Age	Commit message (Collapse)	Author	Lines
25 hours	Find libc's write when git writes first	Bryce Kwon	-0/+4
	A Lua build replaces write, and git can write before cmd_main reaches cgit_init_filters, as it does when GIT_TRACE2 is set, which called through a null pointer and crashed every request.
25 hours	Read a negative ref count as no limit	Bryce Kwon	-5/+3
	summary-branches, summary-tags and max-ref-count already listed every ref at 0, but a negative value reached qsort as a count and crashed the summary and refs pages, and emptied the branch switcher.
25 hours	Page a followed log by the name asked for	Bryce Kwon	-5/+6
	Each row of a followed log moves ctx.qry.vpath to the name its commit knew the file by, and the pager built its links from that, so past a rename both links named the old file and led to an empty page.
25 hours	Show the root commit in a followed log	Bryce Kwon	-13/+12
	A followed log diffs each commit against its parent to learn whether the file changed there, and a root commit was skipped rather than diffed against the empty tree, so a file created in the first commit never showed that commit.
25 hours	Peel an annotated tag before looking for a readme	Bryce Kwon	-0/+1
	Tag links carry the tag name as the head, so on any page reached from an annotated tag the about tab vanished and the about page redirected to the summary.
25 hours	Encode repository urls and the feed branch	Bryce Kwon	-25/+53
	Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
25 hours	Hold object sizes in size_t as git 2.55 does	Bryce Kwon	-37/+37
	Git 2.55 moved object sizes from unsigned long to size_t. The two are the same type on 64-bit hosts, but not on a 32-bit one, where GCC 14 rejects the mismatched pointers, so cgit stopped compiling there.
39 hours	Name every Lua filter failure in the log	Bryce Kwon	-9/+17
	A script raising anything but a string handed die a null to print, and a Lua state that could not be created was used anyway once the filter closed.
39 hours	Let a Lua script write while it loads	Bryce Kwon	-2/+6
	A script's top level runs before cgit hooks stdout for it, and the unhook html() began with tripped an assert that aborted cgit.
39 hours	Detect Lua 5.5 when building	Bryce Kwon	-1/+1
	cgit builds against Lua 5.5 and serves the same pages with it, but a host whose only Lua was 5.5 got a binary without Lua from the search.
40 hours	Give an empty repository's clone table its hooks	Bryce Kwon	-3/+3
	It was a bare table.list with no name, section or label, the one listing that broke what the README promises a theme.
40 hours	Hand the about filter the tree url its links need	Bryce Kwon	-30/+81
	With nothing below the about page, a readme's relative links have to be written against the tree, and only cgit knows how this site spells the url of a tree page and which ref the readme was read from. Both reach the filter already escaped for a url, built by the same writer as cgit's own links.
40 hours	Answer 404 for any path below the about page	Bryce Kwon	-120/+21
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
40 hours	Indent continuation lines with one tab	Bryce Kwon	-7/+7
40 hours	Share the max-blob-size check and its refusal	Bryce Kwon	-27/+35
	Five copies of the test and four of the error page had to agree by hand. The new check pins the four refusals, which no test covered.
40 hours	Mark the parameters callbacks leave unused	Bryce Kwon	-6/+6
	With these and the two changes before them, cgit builds under git's DEVELOPER=1 settings, which also annotate their own callbacks this way.
40 hours	Pass callbacks to git by address	Bryce Kwon	-8/+20
	ISO C has no conversion between a function pointer and void *, so the callbacks handed through git's data pointers and the write found by dlsym stopped the pedantic half of a DEVELOPER=1 build.
40 hours	Keep string literals behind const pointers	Bryce Kwon	-59/+53
	Git's DEVELOPER=1 build turns on -Wwrite-strings as an error, and the literals stored through plain char pointers failed cgit's own objects there. The exec filter's argv takes the cast execvp needs once, the way git's run-command does.
40 hours	Remove what the version removal left behind	Bryce Kwon	-6/+2
40 hours	Stop the stats page after its error page	Bryce Kwon	-11/+12
	A walk that failed to prepare printed an error page and then went on to print the statistics page after it, where the log and the feed return. No request reaches that failure today, since the walk is only limited by a range or an order the page never asks for.
40 hours	Read and write slot keys and pages in full	Bryce Kwon	-3/+7
	xread and xwrite may move fewer bytes than asked. A short write of the key left a slot that could never match, a short read of it reported a collision, and a page write that moved nothing looped for ever.
40 hours	Stop the sendfile loop at the end of a short slot	Bryce Kwon	-0/+4
	sendfile returns zero at the end of the file, and the loop only ended once the offset reached the size recorded when the slot was opened, so a slot cut shorter in between spun the request forever. Only Linux builds this path. A stand-in header type checked it here.
40 hours	Name the right file and error in the scan logs	Bryce Kwon	-2/+3
	A failed stat logged the directory rather than the entry inside it, and a project list that failed to read printed strerror of the flag ferror returns, which names an unrelated error.
