#+title: gitbay changelog Versioning follows semver from v0.1.0. Database migrations run automatically on daemon start; upgrade notes appear per release when anything beyond "replace the binary and restart" is needed. * v1.23.0 — unreleased The web design foundation (#218). Tokens measured in both schemes, one control family, content widths per page, and the landing, repository overview, merge request and settings pages recomposed. Set =[web] title= to =gitbay= in lower case; the templates already are. - =style.css= rewritten on tokens defined on =:root= and again for dark; =TestTokenContrast= enforces the floors and =TestEveryTemplateClassHasARule= that every template class has a rule. - Buttons are primary, secondary, quiet or destructive; one focus ring on everything; success and error flashes share one shape. - Every page picks a width: wide for code, reading for lists and threads, bounded for forms. - The repository header shows description and topics on the code tab only; the overview leads with the file table and puts clone commands and facts after the README; "Find file" is "Search code". - A merge request states who merged or closed it under its title and explains an empty diff. - Repository settings are bounded rows with a consequence beside each control, a saved flash, a rejected value kept, and topics as one field. - Landing copy says what the product is and where to go; the register form says to paste the contents of the key file and links [[SSH-keys]]. * v1.22.1 — 2026-09-13 One merge gate fix. - =require-checks= no longer refuses a merge request head that carries no statuses when nothing was going to report one: a repository with no =.gitbay/ci.yml=, or one whose jobs all wait on a schedule or a tag, had no mergeable merge request and no remedy but turning the setting off. A head whose config carries a job a push runs, and a head in a repository that has recorded a status before — which is what reporting from outside through =status set= looks like — is still refused (#216). * v1.22.0 — 2026-09-12 The CLI output sweep (#183). The rules are on the wiki's Users page, under "Output rules". - A bad invocation prints the command's registered usage, the one source of it; the hand-written copies are gone. - The =gitbay= CLI pads list rows into aligned columns at a terminal and leaves the tabs alone when piped. - An empty list prints nothing on stdout and =nothing to list= on stderr. - Every refusal (exit 4) says what to do instead. - =status list= and =repo topics= print rows. - =admin runners remove=; =forget= stays as an alias until the next release. - A missing positional argument prints the hint and the usage line (#215). * v1.21.0 — 2026-09-12 The web UI/UX sweep (#182). - Destructive controls ask for the object's name typed beside the button: release delete, snippet delete and file remove, team delete, label remove, and SSH key, email and PGP key removal. Reversible controls keep a plain button. - Login returns to the page that asked for it, and says so. - One timestamp format everywhere, =2006-01-02 15:04 UTC=. - Tags on the refs page and in the release form are in version order, newest first. - The file editor explains up front when signed commits or merge-requests-only protection would refuse the commit, answers 404 for a branch that does not exist, and says when a path is new. - Merge refusals name the strategy rather than the flag; an issue closed by a commit reads "closed by in commit ". - Repository settings: every Save names its field. Labels: the colour column appears only when it means something. Sidebars use one shape for empty. List rows show the state only under "all" and say "in ". Global search counts its results. A merged MR shows its merged head and a deleted source branch. The repository home shows the SSH clone URL beside HTTPS. The settings page names =auth token create=. * v1.20.1 — 2026-09-11 One config check. - A negative =limits.max_snippets_per_user= is refused at config load, as =max_repos_per_user= and =max_bytes_per_user= already were; it used to pass validation and read as unlimited (#214). * v1.20.0 — 2026-09-11 Snippets (#195): named text files a user owns outside any repository, shared by URL and edited in place. - Migration 0054: =snippets= and =snippet_files=. - =snippet create|show|list|edit|delete= and =snippet file set|get|remove=. Files are UTF-8 under =limits.max_snippet_bytes= (1MB), at most 64 per snippet; a snippet keeps at least one. =limits.max_snippets_per_user= (0, unlimited) caps how many an account may own, admins included. Visibility =public=, =unlisted= (default) or =private=; a private snippet is not found to everyone but its owner and admins. - Web: =//-/snippets= lists, each snippet page renders its files with a raw route per file, and the owner creates, edits and deletes from the page through the same commands. The owner page links to the list. * v1.19.0 — 2026-09-11 Labels and milestones an org defines once for every repository under it, and =Closes owner/name#N= acting across repositories (#203). ** Org labels and milestones - Migration 0052: =labels= and =milestones= rows belong to a repository or to an org, exactly one, with a partial unique index per scope. Existing rows and their memberships keep their ids. - A repository owned by an org sees the org's labels and milestones beside its own; =issue label --add=, =issue milestone= and =mr milestone= resolve the org's row first. A repository cannot create, recolour, remove, close or reopen a name its org holds; the refusal names the org command. - =org label set|list|remove= and =org milestone create|list|close|reopen=, for org admins. Creating a name that repositories under the org already use folds them in: their issues and merge requests move to the org's row and the repository rows go. =repo transfer= into an org folds the same way. Counts on org rows span the repositories the caller can read. - Web: read-only =//-/labels= and =//-/milestones=, linked from the org page; an "org" mark on repository label and milestone pages, whose forms act on repository rows only. - =label list= and =milestone list= JSON carry =org: true= on an org row. ** Cross-repository closes - =Closes owner/name#N= in a commit on the default branch, or in a merged merge request's title or body, closes