Commits for max
switch to files view, user index
v503_preview2 to v503_base (2026-08-24 to 2026-08-31) v503
Show details
0108f1eb54fdce9856131873059928583be0bacb Mon Aug 24 03:58:09 2026 -0700
- hgSession: add a Last used column to the sessions table. refs #38157
83858083785a6b2b1f3c05f93e818e5a89318692 Tue Aug 25 01:42:34 2026 -0700
- hgSession: show cytoBand and gene/locus annotations for each saved session; date-only Created/Last used columns with full timestamp on hover. Factor locusName lookup into reusable hLocusName/hLocusNameExpand in hdb.c and reuse from hgBlat. refs #38157
The Assembly column now shows band, gene/locus name and Mbp position (separated by whitespace, normal text size). hLocusNameExpand centralizes the ex:/in:/ig: and | to - expansion that hgBlat's results page did inline.
- src/hg/hgSession/hgSession.c - lines changed 85, context: html, text, full: html, text
- src/hg/htdocs/style/hgSession.css - lines changed 3, context: html, text, full: html, text
- src/hg/js/hgSession.js - lines changed 23, context: html, text, full: html, text
5a3be3af33b76d69d1fc98ee76b9a37f96e96fc7 Wed Aug 26 00:36:52 2026 -0700
- Add opt-in per-phase request timing to the new hgBlat and hgSession pages, shown in a dialog with &measureTiming=1. refs #38157
New reusable perfTimer collector (lib/perfTimer.c) records labeled wall-clock intervals via clock1000() and emits them as JSON; hgBlat and hgSession attach a timing array to their payload when the existing measureTiming cart/CGI var is set. A shared gbShowTimingDialog helper in utils.js renders the server phases plus a client render-time row in a house-style modal, which opens automatically when measureTiming is on. Confirms the position band/locus annotation loop dominates hgSession, and run-BLAT plus locus lookups dominate hgBlat.
- src/hg/hgBlat/hgBlat.c - lines changed 13, context: html, text, full: html, text
- src/hg/hgSession/hgSession.c - lines changed 12, context: html, text, full: html, text
- src/hg/htdocs/style/gbModern.css - lines changed 13, context: html, text, full: html, text
- src/hg/js/hgSession.js - lines changed 25, context: html, text, full: html, text
b1ea00a1ea5559c4f27b00da2f90493bd8a3a88e Wed Aug 26 00:57:26 2026 -0700
- hgBlat: reorder the search-form checkboxes to Keep results, Show rearrangements, No min. score, Search many genomes. refs #37893
b7951c4e839a7fcb1d761084ba1fba8a06089049 Wed Aug 26 01:52:20 2026 -0700
- hgSession: use the outline floppy-disk icon for Overwrite, easier to recognize as save
0ff5f19b29ae3b3da4096e1ed1a4b49a4215c8a3 Wed Aug 26 01:53:57 2026 -0700
- hgSession: enlarge the action-row icons (13->17px) so the save/trash glyphs are easier to read
- src/hg/htdocs/style/hgSession.css - lines changed 1, context: html, text, full: html, text
e782dd6b9d73b9e138d57e3ad213bb6402b3802d Wed Aug 26 02:52:41 2026 -0700
- hgTracks: deleting a custom track now clears it from the Visible Tracks list too
A visible custom track is listed twice under the image, once in its own group
and once in the Visible Tracks group. Both the right-click Delete Custom Track
item and the trash icon left the other copy behind until the page was reloaded.
Remove every track-list cell that carries the track's delete icon, in
deleteCustomTrack() so both paths get it. refs #38087
3f97b357c5967755f1e5c914663ce9c7cc385e70 Wed Aug 26 03:01:34 2026 -0700
- Share a link: create the session only when the user asks, and copy in one click
Opening the top-right "Share a link" dialog used to save a session right away, so
just looking at the dialog left an unused link in the user's session list. The
dialog now explains what the link is and offers one "Create link & copy" button
that saves the session and copies the URL in a single step.
The random name for a machine-generated session is now made client-side and sent
with the request, so there is one convention in one place: a leading underscore
(kept verbatim by the short-link encoder, so /s/<user>/_XXXXXXXX stays clean)
plus eight URL-safe characters. hgSession.c no longer auto-names; a logged-in
save with no name is an error, which is what the callers already guarantee.
refs #10138
- src/hg/hgSession/hgSession.c - lines changed 19, context: html, text, full: html, text
024157529eaaa41e89d10d7db2750e6d13a00a62 Wed Aug 26 03:01:39 2026 -0700
- genark: add syncFtp to update the local NCBI genomes mirror
New subcommand that brings /hive/data/outside/ncbi/genomes/{GCA,GCF} up to date
with NCBI. It fetches the current assembly_summary files for GenBank and RefSeq,
diffs them against the last synced copy to find assemblies that are new or have
changed, mirrors those with lftp using the exclude list from fetchLftp.sh, and
appends one row per affected assembly to changes.tsv so later steps know what
moved. With -n it works out the whole change set and writes changes.tsv without
downloading any assembly data.
- src/utils/genark/genark - lines changed 340, context: html, text, full: html, text
5872e3a9d5f3d2916bbf10f359011b9d04fc3b93 Wed Aug 26 03:18:39 2026 -0700
- Revert "Share a link: create the session only when the user asks, and copy in one click"
This reverts commit 3f97b357c59. The change was work in progress and was
committed by mistake; web.c still has the matching data-shortlink part
uncommitted, so this half does not stand on its own. The genark syncFtp commit
that went out with it is fine and stays.
