Age	Commit message (Collapse)	Author	Lines
15 hours	Say what really differs between the auth filters	Bryce Kwon	-6/+8
	The lookups were never the only difference, since the configuration and trim's place differ as well. The configuration is now set off by blank lines, as in the other extensions, instead of a heading.
15 hours	Drop auth guards for input cgit never sends	Bryce Kwon	-18/+6
	cgit names no repository with an empty string, never nil, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
15 hours	Strip control characters from the location alone	Bryce Kwon	-18/+12
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
15 hours	Drop the URL helpers' guards that cannot fire	Bryce Kwon	-18/+2
	Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way.
15 hours	Keep only the request fields the auth filters read	Bryce Kwon	-42/+10
	Seven of the twelve fields filter_open stored were never read. Naming all twelve parameters keeps the order cgit passes them in on record.
15 hours	Take a signed cookie apart with one match	Bryce Kwon	-82/+10
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
15 hours	Drop the highlighter's extension fallback	Bryce Kwon	-47/+8
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.
15 hours	Call string.match like the rest of the highlighter	Bryce Kwon	-1/+1
15 hours	Carry a man page's text as plain strings	Bryce Kwon	-23/+16
	lpeg's constant, query and numbered captures already do what the token helpers did, and nothing ever read the tokens of an escape that draws nothing.
15 hours	Take a no fill line's plain text from its nodes	Bryce Kwon	-7/+1
15 hours	Wrap a man page's font runs with the macros' helper	Bryce Kwon	-27/+11
15 hours	Reuse the digit pattern where it is spelt out	Bryce Kwon	-2/+2
15 hours	Build the block start test from the line grammars	Bryce Kwon	-2/+1
15 hours	Count a rule among the blocks that end a paragraph	Bryce Kwon	-7/+4
15 hours	Inline the list check before indented code	Bryce Kwon	-6/+2
15 hours	Read a setext heading's level off its capture	Bryce Kwon	-10/+4
15 hours	Build every code block in one place	Bryce Kwon	-17/+11
15 hours	Replace a readme's NUL bytes in one substitution	Bryce Kwon	-19/+3
15 hours	Let the dispatch serve markdown without lpeg	Bryce Kwon	-5/+0
	Without lpeg both renderers stay nil, and the handler lookup already falls back to plain text for a format it has no renderer for.
15 hours	Render markdown and man pages through one function	Bryce Kwon	-28/+18
	Everything that can raise already runs inside the parse and emit pcalls, so the outer one in filter_close could only ever have sent the page a second time. The size check moves to the dispatch with it.
15 hours	Drop three needless forward declarations	Bryce Kwon	-9/+3
15 hours	Drop fallbacks for a match that cannot fail	Bryce Kwon	-3/+3
	A table capture of a pattern repeated zero or more times matches every string, the empty one included, so the inline grammars never return nil.
15 hours	Drop the readme hooks that nothing reads	Bryce Kwon	-14/+7
	Nothing in assets/ or in README's list of hooks reads a fenced block's data-lang or the manpage class on a man page's wrapper, so the header now names the two wrappers the stylesheet does style.
2 days	Render the man pages that generators write	Bryce Kwon	-52/+188
	DocBook, pod2man and hand written pages leaked roff onto the page: font escapes inside no fill blocks, comments, layout escapes such as \% and \c, the colours and half line moves around DocBook's links, and the requests and macro definitions their preambles open with. Those now draw nothing, the common named characters and strings render, .EX and pod2man's .Vb read as code, a .TP tag takes a line of its own and the alternating font macros switch fonts between their arguments. Anything rarer still falls back to its text.
2 days	Render more of the markdown seen in readmes	Bryce Kwon	-19/+105
	A line of equals signs or dashes under a paragraph now makes a heading of it, as on GitHub, instead of running into its text, and any other rule ends the paragraph. Four spaces or a tab start a code block, and an escaped pipe stays in its table cell. A link opening with two slashes or backslashes in any mix leads to another site, so it renders as text like the plain scheme relative one already did.
