Age	Commit message (Collapse)	Author	Lines
2026-09-27	Keep string literals behind const pointers	Bryce Kwon	-24/+17
	Git's DEVELOPER=1 build turns on -Wwrite-strings as an error, and the literals stored through plain char pointers failed cgit's own objects there. The exec filter's argv takes the cast execvp needs once, the way git's run-command does.
2026-09-27	Keep the charset off types that only spell xml	Bryce Kwon	-2/+4
	Matching xml anywhere in the type also caught the Office formats, whose names hold openxmlformats, so a .docx went out with a UTF-8 charset.
2026-09-25	Keep the version numbers off the pages	Bryce Kwon	-7/+3
	The generator meta, the footer and the patch signature named the exact cgit and git versions on every response, which only helps someone matching a site against an advisory. The shipped server configs already hide the server's own version for the same reason, and cgit --version still answers on the host.
2026-09-25	Mark a page behind an auth filter private	Bryce Kwon	-0/+5
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-09-24	Send a charset only with a text type	Bryce Kwon	-1/+12
	Archives, packs and the HEAD file went out as octet-stream or gzip with a UTF-8 charset on the end, since only the plain and about pages cleared it.
2026-09-24	Keep option-like branch names out of the switcher	Bryce Kwon	-0/+4
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
2026-09-23	Keep the query string across the about redirects	Bryce Kwon	-6/+15
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-09-21	Add stable markup hooks for site themes	Bryce Kwon	-14/+37
2026-09-15	Align with spaces instead of tabs	Bryce Kwon	-3/+3
2026-09-15	Harden the page renderers	Bryce Kwon	-65/+122
2026-09-12	Name the tagged object under its full id	Bryce Kwon	-5/+9
2026-09-08	Settle the snapshot v-prefix from the tag list	Bryce Kwon	-8/+35
	compose_snapshot_prefix dropped the leading v of a tag only when just one of the names 1.2, v1.2 and V1.2 resolved as a tag, so that the shorter snapshot name could always be traced back to one tag. Those probes went through ref lookups, and on a case-insensitive filesystem a lookup for V1.2 finds the loose file of v1.2, so every freshly made tag counted as ambiguous and kept its v. Once git packed the refs the lookups became exact and the same tag quietly changed its snapshot names. The claimants on a stripped name are now counted over the tag list itself with exact string comparison, so the answer no longer depends on how a ref is stored or on the filesystem underneath. Two tags that really differ only by the letter's case still both keep it.
2026-09-07	Clean up the whole tree	Bryce Kwon	-198/+120
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-17/+19
2026-09-06	Remove the auto-submitting selects	Bryce Kwon	-1/+1
2026-09-06	Remove the theme toggle	Bryce Kwon	-2/+0
2026-09-05	Rename the inconsistent config keys	Bryce Kwon	-3/+3
	The old spellings are no longer read. enable-header and enable-plain-email take the opposite value of the noheader and noplainemail they replace.
2026-09-05	Fold enable-stats back into max-stats	Bryce Kwon	-1/+1
	A max-stats period enables the page again, as it did before v2.2.0, so one key does both jobs.
2026-08-31	Point clone rows at a url a browser can follow	Bryce Kwon	-0/+69
2026-08-27	Keep a detached head in the branch switcher	Bryce Kwon	-0/+41
2026-08-27	Add a meta description to the page head	Bryce Kwon	-0/+12
2026-08-27	Use standard HTTP reason phrases	Bryce Kwon	-1/+1
2026-08-26	Spell the charset UTF-8 everywhere	Bryce Kwon	-1/+1
2026-08-26	Drop the wall clock from the page footer	Bryce Kwon	-3/+2
2026-08-26	Replace non-ASCII output glyphs with ASCII	Bryce Kwon	-3/+2
2026-08-23	Resolve submodule links from .gitmodules	Bryce Kwon	-6/+244
2026-08-23	Fix the submodule rows in the tree listing	Bryce Kwon	-13/+17
	A submodule row linked to a path with its trailing slash stripped, was labelled by its path rather than its entry name, shared the name's element with its hash, claimed a size of zero and offered a blame button that cannot work on a gitlink.
2026-08-19	Keep error pages out of the cache	Bryce Kwon	-0/+6
2026-08-19	Show a pinned commit in switcher, title and crumbs	Bryce Kwon	-18/+110
2026-08-18	Always send the Status header	Bryce Kwon	-0/+4
2026-08-18	Print the raw-content headers with the rest	Bryce Kwon	-0/+7
2026-08-17	Drop the Last-Modified, Expires and ETag headers	Bryce Kwon	-19/+0
2026-08-16	Tidy the structure of the generated markup	Bryce Kwon	-9/+9
2026-08-15	Wrap the dates in time elements	Bryce Kwon	-3/+12
2026-08-15	Drop the XHTML slashes and boolean spellings	Bryce Kwon	-6/+6
2026-08-13	Modernise the document head	Bryce Kwon	-14/+19
2026-08-12	Fix ampersand handling in generated urls	Bryce Kwon	-1/+3
2026-08-12	Remove the repository homepage feature	Bryce Kwon	-5/+0
2026-08-10	Restyle the sources and fix the audit's findings	Bryce Kwon	-745/+780
2026-08-07	Gather page output into one buffer	Bryce Kwon	-0/+4
2026-08-07	Expand module-link placeholders outside printf	Bryce Kwon	-2/+40
2026-08-05	Settle the names, types and layout of the sources	Bryce Kwon	-33/+35
2026-08-03	Give empty repositories their own page	Bryce Kwon	-2/+12
2026-08-01	Add enable-relative-dates and date-format	Bryce Kwon	-6/+25
2026-07-31	Drop the help tab and its built-in guide	Bryce Kwon	-6/+0
2026-07-25	Cap the header branch switcher	Bryce Kwon	-2/+9
2026-07-25	Backfill an absent commit message	Bryce Kwon	-1/+1
2026-07-19	Emit a conforming rel=icon for the favicon link	Bryce Kwon	-1/+1
2026-07-19	Gate the stats page and add a language breakdown	Bryce Kwon	-1/+1
	The max-stats setting now only bounds the selectable periods and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to setup_revisions, and parses each commit once.
2026-07-17	Remove the owner filter hook	Bryce Kwon	-7/+1