Assisted-by: Claude Sonnet 4.5 via Crush

The Markdown sanitizer now preserves <details> and <summary> tags,
enabling collapsible sections in README files and blob views.

Added test coverage to verify these tags are properly preserved through
the sanitization process.

Closes: bug-f881844
Assisted-by: Claude Sonnet 4.5 via Crush

Implement rendering of images and links in README files without
requiring an image proxy. Relative URLs are rewritten to point to
repository files pinned to specific commits.

Relative images and files are served through the blob endpoint with
?raw=1 query parameter. Links to markdown files render the formatted
view, while other files download raw. Directory links go to tree view.

Assisted-by: Claude Sonnet 4.5 via Crush

Implement /{repo}/tag/{tag} route displaying tag metadata including
name, authorship, creation date, optional annotation message, and links
to file tree and commit.

Tag dates use tagger date for annotated tags, falling back to commit
author date for lightweight tags, matching the tags list behavior for
consistency.

Implements: a0daef3
Assisted-by: Claude Sonnet 4.5 via Crush

Implements: bug-05a795c
Co-authored-by: Crush <crush@charm.land>

Implements: bug-0fb4c59
Co-authored-by: Crush <crush@charm.land>

Branches and tags pages now extract and display co-authors
from commit message trailers using the attributionNames
template function. This replicates the existing commits page
behavior, showing "Author, Co1, and Co2 created time" format.

Implements: bug-f5cf6b5
Co-authored-by: Crush <crush@charm.land>

Adds Description field to BaseData and populates it across
all web UI pages (home, about, blob, tree, branches, commits,
tags). Descriptions are derived from:
- Repository descriptions (truncated to 200 chars)
- Server README content (converted to plain text)
- Context-appropriate fallbacks

New helper functions in webui_helpers.go:
- extractPlainTextFromMarkdown: strips markdown formatting
- truncateText: truncates text at word boundaries
- getRepoDescriptionOrFallback: repo desc or fallback

Implements: bug-7b97785
Co-authored-by: Crush <crush@charm.land>

The base.html template checks for .Repo to conditionally render
repository navigation. AboutData was missing this field, causing
template execution to fail with "can't evaluate field Repo".

Adding the nil Repo field allows the {{if .Repo}} check to work
correctly, skipping repository navigation on the about page.

Co-authored-by: Crush <crush@charm.land>

Parse Co-authored-by trailers from commit messages and display
all contributors with proper grammar in commit and commits
pages. Authorship now reads "Author and Co-author" for one
co-author or "Author, Co1, Co2, and Co3" for multiple.

Implements: bug-7e8823e
Co-authored-by: Crush <crush@charm.land>

Change commit page title from 'subject | Commit hash | name'
to 'subject | name@hash' for consistency with git conventions.

Implements: bug-4758ff9
Co-authored-by: Crush <crush@charm.land>

Display 'repo-name/path at ref | Project name' format in tree
view titles for better browser tab/history identification.
Shows shortened commit hash when viewing specific commits.

Implements: bug-45e898a
Co-authored-by: Crush <crush@charm.land>

Modify the author/time info on the home page to follow the same
tooltip pattern as the commits page, displaying "Updated {time}".

- Change HomeRepository.UpdatedAt from string to time.Time
- Convert timestamps to UTC for consistency
- Clean up tooltip format to show timezone only once
- Remove unused humanize import

Implements: bug-af63a29
Co-Authored-By: Crush <crush@charm.land>

Add Title and Description fields to BaseData for proper
HTML title and meta description support. Update base.html
template to use these fields instead of deriving them from
Repo and ServerName.

Implement page-specific titles:
- About: "About | {server name}"
- Home: "{server name}"
- Overview: "{project name or repo}" with description
- Commits: "Commits in {ref} | {project or repo}"
- Commit: "{subject} | Commit {hash} | {project or repo}"
- Tags: "Tags | {project or repo}"
- Branches: "Branches | {project or repo}"
- Files: "Files | {project or repo}"
- Blob: "{filename} | {project or repo}"

Fix shortHash template function to use 7 characters
instead of 8 for consistency with git standards.

Implements: bug-972b30b
Implements: bug-7778d23
Co-Authored-By: Crush <crush@charm.land>

Fixes: bug-45aeed6
Co-authored-by: Crush <crush@charm.land>

Add version query parameters to CSS URLs to force browsers to fetch
newer versions after edits. This ensures users see updated styles
without manually clearing browser cache.

Changes:
- Add ?v=1 to overrides.css and syntax.css URLs
- Document version increment process in AGENTS.md

Implements: bug-9b0a200
Co-Authored-By: Crush <crush@charm.land>

Improve file content detection and syntax highlighting in the web UI:
- Better MIME type detection for files without extensions
- Content-based markdown detection for extensionless files
- Enhanced lexer selection prioritizing content analysis
- Added Chroma import for improved language detection

Implements: bug-147d490
Co-Authored-By: Crush <crush@charm.land>

Add route handlers to serve raw git patches and diffs when accessing
commit URLs with .patch or .diff extensions. This allows users to
download patches directly using curl and pipe them to git apply.

