All File Changes

v502_base to v503_preview (2026-08-10 to 2026-08-17) v503

• confs/hgwbeta.hg.conf
  • lines changed 20, context: html, text, full: html, text
    39b7f53f0d6d94dfd1c3b280fc0e88d5b9cf8f00 Sun Aug 16 01:11:25 2026 -0700
    Installing updated hg.conf files from UCSC servers
• confs/hgwdev.hg.conf
  • lines changed 5, context: html, text, full: html, text
    39b7f53f0d6d94dfd1c3b280fc0e88d5b9cf8f00 Sun Aug 16 01:11:25 2026 -0700
    Installing updated hg.conf files from UCSC servers
• src/checkCompileFlags.sh
  • lines changed 82, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/altSplice/altSplice/makefile
  • lines changed 7, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/cirm/gateway/htdocs/sspsygeneTimeline.html
  • lines changed 5, context: html, text, full: html, text
    f6a269c29b553a8d1f5357e908e15ee1c76f602e Mon Aug 10 11:00:18 2026 -0700
    ADGC1_LM_14,ADGC2_M_27,ADGC3_Y4_N_4,ADGC6_Y2_B_11,ADGC7_Y2_C_19 updates in timeline to reflect active work
  • lines changed 15, context: html, text, full: html, text
    b8f54fc5d9f1fbd30e71035a0244e3408726da24 Mon Aug 10 11:14:52 2026 -0700
    Updating WUSTL ADGC7 - capturing mouse cage behavior active status of data generation/L3/L4 analysis sharing
  • lines changed 5, context: html, text, full: html, text
    2e8750b60612a2c59ef7bceb93d3b865ab9f45b8 Wed Aug 12 10:17:14 2026 -0700
    Active items,reflecting data flow: ADGC1_M_15 --> UCLA Calcium Imaging Capstone Analysis, ADGC2_L_11 --> MiNND scRNA-seq 72 lines, ADGC2_L_27 --> MiNND PatchSeq 192 NTC L0, ADGC6_Y2_B_22 -->SING L0 Video
• src/hg/encode/docId/docIdSubmitDir/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/encode/docId/docIdTidy/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/encode/encodeRenameObj/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/encode/metaCheck/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/encode/regionOrtho/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/encode3/encodeDataWarehouse/edwWebXSendFile/edwWebXSendFile.c
  • lines changed 13, context: html, text, full: html, text
    948d0399a8d2e1f294fb04c82c8d2fbec735707a Tue Aug 11 07:33:13 2026 -0700
    edw: fix heap overflow (edwWebXSendFile) and submit command injection (edwLib) edwWebXSendFile tokenValid()/getFullFileName() used strcat onto exact-sized cloneString buffers, overrunning the heap; tokenValid() does this before the auth token is checked, so it is reachable without valid credentials. Build the strings in right-sized buffers instead. edwAddSubmitJob() interpolated a user-supplied submission URL into a shell command later run by edwRunDaemon; a single quote broke out of the single-quote context and injected commands. Reject quotes/newlines in url and userEmail and single-quote both values in the command. refs #38055, refs #38060
• src/hg/encode3/encodeDataWarehouse/lib/edwLib.c
  • lines changed 10, context: html, text, full: html, text
    948d0399a8d2e1f294fb04c82c8d2fbec735707a Tue Aug 11 07:33:13 2026 -0700
    edw: fix heap overflow (edwWebXSendFile) and submit command injection (edwLib) edwWebXSendFile tokenValid()/getFullFileName() used strcat onto exact-sized cloneString buffers, overrunning the heap; tokenValid() does this before the auth token is checked, so it is reachable without valid credentials. Build the strings in right-sized buffers instead. edwAddSubmitJob() interpolated a user-supplied submission URL into a shell command later run by edwRunDaemon; a single quote broke out of the single-quote context and injected commands. Reject quotes/newlines in url and userEmail and single-quote both values in the command. refs #38055, refs #38060
• src/hg/hgBlat/hgBlat.c
  • lines changed 187, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
  • lines changed 7, context: html, text, full: html, text
    db7af49112d007eea8d9c0bccbac3f42ec7a8591 Tue Aug 11 08:50:55 2026 -0700
    hgBlat: results table follows the form the search came from, refs #37893 The results-page default now tracks which input form the search came from: a submission from the new form lands on the new sortable table, one from the classic form lands on the classic results table (which keeps its banner advertising the new one). Previously the new-form path set blatNewPage=TRUE but nothing set it back, so a user who switched to the classic form - or had opted into the new table earlier - still got the new table. Set blatNewPage to the form's own new/old choice in both directions.