that issue when the actor holds write on the target and the pushing key's scope allows it: a deploy key never acts outside its binding. An unknown or refused target does nothing and logs nothing; the text stays a plain autolink. An archived target is refused. Bare =owner/name#N= without a keyword stays display-only. ** Store - A migration whose first line is =-- foreign_keys: off= runs on one pinned connection with foreign keys off, re-enabled afterwards and =foreign_key_check= required empty. Rebuilding a table other tables reference loses the children's rows otherwise, even under =legacy_alter_table=. ** Behaviour changes - =milestone create= exits 1 on a duplicate title, as =org milestone create= does; it exited 2 before. Upgrade: replace the binary and restart; migration 0052 runs on start and copies every label and milestone row once. * v1.18.1 — 2026-09-11 A runner that cannot hang on a dead connection, SSH keys with names, and dependency updates. ** CI runner - Every ssh invocation carries =ConnectTimeout=10=, =ServerAliveInterval=15= and =ServerAliveCountMax=3=, placed after the identity and the operator's =-ssh-opts= so an operator's value wins. A claim whose TCP session had died under it blocked a laptop runner's poll loop for thirteen hours; it now fails within a minute and the loop resumes. - The build comment in =deploy/Containerfile.ci= stages the file in the runner user's home before =podman build=: a login shell under =su= cannot read root's stdin and does not share root's =/tmp=. ** Keys - SSH keys carry a label (migration 0051). =keys add --label= defaults to the authorized_keys comment; =keys label []= renames or clears it. =keys list=, =admin user show=, =repo deploy-key list= and the settings page show it. Deploy, runner and admin-created keys take the comment as their label. Closes #208. ** Web - Org autolinks stop before trailing punctuation: a bare URL closing a sentence or a parenthesis no longer takes the =.=, =,= or =)= into the href. Closes #209. ** Dependencies - golang.org/x/crypto 0.57, x/image 0.46, x/net 0.59, x/term 0.46. Closes #205. * v1.18.0 — 2026-09-10 What the first real job on a user's runner needed. A twice-daily archive pull that had run on the server's host moved into a container and then onto a laptop, and each hop found a gap. ** CI runner - A secret with newlines — a private key — reaches the build. An env file has no escape for one, so such values are named on podman's command line with =--env NAME= and valued in the podman process's own environment; the value touches neither argv nor the file. - =GITBAY_SSH= in every build's environment: the instance's ssh destination as the build reaches it. Under podman the host's own addresses belong to the container (pasta), so a loopback remote is rewritten to the address pasta exposes the host at. A job that publishes back to the instance uses the variable rather than guessing. Inside a container =ssh= expands =~= from the passwd entry, not =$HOME=; keep a build's ssh config in the workspace and pass =-F=. - =-identity= drops the user's =~/.ssh/config= (=-F /dev/null=): =IdentitiesOnly= kept identities the config named, so a laptop runner authenticated as the user's own full-scope key and, on an admin's machine, could claim every repository's builds. A first-seen host key is accepted, since a service cannot answer a prompt. - A schedule tick queues nothing while the job's last build is pending or running, matching the push path. A repository no runner served gained one row per tick forever. A finished build does not suppress the tick; a schedule re-runs an unchanged commit on purpose. #206 - =admin runners forget = drops a key's heartbeat row; the key stays. =admin runners= rows are the repositories a key may claim. - The bay1 unit names no =-repos=: the runner key's attachments are the boundary. =gitbay-ci:2= carries =python3-venv= and =sqlite3=, since it is also the default image for every repository the runner is attached to. ** Decisions - Claim order stays oldest-first across everything a key may claim; a repository that must never wait on another gets a runner of its own. #207 - No per-account cap on queued builds and no schedule floor: with the tick dedupe a repository with no runner holds one row per scheduled job, and a busy schedule spends its owner's compute. #206 - Attaching a runner is =n/a= on iOS: the key lives on the machine that runs builds. ** Documentation - Users: =GITBAY_SSH=, ssh's home inside a container, the =ci.yml= caps (ten jobs, fifty steps, 4096 bytes a step, 64 KiB a file) and where a broken config shows up. Admin, CI and Threat-Model follow the changes above. ** Upgrading Replace the binaries and reinstall the CLI. No migration. A runner started with =-identity= (every runner =gitbay-runner init= set up) now ignores =~/.ssh/config=; a runner that relied on it for a =ProxyJump= or an alias passes the equivalent in =-ssh-opts=. Homebrew: =brew upgrade krz/tap/gitbay-runner=. * v1.17.0 — 2026-09-09 CI without the operator's compute: a runner anyone installs and attaches to their own repositories, and the server rule that makes that safe. The rest of the #184 list besides. ** CI - A runner key claims builds only for the repositories it is attached to. =repo runner add < key.pub= attaches one; a key the server has not seen lands on the caller's account with scope =runner=. =repo runner list= shows each attached key with its last poll and the build it holds; =repo runner remove = detaches it. All three on the settings page. A runner-scoped key with nothing attached claims nothing, whoever owns it; a full-scope admin key still claims any repository. =runner log= and =runner done= refuse a build outside the key's attachments. #184 - Closed: any account could add a runner-scoped key, and =runner next= with no arguments handed it the oldest pending build on the instance, secrets included. - =runner next --untrusted=: without it a merge request head from a fork is never claimed. The runner passes it when started with =-untrusted=; the bay1 unit does, because it isolates in podman. - =gitbay-runner init= generates a key under =~/.config/gitbay-runner/=, writes =config.toml= beside it, and prints the public key with the command that attaches it. The runner reads that file when present