Age	Commit message (Collapse)	Author	Lines
9 days	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+8
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
9 days	Limit rawdiff to the requested path	Bryce Kwon	-13/+26
	The diff and patch pages honour the path in the url, which the parameter table documents for every page, but rawdiff never handed it to git and answered with the whole diff.
9 days	Send a clone file with its size in whole batches	Bryce Kwon	-4/+18
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
9 days	Keep clone files and oversized responses out of the cache	Bryce Kwon	-13/+65
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
9 days	Gate html serving behind trust-scan-config	Bryce Kwon	-11/+15
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
9 days	Keep the Lua-less build compiling	Bryce Kwon	-0/+6
	`cgit_abort_filters` unhooks the Lua write interposer under NO_LUA too, where neither the hook nor its state exists, so `make NO_LUA=1` and the default mode of `tools/release-build.sh` have not compiled since the die path learned to take stdout back from a filter. The suite now builds that variant into `build/nolua` and runs it, and a `lua:` filter in such a build is refused with a message naming the cause instead of an unknown filter type.
13 days	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-9/+9
2026-09-26	Add stable markup hooks for site themes	Bryce Kwon	-136/+194
2026-09-22	Align with spaces instead of tabs	Bryce Kwon	-43/+42
2026-09-21	Harden the page renderers	Bryce Kwon	-350/+658
2026-09-21	Harden the request path, scan and error recovery	Bryce Kwon	-190/+507
2026-09-21	Answer 404 for a repository whose path is missing	Bryce Kwon	-6/+8
2026-09-21	Read the encoding header without its newline	Bryce Kwon	-1/+1
	The newline made the charset name unknown to the converter, so a message in another charset was left unconverted.
2026-09-21	Read every query parameter	Bryce Kwon	-1/+3
	A parameter without a value swallowed the parameter after it.
2026-09-21	Log a cache slot that cannot be published	Bryce Kwon	-2/+14
2026-09-21	Fail cleanly when a filter cannot run	Bryce Kwon	-5/+20
	A filter program that could not be run answered with two responses, and a filter that exited without reading its input ended cgit with the page half written.
2026-09-21	Name the tagged object under its full id	Bryce Kwon	-34/+40
2026-09-15	Keep the hash rows out of the column widths	Bryce Kwon	-8/+10
2026-09-15	Gate scanned filters with `trust-scan-filters`	Bryce Kwon	-25/+28
2026-09-15	Map trailer idents and print bare lines as written	Bryce Kwon	-17/+40
2026-09-15	Apply the mailmap at HEAD to every ident	Bryce Kwon	-8/+45
2026-09-15	Split trailers out of the commit message	Bryce Kwon	-6/+149
2026-09-15	Lay the tag table out like the commit table	Bryce Kwon	-31/+47
2026-09-08	Settle the snapshot v-prefix from the tag list	Bryce Kwon	-8/+35
	`compose_snapshot_prefix` dropped the leading v of a tag only when just one of the names 1.2, v1.2 and V1.2 resolved as a tag, so that the shorter snapshot name could always be traced back to one tag. Those probes went through ref lookups, and on a case-insensitive filesystem a lookup for V1.2 finds the loose file of v1.2, so every freshly made tag counted as ambiguous and kept its v. Once git packed the refs the lookups became exact and the same tag quietly changed its snapshot names. The claimants on a stripped name are now counted over the tag list itself with exact string comparison, so the answer no longer depends on how a ref is stored or on the filesystem underneath. Two tags that really differ only by the letter's case still both keep it.
2026-09-06	Clean up the whole tree	Bryce Kwon	-984/+596
2026-09-06	Harden the lua filter failure paths	Bryce Kwon	-5/+9
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-318/+226
2026-09-06	Remove the auto-submitting selects	Bryce Kwon	-8/+8
2026-09-06	Remove the theme toggle	Bryce Kwon	-2/+0
2026-09-06	Report ignored config keys on stderr	Bryce Kwon	-4/+12
2026-09-06	Rename the inconsistent config keys	Bryce Kwon	-39/+41
	noplainemail enable-plain-email noheader enable-header cache-root-ttl cache-index-ttl cache-repo-ttl cache-summary-ttl cache-scanrc-ttl cache-scan-ttl agefile age-file renamelimit rename-limit extra-head-content head-content
2026-09-06	Fold `enable-stats` back into `max-stats`	Bryce Kwon	-16/+6
	A `max-stats` period enables the page again, as it did before v2.2.0, so one key does both jobs.
2026-09-01	Size the diffstat bars with colspan, not style	Bryce Kwon	-12/+13
2026-08-29	Point clone rows at a url a browser can follow	Bryce Kwon	-14/+72
2026-08-27	Remove the language breakdown from the stats page	Bryce Kwon	-178/+7
2026-08-27	Keep a detached head in the branch switcher	Bryce Kwon	-0/+41
2026-08-27	Add a meta description to the page head	Bryce Kwon	-0/+12
2026-08-27	Use standard HTTP reason phrases	Bryce Kwon	-62/+62
2026-08-27	Use registered snapshot MIME types	Bryce Kwon	-3/+3
2026-08-27	Spell the charset UTF-8 everywhere	Bryce Kwon	-4/+4
2026-08-27	Date an empty atom feed at the epoch	Bryce Kwon	-2/+3
2026-08-27	Drop the wall clock from the page footer	Bryce Kwon	-3/+2
2026-08-27	Replace `nbsp` spacing with CSS	Bryce Kwon	-8/+8
2026-08-27	Replace non-ASCII output glyphs with ASCII	Bryce Kwon	-14/+12
2026-08-27	Null-terminate the stats pathspec argv	Bryce Kwon	-1/+4
2026-08-24	Resolve submodule links from `.gitmodules`	Bryce Kwon	-6/+252
2026-08-24	Fix the submodule rows in the tree listing	Bryce Kwon	-15/+22
	A submodule row linked to a path with its trailing slash stripped, was labelled by its path rather than its entry name, shared the name's element with its hash, claimed a size of zero and offered a blame button that cannot work on a gitlink.
2026-08-23	Log scan lock failures that are not contention	Bryce Kwon	-20/+26
2026-08-23	Give up a scan or slot whose lock file was renamed	Bryce Kwon	-0/+26
2026-08-23	Serve nothing further once a fill is abandoned	Bryce Kwon	-3/+34

• [next]