40 hours	Keep the charset off types that only spell xml	Bryce Kwon	-2/+4
	Matching xml anywhere in the type also caught the Office formats, whose names hold openxmlformats, so a .docx went out with a UTF-8 charset.
40 hours	Skip an indented comment in the mimetype file	Bryce Kwon	-3/+1
	Only a hash in the first column marked a comment, so an indented one was read as the type "#" for every word after it. The manual already describes comments by their first non-blank character.
40 hours	Cache every branch page under cache-dynamic-ttl	Bryce Kwon	-8/+2
	The dynamic ttl only applied when the url named a branch with h=, so the log, tree and refs of the default branch, which never carry one, fell back to cache-summary-ttl. The manual already gives each ttl the scope the code now uses.
40 hours	Keep date-format=local-local from failing pages	Bryce Kwon	-1/+8
	The guard took local as a name that may carry the -local suffix, but git reads local only as a whole alias of default-local and dies on anything after it, so that one value turned every page into a 500.
40 hours	Keep the error of a request that dies mid capture	Bryce Kwon	-1/+3
	The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
40 hours	Gate a readme ending in a colon like a disk path	Bryce Kwon	-7/+18
	trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test.
40 hours	Keep a repository with an empty url ignored	Bryce Kwon	-1/+0
	The field resets at the end of cgit_add_repo cleared the ignore flag that the empty url branch had just set, so such a repository was listed on the index and selectable with ?r=, where every link to it read the byte before its url.
2026-10-01	Keep the version numbers off the pages	Bryce Kwon	-8/+4
	The generator meta, the footer and the patch signature named the exact cgit and git versions on every response, which only helps someone matching a site against an advisory. The shipped server configs already hide the server's own version for the same reason, and `cgit --version` still answers on the host.
2026-10-01	Mark a page behind an auth filter private	Bryce Kwon	-0/+5
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-10-01	Pin the advisory classes with tests and name an empty author	Bryce Kwon	-6/+10
	Each class behind cgit's published advisories now has a check against the current code, from a newline in a file name to shell syntax handed to a filter. The feed also treated an ident with an empty name and an empty address as present and wrote an empty person, which Atom forbids.
2026-10-01	End a request quietly when the client has gone	Bryce Kwon	-4/+34
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-10-01	Send a charset only with a text type	Bryce Kwon	-10/+14
	Archives, packs and the HEAD file went out as octet-stream or gzip with a UTF-8 charset on the end, since only the blob page cleared it. The headers now decide from the type itself, so the two places that cleared the charset by hand no longer need to.
2026-10-01	Word the blob size and binary errors alike	Bryce Kwon	-11/+7
	The four pages that refuse a blob over max-blob-size each said it in their own way, two of them in lower case, and the blame page ended its binary notice with a full stop no other error carries.
2026-10-01	Leave a branch spelled like an option out of the switcher	Bryce Kwon	-0/+4
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
2026-10-01	Replace the stray bytes of text that is not UTF-8	Bryce Kwon	-43/+80
	A commit whose encoding header names something iconv cannot convert, or whose text is labelled UTF-8 without being it, reached a page declared UTF-8 with its bytes untouched. The atom feed already replaced them, so its UTF-8 reader moves to shared.c and every ident, subject, message and tag text passes through it.
2026-10-01	Walk a path on the blob page from any commit the id names	Bryce Kwon	-7/+13
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
2026-10-01	Keep the query string across the about redirects	Bryce Kwon	-12/+55
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-10-01	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+8
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
2026-10-01	Limit rawdiff to the requested path	Bryce Kwon	-13/+26
	The diff and patch pages honour the path in the url, which the parameter table documents for every page, but rawdiff never handed it to git and answered with the whole diff.
2026-10-01	Send a clone file with its size in whole batches	Bryce Kwon	-4/+18
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
2026-10-01	Keep clone files and oversized responses out of the cache	Bryce Kwon	-13/+65
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
2026-10-01	Gate html serving behind trust-scan-config	Bryce Kwon	-11/+15
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
2026-10-01	Keep the Lua-less build compiling	Bryce Kwon	-0/+6
	`cgit_abort_filters` unhooks the Lua write interposer under NO_LUA too, where neither the hook nor its state exists, so `make NO_LUA=1` and the default mode of `tools/release-build.sh` have not compiled since the die path learned to take stdout back from a filter. The suite now builds that variant into `build/nolua` and runs it, and a `lua:` filter in such a build is refused with a message naming the cause instead of an unknown filter type.
2026-09-27	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-9/+9
2026-09-26	Add stable markup hooks for site themes	Bryce Kwon	-136/+194
2026-09-22	Align with spaces instead of tabs	Bryce Kwon	-43/+42
2026-09-21	Harden the page renderers	Bryce Kwon	-350/+658