2 days	Keep a readme whole past a NUL byte	Bryce Kwon	-2/+20
	cgit takes filter output through a C string sink that stops at the first NUL, so a readme holding one lost everything after it. Each NUL now shows as U+FFFD, as a browser would show it.
6 days	Say when a login fails, and line up the form	Bryce Kwon	-16/+44
	A wrong password sent the reader back to the same empty form, which looked no different from a crash. The redirect now carries a flag the form reads, the same for an unknown user as for a wrong password, and the form leaves the flag out of the way back it signs.
6 days	Colour css properties and pseudo-classes	Bryce Kwon	-14/+17
	Scintillua's css lexer tags them with names the map had no row for, so they came out as plain text.
8 days	Escape the same characters in the highlighter	Bryce Kwon	-6/+39
	A lexer may hand back the bytes of one separator, or the CR and LF of a line ending, in different tokens, so line endings become line feeds before lexing and the separators are escaped once the tokens are joined.
2026-10-16	Claim and test Lua 5.5 for every extension	Bryce Kwon	-13/+13
	luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
2026-10-16	Drop the highlighter's stale guard and dead branch	Bryce Kwon	-11/+2
	cgit runs as a CGI, so no interpreter outlives its request, and the lexers load once per process. The loop below already wrote nothing for an empty blob.
2026-10-16	Find a script's lexer from its shebang line	Bryce Kwon	-3/+5
	Scintillua's detect reads the first line as well as the name, and without it hooks, bin scripts and anything else lacking an extension stayed plain.
2026-10-16	Ship the example tracker links commented out	Bryce Kwon	-5/+8
	An unedited copy sent every #123, Closes: and Bug: mark to bugs.example.com, a link that is wrong for every site.
2026-10-16	Say that a protected repository stays on the index	Bryce Kwon	-0/+8
2026-10-16	Name the auth cookie __Host- where it can be	Bryce Kwon	-4/+20
	Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
2026-10-16	End a session when its account's hash changes	Bryce Kwon	-58/+88
	A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
2026-10-16	Load auth libraries only when a request needs one	Bryce Kwon	-12/+20
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
2026-10-16	Say which hash kinds each system's crypt checks	Bryce Kwon	-4/+27
	The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
2026-10-16	Spend a missing account's login on a real hash	Bryce Kwon	-21/+31
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
2026-10-16	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-2/+10
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
2026-10-16	Read the auth cookie in linear time	Bryce Kwon	-14/+42
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
2026-10-16	Offer avatars at twice the size to dense screens	Bryce Kwon	-14/+22
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
2026-10-16	Hash avatar addresses with SHA-256	Bryce Kwon	-6/+7
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.
2026-10-16	Mark avatar icons as decorative	Bryce Kwon	-8/+6
	A screen reader announced the service's name before every author.
2026-10-16	Unwrap an avatar address in linear time	Bryce Kwon	-6/+12
	An author email of 16,000 "<" took three quarters of a second per log row, and one of 64,000 took twelve seconds.
2026-10-16	Draw no avatar when luaossl is missing	Bryce Kwon	-6/+8
	The require at the top raised as cgit loaded the filter, so every page that lists an author stopped at its first author cell with an error.
2026-10-16	Drop the table loop's dead blank-line test	Bryce Kwon	-1/+1
	A line holding a pipe is never blank.
2026-10-16	Give readme headings anchors like GitHub's	Bryce Kwon	-1/+36
	A readme's links to its own sections, as in a table of contents, had nothing on the page to land on.
2026-10-16	Keep underscores inside words out of emphasis	Bryce Kwon	-4/+9
2026-10-16	Let character references through to the browser	Bryce Kwon	-2/+17
	Decoding them here instead would mean carrying every named reference HTML defines, while the browser already knows them all.