and flags override it. =-identity=, defaulting to the generated key, makes ssh and git use the runner's own key and no other. Homebrew: =brew install krz/tap/gitbay-runner=, then =brew services start krz/tap/gitbay-runner=. Releases ship =gitbay-runner= binaries. - =admin runners= heads its output with the queue: builds pending now, and over the last day the builds claimed, the wait to claim (average and worst) and the builds the reaper ended instead of a runner reporting them. Rows are per key, with the fingerprint and the repositories the key may claim. Migration 0049. #184 - Stop tests for the runner's drain: a signal mid-step, the drop-in's =KillMode= and =TimeoutStopSec=, and a transient systemd user unit where one exists. #179 - The CI wiki page carries every push shape against every job kind and what dedupe, path filters, schedules and the reaper make of it, with a test per row. #176, #177 ** Importing - =import-issues --api-base= reads Forgejo instances: paging by =limit=, oldest first, comments read once, attribution and pull heads taken from the API base rather than github.com. #191 ** Documentation - Users: "Your own runner". Admin, Threat-Model, CI, FAQ and Parity follow the attachment rule. ** Upgrading Replace the binaries and reinstall the CLI. Migration 0050 (runner attachments; the runner heartbeat table is rekeyed by key and emptied), applied on start. One behaviour change: a runner polling with a key of scope =runner= claims nothing until a repository admin attaches it with =repo runner add=. Do that right after the restart. A full-scope admin key is unaffected. Merge request heads from forks are built only by a runner started with =-untrusted=. * v1.16.0 — 2026-09-08 What stops a stranger from moving here: the repository plumbing and the team gates the #185 walk found missing, twelve merge requests merged as one stack. ** Repositories - =repo settings default-branch = moves HEAD and the record; a branch that does not exist is refused. A first push of =master= or =trunk= into a fresh repository moves the unborn HEAD to the branch that arrived, so the clone checks something out. Settings page select. #189 - =repo rename =: the row and the directory move together, with transfer's revert on a failed move. Clone URLs change. #190 - =repo settings require-mr on=: an existing protected branch refuses every direct push in pre-receive, =repo commit-file= and the web editor included; =mr merge= is its only writer. Creating the branch is still a push. #197 - =repo settings protect-tag = (and =unprotect-tag=): matching tags are created once and refuse moves and deletion. Separately, a tag a release is anchored to refuses both while the release exists, protected or not; delete the release first. #201 - =repo access list= reports effective access: one row per account with the highest role and where it comes from (owner, direct, org admin, org member, team). It used to list direct grants only, so a repository reached through teams answered with nothing. #200 - Removing an org member drops their team memberships in the same transaction. They kept every grant their teams carried, and re-adding them to the org restored nothing because nothing had gone. #196 - An outsider gets one answer about an org: its existence and members are public, its teams are for members, and =org team list= and =show= refuse a non-member rather than say the org does not exist. Ref #200 - A repository name may not end in =.atom=, as it may not end in =.git=. Ref #192 ** Merge requests - A push that leaves the merge request's diff unchanged keeps its fresh reviews: the patch-id of each revision against its own merge base is compared, and a rebase onto a target that moved on no longer stales every approval. A push that changes the diff stales them as before. #198 - The merge gates are one computation shared by =mr show= (a =gates= block: approvals counted and required, owners outstanding per file, open threads, checks, whether a fast-forward is possible), the merge request page, and =mr merge=, which names every unmet gate in one refusal rather than the first. =mr review= reports =counts= and says when a verdict is advisory because the reviewer cannot write. #199 ** Notifications - =@name= in an issue, merge request, comment or diff comment files "mentioned you" in that account's inbox and makes them a participant of the thread, provided they can read the repository and have not muted it. Watchers are not told about a mention addressed to someone else. Migration 0047. #202 - =notifications settings mail on|off= (and =show=): inbox rows are filed either way, this is the mail half. Login links are not activity and still arrive. The account page carries the same switch. Migration 0048. Ref #194 ** Web - Atom feeds: =/{owner}/{repo}/releases.atom=, =/{owner}/{repo}/log.atom[/{ref}]= and =/{owner}/activity.atom=, rendered over the rows the pages already serve. The owner feed covers public repositories only, since a reader carries no session; a private repository answers 404. The releases, log and owner pages carry the discovery link. #192 ** Documentation - The Users page says what differs over stock ssh: a multi-word value needs a second layer of quotes, and =help = replaces =--help=. The companion-wiki paragraph #170 made stale now points at =.gitbay/wiki/=. #204 ** Upgrading Replace the binary and reinstall the CLI. Two migrations (0047, the mentions table; 0048, the per-account mail switch), applied on start. Nothing changes behaviour until a setting is turned on: =require-mr=, =protect-tag= and =mail off= are all opt-in. * v1.15.0 — 2026-09-07 Builds run in containers, a rebase is not rebuilt, and a runner restart no longer strands the build it was running. ** CI - A build's steps run in a rootless podman container, one per job. The runner clones outside the container with its key and bind-mounts the workspace in, so a step cannot reach the key, the runner's environment, or another build's workspace. =image:= is required per job and is validated as a reference, never pulled: an operator provisions images on the host. A runner configured for podman that has none refuses to start rather than fall back to the host. =-isolation none= is the explicit host-execution mode. =-cpus= and =-memory= cap a build's container. #144 - Builds have a home directory that outlives the build, so the Go module cache and the sonar scanner survive between runs. It is mounted into the container at the same path, and only that directory. Ref #144 - The host preparation script, the unit drop-in and the weekly image prune ship with =make deploy-runner=; each hardening flag the drop-in relaxes carries the reason in place. Ref #144 - A nightly canary on the runner host proves the boundary holds: =cmc/ci-smoke= runs a job that tries to read the key and list sibling workspaces, and fails if either succeeds. Ref #144 - Dedupe keys on the commit's tree, not its sha. A rebase that changes nothing is not rebuilt: the new commit gets the earlier success as its status, naming the build. Scheduled and tag builds carry no tree and are never reused. #177 - =vuln= and =sonar= run nightly on =main= rather than on every push; neither could inform a merge. Branches run =build= and =test=. #177 - A rewritten branch is filtered against the merge base rather than the old tip, so a rebased branch whose own commits change code no longer reads as a docs-only push and skips its jobs. #176 - A build whose runner's log stream ended with no outcome is failed two minutes later, instead of sitting =running= until a fixed deadline. Migration 0046. Ref #179 - The runner retries reporting a finished build's outcome, four times over about thirty seconds, when the server is unreachable. A gitbayd restart at that moment used to lose the result. Ref #179 - The runner drains on SIGTERM: it claims nothing more, finishes and reports the build in flight, then exits. A second signal exits at once. The unit allows fifty minutes. #179 ** Repositories - =repo show= reports the caller's watch and bookmark state, and the parent of a fork when the caller can read it. #178 - =repo unwatch= clears the row from either state; =repo mute= is the explicit silence. Watch then unwatch used to leave an account below the default with no way back. The web header toggle follows. #180 ** Upgrading Replace the binary and reinstall the CLI. One migration (0046, the build log's close time), applied on start. The runner now defaults to =-isolation podman= and refuses to start without a working podman and a named image. Prepare the host with =deploy/runner-podman-setup.sh= and build =localhost/gitbay-ci:1= from =deploy/Containerfile.ci= before deploying it, or pass =-isolation none= to keep running steps on the host. Validate on a scratch repository with =-repos= scoped to it first; the wiki's Admin page has the procedure. The runner's unit gains =TimeoutStopSec=50min= and =KillMode=mixed= so a stop reaches the runner alone and it can drain; under the default kill mode systemd ends the build's container with the runner. =make deploy-runner= therefore waits for a build in flight. * v1.14.0 — 2026-09-06 Logging into the web without an SSH key, wikis inside the repository, CI that skips what a change does not touch, and the browser catching up with the command line on nine capabilities. ** Accounts and the web - A browser session can be requested by mail: the login page takes a username or a verified address and sends a link that works once and expires in fifteen minutes. An account with no SSH key had no way into the web at all. The response never says whether the account exists, and the form appears only when the instance has SMTP. #155 - A login link resolves to any verified address on the account, not only the primary. #158 - Login mail is queued rather than sent from a goroutine, so a link in flight survives a restart. #159 - A suspended account cannot mail itself a session, and a link minted before suspension opens nothing. #156 - The session cookie is =SameSite=Lax=, and a test now walks every mutating route to assert it carries the origin check. #157 - =POST /register= is reachable on an open instance again. ** Wikis - A wiki lives at =.gitbay/wiki/= on the default branch, so editing one is editing a file in the repository — a push, or the web editor — and it is cloned, diffed and reviewed like anything else. The companion =.wiki= is gone. #170 ** CI - Path filters: =paths= and =paths-ignore= per job, so a docs commit does not run the whole suite. #169 - A branch's first push derives its diff base from the merge base rather than treating every file as changed. #171 - A job filtered out records a skipped status instead of nothing, so =require_checks= cannot wait forever for a check that will never arrive. #172 - A force-push no longer leaves queued builds pointing at an object that is gone; the orphan is cancelled when a runner claims it. #152 - A build step's environment is constructed rather than inherited. It was =os.Environ()= plus the build's variables, which handed repository content everything set on the runner service. A step now gets =PATH=, =HOME=, =LANG=, =CI=, its =GITBAY_*= variables and its secrets. =HOME= is the workspace, so a build cannot read the runner's =.netrc=, =.npmrc= or =.gitconfig=, where tools keep credentials. Ref #144 - A runner host can be prepared for rootless podman: =deploy/runner-podman-setup.sh=, the systemd changes it needs, and weekly image pruning. Nothing reads them yet; the preparation ships before the runner that requires it, on purpose. Ref #144 ** Collaboration - =mr review request --add = asks a particular person for a review, who then carries it in their queue and is notified; =--remove= withdraws the ask. The queue was computed from involvement alone, so a collaborator who had not touched a thread heard nothing. #145 - Bookmarks save someone else's repository to come back to, and the count is the instance's only popularity signal. Separate from pins rather than a flag on them: a pin is private quick access to your own work and drives the rail, a bookmark is public and counted. =repo bookmark=, =repo unbookmark=, =repo bookmarks=, a control on the repository header, the count in the facts bar, and =/bookmarks=. Read access is all a bookmark needs, and one made while a repository was public drops out of the listing if it goes private. #146 ** The browser catches up Nine capabilities that were CLI-only and had no reason to be: - label management — list, create, colour, remove #163 - dependency status under the toggle that turns checks on #164 - release delete #165 - the account export bundle, as a download #166 - organization create and rename; delete stays CLI-only, wanting a typed confirmation, and the page says so #167 - opening a merge request from a fork, with a source picker offering the branches of every fork you can push to #168 - forking a repository #174 - cancelling a queued or running build #162 - the profile form #161, and a markup picker on issue and merge request create #160 - admin table headers align with their columns #151 ** CLI - =gitbay mr rebase = replays a merge request's branch onto its target and re-pushes it. A repository requiring signed commits accepts only fast-forward merges, so a merge request whose target moved had to be rebased by hand; the refusal already named the procedure and this runs it. The git work is local, so the replayed commits carry your signature — the server still holds no key. A branch in a fork is refused, naming the repository to run it in. #175 ** Security - Mutating commands are bounded per account in the dispatcher, so SSH, the JSON API and the web spend one budget and a caller cannot refresh it by changing surface. Authentication failures were throttled; commands were not. #148 - A dead-lettered mail is logged by its queue row id, not the recipient address, and the relay's error is redacted before logging because a rejection quotes the address it rejected. The address stays on the row, where =/admin= shows it. One rule for every mail type. #173 - The 2026-09 sweep's coverage — and what it did not reach — is recorded in the wiki's Threat-Model rather than in a closed issue. #149 ** Dependencies - goldmark 1.8.6, sqlite 1.58.0. #140 ** Upgrading Replace the binary and reinstall the CLI. One migration (0043, bookmarks), applied on start. =limits.write_rate= defaults to 60 mutating commands a minute per account. A script that writes faster will be refused with exit 4 and a retry time; raise it in =[limits]=, or slow the script. Read-only commands, the runner protocol and the host CLI are not counted. A companion =.wiki= repository is no longer read. Move its pages to =.gitbay/wiki/= on the default branch. Runner isolation is half done. Builds still run as the runner's user with no container: the step environment no longer leaks the service's, and a host can be prepared for podman, but nothing yet executes a build in one. Do not enable CI for repositories you do not trust. #144 stays open for the execution half. * v1.13.3 — 2026-09-05 Only a writer's review decides a merge gate, and a scan of one branch stops overwriting another's results. - =mr review= resolves with =CanRead= and applied no further check, and the merge gates counted every fresh verdict. On a public repository that let anyone with an account satisfy =require_approvals= — defeating four-eyes review by holding two accounts, which on an instance with open registration means defeating it outright — and equally let a passer-by block a merge the owner wanted, with no override and only a force-push to clear it. Both were confirmed against a running instance. Reviewing stays open to every reader, because an outside opinion on a public change is worth having; it no longer decides the gate. What does is write access, the same question the gates already answer. An uncounted review is marked advisory by =mr show= and by the merge request page, both reading the same rule, so the page cannot show an approval the gate ignores. #147 - The two =git upload-pack= spawns behind the smart HTTP transport now resolve git at start-up like everything else. The v1.13.2 rewrite matched a plain identifier for the context and these pass =r.Context()=, so it skipped them. #153 - CI analyses each branch as itself. Every scan was recorded against the project's main branch whatever branch produced it, so a feature branch replaced main's results — a branch that removes findings made main look clean before the fix merged, and one that added them made main look broken when it was not. #154 Replace the binary and reinstall the CLI. No migration. A repository relying on approvals from accounts without write access will find those merges now refused. That was the defect: such an approval never meant the repository accepted the change. Grant write, or name the reviewer in CODEOWNERS and grant write, if their approval is meant to count. * v1.13.2 — 2026-09-04 The first SonarCloud scan's findings: eight fixed, the rest triaged and dismissed with reasons. - A pages directory redirect could leave the site. Both redirects passed the raw request path to =http.Redirect= while the cleaned path sat a line above; =net/url= keeps a leading =//=, and Go emits =Location: //evil.example/= unchanged, which a browser reads as protocol-relative. Reaching it needed a public repository named like a host under the subdomain's own owner — repository names permit dots — so it was narrow rather than impossible. The destination is built from the cleaned path through =url.URL= now, which also settles the two spellings the first fix missed: a =..= that escapes to the root, and a backslash, which browsers following the WHATWG rules treat as a separator. #153 - The runner's default workspace was =/gitbay-runner=: a fixed name in a world-writable directory, created with =MkdirAll=, which succeeds against a directory whoever already owns it. bay1 was never exposed — its unit names a workspace — but the default is what anyone running the binary by hand gets, and this is the process that clones repositories and exports build secrets. The default moves under the user's cache directory, the workspace is created 0700, and a symlink or a directory owned by someone else is refused. One we own that is merely too permissive is tightened rather than refused, since every runner before this one made it 0755 and refusing would take the runner down on upgrade. #153 - Logout and flash consumption expire their cookies with the attributes the setting calls used. Deletion worked either way; the difference was a reviewer's puzzle, and four findings. #153 - The topics-remove field has a label. A placeholder is not an accessible name. TestEveryInputHasAnAccessibleName is the guard that was missing, and it knows both associations — six inputs use ==, which is as good as for/id. #153 - git and ssh are resolved