index : cgit

cgit - Changelog
================

Notable changes to this fork, newest release first. History before v2.0.0
belongs to upstream cgit and is not covered here.


v2.12.1 (2026-11-08)
--------------------

A testing and hardening release. The test suite now fails a page that breaks
instead of passing anything that does not crash, the mailmap is held to
max-blob-size, and a review of the tests closed the bugs it found, from a
followed diff that took in small.cpp with small.c to clone urls split in two at
a space. Logins now need virtual-root to be a path, so read the upgrade note
under Changed before deploying.

Added
.....

* make test runs every script and ends on one summary line for the whole run,
  rather than stopping at the first script that fails, and README says how to
  run the tests.
* CGIT_TEST_REQUIRE names prerequisites a run must not skip, so a release run
  fails where a tool it relies on is missing.
* tools/build-release.sh passes further arguments on to make, so its binary can
  be tested as built and a Lua that pkg-config cannot find can be named for it.

Changed
.......

* Upgrade note: the auth filters send a visitor back only to a target that
  starts with a single slash, so logins need virtual-root to be a path, as it is
  by default.
* The tests check the status, the error log and the end of each page they
  request, and the tests that could not fail as written now can.
* MANUAL says the message and description limits count bytes and names the notes
  and .gitmodules as read whole.

Fixed
.....

* The auth filters' redirect check looked at the first two characters alone, so
  it accepted https://evil.example/ and javascript:x. That was safe only because
  cgit signs no url outside virtual-root.
* A mailmap was read whole on every page, so a pusher could make every page of a
  repository read as much as they liked. It is now held to max-blob-size.
* A followed diff took in every path that began with the one asked for, so
  following small.c also showed small.cpp. Whatever path was given, its
  diffstat header read (limited to '').
* A repository url with a space in it was listed as two clone urls, and the
  links of clone urls and submodules carried spaces and bytes past ASCII
  unencoded.
* The plain, snapshot and blob pages sent a download name past ASCII raw, which
  a client may read as ISO-8859-1. It now also goes as filename*,
  percent-encoded in UTF-8.
* about-render gave a heading such as "Twice 1" the same anchor as the second of
  two headings "Twice", so a link to the later one landed on the earlier.
* The index page came out short for a negative offset.
* A directory named as a cgitrc or include was refused only when reading it
  failed, which not every system guarantees.
* A max-stats value that names no period turned the statistics page off without
  a warning.
* The cache hook left pages asked for with an escaped url, such as
  url=foo%2bbar.git/, cached and stale until their ttl ran out.
* The age hook, run by hand from a terminal, waited on a question no one could
  see and then kept the old date.


v2.12.0 (2026-11-07)
--------------------

A usability release. The README gains a quick start, cgit warns about more
config mistakes, the pages are easier to use by keyboard and screen reader
without looking any different, and an audit closed the bugs it found, from diffs
that showed a renamed file added whole to avatar icons that leaked the page's
url. The server configs shrink to short generic drop-ins and the scan cache
starts afresh, so read the two upgrade notes under Changed before deploying.

Added
.....

* README has a quick start, the packages the build needs, a map of the source
  tree, how to check a setup from a shell, and the options renamed since
  upstream cgit.
* MANUAL has a contents list, and its entries say what 0 and negative values
  do, which global settings a repository can override, which settings have to
  come before scan-path, what the log's count columns cost and when a
  commit-graph file speeds up the log.
* cgit logs a warning naming the file and line, or the path, for a cgitrc or
  include it cannot read, a word where a setting expects a number, a snapshot
  format name that matches nothing and a repository that will not open.
* The login form says when logins are unavailable, when a signed-in visitor
  has no access to the repository and when the page is not served over https.
  The auth filters log a failed login with the name but never the password,
  and every extension logs a Lua module it falls back without.
* The server configs show HTTPS and smart HTTP clone and push through
  git-http-backend as commented examples.
* A repository listed in cgitrc without repo.desc shows the first line of its
  description file, as a scanned one already did.
* The index marks its sorted column with aria-sort, a keyboard can reach and
  scroll the hex dump and the stats table, and forced colours mark the changed
  lines of a side-by-side diff.

Changed
.......

* The server configs in custom/servers are short generic drop-ins included
  from the server's own main config: an nginx server block, an Apache virtual
  host and a lighttpd snippet. The standalone configs, with their compression,
  catch-all hosts, security headers and per-distribution setup, are gone.
* Upgrade note: a site built on the old server configs keeps working, so
  compare the new ones before replacing them.
* The cached scan is keyed on every setting the scan uses, so configs that
  scan differently keep lists of their own.
* Upgrade note: the first request after upgrading scans again, and the old
  rc-* files under cache-root are no longer read and can be deleted.
* scan-path lists repositories in path order, compared as case-sensitive-sort
  says, rather than in the order the directory hands them back.
* A negative cache-scan-ttl keeps a scanned list for good, and a negative
  cache-size turns the scan cache off along with the page cache.
* cgit.conf is read before Git's Makefile as well as after it, so a Git option
  such as NO_REGEX set there takes effect. A += line in it now appends twice,
  which repeats a flag but does no harm.
* A snapshot link for a ref with a slash in its name uses a dash in its place,
  as in demo-release-2.0.tar.gz, and the archive unpacks into the
  repository's own prefix.
* The tree view shows at most the first 64 KB of a binary file as a hex dump,
  with a link to the whole file.
* Blame is offered only for regular text files within max-blob-size.
* An error page's title leads with the error, and a page pinned to a commit
  names it with the page, as in "tree @ abc1234 - repo - site".
* The tag table heads its second column Commit when the repository has no
  snapshot formats, and the logo's alt text is root-title.
* A protected repository's login page shows the site's description instead of
  the repository's, names no owner and asks not to be indexed.
* A Lua filter's print writes where html does, so its output lands in place.

