsing until it had downloaded and run, though cgit.js only acts once the document is ready. Deferred scripts still run in the order given and before DOMContentLoaded, so a site script after cgit.js can still call window.cgit.
2026-10-10	Read a negative ref count as no limit	Bryce Kwon	-4/+6
	summary-branches, summary-tags and max-ref-count already listed every ref at 0, but a negative value reached qsort as a count and crashed the summary and refs pages, and emptied the branch switcher.
2026-10-03	Say blame gets the source filter and line numbers	Bryce Kwon	-6/+6
2026-10-03	Name every trailer link-trailers.lua links	Bryce Kwon	-3/+3
2026-10-03	Fix the sample cgitrc's defaults and value syntax	Bryce Kwon	-13/+16
2026-10-03	Describe root-readme as the site's about page	Bryce Kwon	-5/+5
2026-10-02	Name the log link that enable-index-links adds	Bryce Kwon	-1/+1
	The manual has named the commit page since it was written in 2008, a year after the index started linking the log instead.
2026-09-22	Stop caching clone files and oversized responses	Bryce Kwon	-0/+5
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. cache-max-slot-size, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
2026-09-22	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+3
	enable-html-serving makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without trust-scan-config and run script against every visitor. The warning for a key read from git config also named a null repository, because repo->path was set only after that file had been read.
2026-09-21	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-11/+12
2026-09-15	Unify the docs, samples and extensions	Bryce Kwon	-133/+139
2026-09-14	Harden the request path, scan and error recovery	Bryce Kwon	-6/+6
2026-09-12	Gate scanned filters with trust-scan-filters	Bryce Kwon	-18/+16
2026-09-12	Apply the mailmap at HEAD to every ident	Bryce Kwon	-0/+9
2026-09-12	Split trailers out of the commit message	Bryce Kwon	-0/+19
2026-09-07	Clean up the whole tree	Bryce Kwon	-4/+3
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-74/+28
2026-09-05	Rename the inconsistent config keys	Bryce Kwon	-117/+126
	The old spellings are no longer read. enable-header and enable-plain-email take the opposite value of the noheader and noplainemail they replace.
2026-08-27	Remove the language breakdown from the stats page	Bryce Kwon	-2/+2
2026-08-19	Document cache directory ownership	Bryce Kwon	-1/+3
2026-08-12	Remove the repository homepage feature	Bryce Kwon	-3/+0
2026-08-01	Add enable-relative-dates and date-format	Bryce Kwon	-0/+9
2026-07-31	Drop the help tab and its built-in guide	Bryce Kwon	-4/+0