Age	Commit message (Collapse)	Author	Lines
2026-08-12	Remove the repository homepage feature	Bryce Kwon	-4/+0
2026-08-10	Restyle the sources and fix the audit's findings	Bryce Kwon	-843/+918
2026-08-08	Bound the search and cache key a request can ask	Bryce Kwon	-1/+8
2026-08-07	Gather page output into one buffer	Bryce Kwon	-0/+3
2026-08-05	Settle the names, types and layout of the sources	Bryce Kwon	-59/+59
2026-08-05	Isolate the git environment without a constructor	Bryce Kwon	-8/+13
2026-08-05	Update the bundled Git to 2.55.0	Bryce Kwon	-1/+1
2026-08-03	Give empty repositories their own page	Bryce Kwon	-18/+7
2026-08-01	Add enable-relative-dates and date-format	Bryce Kwon	-0/+6
2026-07-31	Drop the help tab and its built-in guide	Bryce Kwon	-3/+0
2026-07-25	Swap the browser markdown renderer for a filter	Bryce Kwon	-3/+0
	The readme is now escaped plain text unless about-filter points at the new about-render.lua, which renders markdown, man pages and plain text server-side. The enable-markdown setting goes away with the renderer.
2026-07-25	Add max-patch-count to bound the patch view	Bryce Kwon	-0/+3
2026-07-19	Gate the stats page and add a language breakdown	Bryce Kwon	-0/+6
	The max-stats setting now only bounds the selectable periods and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to setup_revisions, and parses each commit once.
2026-07-17	Remove the owner filter hook	Bryce Kwon	-6/+0
2026-07-16	Stat oversized diffs instead of inlining them	Bryce Kwon	-0/+6
2026-07-16	Cap and paginate the ref listings	Bryce Kwon	-0/+3
2026-07-16	Add a help page with common workflows	Bryce Kwon	-0/+3
2026-07-16	Point the fork's links and credits at itself	Bryce Kwon	-2/+2
	AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
2026-07-16	Drop unused config and query fields	Bryce Kwon	-4/+0
2026-07-16	Key the cache on scheme and host	Bryce Kwon	-2/+15
	Clone urls and atom links are built from the request scheme and Host, but the cache key left them out, so a request with a spoofed Host could cache a page carrying a bogus clone url and serve it to other visitors.
2026-07-16	Bound the authenticate-post length safely	Bryce Kwon	-3/+4
	The POST length was clamped with a signed comparison, so a very large Content-Length could turn negative and slip past the limit into the fixed-size buffer.
2026-07-15	Respect the cgitrc order of sections	Bryce Kwon	-1/+1
	The default sorted the sections and the repositories within them by name, so the order written in the cgitrc file was ignored.
2026-07-15	Keep snapshots working under a global git config	Bryce Kwon	-1/+7
	cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a ~ in core.excludesfile. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot failed to decompress.
2026-07-15	Clamp the log offset to bound history walks	Bryce Kwon	-1/+11
	A crafted ofs value could send cgit walking most of the history for one request.
2026-07-15	Check max-blob-size up front and default to 10 MB	Bryce Kwon	-1/+1
	Only the tree view honoured the limit, and only after loading the whole object. The default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole. Zero still turns the limit off.
2026-07-15	Render README markdown in the browser	Bryce Kwon	-0/+3
	cgit had no markdown support of its own, so a readme was rendered through an external python filter or not at all. Escaping the source and formatting it in cgit.js keeps the work in the browser like the blob highlighter, and the page stays readable as plain text without scripting.
2026-07-15	Add enable-tree-group-dirs to list dirs first	Bryce Kwon	-0/+2
2026-07-15	Gate the cache listing behind enable-cache-list	Bryce Kwon	-0/+2
	The ls_cache page printed the cache directory path and the urls other visitors had requested, with no gate at all.
2026-07-15	Reorganise into source, assets and libraries	Bryce Kwon	-0/+0
	Everything the build generates now lands in build/, so a clean is a single remove and the source tree stays free of build output.