Fixed
.....

* The diff, rawdiff and patch of a renamed file showed it added whole.
* The patch link of a large diff between two commits led to a patch of the
  newer commit alone.
* The blame page's folder crumbs, and its "^" link on lines from the commit
  that created a file, led to 404 pages.
* Snapshot links for a ref with a slash in its name answered 404.
* Two configs sharing a cache-root read one scanned list, so strict-export and
  trust-scan-config could leak from one to the other. The cached list also
  dropped a repository's own branch-sort, module links and turned-off filters,
  and wrote the description placeholder as a description.
* A negative cache-scan-ttl rescanned on every request.
* An empty repository's Atom feed was an HTML page.
* A mistyped repository url said "No repositories found", a submodule path said
  "Bad object id", and a log search with no match showed an empty table.
* While the auth filters' state directory was missing, the login form came out
  without fields and with its error inside an attribute.
* auth-inline.lua's docs pointed auth-filter at the copy make install
  overwrites, which made protected repositories public again on the next
  install, and both auth filters' docs said repository name where they match
  the url.
* Avatar icons sent the page's url to Gravatar or Libravatar as the Referer.
* On phones, long ref labels, email addresses and paths pushed the page
  sideways, and listing dates split at a hyphen, which also happened at
  tablet width.
* about-render restarted a numbered list at 1 after a blank line or a code
  block.
* robots.txt also blocked files whose names start with blame or snapshot.
* The build claimed to link a named Lua that pkg-config could not find, and
  gave no reason when it left Lua out.


v2.11.1 (2026-10-31)
--------------------

A bugfix release for v2.11.0, which crashed on the log and summary pages of
any repository with enable-mailmap on.

Fixed
.....

* The log and summary pages of a repository with enable-mailmap on crashed,
  as releasing the walk also freed the mailmap cgit keeps for the whole
  request. The patch and stats pages could free memory twice when git failed
  to start their walk.
* The syntax highlighter left a file whose extension is in capitals, such as
  MAIN.C, without colour.
* A page served uncached because its cache slot could not be written showed
  its title twice.
* A scan logged "Unable to read the owner" with "Success" as the reason for
  each repository whose owner has no passwd entry.
* tools/build-development.sh probed the compiler named by CC for sanitizers
  but built with cc, and tools/build-release.sh left its probe files behind
  in the temporary directory.
* Some tests with an exec filter failed now and then, depending on whether
  cgit or the filter ran first.


v2.11.0 (2026-10-31)
--------------------

A release that cuts cgit back to a lean core. Nearly 300 commits take out dead
code, repeated logic and stale comments across the sources, the stylesheet,
the extensions, the tests and the docs, and fix the bugs found on the way. The
caches now lock with flock throughout, so read the two upgrade notes under
Changed before deploying, above all on a cache-root shared between hosts.

Added
.....

* tools/build-release.sh builds on macOS as well as on Linux and the BSDs. It
  probes its linker flags as it already did its compiler flags, and keeps full
  RELRO wherever the linker offers it.
* tools/build-development.sh uses whichever sanitizers the compiler offers,
  falling back to UndefinedBehaviorSanitizer alone where AddressSanitizer is
  missing, as on OpenBSD.
* make get-git fetches, checks and unpacks git's tarball with the tools each
  system ships, curl, wget, fetch or ftp, and sha256sum, shasum, sha256 or
  openssl, piping xz to tar where tar cannot read it.

Changed
.......

* The page cache and the cached repository list take the same lock, an flock
  on a lock file opened close-on-exec. A request that finds a slot or the list
  being rebuilt by another no longer logs "Unable to lock slot", while a real
  failure to open, lock or write a lock file is logged with its path.
* Upgrade note for Linux: a scan by the old binary still running when the new
  one starts holds an fcntl lock that flock does not see, so one rebuild of
  the repository list can be written by two processes at once. Delete the
  rc-* files under cache-root once the new binary is in place, or upgrade
  while no scan runs.
* Upgrade note for NFS: on a mount with local_lock=flock or local_lock=all,
  flock stays on each client, so hosts sharing one cache-root can rebuild the
  same repository list at once, as the page cache always could. Give each
  host a cache-root of its own on local disk.
* The command line switches --repo, --page, --head, --oid and --ofs are gone.
  They were undocumented, --query covers them, and --repo never selected a
  repository.
* syntax-highlight.lua colours a file only when Scintillua's detect() names a
  lexer for it, and no longer guesses from the file extension. A Scintillua
  without detect() leaves every file uncoloured but escaped.
* about-render.lua no longer puts a data-lang attribute on fenced code or a
  manpage class on man pages, since nothing styled or read either.
* A line range such as #n10-n20 scrolls to where a single line lands, rather
  than three quarters of the way down the window.
* The truncation link of a side-by-side diff is underlined like the unified
  one, and the login error takes the colour of the other error messages.
* An empty repository's page no longer draws a Clone heading over no rows when
  clone-url expands to nothing, which matches the summary page.
* A corrupt repository whose root tree is missing lists as empty instead of
  answering 404.
* The diff page names a revision that is not a commit as the request wrote
  it, and --version prints cgit in lower case.
* The test suite writes its configs through shared helpers, and its duplicate
  checks are gone.

Fixed
.....