  • lines changed 3, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
  • lines changed 5, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
  • lines changed 98, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/hgCollection/hgCollection.c
  • lines changed 2, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgCollection/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/hgCustom/hgCustom.c
  • lines changed 5, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
  • lines changed 24, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/hgFileSearch/hgFileSearch.c
  • lines changed 1, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGene/rnaStructure.c
  • lines changed 8, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgGenome/browseRegions.c
  • lines changed 2, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGenome/configure.c
  • lines changed 4, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGenome/correlate.c
  • lines changed 3, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGenome/import.c
  • lines changed 3, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGenome/mainPage.c
  • lines changed 1, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgGenome/sortGenes.c
  • lines changed 3, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgHubConnect/hgHubConnect.c
  • lines changed 4, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgHubConnect/hooks/pre-finish.c
  • lines changed 11, context: html, text, full: html, text
    7ba5c812bda048b28ade940e0030b8000a02ae4b Mon Aug 10 11:58:51 2026 -0700
    hubSpace: key rows on location so two hubs can hold the same file name, refs #37964 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/hgIntegrator/hgIntegrator.c
  • lines changed 4, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgLiftOver/hgLiftOver.c
  • lines changed 6, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgLinkIn/hgLinkIn.c
  • lines changed 2, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgLogin/hgLogin.c
  • lines changed 6, context: html, text, full: html, text
    39c57b82b853bb7aaa9ec15dc0b5f293b0329256 Mon Aug 10 15:32:56 2026 -0700
    Removing em dashes and dropping the "if you did not request this" line from hgLogin's login-link and change-email messages. refs #37929
  • lines changed 32, context: html, text, full: html, text
    663d6e61cc7cbd60100bbe9ae89a4c876530348b Tue Aug 11 05:10:02 2026 -0700
    hgLogin: make the change-email confirm link single-use and record lastUse on the email-link chooser sign-in, refs #37929 Two issues Gerardo found in QA: (i) The change-email confirmation link was stateless (signature + expiry only), so opening it again within the hour re-applied the change -- and a stale link could silently override a newer email change. Fold the account's current email into the signed string: confirmChangeEmail recomputes the signature from the address currently on the account, so once the change is applied the address is no longer the one the link was signed against and the link stops validating. No new column or stored token needed. (ii) chooseAccount's email-link branch (the multi-account case) signed the user in without updating gbMembers.lastUse, unlike the single-account emailLogin path. Add the lastUse update for the chosen account.
  • lines changed 24, context: html, text, full: html, text
    516b59c2d55af8ec1d71f43c06e545f5633b4cd3 Tue Aug 11 06:15:09 2026 -0700
    hgLogin: fix two social-login gaps found in v502 code review, refs #38037 #1 The OAuth account-chooser query listed accounts the action would then refuse: it lacked the accountActivated='Y' filter that chooseAccount() and resolveIdentity() both apply, so the page could offer an unactivated row (and expose the username anyone could have created with the victim's address). Add the filter so the page and the action agree. #2 oauthReturn() removed oauth_state but never oauth_provider, and it acted on the error parameter before checking state. So after one social login a later hgLogin?error=<text> re-entered the flow and printed the (escaped) provider text on the login page, and a crafted error link could consume the state nonce of a login in flight. Validate state first, then clear both oauth_state and oauth_provider, so the flow ends cleanly and a stray code/error link is ignored. Found in the v502 final-build code review, refs #38069.
  • lines changed 13, context: html, text, full: html, text
    1a7b4e1d39c69f33d6d78d1f3ca61b783d2ded40 Tue Aug 11 08:08:50 2026 -0700
    hgLogin: escape reflected values on the older login/account form pages (XSS) The pre-social-login pages printed cart and CGI values into HTML with a plain %s. Since every CGI parameter becomes a cart variable, a crafted URL could reflect script into the page, and the login cookie is written by JavaScript (not HttpOnly), so injected script could read it. Wrap the reflected values in htmlEncode() at the point of output, matching the existing encXxx pattern in the file. Covers displayLoginPage, displayAccHelpPage, changePasswordPage, signupPage, displayMailSuccess and displayMailSuccessPwd. refs #38011
  • lines changed 24, context: html, text, full: html, text
    8f329215737bf098902eb0d589be5c1b29008aa4 Thu Aug 13 08:18:44 2026 -0700
    hgLogin: treat the login-flow cart variables as server-owned, refs #38037
• src/hg/hgMenubar/hgMenubar.c
  • lines changed 13, context: html, text, full: html, text
    41e62d7a41147961651f6d317e3b90b7680d806c Tue Aug 11 10:22:02 2026 -0700
    hgMenubar: only allow incFile to name a file in the include directory, refs #38052 hgMenubar opens the file named by its incFile request parameter and prints it line by line. The path was built as DOCUMENT_ROOT + incFile with no traversal stripping, so a request could read any file the server can read, with no login. Confirmed against an unpatched build. incFile=/../../../../etc/passwd returned the password file. Pointing it at hg.conf.private returned 216 lines, 19 of which match a password, secret or key setting, and that file is world readable so the apache user can read it. This is credential disclosure, not just file disclosure. incFile now has to start with /inc/ and contain no "..", otherwise it is ignored and the normal menu bar is served. I kept the parameter rather than removing it because printMenuBar already treats a non-default value specially, skipping printIncludes, so an alternate include looks like a designed feature that a mirror could be using. Nothing in our own tree passes incFile. A rejected value is logged to stderr. Before this change a traversal attempt failed with a 500, which was visible in the logs; without the log line the attempt would now blend in as an ordinary page. Falling back beats aborting here because this CGI is included into every static page through SSI, so an abort on a bad parameter would break the page.
