Commit 1371d96586
Verified · cmc ci/build: success ci/sonar: success ci/test: success
CHANGELOG.org +17 −1
| @@ -4,7 +4,7 @@ Versioning follows semver from v0.1.0. Database migrations run | ||
| 4 | 4 | automatically on daemon start; upgrade notes appear per release when |
| 5 | 5 | anything beyond "replace the binary and restart" is needed. |
| 6 | 6 | |
| 7 | * v1.31.0 — unreleased | |
| 7 | * v1.31.0 — 2026-09-20 | |
| 8 | 8 | |
| 9 | 9 | The desktop layout (#226): the web UI uses a wide screen. |
| 10 | 10 | |
| @@ -98,6 +98,22 @@ A web UI sweep. | ||
| 98 | 98 | - =.pathbar= actions sit on the centre line with the ref and the |
| 99 | 99 | crumbs. |
| 100 | 100 | |
| 101 | The SonarCloud dashboard is at zero (#238). Four of its 38 findings were | |
| 102 | real; the rest are dismissed with their reasons recorded on the | |
| 103 | dashboard. | |
| 104 | ||
| 105 | - A trailing-slash redirect cannot leave the site. =net/http= fills | |
| 106 | =URL.Scheme= and =URL.Host= from an absolute-form request line, which | |
| 107 | RFC 7230 requires a server to accept, so =GET http://evil.example/cmc/= | |
| 108 | answered =301 Location: http://evil.example/cmc=. A browser sends | |
| 109 | absolute form only to a proxy, so nothing reached this through one | |
| 110 | directly. | |
| 111 | - The global search, repository search and register forms no longer | |
| 112 | carry =autofocus=, which moved focus past the heading, the result | |
| 113 | count and the search page's filters. The diff line-comment box keeps | |
| 114 | it: that form renders only after the reader asks for it on a line, | |
| 115 | and with no JavaScript nothing else carries focus across the reload. | |
| 116 | ||
| 101 | 117 | * v1.30.0 — 2026-09-19 |
| 102 | 118 | |
| 103 | 119 | Every command runs on every surface, markup previews before it is |