* The sample cgitrc placed scan-path ahead of about 30 settings that must
  come before it, so uncommenting it where it stood silently dropped those
  settings for every scanned repository.
* With enable-commit-graph and follow both on, the log labelled the age column
  Graph and lost its Age header.
* The stats page dropped commits made on the window's first day earlier than
  the time of the request.
* The stats page handed a path starting with a colon to git as pathspec
  magic, which the log, patch and feed pages refuse.
* A snapshot of a repository whose url is ".git" or empty read past a buffer
  while working out the snapshot's name.
* The age labels skipped every other age when they moved to a coarser unit,
  leaving some stale until the next pass.
* post-receive.cgit-age printed an error and exited non-zero when it could not
  write the age file. Like the other hooks it now says nothing and exits 0.
* The auth filters failed every login on Lua 5.3 and later when
  session_seconds was not a whole number, and accepted a few malformed
  spellings of a valid cookie.
* Filters and snapshot compressors inherited a stray copy of a cache slot's
  lock, a refresh that could not take its lock went unlogged, and a slot whose
  key could not be written stayed locked through the uncached render.
* On FreeBSD, NetBSD and OpenBSD the build left Lua out, because those systems
  name its package lua-5.4 or lua54.
* Small leaks on the tree, refs, page header, log, snapshot and history walk
  paths are closed.
* The docs stated a few defaults and behaviours wrongly. virtual-root now
  reads as defaulting to SCRIPT_NAME followed by a slash, and
  enable-version-info, project-list and the server configs' asset links are
  described as they work.
* Two filter tests passed without their filter running, and several checks
  matched text other than what they were after.


v2.10.0 (2026-10-29)
--------------------

A release that squares off the interface and brings its colours up to WCAG
AA, with a readme renderer that copes with more of what projects ship and an
example hook that keeps the commit-graph current.

Added
.....

* enable-version-info, off by default, puts cgit's version in the footer, the
  generator tag and the signature of patches, with git's beside it in the
  footer.
* custom/hooks/post-receive.commit-graph writes the commit-graph and its
  changed path filters after each push, which speeds up the log, blame and
  graph pages and any log limited to one file.
* The readme renderer makes a heading of a paragraph underlined with equals
  signs or dashes, starts a code block at four spaces or a tab, and keeps an
  escaped pipe inside its table cell.
* tools/build-development.sh builds cgit for debugging, unoptimised and held
  to git's developer warnings, with AddressSanitizer and
  UndefinedBehaviorSanitizer linked in. With clang and ctags it also leaves a
  compilation database and a tags file in build/.

Changed
.......

* Controls, tabs and labels have square corners. The radius tokens stay, set
  to zero, so a theme can still round them.
* Every text colour reaches 4.5:1 on the backgrounds it sits on, row stripes
  included, and links inside running text are underlined.
* Form controls have a border of 3:1 contrast, and every link and control
  shows the same focus ring.
* Every framed box and table grid has the same mid grey border.
* The diff and stat options panel has its caption as a header strip, with
  the selects and the button sharing one column.
* Page titles name the page first, then the repository and the site, so
  tabs, history and search results can tell the pages apart.
* A signed tag's signature prints as part of its message again, as it did up
  to v2.9.1, rather than folded away.
* The syntax highlight colours are tokens, so a theme can change them like
  the rest.
* The scripts load with defer. A site script placed after cgit.js can still
  call window.cgit.
* The post-receive.cgit-cache hook drops only the pushed repository's pages
  and the index. It finds the repository's url from scan-path or
  hooks.cgiturl, and clears everything as before when it has neither.
* The example server configs name the release they were written for, nginx
  1.30, Apache httpd 2.4 and lighttpd 1.4.
* tools/release-build.sh is now tools/build-release.sh, and CHANGELOG.txt is
  now CHANGE.txt.

Fixed
.....

* A long hash or download name made the whole page scroll sideways on a
  phone. Both may now break.
* A readme holding a NUL byte lost everything after it. Each NUL now shows as
  U+FFFD.
* A markdown link opening with a mix of slashes and backslashes, which a
  browser follows to another site, now renders as text, as one opening with
  two slashes already did.
* Man pages written by DocBook, pod2man or by hand leaked roff onto the page.
  Their escapes, comments and preambles now draw nothing, the common named
  characters render, and .EX, .Vb, .TP and the alternating font macros lay
  out as intended.
* In forced colours, such as a Windows high contrast theme, the active tab
  and the lines a URL names had no mark. They now take the reader's Highlight
  colour.
* A screen reader announced the graph and links columns with no name.
* The commit page offered diff options for an octopus merge, which draws no
  diff.
* Error text such as "Path not found" sat further in than the rest of the
  page.


v2.9.2 (2026-10-25)
-------------------

A polish release for narrow screens and for the finer details of the pages,
with the summary's columns lined up, a login that says when it failed and a
signed tag's signature folded away.

Added
.....

* A wrong username or password brings the login form back with a message
  saying so, where it used to come back empty. Both auth filters carry it, an
  unknown user is told the same as a wrong password, and the button now sits
  under the fields. The README names the hooks, form.login and p.login-error.
* A signed tag's signature, PGP, SSH or X.509, is folded away under the tag's
  message in details.signature, rather than printed as part of the message.
* The syntax highlighter colours CSS properties and pseudo-classes, which
  Scintillua's css lexer tags with names it had no colour for.
* Links, rows and buttons fade between colours, and the line highlight fades
  in, unless the reader asks for reduced motion.

Changed
.......

* On a narrow window the tabs stay on one row and scroll sideways with the
  active tab in view, rather than wrapping a tab or two onto a second row.
* On a narrow screen each commit detail sits under its label, and a phone
  leaves out the diffstat's file modes. The summary keeps its log counts on a
  phone, so its rows still line up.
* List rows highlight under a mouse only, so on a touch screen the last row
  tapped no longer stays highlighted.
* The logo is brighter in dark mode.
* The diffstat bars are drawn as SVG, so a strict Content Security Policy no
  longer has to allow inline styles, and the diffstat box has room inside its
  border.

Fixed
.....

