Age	Commit message (Collapse)	Author	Lines
37 hours	Load auth libraries only when a request needs one	Bryce Kwon	-6/+43
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
37 hours	Spend a missing account's login on a real hash	Bryce Kwon	-36/+68
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
37 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-0/+22
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
37 hours	Read the auth cookie in linear time	Bryce Kwon	-0/+10
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
37 hours	Offer avatars at twice the size to dense screens	Bryce Kwon	-0/+1
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
37 hours	Hash avatar addresses with SHA-256	Bryce Kwon	-7/+9
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.
37 hours	Mark avatar icons as decorative	Bryce Kwon	-3/+1
	A screen reader announced the service's name before every author.
37 hours	Unwrap an avatar address in linear time	Bryce Kwon	-0/+7
	An author email of 16,000 "<" took three quarters of a second per log row, and one of 64,000 took twelve seconds.
37 hours	Draw no avatar when luaossl is missing	Bryce Kwon	-9/+33
	The require at the top raised as cgit loaded the filter, so every page that lists an author stopped at its first author cell with an error.
38 hours	Compare the cached page with the uncached one whole	Bryce Kwon	-5/+1
	The footer lost the time it was generated at in 2018, and both runs come from the same binary, so the two pages have nothing to differ in.
38 hours	Give an empty repository's clone table its hooks	Bryce Kwon	-3/+13
	It was a bare table.list with no name, section or label, the one listing that broke what the README promises a theme.
38 hours	Check every markup hook the README names	Bryce Kwon	-0/+73
	The README promised that t0005 checked them all, while fourteen went unchecked, and three of its claims were too broad. A date shown in full carries no age hooks, line anchors follow enable-tree-linenumbers and cgit.css also styles html.cgit-standalone.
38 hours	Add blame to the source filter and line number docs	Bryce Kwon	-0/+8
38 hours	Say that js may be given more than once	Bryce Kwon	-1/+20
38 hours	Describe root-readme as the site's about page	Bryce Kwon	-0/+16
38 hours	Say which filters get the repository variables	Bryce Kwon	-0/+12
38 hours	Leave readme out of what scan-path fixes	Bryce Kwon	-0/+10
38 hours	Name the log link that enable-index-links adds	Bryce Kwon	-1/+10
	The manual has named the commit page since it was written in 2008, a year after the index started linking the log instead.
38 hours	Give readme headings anchors like GitHub's	Bryce Kwon	-9/+22
	A readme's links to its own sections, as in a table of contents, had nothing on the page to land on.
38 hours	Keep underscores inside words out of emphasis	Bryce Kwon	-0/+6
38 hours	Let character references through to the browser	Bryce Kwon	-0/+9
	Decoding them here instead would mean carrying every named reference HTML defines, while the browser already knows them all.
38 hours	Honour backslash escapes in readmes	Bryce Kwon	-0/+9
38 hours	Link the urls and addresses in angle brackets	Bryce Kwon	-0/+8
38 hours	Keep a wrapped list item in its list	Bryce Kwon	-0/+9
	The item's second line became a paragraph of its own and the items after it a new list, so an ordered list started counting again.
38 hours	Let a table cut a paragraph short	Bryce Kwon	-0/+3
	A table written right under a line of text came out as more of the paragraph, pipes and all.
38 hours	Run a paragraph's lines together like GitHub	Bryce Kwon	-3/+10
	GitHub shows a single newline in a markdown file as a space, and roff fills the lines of a man page the same way, so text wrapped in the source came out ragged on the about page.
38 hours	Leave images and badges out of rendered readmes	Bryce Kwon	-6/+7
	A relative image loaded from below the about page, which answers 404 now, and a remote one had every visitor's browser call a third party. A badge also came out as a link to its own image, wrapped in stray brackets.
38 hours	Lead a readme's relative links into the tree	Bryce Kwon	-5/+59
	A browser resolved them against the about page, where nothing lives now that the page answers 404 below itself. They resolve the way GitHub resolves a readme's links instead, from the readme's directory and on the branch it was read from.
38 hours	Trim readme lines in linear time	Bryce Kwon	-0/+10
	The heading pattern backtracked over a run of spaces in cubic time and the cell trim in quadratic time, so one crafted line in a readme could hold a request for half an hour, well inside the size cap. The heading rule now also keeps a sharp that ends a word, as in "# C#".
