Age	Commit message (Collapse)	Author	Lines
18 hours	Abbreviate the index ids into local buffers	Bryce Kwon	-14/+3
18 hours	Name the diff prototype parameters as defined	Bryce Kwon	-1/+1
18 hours	Find blame's next tab stop the way ssdiff does	Bryce Kwon	-2/+3
	The mask only worked while TAB_WIDTH stayed a power of two.
18 hours	Emit both blame side columns with one loop	Bryce Kwon	-18/+6
18 hours	Set the blame scoreboard's path once	Bryce Kwon	-1/+0
18 hours	Clear the blame details with string_list_clear	Bryce Kwon	-10/+1
18 hours	Test a blob for binary before blaming it	Bryce Kwon	-15/+9
18 hours	Pass request strings on without copying them	Bryce Kwon	-13/+5
18 hours	Move the stats period struct into ui-stats.c	Bryce Kwon	-28/+27
18 hours	Print every stats row with one function	Bryce Kwon	-32/+16
	The cells of the Others row lose the empty class attribute they carried.
18 hours	Step a stats period with one function	Bryce Kwon	-50/+20
18 hours	Build the patch and stats arguments in a strvec	Bryce Kwon	-32/+22
18 hours	Drop an unused include from the patch page	Bryce Kwon	-1/+0
18 hours	Drop rev settings that change nothing	Bryce Kwon	-9/+0
	repo_init_revisions already sets abbrev, commit_format and show_root_diff to these values, and verbose_header is only read by log_tree_commit, which the log and stats walks never call.
18 hours	Split a log range with git's string list helper	Bryce Kwon	-29/+9
18 hours	Free the log's tip when its walk fails	Bryce Kwon	-14/+6
	Every exit now goes through one label, which also clears the walk arguments that the normal end used to leave allocated.
18 hours	Refuse pathspec magic on the stats page	Bryce Kwon	-0/+6
18 hours	Open the stats window at midnight on its first day	Bryce Kwon	-0/+4
18 hours	Label the age column of a followed log	Bryce Kwon	-20/+20
18 hours	Write the flags recipe the way the version one is	Bryce Kwon	-3/+3
	Its message also spells the project's name as cgit.
18 hours	Trim and correct the build file comments	Bryce Kwon	-3/+1
	The test rule's note on ordering predates .NOTPARALLEL, which covers it. The install paths are not compiled in, and a lowercase name is no easier to override than another.
3 days	Declare each phony target beside its rule	Bryce Kwon	-1/+2
	A list at the end of the file is easy to miss when a target is added or renamed.
3 days	Add a development build script	Bryce Kwon	-2/+5
	cgit's objects are compiled by its own rule rather than git's, so they took no -MJ flag and a compilation database held only git's sources.
3 days	Fold the version script into its make recipe	Bryce Kwon	-8/+17
	gen-version.sh was only ever run by this one recipe, so tools/ now holds just the scripts a person runs.
3 days	Offer no diff options on an octopus merge	Bryce Kwon	-1/+3
	The commit page draws no diff for a merge of three or more parents, so the options above it changed nothing.
3 days	Offer the versions as an option	Bryce Kwon	-3/+18
	enable-version-info brings back the cgit and git versions that 3a00e19 took off the footer and the generator tag, for a site that wants them, and the version 2a6726a put on the signature of patches now follows it too. It stays off by default for the reason 3a00e19 gave.
3 days	Name the page first in every title	Bryce Kwon	-3/+24
	Summary, about, log, refs, tag and stats pages shared one title, so tabs, history and search results could not tell them apart. Titles now read page, repository and site, with root-title as the site, and the description stays in the meta description, where search engines read it.
3 days	Name the graph and links header cells	Bryce Kwon	-2/+2
	Both were empty, so a screen reader moving through the table announced those columns with no name. An aria-label names them without adding text to the page.
3 days	Load the scripts with defer	Bryce Kwon	-1/+1
	A plain script in the head held up parsing until it had downloaded and run, though cgit.js only acts once the document is ready. Deferred scripts still run in the order given and before DOMContentLoaded, so a site script after cgit.js can still call window.cgit.
3 days	Tidy the diff and stat options panel	Bryce Kwon	-7/+7
	Its caption sat above the box, each select took its own width, and the reload button hung indented under them. The caption is now the panel's header strip, the selects and the button share one column at the width of the widest select, and the labels lose their colons to match the commit details.
3 days	Stop folding a tag's signature away	Bryce Kwon	-25/+4
	The fold put a click between the reader and the signature, and the browser's own disclosure marker and summary did not take the theme. The signature prints as part of the message again, as it did up to v2.9.1.
7 days	Draw no diffstat table for a change to no files	Bryce Kwon	-4/+7
	The padding the table gained left an empty commit with a hollow frame where the file rows would be.
7 days	Fold a tag's signature away under its message	Bryce Kwon	-4/+25
	The armour ran on for more lines than most tag messages, as part of the message itself. git finds the signature for every kind it can sign with, so PGP, SSH and X.509 all fold the same way.
