Age	Commit message (Collapse)	Author	Lines
2026-07-15	Keep snapshots working under a global git config	Bryce Kwon	-1/+7
	cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a ~ in core.excludesfile. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot failed to decompress.
2026-07-15	Clamp the log offset to bound history walks	Bryce Kwon	-1/+11
	A crafted ofs value could send cgit walking most of the history for one request.
2026-07-15	Check max-blob-size up front and default to 10 MB	Bryce Kwon	-1/+1
	Only the tree view honoured the limit, and only after loading the whole object. The default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole. Zero still turns the limit off.
2026-07-15	Render README markdown in the browser	Bryce Kwon	-0/+3
	cgit had no markdown support of its own, so a readme was rendered through an external python filter or not at all. Escaping the source and formatting it in cgit.js keeps the work in the browser like the blob highlighter, and the page stays readable as plain text without scripting.
2026-07-15	Add enable-tree-group-dirs to list dirs first	Bryce Kwon	-0/+2
2026-07-15	Gate the cache listing behind enable-cache-list	Bryce Kwon	-0/+2
	The ls_cache page printed the cache directory path and the urls other visitors had requested, with no gate at all.
2026-07-15	Reorganise into source, assets and libraries	Bryce Kwon	-0/+0
	Everything the build generates now lands in build/, so a clean is a single remove and the source tree stays free of build output.