• src/hg/hgMirror/hgMirror
  • lines changed 1, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgPal/hgPal.c
  • lines changed 3, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgPhyloPlace/phyloPlace.c
  • lines changed 1, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgSearch/hgSearch.c
  • lines changed 7, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgSession/hgSession.c
  • lines changed 3, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgTables/genomeSpace.c
  • lines changed 4, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgTables/identifiers.c
  • lines changed 4, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgTables/userRegions.c
  • lines changed 5, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/hgTrackUi/hgTrackUi.c
  • lines changed 2, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgTracks/bigBedTrack.c
  • lines changed 12, context: html, text, full: html, text
    b53f0365865b5449ef209ea86c5220dd07dc8b28 Fri Aug 7 12:07:45 2026 -0700
    quickLift: don't report items that failed to lift as filtered out, refs #38033 Items that could not be mapped through the chain were counted by the same variable the track filters use, so a lifted view claimed a number of items had been filtered out when no filter had removed anything. Count the two cases apart: failing a filter is a filter rejection, while passing the filters and then getting nothing back from the lift is a lift failure, and say so in the label.
  • lines changed 1, context: html, text, full: html, text
    7f65d3da8f2138d847f15a8398f8dcee1a079027 Fri Aug 7 12:07:59 2026 -0700
    quickLift: clip an oversized item to the chains we loaded instead of dropping it, refs #38042 quickLift loads chains for the window plus padding, capped at 1 Mb. An item that reaches further than that has ends where no chain reaches, remapRangeList can place neither of them, and the whole item is dropped even though the part on screen maps fine. ClinVar copy number variants run to 159 Mb, so 44 of the 46 in one window disappeared. Pull the ends in to what the chains cover before mapping. The browser never draws the ends of an item that spans the window, so their exact position does not matter, and the existing spanned-item merge still reports it. A clipped end is snapped to a base inside an aligned block, since remapRangeList will only place a coordinate that lands on real alignment. The clip is in the quickLift code, not the shared liftOver remap path. Only hgTracks asks for it, so the details page keeps the item's true extent. Gated by quickLiftClipToChains, on by default.
• src/hg/hgTracks/config.c
  • lines changed 37, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 4, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
  • lines changed 9, context: html, text, full: html, text
    cf3880c50c550e4deb61c9664f4f994e13ab6dd8 Mon Aug 17 08:05:58 2026 -0700
    hgc/hgTracks: fix three items from the v502 code review, refs #38106 Shared BLAT alignment links (hgc g=htcBlatAlign) drew the page and then exit(0), which skips main's cartCheckout, so the loaded session was never written back and the recipient's cart ended up nearly empty. Add cartCheckout(&cart) before all four exit(0) calls that follow webEndGb(), including the two early error returns. squishCodonFont() decided FreeType was active with a looser test than maybeNewFonts(), missing the requirement that the font name match a row in freeTypeFonts[]; when they disagreed the bitmap engine got a cell height it cannot render. Factor the engine decision into freeTypeFontActive() and use it in both places. Query name, chrom and a hub's organism string went raw into single-quoted JS string literals and page titles on the modern alignment page; the shared-link path reads the query name back out of a bigPsl, so it is not covered by hgBlat's whitelist. javaScriptLiteralEncode the JS arguments and htmlEncode the HTML labels. Also add "u"/"s" (the shared-link session selectors) to hgc excludeVars so they are not left in the reader's cart.
• src/hg/hgTracks/expRatioTracks.c
  • lines changed 3, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/hgTracks/hgTracks.c
  • lines changed 25, context: html, text, full: html, text
    cfd5fcabf643de689fd383958047718f67fe6575 Mon Aug 10 11:52:18 2026 -0700
    hgTracks: don't split a squishyPack track when the squished part is off screen, refs #37974 expandSquishyPackTracks decided to clone the track from slCount(squishTrack->items) alone, without asking whether any of those items are in the window. Items outside the window are never laid out into a row, so a squink built only from those has no rows and no height, yet it still claims a center label slice at y == pixHeight and sliceIsConsistent warns "slice(center) has an invalid X or Y offset". Only split when at least one item above the point really overlaps the window, the same test packCountRowsOverflow uses, with hgFind matches skipped since those always stay in pack. That makes the later "if the squish track has no items, continue" check unreachable, so it goes. Removing it fixes a second bug: that path skipped both slReverse() calls, so a squishyPack track whose items all stayed in pack kept its item list reversed. The warning goes to stderr and verbose is hIsPrivateHost(), so only hgwdev ever showed it. The reversed item list was visible everywhere.