7 days	Let a commit's labels wrap apart from its subject	Bryce Kwon	-0/+6
	The labels sat flush against the subject's last word, which made the two one unbreakable run, so a narrow cell stranded a word on its own line. A space now precedes each label and carries its gap, and a line that breaks there drops it, so a wrapped label starts flush.
7 days	Give every summary section the same columns	Bryce Kwon	-43/+93
	The ref rows always spanned five columns and the log three to five, so with the default config the log and clone rows stopped 160px short of the table's edge, and with any config the log rows did on a phone, where they alone lost their counts. A column no cell began in also made the summary and refs pages invalid HTML.
7 days	Draw the diffstat bars as SVG	Bryce Kwon	-16/+9
	The bars were cells spanning up to 1000 columns of a nested table, which kept them free of inline styles under a strict CSP but broke the HTML table model, 18 errors on a commit page, and left Firefox's longest bar short of the full width. An SVG canvas sized by its attributes is just as safe under a CSP, validates, and draws every bar exactly to scale.
7 days	Keep each snapshot link in one piece	Bryce Kwon	-0/+4
	On a narrow screen the download column broke a snapshot name at a hyphen or left its signature link alone on the next line. Each file and its signature now stay together, and a line breaks only between them.
8 days	Sign patches with the cgit version	Bryce Kwon	-3/+13
	git format-patch ends each patch with the version of git that wrote it, and the bare "cgit" that 3a00e19 left in its place said less. The version is written as git writes its own, without the v of the tag, so a release build signs with "cgit 2.9.0". The footer and the generator tag still leave versions out.
8 days	Show characters a browser breaks at as escapes	Bryce Kwon	-6/+108
	The HTML parser turns a carriage return with no line feed after it into a line feed, and WebKit starts a new line at U+2028 and U+2029, while git and the line numbers count line feeds alone, so each one set every later line of the tree and blame pages a line below its number. CSS Text makes vertical tab, form feed and next line forced breaks as well, though no engine honours that yet. The escapes follow gitweb, which shows control characters the same way.
2026-10-17	Isolate git from HOME before git's own setup	Bryce Kwon	-3/+5
	Git reads the global config for its trace settings before cmd_main is reached, so the isolation there came too late and every request probed $HOME/.gitconfig. The home-access test had passed on arm64 only because access is no syscall of its own there, so it now traces every call that takes a path.
2026-10-17	Sort an empty list without handing qsort a null	Bryce Kwon	-9/+21
	Every list sorted here is null until its first entry, and C leaves a null base undefined even with nothing to sort. glibc declares it nonnull and its UBSan build aborted the stats page of a repository with no commits in the window, which the Linux matrix caught.
2026-10-17	Lock a cache slot with flock	Bryce Kwon	-7/+6
	The slot lock was a POSIX record lock, which a process loses the moment any descriptor on the file closes, and the fill puts the lock file on stdout, which every exec filter and snapshot compressor closes with its dup2. A second request on the slot could then rebuild it under the first and splice the two pages. An flock holds until the last descriptor goes.
2026-10-17	Abandon a fill whose last flush fails to write	Bryce Kwon	-2/+4
	The slot being filled was forgotten before the page's final flush, so a write that failed there, on a full disk for one, could not abandon the fill: cgit died into the lock file instead and the visitor got nothing. The mid-page path already delivered the page from the lock file.
2026-10-17	Hold patch and rawdiff to max-blob-size	Bryce Kwon	-0/+8
	Both pages hand the diff to git, whose own limit on an inlined blob is 512 MB, so a commit adding a blob the other views refuse was inflated and diffed in full. The cap is passed through to git, which shows such a blob as binary.
2026-10-17	Keep every control byte out of a header value	Bryce Kwon	-0/+4
	A quoted header value escaped only the quote, the backslash, CR and LF. A web server refuses a response whose header holds any other control byte, so a file named with one could not be downloaded at all.
2026-10-17	Widen the cache ttl before multiplying it	Bryce Kwon	-1/+3
	A ttl in the tens of millions of minutes overflowed the int it was multiplied in.
2026-10-17	Hold a scanned defbranch to a ref name	Bryce Kwon	-1/+3
	The index stats the default branch below the repository to date it, and a scanned repository sets its own defbranch, which was not held to what a ref may hold, so one spelled as a path reached a file outside.
2026-10-17	Answer the plain view once for duplicate entries	Bryce Kwon	-1/+7
	A tree can hold two entries of one name when fsck is off, and the walk went on after the first answered: a second file put two responses in one body, and a directory under the same name printed headers from the mimetype string the first had already freed.
2026-10-17	Hold a signature download to max-blob-size	Bryce Kwon	-0/+11
	A signature is a note a pusher stored, and the download read it whole without the size check every other blob a page inflates goes through.
2026-10-17	Lead a snapshot name to its tag ahead of a branch	Bryce Kwon	-31/+56
	The refs listing offers a tag's snapshot under the stem of its name, and the lookup back from that name settled on whatever ref matched first, so a branch spelled like the stem was archived in the tag's place. Every candidate is now tried as a tag before any is tried as a branch.