* The summary's sections disagreed on how many columns its table had. With
  the default config the log and clone rows stopped short of the table's edge,
  on a phone the log rows did with any config, and the summary and refs pages
  were invalid HTML.
* A commit's branch and tag labels were joined to the last word of its subject,
  so a narrow cell broke the line before that word and stranded another.
* A download link and its signature could break across lines mid-name.
* The rule above the code on the blob and blame pages, and the line highlight,
  ended at the longest line of a short file rather than at the page's edge.
* A commit that changes no files drew an empty diffstat frame.


v2.9.1 (2026-10-24)
-------------------

A bugfix release for the tree and blame pages, whose line numbers had drifted
away from the code since v2.0.0 in Safari and in every browser on a typical
Linux desktop, until the code sat dozens of lines below its number at the end
of a long file.

Added
.....

* A character a browser would start a new line at, though git does not, is
  shown as an escape sequence in span.escape on the tree and blame pages and
  by the syntax highlighter: a carriage return with no line feed after it, a
  vertical tab, a form feed, next line and the Unicode line and paragraph
  separators.

Changed
.......

* Patches end with the cgit version again, written as git writes its own, so
  this release signs them "cgit 2.9.1". The footer and the generator tag still
  carry no version.

Fixed
.....

* The code beside the line numbers was set in the browser's own monospace
  font, which made each of its lines a little taller than its number, by a
  pixel in Safari and on Linux, so the two columns drifted apart down every
  file.
* A lone carriage return started an extra line in every browser, and U+2028
  and U+2029 did in Safari, each pushing every later line below its number.
* The line highlight sat a pixel low, covered only the digits of each number,
  and ended at the edge of the view on a file scrolled sideways.
* Code in a readme took the browser's own monospace font, Courier in Chrome
  and Safari, rather than the theme's --font-mono.


v2.9.0 (2026-10-17)
-------------------

A compatibility and hardening release. Lua 5.5 is supported, readmes render
closer to how GitHub shows them, the auth examples were overhauled, 32-bit
builds compile again, and two audits of the extensions and of the C code
closed what they found, from a cache lock that an exec filter let go of to
a log search that was never the literal match it claimed to be.

Added
.....

* Lua 5.5, detected when building and claimed by every extension, which
  needs luaossl 20260910 or later there.
* Stable markup hooks for site themes: a data-page attribute, named sections
  and a class per link kind.
* Readmes follow GitHub more closely: relative links lead into the tree at
  the readme's own ref, lines of a paragraph run together, a table may cut a
  paragraph short, a wrapped list item stays in its list, urls and addresses
  in angle brackets link, backslash escapes and character references are
  honoured, underscores inside words are left alone, and headings get the
  anchors GitHub gives them. Images and badges are left out.
* The auth examples bind a session to the account's password hash, so a
  changed password ends it, use a __Host- cookie where one can be set, turn
  down passwords past 256 bytes unchecked, spend a missing account's login on
  a real hash, load their libraries only when a request needs one, and say
  which hash kinds each system's crypt checks.
* Avatars are looked up by SHA-256, offered at twice the size to dense
  screens, marked decorative, and left out when luaossl is missing.
* The syntax highlighter finds a script's lexer from its shebang line.
* make get-git checks the Git tarball against the SHA-256 kernel.org lists.
* The dumb transport answers HEAD from the ref store and the index dates a
  repository from its reftable, so reftable repositories clone and age.

Changed
.......

* enable-trailers is now enable-commit-trailers.
* The bundled Git is 2.56.0.
* The pages carry no version number, and the Lua-less build is checked by
  the suite as well.
* Any path below the about page answers 404, the about filter is handed the
  tree url its links need, and the about redirect keeps the query string.
* The dumb transport serves only what a clone asks for, a loose object, a
  pack with its index and info/http-alternates, sends each file with its
  size and keeps none of them in the cache.
* A page behind an auth filter is marked private, and every page that
  follows a branch takes cache-dynamic-ttl.
* summary-branches, summary-tags and max-ref-count read a negative value as
  no limit, and the feed refuses pathspec magic as the log does.
* patch, rawdiff and signature downloads hold to max-blob-size, and a
  readme past it says so on the about page.
* Diffs no longer ask xdiff for a minimal result, which cost quadratic time
  on a reordered file, and tar.xz snapshots are compressed on one thread.
* The cache slot lock is an flock, which outlasts an exec filter's swap of
  stdout where the record lock did not.
* Git is built without translations or Tcl, the release script builds with
  the compiler it probed, the two builds no longer share vendor/git at once,
  sparse checks the sources as gnu17, and a musl build is documented.
* The example tracker links in link-commits.lua and link-trailers.lua ship
  commented out, so an unedited copy links object names alone.
* The manual, README and sample cgitrc say what the code does: every page
  and query parameter, every file make install puts in place, the defaults
  and value syntax, and which filters get the repository variables.

Fixed
.....

* 32-bit builds, where Git 2.55's size_t object sizes no longer compiled.
* The log search matched as a regular expression after all, so a term with
  a bracket in it answered a 500 and a crafted one took the memory of the
  box.
* A pushed date or zone outside what git's date code accepts, and a notes
  ref pointing at anything but a tree, ended the summary, refs, log, commit
  and feed pages of the repository.
* A snapshot name led to a branch spelled like the tag's stem, members
  of a snapshot named by its suffix alone started at a slash, and a missing
  PATH refused every compressed snapshot.
* The plain view answered twice for duplicate tree entries and read a freed
  mimetype on the way, a control byte in a file name made the web server
  refuse the download, a scanned defbranch could name a path outside the
  repository, and the error page resolved the very id it had refused.
* A fill whose last flush failed to write, on a full disk for one, left the
  visitor a blank response, a cache ttl in the tens of millions of minutes
  overflowed, and an empty list reached qsort as a null, which glibc's
  sanitizer build aborted on.
* Links built from the repository url and the feed link's branch were not
  encoded, a readme vanished behind an annotated tag, a followed log lost
  its root commit and paged by the wrong name, a Lua build crashed when git
  wrote before cgit's own setup, text was cut inside a multibyte character,
  and the tag page offered snapshots of trees and blobs.
* An absolute symlink target was linked as a path inside the tree, a chain
  of single directories ended in a dangling separator, a repository without
  a path was dated from a file named "(null)", a NUL ended a config comment
  early, and a tree row was left open when a link target could not be read.
* An empty repo.url is ignored, a readme ending in a colon is gated like a
  path on disk, an error mid capture keeps its message, date-format=
  local-local renders, an indented comment in the mimetype file is skipped,
  types that only spell xml get no charset, the sendfile loop stops at a
  short slot, slot keys and pages are read and written in full, and the
  stats page stops after its error page.
* auth-file.lua refuses every repository when it cannot read its repos file,
  cookie, readme and avatar parsing run in linear time, the cache hook keeps
  its rm errors from pushers, the age hook leaves its directory writable to
  the group, a Lua script may write while it loads, and every Lua filter
  failure is named in the log.
* Git read the global config for its trace settings before cgit isolated
  the environment, so every request probed $HOME/.gitconfig.
* make DEVELOPER=1 passes: string literals sit behind const pointers and
  callbacks are passed by address.


