Commit history
- Show who reacted when hovering a reaction, loading at most five names on demand and summarizing the rest as a count so huge reaction totals stay cheap.486e8a2⌁taigrr committed
- Float the reaction picker above its button instead of inserting it into the bar, so opening it no longer shifts the comment layout.77e5dbe⌁taigrr committed
a360a78⌁
- Open a paginated day breakdown under the contribution graph when a day is clicked, and let users show their private contributions to visitors as anonymous counts or keep them hidden.aa762f9⌁taigrr committed
- Sweep imports and forks whose provisioning Workflow was lost: refresh them once, then mark them failed if still pending.e543b2d⌁taigrr committed
- Send signed-in users from the sign-in, sign-up, two-factor and forgot-password pages to the dashboard instead of showing forms that no longer apply.cab88e1⌁taigrr committed
- Show commits as their author's account wherever the commit email is one of that account's verified addresses, instead of the raw git name with a mismatched avatar.4e89c38⌁taigrr committed
- Serve GitHub-style .diff and .patch suffixes on commit, pull request and compare URLs so changes can be piped into git apply and git am.7cbad77⌁taigrr committed
- Gate idle self-hosted runner long-polls on per-scope job doorbells so they stop scanning queued jobs in D1 every two seconds until a job is actually queued for their repo or owner.91e0d88⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Cap every non-push-token credential at read on unclaimed scratch repos, site admins and deploy tokens included, so LFS, contents API and web writes follow the git proxy guard459f46f⌁taigrr committed
- Merge roadmap/tests-securitydd86194⌁taigrr committed
- Skip dependency scans whose commit is no longer the default-branch head, so an out-of-order scan can't wipe newer results.056aadd⌁taigrr committed
- Drain small unread request bodies instead of cancelling them; cancelling still broke reused dev connections.90db13c⌁taigrr committed
- Drain unread request bodies once a custom route has answered, so early rejections don't poison keep-alive connections.a10c5a9⌁taigrr committed
- Allow loopback webhook sinks and disable rate limits for local e2e runs, only on a loopback forge with the dev flags set.55d6661⌁taigrr committed
- Accept pushes to scratch repositories only with their scratch push token, and return 422 for case-insensitive duplicate labels.f760be0⌁taigrr committed
- Security: tighten the POST-A/B fixes after re-review (entity-decoded camo decisions, own-host images load directly, own-host checks on verify and redirects, SVG badges kept, targeted 5xx masking, same-site user-content as a warning, per-isolate walk dedupe, plan gate on preview tickets).d958823⌁taigrr committed
- Security: fix post-audit feature review findings POST-B1..B7 (AI suggestions billed to the viewer, no owner usage leak, container plan gate on sync/preview, safe admin stop, one background tree walk per key, token imports always private).81d0558⌁taigrr committed
- Security: fix post-merge review findings POST-A1..A8 (user-content redirect with Basic credentials, grant revocation, same-site user-content origin, camo bypasses and self-proxying, rel injection, avatar cache purge, 5xx error messages).9837efb⌁taigrr committed
- Add marketing and feature pages, a site footer and new brand assets, extract shared UI primitives, and keep HttpError status across server-to-client serialization.698aa2a⌁taigrr committed
- Hide failed and in-progress imports from explore, landing, search and other users' profilesf3bf2c9⌁taigrr committed
- Make the unsubscribe-token tamper test deterministic (it was a no-op when the signature began with 1)1b847be⌁taigrr committed
- Dispose Artifacts handles that resolve after a call timeout, and release the status-check handle on failure705afe0⌁taigrr committed
- Add AI-suggested pull request titles and descriptions on the compare page for plans that include AI or bring their own key, metered through aiMeter as "pr-describe" on a cheap PR_DESCRIBE_MODEL.33f39b5⌁taigrr committed