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
  • lines changed 7, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
  • lines changed 6, context: html, text, full: html, text
    5440b4ccf5796778b6a65186bf83c17970f00d7a Sun Aug 16 18:43:46 2026 -0700
    Support PDF output in hgRenderTracks via hgt.psOutput. refs #38118 hgRenderTracks had PDF output wired up behind a compile-time PDF_OUTPUT define that was set to 0, so it could only be reached by editing and rebuilding. Select it at runtime with hgt.psOutput=on instead, which is the same variable the hgTracks View->PDF menu item already uses. PNG remains the default. Also return from handlePostscript after doTrackForm when trackImgOnly is set. In that case makeActiveImage has already converted the eps, written the PDF to stdout and unlinked the eps, so the convertEpsToPdf that follows aborted on the missing file. The client never saw it because the PDF was already flushed and hPrintDisable swallowed the error page, but every request logged "Couldn't open ... .eps" to the apache error log. Document the new parameter in the hgRenderTracks section of customTrackText.html and in the hgRenderTracks tip in allTipsRaw.html.
  • lines changed 30, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/hgTracks/hgTracks.h
  • lines changed 3, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 5, context: html, text, full: html, text
    cf3880c50c550e4deb61c9664f4f994e13ab6dd8 Mon Aug 17 08:05:58 2026 -0700
    hgc/hgTracks: fix three items from the v502 code review, refs #38106 Shared BLAT alignment links (hgc g=htcBlatAlign) drew the page and then exit(0), which skips main's cartCheckout, so the loaded session was never written back and the recipient's cart ended up nearly empty. Add cartCheckout(&cart) before all four exit(0) calls that follow webEndGb(), including the two early error returns. squishCodonFont() decided FreeType was active with a looser test than maybeNewFonts(), missing the requirement that the font name match a row in freeTypeFonts[]; when they disagreed the bitmap engine got a cell height it cannot render. Factor the engine decision into freeTypeFontActive() and use it in both places. Query name, chrom and a hub's organism string went raw into single-quoted JS string literals and page titles on the modern alignment page; the shared-link path reads the query name back out of a bigPsl, so it is not covered by hgBlat's whitelist. javaScriptLiteralEncode the JS arguments and htmlEncode the HTML labels. Also add "u"/"s" (the shared-link session selectors) to hgc excludeVars so they are not left in the reader's cart.
• src/hg/hgTracks/lollyTrack.c
  • lines changed 20, context: html, text, full: html, text
    75b9f337975beb5a9eaec5ff00e48cb878591fd2 Fri Aug 7 12:07:35 2026 -0700
    bigLolly: reserve top margin from the largest lolly actually drawn, refs #38031 A track that sets lollySizeField scales each radius by the track height, so a lolly can end up bigger than lollyMaxSize. The margins were reserved from lollyMaxSize alone, so once the drawn radius passed it the top row of circles ran off the top of the row and came out flat. Take the larger of the two, which leaves every current picture unchanged since today's radii are all below lollyMaxSize. The same margin positions the y-axis gridlines and the upper and lower value labels, so all three move together and the axis still lines up with the circles.
• src/hg/hgTracks/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/hgTracks/netTrack.c
  • lines changed 2, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/hgTracks/renderMain.c
  • lines changed 6, context: html, text, full: html, text
    5440b4ccf5796778b6a65186bf83c17970f00d7a Sun Aug 16 18:43:46 2026 -0700
    Support PDF output in hgRenderTracks via hgt.psOutput. refs #38118 hgRenderTracks had PDF output wired up behind a compile-time PDF_OUTPUT define that was set to 0, so it could only be reached by editing and rebuilding. Select it at runtime with hgt.psOutput=on instead, which is the same variable the hgTracks View->PDF menu item already uses. PNG remains the default. Also return from handlePostscript after doTrackForm when trackImgOnly is set. In that case makeActiveImage has already converted the eps, written the PDF to stdout and unlinked the eps, so the convertEpsToPdf that follows aborted on the missing file. The client never saw it because the PDF was already flushed and hPrintDisable swallowed the error page, but every request logged "Couldn't open ... .eps" to the apache error log. Document the new parameter in the hgRenderTracks section of customTrackText.html and in the hgRenderTracks tip in allTipsRaw.html.
• src/hg/hgTracks/simpleTracks.c
  • lines changed 4, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 24, context: html, text, full: html, text
    9da759daff220e6433da737debffcc2e81f4de18 Tue Aug 11 09:52:37 2026 -0700
    Fixes from code review, refs #38064
  • lines changed 2, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
  • lines changed 8, context: html, text, full: html, text
    cf3880c50c550e4deb61c9664f4f994e13ab6dd8 Mon Aug 17 08:05:58 2026 -0700
    hgc/hgTracks: fix three items from the v502 code review, refs #38106 Shared BLAT alignment links (hgc g=htcBlatAlign) drew the page and then exit(0), which skips main's cartCheckout, so the loaded session was never written back and the recipient's cart ended up nearly empty. Add cartCheckout(&cart) before all four exit(0) calls that follow webEndGb(), including the two early error returns. squishCodonFont() decided FreeType was active with a looser test than maybeNewFonts(), missing the requirement that the font name match a row in freeTypeFonts[]; when they disagreed the bitmap engine got a cell height it cannot render. Factor the engine decision into freeTypeFontActive() and use it in both places. Query name, chrom and a hub's organism string went raw into single-quoted JS string literals and page titles on the modern alignment page; the shared-link path reads the query name back out of a bigPsl, so it is not covered by hgBlat's whitelist. javaScriptLiteralEncode the JS arguments and htmlEncode the HTML labels. Also add "u"/"s" (the shared-link session selectors) to hgc excludeVars so they are not left in the reader's cart.
