Age	Commit message (Collapse)	Author	Lines
2026-09-22	Stop caching clone files and oversized responses	Bryce Kwon	-0/+5
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. cache-max-slot-size, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
2026-09-22	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+3
	enable-html-serving makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without trust-scan-config and run script against every visitor. The warning for a key read from git config also named a null repository, because repo->path was set only after that file had been read.
2026-09-21	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-11/+12
2026-09-15	Unify the docs, samples and extensions	Bryce Kwon	-207/+236
2026-09-14	Harden the request path, scan and error recovery	Bryce Kwon	-6/+6
2026-09-12	Gate scanned filters with trust-scan-filters	Bryce Kwon	-18/+16
2026-09-12	Apply the mailmap at HEAD to every ident	Bryce Kwon	-0/+9
2026-09-12	Add the link-trailers extension	Bryce Kwon	-0/+109
2026-09-12	Split trailers out of the commit message	Bryce Kwon	-0/+19
2026-09-07	Clean up the whole tree	Bryce Kwon	-84/+43
2026-09-07	Give the login inputs explicit field types	Bryce Kwon	-2/+2
2026-09-07	Refresh the server configs and drop unsafe-inline	Bryce Kwon	-94/+71
	style-src allowed inline styles only for the diffstat bars, which take their width from colspan instead. t0004 now checks that the three configs pin the same policy.
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-297/+203
2026-09-05	Rename the inconsistent config keys	Bryce Kwon	-120/+129
	The old spellings are no longer read. enable-header and enable-plain-email take the opposite value of the noheader and noplainemail they replace.
2026-08-27	Remove the language breakdown from the stats page	Bryce Kwon	-2/+2
2026-08-26	Replace nbsp spacing with CSS	Bryce Kwon	-4/+4
2026-08-19	Document cache directory ownership	Bryce Kwon	-1/+3
2026-08-19	Refuse unknown and spoofed hostnames in nginx.conf	Bryce Kwon	-0/+31
2026-08-18	Rework the response headers in the server configs	Bryce Kwon	-30/+132
2026-08-17	Drop the Last-Modified, Expires and ETag headers	Bryce Kwon	-1/+11
2026-08-17	Drop the update-server-info hook	Bryce Kwon	-25/+0
2026-08-17	Rename the agefile hook to cgit-age	Bryce Kwon	-0/+0
2026-08-17	Let password managers fill the login form	Bryce Kwon	-8/+8
2026-08-17	Lazy load the avatar icons	Bryce Kwon	-2/+10
2026-08-17	Restyle the filter extension headers and markup	Bryce Kwon	-845/+917
2026-08-12	Remove the repository homepage feature	Bryce Kwon	-3/+0
2026-08-05	Move the cookie-signing secret out of the cache v2.3.0	Bryce Kwon	-2/+2
2026-08-01	Trim the lua headers and fix the Scintillua notes	Bryce Kwon	-104/+18
2026-08-01	Fix cookie name escaping and stored hash trimming	Bryce Kwon	-3/+26
2026-08-01	Make the server configs complete standalone files	Bryce Kwon	-219/+410
2026-08-01	Add a hook that clears cgit's cache on push	Bryce Kwon	-0/+38
2026-08-01	Set a readable umask in the post-update hook	Bryce Kwon	-0/+7
2026-08-01	Rewrite the agefile hook for reliability	Bryce Kwon	-6/+25
2026-08-01	Add enable-relative-dates and date-format	Bryce Kwon	-0/+9
2026-07-31	Drop the help tab and its built-in guide	Bryce Kwon	-4/+0
2026-07-31	Reorganise the tree into vendor/ and custom/	Bryce Kwon	-0/+3416