v2.8.0 (2026-09-16)
-------------------

A feature and hardening release. Commit trailers get a table of their own, the
mailmap is applied everywhere a person is named, the per-repository filter gate
gives way to a trust switch for scanned repositories, and an audit closed every
crash and every request that could reach git unchecked.

Added
.....

* Commit trailers shown as a table under the message, behind enable-trailers.
* trailer-filter, with link-trailers.lua linking Fixes, Reverts, Closes, Bug and
  bare URLs.
* The .mailmap at HEAD applied to every ident and search, behind enable-mailmap.

Changed
.......

* enable-filter-overrides became trust-scan-config, gating only the risky keys a
  scanned repository's own cgitrc or git config can set.
* A request may name a revision only by hex id or ref name, and the log search
  matches literally.
* A die inside git answers a 500 page and logs the reason.
* The static ttl covers only the pages whose content the id fixes.
* One phrase and status for a bad object id or a revision that is not a commit.
* A scan path that is itself a repository is named after its directory.
* The tag page shows the tagged object's full id.

Fixed
.....

* Crashes on a repository without a path, an unknown page name, an empty url, a
  repo.* key after scan-path, a broken git config in a scanned repository, an
  unparsable commit and a history with a missing parent object.
* A full cache disk no longer fails every cacheable request, and an error mid
  page finishes the page instead of starting a second response.
* Revisions, paths and snapshot names can no longer reach git as options,
  pathspec magic or archive members outside the extraction directory.
* Filters answer one error page when they cannot run, start with SIGPIPE at its
  default and no longer leave a page half written when they exit early.
* Limits hold for a diff limited to a directory, a large symlink target and a
  deep chain of single directories.
* The about page no longer serves the repository's own files beside a readme on
  disk.
* Snapshots of dash-named tags, a missing compressor, nested tags, dumb clones
  of an empty repository, a symlink cycle under the scan path, the fallback
  default branch, a blank line in mimetype-file and a POST body arriving in
  pieces all answer correctly.
* Commit encoding, trailer splitting, notes lookup, subject truncation, ref
  decorations and statistics buckets render correctly in their edge cases.
* Two builds of the same sources are byte for byte identical.


v2.7.1 (2026-09-08)
-------------------

A bugfix release. A tag's snapshot names no longer depend on how git happens to
store its ref.

Fixed
.....

* Snapshot names shed a tag's leading v reliably again. On a case-insensitive
  filesystem a freshly created tag kept the v until git packed the refs, so the
  same tag could change its snapshot names over time.


v2.7.0 (2026-09-08)
-------------------

A configuration release. The badly named keys are renamed, the statistics switch
folds back into max-stats, the parser now reports what it ignores, and the theme
toggle is gone.

Added
.....

* Unknown or misplaced configuration keys are reported to stderr instead of
  being dropped silently.

Changed
.......

* noheader became enable-header, with its polarity flipped.
* noplainemail became enable-plain-email, with its polarity flipped.
* cache-root-ttl became cache-index-ttl.
* cache-repo-ttl became cache-summary-ttl.
* cache-scanrc-ttl became cache-scan-ttl.
* agefile became age-file.
* renamelimit became rename-limit.
* repo.extra-head-content became repo.head-content.
* Old key spellings are not read and draw the unknown-key warning.
* max-stats enables the statistics page and bounds its coarsest period again, as
  it did before v2.2.0.
* enable-stats and repo.enable-stats are gone.
* repo.max-stats=0 turns the statistics page off for one repository.

Removed
.......

* The header theme toggle. The light and dark theme follows the system
  preference alone, and a saved choice in localStorage is no longer read.
* Selects no longer submit their form the moment they change. The diff and stats
  panels always show their reload button instead of keeping it for readers
  without scripting.

Fixed
.....

* A lua filter that fails now answers with an error page naming the script and
  the error, where before the page was fed back into the broken filter and the
  visitor got an empty response.


v2.6.1 (2026-09-01)
-------------------

A small release. Every clone row is now a link a browser can follow, and the
diffstat graph drops the output's last inline style, so a strict
Content-Security-Policy needs no exceptions.

Changed
.......

* Clone rows are links. The ssh, scp and git forms cannot be followed by a
  browser, so those rows point at the first http url in the clone list, or at
  the repository page when there is none, and the scp form stays out of the
  document head since it is not a URI.
* The diffstat bars take their width from colspan on a fixed-layout table rather
  than from inline styles. A site pointing css= at a stylesheet of its own needs
  the new inner graph table rule from cgit.css, or the bars render as equal
  width segments spaced apart.


v2.6.0 (2026-08-28)
-------------------

A cleanup release. Output is ASCII only and deterministic, the statistics page
drops its language breakdown, and two bugs a cross-compiler review found are
fixed.

Added
.....