• src/hg/hgUserSuggestion/hgUserSuggestion.c
  • lines changed 4, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgc/hgc.c
  • lines changed 22, context: html, text, full: html, text
    e08ae97dc288749c2454fd98a10dc79f06e27cb5 Tue Aug 11 06:16:20 2026 -0700
    hgBlat/hgc: fixes from the v502 code review of the BLAT results pages, refs #37893 #4 blatOldTracks now falls back to "keep" (with a warning) on any value other than keep/hide/delete, instead of dropping into the destructive delete branch, so a typo in hg.conf can never silently discard a user's earlier BLAT tracks. #5 htmlEncode() (js/utils.js) now also escapes " and ', which the browser's text->markup conversion leaves alone. Every hgBlat caller puts the result in a double-quoted attribute, so an unescaped quote in the cart position string could break out of the attribute; the shared helper now honors its documented contract. #6 The non-BLAT alignment title no longer starts with a stray space. #7 open_memstream() is checked for NULL: on that failure the alignment renders straight to stdout instead of writing to a NULL FILE and calling fclose(NULL). The section reorder keys on the literal "<H4><A NAME=genomic>"/"<H4><A NAME=ali>" strings, so a note was added in fuzzyShow.c and pslShow.c to keep them intact. Found in the v502 final-build code review, refs #38069.
  • lines changed 4, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
  • lines changed 6, context: html, text, full: html, text
    44abc107a014bf17a4c5b0d5ede16f8d10ce180d Tue Aug 11 09:58:31 2026 -0700
    hgc: bound the copy in parseSs so an oversized ss or item cannot overflow, refs #38054 parseSs copied its argument into a fixed 1024-byte static buffer with strcpy and no length check. The argument is the cart variable ss, or the item name, and a visitor controls both. A legitimate value is a short triple of trash file paths, so any oversized value is a bug or an attack. Measured against an unpatched build, driving the item through QUERY_STRING: 1500 and 8000 bytes both wrote past the end of the buffer and the CGI carried on and exited 0, so the corruption was silent. 100000 bytes gave SIGSEGV. Remote and unauthenticated in every case. safecpy does the same copy with a length check and aborts on overflow, which is consistent with the three errAborts parseSs already has for the other malformed cases. It also does not echo the value into the error message. The boundary now behaves as expected. An item of 1023 bytes still parses, 1024 aborts, and a valid three-word value parses exactly as before. All six call sites pass user data through this one copy, so they are all covered.
  • lines changed 13, context: html, text, full: html, text
    be4f99627b03673652489ddaf9254782ab5c8b3e Fri Aug 14 09:07:33 2026 -0700
    hgc: read chain query sequence from the two bit file when the query assembly has no database, refs #37974 htcChainAli chose the query sequence with the otherDb branch ahead of the otherTwoBitUrl branch, and otherDb is the second word of the track's type line, so it is never NULL. The two bit branch has been unreachable since a1cfd4eb6e2. That only shows up now because a quickLift chain names its source assembly in the type line. When the source is a GenArk accession there is no database to connect to, so clicking an alignment link on the Alignment Differences page aborted with "Couldn't connect to database 'GCA_002844635.1'". The track already carries the right file in otherTwoBitUrl; nothing read it. Move the two bit branch first and gate it on the database not existing, so a native chain track still takes the database branch.
  • lines changed 6, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
  • lines changed 44, context: html, text, full: html, text
    cf3880c50c550e4deb61c9664f4f994e13ab6dd8 Mon Aug 17 08:05:58 2026 -0700
    hgc/hgTracks: fix three items from the v502 code review, refs #38106 Shared BLAT alignment links (hgc g=htcBlatAlign) drew the page and then exit(0), which skips main's cartCheckout, so the loaded session was never written back and the recipient's cart ended up nearly empty. Add cartCheckout(&cart) before all four exit(0) calls that follow webEndGb(), including the two early error returns. squishCodonFont() decided FreeType was active with a looser test than maybeNewFonts(), missing the requirement that the font name match a row in freeTypeFonts[]; when they disagreed the bitmap engine got a cell height it cannot render. Factor the engine decision into freeTypeFontActive() and use it in both places. Query name, chrom and a hub's organism string went raw into single-quoted JS string literals and page titles on the modern alignment page; the shared-link path reads the query name back out of a bigPsl, so it is not covered by hgBlat's whitelist. javaScriptLiteralEncode the JS arguments and htmlEncode the HTML labels. Also add "u"/"s" (the shared-link session selectors) to hgc excludeVars so they are not left in the reader's cart.