once at start-up rather than searched on every spawn, and gitbayd refuses to start when one is absent instead of failing on whichever request first needed it. This was 74 of the 118 findings; a dashboard that is mostly permanent noise is one nobody reads. #153 Also: SQLite migrations are excluded from analysis. They were read as PL/SQL, where ='' is NULL=, so =WHERE col = ''= on a =NOT NULL DEFAULT ''= column — correct SQLite, and the shape used throughout — read as a null-comparison bug. Replace the binary and reinstall the CLI. No migration. A runner whose workspace is group- or world-readable will have it tightened to 0700 on next start, and will refuse to start if that workspace is a symlink or belongs to another user. * v1.13.1 — 2026-09-04 A command that reads its payload from stdin says so, and SonarCloud runs alongside the vulnerability scan. - =repo secret set= blocked with nothing printed, which is indistinguishable from a hung connection, and pressing Enter did not end it because the server reads to EOF — so it looked the same before and after the value had been typed, and the secret echoed into the scrollback on the way. A terminal is now told what is wanted and that Ctrl-D ends it; a secret is read without echo and takes one line, so Enter is enough. Piped input is unchanged, byte for byte: =printf %s "$TOKEN" | gitbay repo secret set ...= still sends exactly the token. Applies to =keys add=, =auth pgp add=, =repo deploy-key add= and =release asset add= as well; public keys keep echoing, since they are public. #150 - A =sonar= CI job reports to SonarCloud, alongside =vuln=. Report-only: it does not gate a build, unlike the vulnerability scan. A merge request from a fork builds without secrets by design, so the job says why it is skipping there rather than failing on a missing credential. Only =SONAR_TOKEN= is secret and it is a build secret; the organization, project key and host are checked in. Ref #149 Replace the binary and reinstall the CLI. No migration. * v1.13.0 — 2026-09-04 Collaboration. A review is composed and submitted as one thing, a merge request can say it is not asking yet and can show what changed since you last looked, issues are searched by their text, and the events half the mutations never recorded now exist. - A review is composed as a unit. =mr diff-comment --pending= holds a comment back; =mr review= publishes the batch with the verdict and says how many went with it; =mr review --discard= throws away what was never submitted. A pending comment notifies nobody when written — the review is the announcement, and it names its own size — and does not gate a merge, since a thread only its author can see is one nobody else could resolve. #111 - =mr create --draft=, =mr draft=, =mr ready=. A draft does not merge and does not appear in anyone's review queue; marking it ready is the request for review. Draft is a flag rather than a fifth state, so every =state = 'open'= rule still means what it did, and the merge refusal is unconditional: every other gate is a setting an admin turns on, and this one is the author's own statement about their own work. #111 - =mr range-diff= shows what changed between two revisions of a merge request, and =mr revisions= lists them. A push stales every review and nothing said what had moved; a diff of the two heads cannot answer it, and the previous head was overwritten in place. Each side of the comparison carries the merge base it had at the time, since measuring both against today's would attribute every commit that landed on the target in between to this merge request's author. #111 - Issues and merge requests are searched by their title and body, over FTS5. =issue list --search= and =mr list --search= narrow one repository; the instance-wide =search= reaches bodies now, and both list pages carry a search box. What someone types is quoted term by term, so an FTS5 operator — =c++=, =AND=, a lone quote — is a word to match rather than a syntax error. #114 - Ten mutations that changed a repository silently now record an event: =mr.closed=, =mr.reviewed=, =mr.edited=, =mr.retargeted=, =mr.draft=, =issue.edited=, =issue.labeled=, =issue.assigned=, =issue.milestoned=, =mr.milestoned=, =release.deleted=. =mr close= and =issue edit= also notify participants, which they did not. The full list is on the API wiki page and =webhook add --events= refuses a name that is not on it, since a subscription to a typo would never fire and nothing would say so. #112 - =gitbay-runner -jobs N= runs N builds at once. Claiming was always a single transaction that selects and updates, and each build already worked in its own directory, so several workers were safe the whole time; the runner never used more than one. #115 - A merge request replayed from a migration bundle has a diff. The bundle carried no head at all, and =mr diff= resolves through the head ref, so a merged merge request — which has no source branch left — could only fail. Re-running an import after the git push sets the head it could not set the first time. The GitHub import fetches =refs/pull/*/head=, which a mirror made with the default refspecs does not carry. #128 - The review loop is driven end to end by three accounts in the test suite: draft, ready, thread, approval, resolve, merge, with approvals, CODEOWNERS and require-resolved all on at once. Every one of those had its own test and none of them met. #139 - A bare =go test ./...