38 hours	Hand the about filter the tree url its links need	Bryce Kwon	-2/+24
	With nothing below the about page, a readme's relative links have to be written against the tree, and only cgit knows how this site spells the url of a tree page and which ref the readme was read from. Both reach the filter already escaped for a url, built by the same writer as cgit's own links.
38 hours	Answer 404 for any path below the about page	Bryce Kwon	-11/+22
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
38 hours	Keep the age hook's directory group writable	Bryce Kwon	-0/+20
	The hook forced a 022 umask, so in a repository shared with a group the first pusher owned info/web and every other member's push failed to write the age file there.
38 hours	Keep the cache hook's rm errors from pushers	Bryce Kwon	-0/+34
	Only the exit status was hidden, so a pusher without write access to the cache root saw a permission error per cached page, against what the hook's own comment promised.
38 hours	Trim avatar addresses in linear time	Bryce Kwon	-0/+6
	The trim pattern backtracked over a run of spaces inside an address, which a commit can carry, and a log page runs the filter for every row. Forty thousand spaces took two seconds per row.
38 hours	Refuse every repository when auth-file loses repos	Bryce Kwon	-0/+13
	A repos file the filter could not open read as listing nothing, so a permission slip or a mistyped path made every protected repository public. A line naming a repository with no groups was skipped the same way, where auth-inline's empty list denies everyone.
38 hours	Share the max-blob-size check and its refusal	Bryce Kwon	-0/+13
	Five copies of the test and four of the error page had to agree by hand. The new check pins the four refusals, which no test covered.
38 hours	Name the right file and error in the scan logs	Bryce Kwon	-0/+28
	A failed stat logged the directory rather than the entry inside it, and a project list that failed to read printed strerror of the flag ferror returns, which names an unrelated error.
38 hours	Keep the charset off types that only spell xml	Bryce Kwon	-0/+25
	Matching xml anywhere in the type also caught the Office formats, whose names hold openxmlformats, so a .docx went out with a UTF-8 charset.
38 hours	Skip an indented comment in the mimetype file	Bryce Kwon	-0/+6
	Only a hash in the first column marked a comment, so an indented one was read as the type "#" for every word after it. The manual already describes comments by their first non-blank character.
38 hours	Cache every branch page under cache-dynamic-ttl	Bryce Kwon	-0/+19
	The dynamic ttl only applied when the url named a branch with h=, so the log, tree and refs of the default branch, which never carry one, fell back to cache-summary-ttl. The manual already gives each ttl the scope the code now uses.
38 hours	Keep date-format=local-local from failing pages	Bryce Kwon	-0/+13
	The guard took local as a name that may carry the -local suffix, but git reads local only as a whole alias of default-local and dies on anything after it, so that one value turned every page into a 500.
38 hours	Keep the error of a request that dies mid capture	Bryce Kwon	-0/+29
	The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
38 hours	Gate a readme ending in a colon like a disk path	Bryce Kwon	-0/+10
	trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test.
38 hours	Keep a repository with an empty url ignored	Bryce Kwon	-1/+6
	The field resets at the end of cgit_add_repo cleared the ignore flag that the empty url branch had just set, so such a repository was listed on the index and selectable with ?r=, where every link to it read the byte before its url.
2026-10-01	Keep the version numbers off the pages	Bryce Kwon	-6/+3
	The generator meta, the footer and the patch signature named the exact cgit and git versions on every response, which only helps someone matching a site against an advisory. The shipped server configs already hide the server's own version for the same reason, and `cgit --version` still answers on the host.
2026-10-01	Mark a page behind an auth filter private	Bryce Kwon	-0/+22
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-10-01	Pin the advisory classes with tests and name an empty author	Bryce Kwon	-0/+110
	Each class behind cgit's published advisories now has a check against the current code, from a newline in a file name to shell syntax handed to a filter. The feed also treated an ident with an empty name and an empty address as present and wrote an empty person, which Atom forbids.
2026-10-01	End a request quietly when the client has gone	Bryce Kwon	-0/+16
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-10-01	Send a charset only with a text type	Bryce Kwon	-5/+5
	Archives, packs and the HEAD file went out as octet-stream or gzip with a UTF-8 charset on the end, since only the blob page cleared it. The headers now decide from the type itself, so the two places that cleared the charset by hand no longer need to.
2026-10-01	Leave a branch spelled like an option out of the switcher	Bryce Kwon	-0/+7
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.