• src/hg/hgc/pubs.c
  • lines changed 8, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/hgc/retroClick.c
  • lines changed 2, context: html, text, full: html, text
    800bc2ec4d548b450cd21f0bd8bd5b160a353607 Mon Aug 17 02:32:06 2026 -0700
    hgc: fix RetroGenes alignment crash from reading unset 'table' cart var retroShowCdnaAli() read a cart variable "table" that no code path sets; only "aliTable" is passed to the hgcRetroCdnaAli handler, so cartString() aborted with hashMustFindVal: 'table' not found. Use the aliTable value (already read into 'track') for mappingInfoNew(), the same table name retroClickHandler passes. refs #38114
• src/hg/hgsql/hgsql.c
  • lines changed 4, context: html, text, full: html, text
    c4ffb1cc95ba1c1f06d32808237b7cb6623cbee4 Wed Aug 12 10:16:59 2026 -0700
    MariaDB has begun issuing deprecation warnings for the 'mysql'-named version of their client. Updating hgsql to use the preferred name, no ticket
• src/hg/htdocs/allTipsRaw.html
  • lines changed 1, context: html, text, full: html, text
    5440b4ccf5796778b6a65186bf83c17970f00d7a Sun Aug 16 18:43:46 2026 -0700
    Support PDF output in hgRenderTracks via hgt.psOutput. refs #38118 hgRenderTracks had PDF output wired up behind a compile-time PDF_OUTPUT define that was set to 0, so it could only be reached by editing and rebuilding. Select it at runtime with hgt.psOutput=on instead, which is the same variable the hgTracks View->PDF menu item already uses. PNG remains the default. Also return from handlePostscript after doTrackForm when trackImgOnly is set. In that case makeActiveImage has already converted the eps, written the PDF to stdout and unlinked the eps, so the convertEpsToPdf that follows aborted on the missing file. The client never saw it because the PDF was already flushed and hPrintDisable swallowed the error page, but every request logged "Couldn't open ... .eps" to the apache error log. Document the new parameter in the hgRenderTracks section of customTrackText.html and in the hgRenderTracks tip in allTipsRaw.html.
• src/hg/htdocs/goldenPath/help/blatExample.fa
  • lines changed 279, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
• src/hg/htdocs/goldenPath/help/customTrackText.html
  • lines changed 5, context: html, text, full: html, text
    5440b4ccf5796778b6a65186bf83c17970f00d7a Sun Aug 16 18:43:46 2026 -0700
    Support PDF output in hgRenderTracks via hgt.psOutput. refs #38118 hgRenderTracks had PDF output wired up behind a compile-time PDF_OUTPUT define that was set to 0, so it could only be reached by editing and rebuilding. Select it at runtime with hgt.psOutput=on instead, which is the same variable the hgTracks View->PDF menu item already uses. PNG remains the default. Also return from handlePostscript after doTrackForm when trackImgOnly is set. In that case makeActiveImage has already converted the eps, written the PDF to stdout and unlinked the eps, so the convertEpsToPdf that follows aborted on the missing file. The client never saw it because the PDF was already flushed and hPrintDisable swallowed the error page, but every request logged "Couldn't open ... .eps" to the apache error log. Document the new parameter in the hgRenderTracks section of customTrackText.html and in the hgRenderTracks tip in allTipsRaw.html.
• src/hg/htdocs/goldenPath/newsarch.html
  • lines changed 59, context: html, text, full: html, text
    94d4368e9b539a8c369e16a8a950e14799f03cab Tue Aug 11 16:13:45 2026 -0700
    Announcing the ClinPred pathogenicity score track for hg19 and hg38, refs #37510 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/htdocs/indexNews.html
  • lines changed 12, context: html, text, full: html, text
    94d4368e9b539a8c369e16a8a950e14799f03cab Tue Aug 11 16:13:45 2026 -0700
    Announcing the ClinPred pathogenicity score track for hg19 and hg38, refs #37510 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/htdocs/style/hgBlat.css
  • lines changed 210, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
• src/hg/htdocs/style/makefile
  • lines changed 1, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
• src/hg/hubApi/apiUtils.c
  • lines changed 41, context: html, text, full: html, text
    f880f8b822d19c049867d38998c93a03566ba13f Wed Aug 12 13:26:46 2026 -0700
    fixing up errors found in code review refs #37946
  • lines changed 3, context: html, text, full: html, text
    c40c049765198e994676eb5b0d8f5f63fb970896 Wed Aug 12 16:38:41 2026 -0700
    fix per code review refs #38005
• src/hg/hubApi/hubApi.c
  • lines changed 84, context: html, text, full: html, text
    ade26bcbd0927eaae0c456182a97877752c0eb4a Wed Aug 12 16:23:05 2026 -0700
    fixup the web page system to function properly with modern hub syntax and fixing bugs from code review refs #38005
• src/hg/hubApi/liftOver.c
  • lines changed 23, context: html, text, full: html, text
    f880f8b822d19c049867d38998c93a03566ba13f Wed Aug 12 13:26:46 2026 -0700
    fixing up errors found in code review refs #37946
• src/hg/inc/asmSummary.h
  • lines changed 124, context: html, text, full: html, text
    889acd1c73910e973c8325bbd44cfc64bb63a1e3 Wed Aug 12 15:49:54 2026 -0700
    following advice in code review remove obsolete files refs #38005
• src/hg/inc/liftOver.h
  • lines changed 4, context: html, text, full: html, text
    7f65d3da8f2138d847f15a8398f8dcee1a079027 Fri Aug 7 12:07:59 2026 -0700
    quickLift: clip an oversized item to the chains we loaded instead of dropping it, refs #38042 quickLift loads chains for the window plus padding, capped at 1 Mb. An item that reaches further than that has ends where no chain reaches, remapRangeList can place neither of them, and the whole item is dropped even though the part on screen maps fine. ClinVar copy number variants run to 159 Mb, so 44 of the 46 in one window disappeared. Pull the ends in to what the chains cover before mapping. The browser never draws the ends of an item that spans the window, so their exact position does not matter, and the existing spanned-item merge still reports it. A clipped end is snapped to a base inside an aligned block, since remapRangeList will only place a coordinate that lands on real alignment. The clip is in the quickLift code, not the shared liftOver remap path. Only hgTracks asks for it, so the details page keeps the item's true extent. Gated by quickLiftClipToChains, on by default.