- src/hg/hgSession/hgSession.c - lines changed 19, context: html, text, full: html, text
b03051dec6a7b9d132995e809f378bc3277a987a Thu Aug 27 01:18:06 2026 -0700
- escape search terms and uploaded sequence names (XSS), refs #38057
#Preview2 week - bugs introduced now will need a build patch to fix
#Preview2 week - bugs introduced now will need a build patch to fix
Follow-up to the QA review of dbd10edb43b.
hgFileSearch and hgTracks track search: the name/description/simple search
boxes echoed the search term into a value attribute unescaped. The earlier
pass escaped the hgFileSearch simple box only, which sits inside a
USE_TABS block that is not compiled.
hgPhyloPlace: uploaded sequence names are echoed in the QC failure
messages from vcfFromFasta, in the subtree summary table, in the
placement and mutation-path headings, in the subtree download links and
in the no-reference-match list. All now go through htmlEncode.
hgLiftOver: the failure file was read back while its FILE* was still
open and unflushed, so the "Failed input regions" block always came out
empty. Close mapped and unmapped right after liftOver writes them.
- src/hg/hgFileSearch/hgFileSearch.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgLiftOver/hgLiftOver.c - lines changed 6, context: html, text, full: html, text
- src/hg/hgPhyloPlace/phyloPlace.c - lines changed 11, context: html, text, full: html, text
- src/hg/hgTracks/searchTracks.c - lines changed 3, context: html, text, full: html, text
75593a4e317eac40b781c83718961f0eb7f84f3a Thu Aug 27 06:32:34 2026 -0700
- Blue bar login and logout now return to the page they were clicked on
#Preview2 week - bugs introduced now will need a build patch to fix
The Login link in the blue bar sent everyone to the My Sessions page after
they signed in, and the Sign out and account links in the logged-in dialog
did the same, so a visitor reading a help page or looking at an item details
page lost their place. Only hgTracks was handled, as a special case.
Adds wikiLinkEncodeCurrentPageReturnUrl(), which builds a returnto for the
page the CGI is currently serving, including its query string, since the
track and item parameters of pages like hgTrackUi and hgc are not all kept in
the cart. hgTracks keeps its old behaviour of returning to hgTracks?hgsid=,
because its state is in the cart and its query string can hold a one-shot
zoom or drag. hgMenubar does the same for the static pages it is included
into, using the page path from the SSI environment.
The two checks hgLogin runs on an incoming returnto (URL shape, and the
optional login.approvedReturn host list) move to wikiLink.c so that the CGIs
building a link apply the same rules before writing it. A URL hgLogin would
refuse now becomes an ordinary login link instead of an error page: an
over-long or oddly-quoted query string costs the query string, and a host
that login.approvedReturn does not cover falls back to the old My Sessions
target. Note that with login.approvedReturn set, static-page returns need
the bare host added to the list.
Also converts the fixed 2 kB buffers in the wikiLink URL builders to
dyStrings, since a cgi-encoded return URL can nearly triple in length and
safef would have aborted.
refs #38192
- src/hg/hgLogin/hgLogin.c - lines changed 68, context: html, text, full: html, text
- src/hg/hgLogin/hgLogin.h - lines changed 1, context: html, text, full: html, text
- src/hg/hgMenubar/hgMenubar.c - lines changed 31, context: html, text, full: html, text
- src/hg/lib/wikiLink.c - lines changed 193, context: html, text, full: html, text
4fd18ab7854e6620576499d1b7f70fd03d9b6f9d Thu Aug 27 09:03:04 2026 -0700
- hgBlat: name a BLAT track after the gene whose exon it hits, and call protein lengths aa
#Preview2 week - bugs introduced now will need a build patch to fix
topHitLocusLabel() took whatever locusName row hRangeQuery happened to return
first, which is bin order and unrelated to the hit. A 400 bp query with 345 bp
inside an EGFR exon came back as "400bp chr7:55019001" because the intergenic
row upstream sorted first. It now walks all overlapping rows and prefers an
exon row over an intron row, breaking ties by how much of the hit each row
covers.
Protein searches were also labelled "154bp SOD1". Query lengths of a protein
search are amino acids, so the track name, its description and the results page
(length and the coverage mouseover) now say "aa" for those.
refs #38086
- src/hg/hgBlat/hgBlat.c - lines changed 44, context: html, text, full: html, text
56fec2823d2419eb9395bed6f2b56dec2c1daceb Fri Aug 28 02:02:18 2026 -0700
- Escape nodeName in variantPathPrint (XSS), found by automated code review
htmlEncode vpn->nodeName before printing in variantPathPrint() to close
XSS gap. The node name can be a user-uploaded sample ID (FASTA/VCF),
making this a reachable vulnerability of the same class the parent commit
closes in other spots.
- src/hg/hgPhyloPlace/phyloPlace.c - lines changed 1, context: html, text, full: html, text
7a03e53ac12bd080fee86c9e1184be4da154cabf Fri Aug 28 02:46:03 2026 -0700
- updating catalog
- src/hg/utils/hgConfCatalog/hgConfCatalog.py - lines changed 22, context: html, text, full: html, text
switch to files view, user index