Implements: bug-d552262
Co-Authored-By: Crush <crush@charm.land>

Consolidates common data fields across web UI pages into reusable
BaseData, RepoBaseData, and PaginationData structs to reduce code
duplication and improve maintainability.

Implements: bug-7dfe278
Co-authored-by: Crush <crush@charm.land>

Previously, the breadcrumb navigation would truncate all refs using
shortHash, causing branch names like "generate-promo-codes" to display
as just "generate".

This change adds an IsCommitHash field to template data structures and
updates the templates to conditionally apply shortHash only for actual
commit hashes while showing full names for branches and tags.

Implements: bug-bf0175a
Co-Authored-By: Crush <crush@charm.land>

Replace hardcoded text/plain content-type with proper MIME type
detection using mime.TypeByExtension and http.DetectContentType
as fallback. Ensures binary files are served with correct types
while maintaining UTF-8 charset for text files.

Fixes: bug-74a99e4

Fixes: bug-dddb40e
Co-Authored-By: Crush <crush@charm.land>

Prevent the last breadcrumb item from being linked when viewing
a directory or file in the tree view. Follows the same pattern
already used in blob.html.

Fixes: bug-d8ce4b4

- Use Atkinson Hyperlegible as sans
- Use 0xProto first, JetBrains Mono second as mono
- Preserve existing Pico CSS fallbacks

Co-Authored-By: Crush <crush@charm.land>

Co-Authored-By: Crush <crush@charm.land>

Co-Authored-By: Crush <crush@charm.land>

Co-Authored-By: Crush <crush@charm.land>

Change the order of operations in UpdatedAt() to first try getting
the timestamp from the latest commit before falling back to the
last-modified file. This ensures more accurate update timestamps.

Co-Authored-By: Crush <crush@charm.land>

Bumps the all group with 4 updates: [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma), [github.com/charmbracelet/x/ansi](https://github.com/charmbracelet/x), [golang.org/x/crypto](https://github.com/golang/crypto) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `github.com/alecthomas/chroma/v2` from 2.22.0 to 2.23.0
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.22.0...v2.23.0)

Updates `github.com/charmbracelet/x/ansi` from 0.11.3 to 0.11.4
- [Commits](https://github.com/charmbracelet/x/compare/ansi/v0.11.3...ansi/v0.11.4)

Updates `golang.org/x/crypto` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/crypto/compare/v0.46.0...v0.47.0)

Updates `modernc.org/sqlite` from 1.43.0 to 1.44.2
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.43.0...v1.44.2)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/ansi
  dependency-version: 0.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.44.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the all group with 3 updates: [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma), [github.com/spf13/cobra](https://github.com/spf13/cobra) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `github.com/alecthomas/chroma/v2` from 2.21.1 to 2.22.0
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.21.1...v2.22.0)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.10.1...v1.10.2)

Updates `modernc.org/sqlite` from 1.42.2 to 1.43.0
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.42.2...v1.43.0)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add support for certificate reloading upon SIGHUP

* fix: support certificate reloading for unix and add test

* fix(cmd): move cert reloader logic to the serve package

---------

Co-authored-by: Ayman Bagabas <ayman.bagabas@gmail.com>

* fix: require admin privileges for force delete of LFS locks

Move user context retrieval before the force flag check to ensure
proper authorization. Force deletions now require admin privileges,
preventing non-admin users from deleting locks owned by others.

Fixes GHSA-6jm8-x3g6-r33j (CVE-2026-22253)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: improve comment clarity for force delete path

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Fixes: https://github.com/charmbracelet/soft-serve/issues/759

Co-authored-by: aymanbagabas <3187948+aymanbagabas@users.noreply.github.com>

Bumps the all group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.20.0` | `2.21.1` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.2` | `5.16.4` |
| [github.com/google/go-querystring](https://github.com/google/go-querystring) | `1.1.0` | `1.2.0` |
| [github.com/muesli/mango-cobra](https://github.com/muesli/mango-cobra) | `1.2.0` | `1.3.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.0` | `1.23.2` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.38.2` | `1.42.2` |



Updates `github.com/alecthomas/chroma/v2` from 2.20.0 to 2.21.1
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.20.0...v2.21.1)

Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.4)

Updates `github.com/google/go-querystring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/go-querystring/releases)
- [Commits](https://github.com/google/go-querystring/compare/v1.1.0...v1.2.0)

Updates `github.com/muesli/mango-cobra` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/muesli/mango-cobra/releases)
- [Commits](https://github.com/muesli/mango-cobra/compare/v1.2.0...v1.3.0)

Updates `github.com/prometheus/client_golang` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.1)

Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/crypto/compare/v0.45.0...v0.46.0)

Updates `golang.org/x/sync` from 0.18.0 to 0.19.0
- [Commits](https://github.com/golang/sync/compare/v0.18.0...v0.19.0)

Updates `modernc.org/sqlite` from 1.38.2 to 1.42.2
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.2...v1.42.2)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/google/go-querystring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/muesli/mango-cobra
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/sync
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>