• src/hg/inc/quickLift.h
  • lines changed 5, context: html, text, full: html, text
    7f65d3da8f2138d847f15a8398f8dcee1a079027 Fri Aug 7 12:07:59 2026 -0700
    quickLift: clip an oversized item to the chains we loaded instead of dropping it, refs #38042 quickLift loads chains for the window plus padding, capped at 1 Mb. An item that reaches further than that has ends where no chain reaches, remapRangeList can place neither of them, and the whole item is dropped even though the part on screen maps fine. ClinVar copy number variants run to 159 Mb, so 44 of the 46 in one window disappeared. Pull the ends in to what the chains cover before mapping. The browser never draws the ends of an item that spans the window, so their exact position does not matter, and the existing spanned-item merge still reports it. A clipped end is snapped to a base inside an aligned block, since remapRangeList will only place a coordinate that lands on real alignment. The clip is in the quickLift code, not the shared liftOver remap path. Only hgTracks asks for it, so the details page keeps the item's true extent. Gated by quickLiftClipToChains, on by default.
• src/hg/inc/trackDb.h
  • lines changed 3, context: html, text, full: html, text
    b53f0365865b5449ef209ea86c5220dd07dc8b28 Fri Aug 7 12:07:45 2026 -0700
    quickLift: don't report items that failed to lift as filtered out, refs #38033 Items that could not be mapped through the chain were counted by the same variable the track filters use, so a lifted view claimed a number of items had been filtered out when no filter had removed anything. Count the two cases apart: failing a filter is a filter rejection, while passing the filters and then getting nothing back from the lift is a lift failure, and say so in the label.
• src/hg/inc/trashDir.h
  • lines changed 30, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/inc/userdata.h
  • lines changed 12, context: html, text, full: html, text
    7ba5c812bda048b28ade940e0030b8000a02ae4b Mon Aug 10 11:58:51 2026 -0700
    hubSpace: key rows on location so two hubs can hold the same file name, refs #37964 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/js/hgBlat.js
  • lines changed 516, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
• src/hg/js/hgMyData.js
  • lines changed 86, context: html, text, full: html, text
    55efeb031b7d8367e8be67cd05fad21c2e592170 Mon Aug 10 11:59:10 2026 -0700
    hubSpace: take the batch genome from hub.txt, and always say why an upload was refused, refs #37972 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 10, context: html, text, full: html, text
    37aae4a2c5a919c329378f3da0792e168426537d Tue Aug 11 11:31:52 2026 -0700
    hgMyData: a blank hub genome means unset, not a mismatch, refs #37964 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 26, context: html, text, full: html, text
    1671523c0100477eb8d68eb2b825c1f09c069092 Wed Aug 12 10:15:10 2026 -0700
    Add docstring to hgMyData.js with a basic overview of the code, refs #38064
• src/hg/js/hgTracks.js
  • lines changed 8, context: html, text, full: html, text
    9a1633df43738cc9bb0b64ad932514ffaae85895 Mon Aug 10 17:17:12 2026 -0700
    hgTracks: start the drag-select color picker on the saved color, refs #37990 Checking "don't show this again" makes the dialog's close handler remove it from the DOM rather than hide it, so the next drag builds a new one. The rebuilt picker took the default color and the color the user had saved was gone. The dialog saves its color with dragSelect.saveHlColor, which writes hgTracks.prevHlColor. makeHighlightPicker reads a prevHlColor of its own, which nothing in this path ever sets, so it fell through to the default. Pass the saved color in as the picker's starting color. Leave the fourth argument undefined so the label keeps its default: the label test reads label.length, so passing null there would throw. Without the checkbox the dialog is only hidden and keeps its value, which is why this was hard to reproduce from the report.