= says the timeout is too short instead of panicking eleven minutes in and blaming whichever test was running. =make test= is what CONTRIBUTING asks for now. #143 Migrations 0036 through 0039 add the search index, the draft flag, pending review comments and merge request head history; 0036 and 0039 backfill from what is already there. They run on daemon start. Two things this does not do. There is still no way to ask a particular person for a review — the queue is computed from involvement, so a collaborator with write access who has not touched a thread hears nothing (krz/gitbay#145). And a CI build still runs as the runner's own user with no container; the runner on this instance is scoped to one repository, which is what keeps that narrow (krz/gitbay#144). Both are v1.14.0. * v1.12.0 — 2026-09-04 The store and the push path. Dashboard queries walk an index instead of sorting the table, concurrent writers wait instead of failing, expired rows are swept, and a large first push no longer forks a process per commit. - Every dashboard list scanned its table and sorted the result to take fifty rows. Reachability is correlated subqueries and cannot be indexed; the index supplies the =ORDER BY= instead, so the walk stops at =LIMIT=. On 20k issues and 20k merge requests: open issues 11.8ms to 0.8ms, open merge requests 12.1ms to 0.8ms, the review queue 15.5ms to 0.3ms, assigned issues 10.6ms to 0.04ms. The last of those also drives from =issue_assignees= rather than testing =EXISTS= against every issue. #137 - Concurrent writers serialise rather than failing. Every transaction in the store writes, and a deferred one takes the write lock at its first write, by which point another may hold it; SQLite answers =SQLITE_BUSY= and does not run the busy handler for that case, so =busy_timeout= could not help. Measured with eight concurrent read-then-write transactions, 44% of them failed. Beginning immediate takes the lock up front, where the timeout applies. #121 - =repo settings= updates no longer overwrite each other. =settings_json= is one blob, and every caller read it off a repository loaded earlier, changed a field and wrote it all back; two admins at once and the later write put back what it had read for the other's field. The read and the write happen together now, under one immediate transaction. #123 - Expired sessions and tokens are swept, and =[retention]= caps how long the audit log, the activity feed, webhook deliveries and the mail queue keep a row. Unset means forever, which is what every existing instance gets. #122 - The audit entry records flag names without their values. Secrets never reached argv — they travel on stdin — but prose did: =--body = was stored verbatim, in a table nothing pruned, for a repository that may be private. Identifiers are positional and survive. #122 - pre-receive on a require-signed repository forked a =cat-file= per incoming commit and built one JSON message holding the whole push. A 50k-commit first push forked 50k processes and held the history in memory twice. One =cat-file --batch= serves the push now, and the daemon verifies each commit as it arrives. #100 - The payloads other surfaces decode are named types in =control=. httpd had its own copies of what the build, profile and dashboard commands emit, so a field added to a command was silently absent on the page. #126 Migration 0035 adds three indexes; it runs on daemon start. Two changes in behaviour rather than configuration. A heavily contended write now blocks for up to =busy_timeout= (five seconds) instead of returning an error immediately — waiting is the point, but a caller that treated the error as normal will see a pause instead. And anything parsing =audit --json= for command arguments will find flag values gone; the flag names and the positional arguments are still there. * v1.11.0 — 2026-09-04 The web catches up with the rest of the forge: search across the instance, a notification inbox, a compare view, linkable diff lines, and a pass over contrast, heading structure and the stylesheet. - Notifications are no longer mail or nothing. An =inbox= table holds a row per recipient whether or not the instance has SMTP; =notifications list= reads it, unread by default, and =notifications read ... | --all= clears it. =repo watch= adds you to a repository's notifications and =repo unwatch= mutes it, with a mute beating every other reason to be told, including owning the repository or having written the thread. The unread count rides on =dashboard= and in the web rail. #113 - =search= matches repository paths, descriptions and topics, and issue and merge request titles, across everything the caller can read; =/search= renders it with a field in the rail on every page, and an anonymous visitor gets the public rows from the same query. Titles only — body search is #114. #118 - =/{owner}/{repo}/compare/{a}...{b}= shows what one ref adds on top of another. Diff rows, files and review threads carry ids, so a line can be linked to. The issue and merge request lists page at fifty with the cursors the commands already emit. #118 - CODEOWNERS gating is a setting rather than a file that happens to exist: =repo settings require-codeowners on|off=, off by default, still independent of =require-approvals=. A repository can carry the file as documentation of who to ask without it gating merges. #142 - A failed form action's reason rides a one-shot cookie instead of =?e==, so it no longer survives a reload or lands in history. #119 - A diff cut at 4 MiB cuts on a line boundary and says so, the diffstat says its counts are partial, and a merge request's commit list says "first 100 of N". #117 - Page templates parse once with the layout at start-up, so a template that does not parse fails the process rather than the first visit to its page. #116 - Markdown headings carry ids, matching org pages, and the stylesheet serves a hash ETag with a day's lifetime and answers a matching =If-None-Match= with 304. #132 - Dark-mode buttons carry a visible edge (a 1 px border was 1.3:1 against the 3:1 non-text contrast floor), and a stored label colour is held between 0.12 and 0.28 relative luminance so it clears 3:1 on both grounds while keeping its hue. #120 - Accessibility: the pin star is decoration and the word carries the meaning, the refs and release asset tables have scoped column headers, state filters carry =aria-current= rather than marking the active one by colour alone, and a rendered README or wiki page's headings move down one level so they sit under the page's own. #133 - The stylesheet drops rules no template reaches, folds two off-scale values onto the type scale, and resolves the classes templates asked for and it never defined. #131 - On a phone the tab bar wraps to a second row instead of scrolling sideways with its scrollbar hidden, and the landing page says in three sections what a reader, a writer and a reviewer can do. #134 Migration 0034 adds =inbox= and =repo_watchers=; it runs on daemon start. Reinstall the CLI for =search=, =notifications= and =repo watch/unwatch=. Two upgrade notes beyond replacing the binary. A repository that relied on a CODEOWNERS