* README.txt documents how cgit urls are built, both url forms, every query
  parameter, the endpoints that are not pages, and worked examples.
* tests/README.txt describes the suite layout, numbering and traps.
* Pages carry a meta description, from the repository or root description.
* Submodule links resolve through .gitmodules, and submodule rows are set apart
  in the tree listing.

Changed
.......

* Output is ASCII only. The truncation marker is an ellipsis, the title path
  separator is plain, and unrepresentable bytes print as a question mark.
* Non-breaking space padding is done with CSS.
* Pages are byte for byte deterministic. The footer drops its clock and an empty
  atom feed is dated at the epoch.
* The charset is spelled UTF-8 everywhere.
* Snapshots use registered media types, so application/gzip, application/zip and
  application/zstd replace their x- forms.
* Status lines use the standard HTTP reason phrases.
* Table header and image attributes follow the usual order.
* Test scripts are renumbered into themed ranges and prefer POSIX forms.

Removed
.......

* The statistics page no longer breaks the tree down by language. The built-in
  extension table was a standing maintenance cost, classifying by extension
  misleads, and the tree walk it needed was the only part of the page reading
  object sizes. The commits-per-author table is unchanged.

Fixed
.....

* The statistics page no longer reads past its argument list when given a path.
  The array handed to git's revision setup lacked a trailing null, so a url such
  as /repo/stats/dir read whatever followed it on the stack.
* A detached head stays selected in the branch switcher. Browsing at a raw
  commit or tag left it resting on the first branch, so switch moved away.


v2.5.0 (2026-08-23)
-------------------

A correctness and conformance release. The generated markup moves fully to
HTML5, cgit stops emitting HTTP headers a front-end server should own, the page
cache and repository scan get real locking, and pages pinned to a commit now say
so.

Added
.....

* Pages pinned to a commit via the id parameter show it. The branch switcher
  gains a "(detached)" entry, the page title carries the short hash, and the
  path strip gains a rev crumb linking back to the branch tip.
* The shipped server configs gain Permissions-Policy, cross-origin isolation
  headers and form-action in the CSP, and enable HSTS. The nginx config adds
  catch-all blocks that drop requests for hostnames the site does not serve,
  since cgit keys its cache on Host.
* Operators get log lines for two previously silent failures, a cache too small
  for its keys and a repository scan lock that fails for reasons other than
  contention.
* The documentation now spells out that the cache directory must be pre-created,
  owned by the web server account and mode 0700.
* Login forms carry autocomplete hints for password managers, and avatar images
  load lazily.

Changed
.......

* Atom feeds conform to the RFC. They are served as application/atom+xml with an
  XML declaration, invalid bytes are replaced instead of emitted, and every
  entry carries an author name.
* Dates render as HTML time elements with strict ISO 8601 values.
* Markup is fully HTML5. Complete documents everywhere, real table header cells,
  no XHTML self-closing slashes and no HTML comments in the output. The plain
  directory listing gets a doctype so browsers leave quirks mode.
* cgit no longer sends Last-Modified, Expires or ETag. Front-end caching policy
  lives in the server configs, which now append headers rather than replace
  cgit's own.
* Only a full object id qualifies for cache-static-ttl, since the id parameter
  accepts any rev git can resolve.
* Percentages in the diffstat bars and language table print from integers, so a
  filter that switches the numeric locale cannot corrupt the output.
* URL encoding is tightened. Ampersands and plus signs are percent-encoded in
  paths, and query strings are escaped at each sink instead of being
  pre-escaped.
* The responsive breakpoints only hide or restack chrome and never change font
  sizes or gutters. Narrow screens drop the search box, branch switcher and
  author columns, and diff tables scroll inside their own box.
* The client-side age refresher uses the same bucket arithmetic as the server,
  so refreshed ages no longer drift from rendered ones.
* The example agefile hook was renamed to post-receive.cgit-age.

Removed
.......

* The repository homepage feature, including repo.homepage, the gitweb.homepage
  mapping and the homepage tab.
* The post-update.update-server-info example hook.

Fixed
.....

* Error pages are no longer cached, so requesting a commit before it is pushed
  can no longer pin a 404 into the cache forever.
* An abandoned cache fill no longer appends a second page to the response,
  publishes its lock file or leaves a stale copy to be served.
* A crashed repository scan no longer freezes the index forever. Scan and cache
  locks are fcntl locks released by the kernel with the process, and lock
  holders re-verify their lock file after acquiring it, closing a race that
  could truncate a live file.
* Blobs containing a NUL byte anywhere are treated as binary in tree and blame
  views, and the raw path substitutes replacement characters instead of
  truncating at the NUL.
* An annotated tag whose tagger has no email no longer passes NULL to the email
  filter, repositories without an owner no longer render an empty link,
  single-page logs drop the pager, and filler rows use correct colspan values.
* The dev preview server splits CGI headers at the earliest blank line, so DOS
  line endings in page output no longer swallow the document head.


v2.4.0 (2026-08-08)
-------------------

A performance and robustness release. Output is buffered instead of written
fragment by fragment, the hot paths shed repeated work, and a cluster of fixes
closes crashes reachable from repository-controlled content.

Changed
.......

* The bundled Git is updated from 2.54.0 to 2.55.0, with NO_RUST set so Cargo
  does not become a silent build requirement.
* Page output is collected in a 64 KB buffer and written in whole blocks instead
  of one write per HTML fragment.
* Blame and tree line numbers, hex dump rows and intra-line diff highlights are
  emitted in batches rather than per line or character.
* The diff view renders each file while it is already open and replays it after
  the diffstat, replacing a second full tree walk.
* Blame reuses a commit's rendered detail across its entries, the index resolves
  repository ages once before sorting, and the stats page computes its period
  labels once.
* Side-by-side tab expansion is a single pass, where it was previously quadratic
  on tab-heavy lines.
* Search queries are clamped to 512 characters, bounding the matching work one
  request can demand and the size of cache keys.
* The sources compile as gnu17 so their meaning does not drift with compiler
  defaults, and the release script probes each hardening flag, preferring
  FORTIFY_SOURCE level 3.

