Age	Commit message (Collapse)	Author	Lines
2026-09-23	Walk a path on the blob page from a commit id	Bryce Kwon	-0/+15
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
2026-09-23	Keep the query string across the about redirects	Bryce Kwon	-0/+13
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-09-23	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+13
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
2026-09-22	Send a clone file with its size in whole batches	Bryce Kwon	-0/+15
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
2026-09-22	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+39
	enable-html-serving makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without trust-scan-config and run script against every visitor. The warning for a key read from git config also named a null repository, because repo->path was set only after that file had been read.
2026-09-21	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-1/+1
2026-09-15	Test the hardening pass	Bryce Kwon	-0/+471