file gating merges by its presence alone loses that gate until =require-codeowners= is set: nothing back-fills it, since the database cannot say which branches carry the file. And =search= and =notifications= are now reserved top-level routes, so a user or organization already holding either name keeps it but its profile page is shadowed by the route. * v1.10.0 — 2026-09-04 Every command parses its arguments the same way, the web answers by exit code, and a restart no longer waits on idle connections. - One flag parser for every command: an unknown flag, a missing value or too many arguments is exit 2 with the command's usage, everywhere. =mr review --approve --bogus= used to report repository =--bogus= as not found. #96 - =--json= is honoured by the dispatcher's own refusals, so a script told no gets the envelope. #109 - A store failure is exit 1 and not-found is exit 3; both used to be usage errors. #107 - Web form actions answer by exit code: the 404 page for a thing that does not exist, the page with the message for anything else. #106 - Inside a clone, =gitbay mr create= takes the checked-out branch as =--source=; =gitbay --help= is the server's reference for the noun, flags included. #101 #130 - Shutdown closes idle SSH connections at once and drains only sessions mid-command; a store failure during key lookup no longer counts as a bad key against the auth limiter; the CLI says on ssh's exit 255 that a burst may have tripped it. #141 - A merge request head the target already contains is recorded as merged instead of refused; a fork is created with its parent in one insert; a failed transfer revert is reported; the repository quota is checked under a lock. #108 - Issues and merge requests share their comment, reference and author-or-write code. #110 - The payloads the web and clients decode are named types: =Created=, =MRCreated=, =IssueShow=, =MRShow=. JSON unchanged. #126 - Tests: parse failures per command, non-ASCII paths (which found =ls-tree= returning octal escapes, fixed with =core.quotepath=off= for every git the server runs), concurrent pushes. #129 Replace the binary and restart, and reinstall the CLI. No migration. * v1.9.0 — 2026-09-03 The runner is no longer an admin, the web no longer reaches around the registry, and the CLI stops paying a handshake per command. - =keys add --scope runner= confines a key to =runner next/log/done= and read-only git; the runner commands accept that scope or an admin. The systemd drop-in sandboxes the runner process. gitbay.org's runner now polls as a non-admin =ci= account scoped to one repository. #92 - The web's repo create, issue create and edit, MR edit and both comment forms dispatch the command the CLI runs, so the repository quota, the archived-repository refusal, notifications, the body format and the audit entry hold from a browser. #93 - The CLI shares one SSH connection per instance (=ControlMaster=, five minutes idle): a command costs a round trip instead of a handshake, 0.4 s instead of 4 s from a distant laptop. =no_multiplex = true= on an instance opts out. #94 - A disabled account is refused on every surface, and disabling revokes its API tokens along with its sessions. #95 - CODEOWNERS gates whenever the file exists on the target branch, not only under =require-approvals=. #99 - The HTTP listeners have header and idle timeouts, and SIGTERM drains in-flight requests and SSH sessions before exit. #104 #105 - =git archive= runs under a two-minute deadline and a 512 MiB cap. #124 - Every git invocation ends option parsing before the ref, so a ref shaped like an option is a bad revision and never a flag. #135 - The admin noun is gated in the dispatcher as well as in each handler; registry tests cover that and =ReadsStdin=. #127 - An e2e test runs every =ReadOnly= command against a populated instance and fails on any row it changes. #97 - =http.trusted_proxies= attributes proxied API requests to the last untrusted =X-Forwarded-For= hop for rate limiting; =email add= is capped at five codes an hour per account. #136 - A merge request head is built in the target repository, at =refs/merge-requests//head=, so a fork's merge request has =ci/= statuses for =require-checks= to gate on. A head from another repository is built without the target's secrets. #98 - Triggers refuse deleting a user or organization that still owns repositories, whatever path the delete takes. #136 - The stylesheet's fonts are served again, and directory crumbs on blob and blame pages link to the tree. #102 #103 - The Threat-Model wiki page covers the runner. #138 Replace the binary and restart, reinstall the CLI, and =make deploy-runner=: the runner fetches merge request refs before checkout. Migrations 0032 and 0033 run on start. The daemon host needs git 2.24 or newer for =--end-of-options=. Operators running =gitbay-runner=: give it a non-admin account with a key added by =keys add --scope runner=, remove the admin key it held, and =make deploy-runner= to install the sandboxed unit drop-in; an admin key keeps working meanwhile. * v1.8.1 — 2026-09-03 Markdown and org files render when opened. - A =.md=, =.markdown= or =.org= file renders on its page the way a README does on the directory page, through the same renderer with relative links resolved against the file's directory. =source= in the action bar, or =?view=source=, shows the text as before. Every other file is unchanged. #88 - The e2e harness waits for the HTTP and git listeners as well as SSH before a test starts; a test whose first act was an HTTP request could be refused, which failed two otherwise green runs. #91 Replace the binary and restart. No migration. * v1.8.0 — 2026-09-03 The tracker's lists narrow, labels have colours you set, and the CLI's help is the server's. - =issue list= takes =--label=, =--assignee=, =--author= and =--milestone= (a title, or =none= for issues with no milestone); =mr list= takes =--author= and =--milestone=. The store narrows in SQL, and the web lists take the same names as query parameters and show each active filter with a link that drops it and keeps the rest. Both lists had taken =--state= and nothing else, so the web's filtering could never match the CLI's. #84 - =label list= shows a repository's labels with their colour and how many issues carry each; =label set