Fixed
.....

* A repository under scan-path could supply its own module-link template, which
  was handed straight to printf. Surplus conversions could crash cgit or read
  stack memory into the page. Templates are now expanded manually.
* Sorting branches by age crashed when a branch ref pointed at a tag or tree
  object.
* Hunks whose header omits a length, as git writes for single-line hunks, were
  numbered from zero in side-by-side diffs and lost their links.
* A request whose cache key was too long to read back could never hit,
  regenerating the page every time while still writing an unusable slot. Such
  requests now skip the cache and log it.
* Git config isolation ran from a constructor attribute that some compilers
  silently discard. It now runs from main.
* A memory leak of deferred side-by-side lines and an integer-truncation bug in
  the stats author ordering.


v2.3.0 (2026-08-05)
-------------------

A consolidation release focused on how the project is laid out, deployed and
operated. Everything an operator ships or edits now lives under custom/, the
server configs became complete standalone files, and the hooks and auth filters
were hardened.

Added
.....

* New enable-relative-dates option, default 1. Set to 0 to always show calendar
  dates in the age columns instead of elapsed times.
* New date-format option controlling those calendar dates, accepting git's date
  format names plus strftime formats.
* New example hook post-receive.cgit-cache that clears cgit's output cache after
  a push, so new commits appear immediately instead of after the cache TTL.
* New CGIT_EXTRA_CFLAGS make variable applying extra compiler flags to cgit's
  own objects only, not the bundled git.

Changed
.......

* The tree was reorganized. The git submodule moved to vendor/git, and the
  example cgitrc, Lua filters, hooks and server configs moved into custom/.
  Operators following old paths must update them.
* Repositories with no commits get a dedicated page with working clone URLs
  instead of a bare notice with dead tabs.
* A description file still holding git's "Unnamed repository" boilerplate is
  treated as no description.
* The theme is applied before first paint, so pages no longer flash the wrong
  theme, and the header no longer shifts as the page loads.
* The nginx, Apache and lighttpd configs are complete, runnable files carrying
  their own top-level directives, rather than snippets assuming a distro base.
* The agefile hook uses committer dates from branches only, writes atomically
  and keeps its output readable by the web server. The update-server-info hook
  likewise forces a safe umask.
* The auth filters' secret moved from /var/cache/cgit to /var/lib/cgit, so
  pruning the cache no longer invalidates every live session.
* The dev preview server forwards cookies, referers and request bodies, so the
  auth filters can be exercised locally, and decodes escaped repository names.

Removed
.......

* The built-in help page and its enable-help option.
* GitHub Actions CI, the release workflow and the make dist target.

Fixed
.....

* Ordinary working trees found by scan-path are listed as repo instead of
  repo/.git.
* The auth filters match cookie names containing pattern magic characters, and
  auth-file tolerates a users file saved with CRLF line endings.


v2.2.0 (2026-07-25)
-------------------

A hardening release that puts explicit ceilings on the work a single request can
provoke, reworks the statistics page, and overhauls the bundled Lua filters.

Added
.....

* The stats page gains a language breakdown, sizing the tree at HEAD by file
  extension without ever loading blob contents.
* New enable-stats option, default 0, as the dedicated switch for the statistics
  page.
* New max-patch-count option, default 50, bounding how many commits the patch
  view emits as a series.
* New about-filter script about-render.lua, a server-side renderer for markdown,
  man pages and plain text, falling back to escaped text when its dependencies
  are missing.
* New make dist target staging the release tarball, so local and released
  tarballs are identical.

Changed
.......

* max-stats no longer enables the stats page, it only bounds the coarsest
  period. Instances relying on it must now also set enable-stats=1.
* The auth filters are hardened. Cookies are Secure by default, redirect targets
  are validated so a login cannot bounce to another origin, password checks are
  constant time even for unknown users, and a protected repository with no
  resolvable users denies everyone.
* The avatar filters skip missing addresses instead of hashing garbage,
  normalise the rest, and expose size, style and URL settings.
* link-commits.lua takes a user-editable list of pattern and URL rules instead
  of a hardcoded issue reference, resolving all matches in one pass.
* The syntax highlighter falls back through an extension map when lexer
  detection fails and emits its plain-text fallback in slices instead of one
  full-size copy.
* The masthead reserves the logo column so the header no longer shifts while the
  logo loads, and the logo and favicon were redrawn at higher resolution.

Removed
.......

* The client-side markdown renderer and the enable-markdown option. Rendered
  readmes now require about-filter pointed at about-render.lua.
* The PDF documentation targets.

Fixed
.....

* A file name containing a quote could break out of the link attributes in
  side-by-side diffs. Paths are now percent-encoded.
* A commit with no message no longer crashes the history views.
* max-blob-size also bounds the diff path, so a huge blob is reported as binary
  instead of inflated into memory, and dangling refs are skipped instead of
  dereferenced.
* The diff size caps are no longer silently disabled when follow is active.
* The header branch switcher respects max-ref-count instead of emitting an
  option per branch on every page.
* zstd snapshots run single-threaded, so one request cannot fan out across every
  core.
* The stats walk is pruned by date instead of visiting all history, and a commit
  whose date cannot be represented is dropped rather than indexing a month table
  out of bounds.
* The cache listing bounds its key output, and a malformed cgitrc line no longer
  discards the rest of the file.
* The build no longer triggers a section-alignment warning on every macOS link.


v2.1.0 (2026-07-19)
-------------------

A release about behaving well on large repositories and under a strict
Content-Security-Policy. Syntax highlighting moves out of the browser and into
an optional server-side filter.

Added
.....

