cgit, branch main

cmd/cgitd: HTTP server for cgit CGI

2026-04-14T14:17:11Z

This program can be built into single binary, provides as an alternatives to common setup that require second application (web server with their own configuration).

cache: truncate lock file before filling

2026-04-13T17:04:38Z

lock_slot() opens the lock file with O_RDWR|O_CREAT but without O_TRUNC. If a previous cgit process was killed between lock_slot() and unlock_slot() (e.g. by a CGI timeout or OOM), the stale lock file remains on disk with the old content, and the kernel releases the fcntl lock. The next process to claim the same cache slot then opens this stale lock file, acquires the fcntl lock, writes its key and generated content on top of the old bytes. If the new response is shorter than what was previously in the file, trailing bytes from the old response survive beyond the end of the new content. fstat() in fill_slot() reports the total file size (including the stale tail), and print_slot() faithfully sends all of it -- producing a response that is the correct page followed by a fragment of whatever previously occupied that lock file. Fix this by truncating the lock file after acquiring the lock and before writing the new key. Signed-off-by: Jason A. Donenfeld

cgit: override die routine globally

2026-03-10T21:19:00Z

We don't get any return value from compile_grep_patterns calling compile_regexp_failed, causing the default die routine to print to stderr and then for cgit to exit ungracefully. Instead override the default die routine to show a normal error page. Perhaps compile_grep_patterns ought to change upstream to return an error. But this commit here will handle future issues as well, so perhaps not a bad idea to do anyway. Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004982.html Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004983.html Reported-by: Adrian C. Reported-by: Aiden Woodruff Signed-off-by: Jason A. Donenfeld

ui-log: allow link following to be disabled per-repo

2026-02-24T10:49:35Z

This exists for other CPU heavy operations like blame, but doesn't for the follow functionality. Add it for that. Signed-off-by: Jason A. Donenfeld

Bump version

2026-02-24T01:44:41Z

Signed-off-by: Jason A. Donenfeld

ui-log: don't free diff object when outputting diff

2026-02-24T01:36:59Z

In git 2.36, the logic for diff_flush() changed, resulting in our object getting freed, which led to following renames producing garbage commits until it eventually crashed. Fixes: bb02e24 ("git: update to v2.36.0") Signed-off-by: Jason A. Donenfeld

css: round border edges for deco

2026-02-23T23:39:05Z

Signed-off-by: Christian Hesse

css: highlight line in diff...

2026-02-23T23:39:05Z

... specified in the URL, with a curved arrow ahead of the line number. Signed-off-by: Loïc Signed-off-by: Christian Hesse

Makefile: fix uninstall to remove filters

2026-02-23T23:39:05Z

Signed-off-by: Christian Barcenas Signed-off-by: Christian Hesse

Makefile: fix uninstall to remove js and robots.txt

2026-02-23T23:39:05Z

Signed-off-by: Christian Barcenas Signed-off-by: Christian Hesse