Age	Commit message (Collapse)	Author	Lines
19 hours	Pass over a notes ref that names no tree	Bryce Kwon	-3/+14
	A pusher can point refs/notes/commits or a signature notes ref at any object, and git dies loading one that is no tree, which ended every page of the repository, the dumb transport included. Such a ref now counts as absent.
39 hours	Keep string literals behind const pointers	Bryce Kwon	-1/+1
	Git's DEVELOPER=1 build turns on -Wwrite-strings as an error, and the literals stored through plain char pointers failed cgit's own objects there. The exec filter's argv takes the cast execvp needs once, the way git's run-command does.
39 hours	Remove what the version removal left behind	Bryce Kwon	-2/+0
39 hours	Cache every branch page under cache-dynamic-ttl	Bryce Kwon	-7/+2
	The dynamic ttl only applied when the url named a branch with h=, so the log, tree and refs of the default branch, which never carry one, fell back to cache-summary-ttl. The manual already gives each ttl the scope the code now uses.
39 hours	Gate a readme ending in a colon like a disk path	Bryce Kwon	-4/+2
	trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test.
2026-10-01	End a request quietly when the client has gone	Bryce Kwon	-1/+3
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-10-01	Keep clone files and oversized responses out of the cache	Bryce Kwon	-1/+19
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
2026-09-27	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-5/+5
2026-09-22	Align with spaces instead of tabs	Bryce Kwon	-13/+12
2026-09-21	Harden the request path, scan and error recovery	Bryce Kwon	-52/+125
2026-09-21	Answer 404 for a repository whose path is missing	Bryce Kwon	-6/+8
2026-09-15	Gate scanned filters with `trust-scan-filters`	Bryce Kwon	-22/+13
2026-09-15	Apply the mailmap at HEAD to every ident	Bryce Kwon	-0/+6
2026-09-15	Split trailers out of the commit message	Bryce Kwon	-2/+14
2026-09-06	Clean up the whole tree	Bryce Kwon	-56/+47
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-54/+37
2026-09-06	Report ignored config keys on stderr	Bryce Kwon	-4/+12
2026-09-06	Rename the inconsistent config keys	Bryce Kwon	-23/+25
	noplainemail enable-plain-email noheader enable-header cache-root-ttl cache-index-ttl cache-repo-ttl cache-summary-ttl cache-scanrc-ttl cache-scan-ttl agefile age-file renamelimit rename-limit extra-head-content head-content
2026-09-06	Fold `enable-stats` back into `max-stats`	Bryce Kwon	-6/+0
	A `max-stats` period enables the page again, as it did before v2.2.0, so one key does both jobs.
2026-08-27	Use standard HTTP reason phrases	Bryce Kwon	-5/+5
2026-08-24	Resolve submodule links from `.gitmodules`	Bryce Kwon	-0/+5
2026-08-23	Log scan lock failures that are not contention	Bryce Kwon	-1/+6
2026-08-23	Give up a scan or slot whose lock file was renamed	Bryce Kwon	-0/+13
2026-08-22	Let a crashed scan's lock expire with its process	Bryce Kwon	-9/+40
2026-08-22	Cache id-pinned pages and snapshots as static	Bryce Kwon	-3/+27
2026-08-22	Keep error pages out of the cache	Bryce Kwon	-3/+2
2026-08-14	Drop the Last-Modified, Expires and ETag headers	Bryce Kwon	-11/+0
2026-08-14	Remove the repository homepage feature	Bryce Kwon	-4/+0
2026-08-12	Restyle the sources and fix the audit's findings	Bryce Kwon	-843/+918
2026-08-08	Bound the search and cache key a request can ask	Bryce Kwon	-1/+8
2026-08-08	Gather page output into one buffer	Bryce Kwon	-0/+3
2026-08-06	Settle the names, types and layout of the sources	Bryce Kwon	-59/+59
2026-08-06	Isolate the git environment without a constructor	Bryce Kwon	-8/+13
2026-08-05	Update the bundled Git to 2.55.0	Bryce Kwon	-1/+1
2026-08-02	Give empty repositories their own page	Bryce Kwon	-18/+7
2026-08-01	Add `enable-relative-dates` and `date-format`	Bryce Kwon	-0/+6
2026-08-01	Drop the help tab and its built-in guide	Bryce Kwon	-3/+0
2026-07-25	Replace the browser markdown renderer with a filter	Bryce Kwon	-3/+0
	The readme is now escaped plain text unless `about-filter` points at the new `about-render.lua`, which renders markdown, man pages and plain text server-side. `enable-markdown` goes away with the renderer.
2026-07-25	Add `max-patch-count` to bound the patch view	Bryce Kwon	-0/+3
2026-07-20	Gate the stats page and add a language breakdown	Bryce Kwon	-0/+6
	`max-stats` only bounds the selectable periods now and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to `setup_revisions`, and parses each commit once.
2026-07-19	Remove the owner filter hook	Bryce Kwon	-6/+0
2026-07-19	Stat oversized diffs instead of inlining them	Bryce Kwon	-0/+6
2026-07-19	Cap and paginate the ref listings	Bryce Kwon	-0/+3
2026-07-19	Add a help page with common workflows	Bryce Kwon	-0/+3
2026-07-16	Point the fork's links and credits at itself	Bryce Kwon	-2/+2
	AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
2026-07-16	Drop unused config and query fields	Bryce Kwon	-4/+0
2026-07-16	Key the cache on scheme and host	Bryce Kwon	-2/+15
	Clone urls and atom links are built from the request scheme and Host, but the cache key left them out, so a request with a spoofed Host could cache a page carrying a bogus clone url and serve it to other visitors.
2026-07-16	Bound the authenticate-post length safely	Bryce Kwon	-3/+4
	The POST length was clamped with a signed comparison, so a very large Content-Length could turn negative and slip past the limit into the fixed-size buffer.
2026-07-16	Respect the cgitrc order of sections	Bryce Kwon	-1/+1
	The default sorted the sections and the repositories within them by name, so the order written in the cgitrc file was ignored.
2026-07-16	Keep snapshots working under a global git config	Bryce Kwon	-1/+7
	cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a `~` in `core.excludesfile`. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot came out undecompressable.