* New max-ref-count option, default 200, capping how many branches and tags each
  refs section lists, with independent pagination on the dedicated branch and
  tag pages.
* New max-diff-files option, default 200. A commit touching more files renders
  only its diffstat, with a notice pointing at the per-file diffs and the patch
  view.
* New max-diff-lines option, default 1000. A single file exceeding it within a
  whole-commit view links to its own diff page instead of rendering inline.
  Single-file diffs, rawdiff and patch are never capped.
* An optional server-side syntax highlighter, syntax-highlight.lua, built on the
  Scintillua lexers with around 120 languages, degrading to plain escaped text
  when its dependencies are absent.
* A built-in help page documenting the site's URL patterns, behind the new
  enable-help option. Removed again in v2.3.0.
* URL fragments highlight the targeted source line in blob and blame views,
  support ranges like #n5-n12, and land the target mid-viewport.

Changed
.......

* The auto-submitting select controls drop their inline onchange handlers and
  are wired up from cgit.js, so the option forms work under a CSP without
  unsafe-inline.
* A plaintext readme keeps its line structure instead of collapsing into a
  run-on paragraph.
* Syntax highlighting of source views moved from the browser to the optional
  filter. Without a source-filter, code is served plain, and the client-side
  highlighter is deleted.
* Font sizes were evened out across the interface, and the external-link icon
  follows the tab's text color in both themes.
* The mobile layout hides the author and size columns, the search form and the
  branch switcher, so nothing forces sideways scrolling.

Removed
.......

* The owner-filter hook and its per-repository override. Owners always render as
  plain linked text.

Fixed
.....

* Release binaries no longer ship with an empty version string when git describe
  fails in a shallow clone.


v2.0.0 (2026-07-16)
-------------------

First release of this fork, cut from upstream cgit v1.3.1. The page chrome is
rebuilt as semantic HTML with dark mode and a phone layout, the runtime sheds
its external interpreters and crypto libraries, and around two dozen security
and correctness fixes land.

Added
.....

* Built-in client-side syntax highlighting in cgit.js for roughly 33 languages,
  used when no source-filter is configured.
* Built-in client-side markdown rendering for about pages behind the new
  enable-markdown option, restricted to safe link and image targets.
* A light and dark theme with a toggle cycling auto, light and dark, persisted
  in localStorage and invisible without JavaScript.
* A responsive layout for phones and small screens, with stacking panels and a
  repository index that collapses to name and age.
* New enable-tree-group-dirs option listing directories before files in the tree
  view.
* New enable-cache-list option, default 0, gating the previously unprotected
  cache listing page.
* A fully commented example cgitrc listing every option at its default, and
  complete nginx, Apache and lighttpd examples with security headers.
* An example post-update hook running update-server-info, needed because the
  built-in clone support speaks dumb HTTP.
* tools/serve.py, a dependency-free local preview server, and
  tools/release-build.sh, a hardened Linux release build.
* CI covering gcc and clang, the test suite under ASan and UBSan, sparse, and a
  hardened PIE build, plus a tag-triggered release workflow shipping hardened
  tarballs with checksums.
* Accessible names on the search field, branch switcher and breadcrumb
  navigation, and contextual titles on the nav tabs.

Changed
.......

* max-blob-size defaults to 10 MB instead of unlimited, and now caps everything
  cgit reads into memory to serve, including plain and blob output. Oversized
  objects return a 413 page.
* section-sort defaults to 0, so the order repositories are written in cgitrc is
  respected rather than alphabetized.
* Repository age on the index is derived from HEAD instead of a hardcoded
  refs/heads/master, so repositories on main show an age.
* The page chrome is semantic HTML instead of nested tables, keeping the
  existing class and id names so custom themes still match.
* The filter scripts moved to a Lua-only set. simple-authentication.lua became
  auth-inline.lua, file-authentication.lua became auth-file.lua and
  commit-links.sh became link-commits.lua.
* Lua is optional and autodetected through pkg-config, preferring LuaJIT.
  NO_LUA=1 forces a self-contained binary.
* The sources were reorganized into source/, libraries/, assets/, extensions/,
  examples/, tools/ and tests/, with all generated output under build/.
* The auth filters compare cookie HMACs in constant time, set SameSite=Lax, and
  strip header injection from Set-Cookie and Location values.

Removed
.......

* OpenSSL is no longer a build dependency, and libcurl is not required.
* Every Python filter script, including the Pygments highlighter, the markdown
  and rst converters and the Python gravatar filter.
* The Gentoo LDAP auth filter, owner-example.lua, about-formatting.sh and the
  man and txt about converters.
* The unused name query parameter and the never-read cache-max-create-time and
  max-lock-attempts settings.

Fixed
.....

* An unauthenticated arbitrary file write through the log id parameter, which
  reached git's revision parser as an option. Revisions beginning with a dash
  are rejected.
* Cache poisoning through a spoofed Host header. The scheme and host are now
  part of the cache key.
* Stored XSS from about pages, which were written as raw HTML when no
  about-filter was configured. They are now escaped.
* Two path traversals, one past the about-path prefix check via a sibling
  directory sharing a name prefix, and one through a crafted HEAD ref.
* max-blob-size is enforced before a blob is read into memory, not after.
* A signed-comparison bypass of the authentication POST size limit, and an
  unbounded history walk from a crafted ofs value, now clamped.
* Every snapshot was undecompressable whenever a global git config existed,
  because git's error output was compressed into the archive.
* Numerous crashes, among them out-of-bounds accesses on short paths and empty
  URLs, NULL dereferences on odd blobs and authorless commits, a division by
  zero in the diffstat and undefined ctype behaviour on negative chars.
* Truncated pages after stat-only diffs and binary blames, a 200 instead of a
  404 for unknown blob paths, submodule hashes losing digits in diffs, pager
  links dropping search terms containing reserved characters, a missing updated
  element in empty atom feeds and negative ages from the age refresher.