  • lines changed 8, context: html, text, full: html, text
    19ffb1f276b652de2cd1f593c19bd25630ed6b59 Mon Aug 10 17:17:28 2026 -0700
    hgTracks: let "Save Color" honor the "don't show this again" checkbox, refs #38071 Every other button in the Drag-and-select dialog clears hgTracks.enableHighlightingDialog when the box is checked, and stores it. Save Color did neither, so the box was ignored: the close handler removed the dialog as though it had been turned off, and then it came back on the next drag. saveHlColor only writes prevHlColor, so send the setting alongside it the way "Zoom In" already does.
  • lines changed 41, context: html, text, full: html, text
    e11bc091d6678467768adaa1b2f05c0296ae4352 Wed Aug 12 08:42:06 2026 -0700
    hgTracks: add "Delete Custom Track" to the track right-click menu Custom tracks can now be deleted from the track right-click menu, the same way they are deleted by the trash-can icon in the track list. Both paths call the same deleteCustomTrack() helper, so there is one deletion code path. The menu item is shown only for custom tracks (id starts with "ct_"), reuses the trash SVG inlined from printTrashIcon(), and removes the track from the image in place via hideTracks() rather than reloading the page. refs #38087
  • lines changed 5, context: html, text, full: html, text
    a1354aabe7a5ccdc84bf559fcb97047df817e29a Thu Aug 13 04:34:43 2026 -0700
    hgTracks: trash-icon custom-track delete also removes it from the image The trash icon in the track list now calls hideTracks() after the delete, the same cleanup as the right-click "Delete Custom Track" path, so a deleted custom track disappears from the image and hgTracks.trackDb right away instead of lingering until the next page reload. Guarded on the track being present in hgTracks.trackDb, since hideTracks()/tdbFindChildless() assume that and a hidden custom track can be deleted from the list while not drawn. refs #38087
  • lines changed 13, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/js/hui.js
  • lines changed 32, context: html, text, full: html, text
    26c8e4e2290ebd613b3aad5d5d2b6a12bdfff251 Mon Aug 10 17:16:54 2026 -0700
    hgTracks: apply the color a drag picks in the highlight picker, refs #37987 The Drag-and-select dialog's buttons read the hex text box beside the swatch, not the picker itself. Clicking a palette square makes spectrum treat the color as chosen, which updates that box. Dragging in the gradient square only repaints the picker: spectrum does not consider the color chosen until "choose" is clicked, so the box kept its old value and "Save Color" saved the old color. A move handler now writes the dragged color into the box as the drag happens, and a hide handler resyncs the box so a cancelled drag does not leave the dragged color behind. Also open the picker above the swatch when opening downwards would cover the dialog's row of buttons, which otherwise cannot be clicked at all. Reported on the mailing list in #37983.
• src/hg/js/utils.js
  • lines changed 8, context: html, text, full: html, text
    e08ae97dc288749c2454fd98a10dc79f06e27cb5 Tue Aug 11 06:16:20 2026 -0700
    hgBlat/hgc: fixes from the v502 code review of the BLAT results pages, refs #37893 #4 blatOldTracks now falls back to "keep" (with a warning) on any value other than keep/hide/delete, instead of dropping into the destructive delete branch, so a typo in hg.conf can never silently discard a user's earlier BLAT tracks. #5 htmlEncode() (js/utils.js) now also escapes " and ', which the browser's text->markup conversion leaves alone. Every hgBlat caller puts the result in a double-quoted attribute, so an unescaped quote in the cart position string could break out of the attribute; the shared helper now honors its documented contract. #6 The non-BLAT alignment title no longer starts with a stray space. #7 open_memstream() is checked for NULL: on that failure the alignment renders straight to stdout instead of writing to a NULL FILE and calling fclose(NULL). The section reorder keys on the literal "<H4><A NAME=genomic>"/"<H4><A NAME=ali>" strings, so a note was added in fuzzyShow.c and pslShow.c to keep them intact. Found in the v502 final-build code review, refs #38069.
  • lines changed 422, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
• src/hg/lib/asmSummary.as
  • lines changed 41, context: html, text, full: html, text
    889acd1c73910e973c8325bbd44cfc64bb63a1e3 Wed Aug 12 15:49:54 2026 -0700
    following advice in code review remove obsolete files refs #38005
• src/hg/lib/asmSummary.c
  • lines changed 785, context: html, text, full: html, text
    889acd1c73910e973c8325bbd44cfc64bb63a1e3 Wed Aug 12 15:49:54 2026 -0700
    following advice in code review remove obsolete files refs #38005
• src/hg/lib/asmSummary.sql
  • lines changed 47, context: html, text, full: html, text
    889acd1c73910e973c8325bbd44cfc64bb63a1e3 Wed Aug 12 15:49:54 2026 -0700
    following advice in code review remove obsolete files refs #38005
• src/hg/lib/assemblySummary.as
  • lines changed 3, context: html, text, full: html, text
    619974f143583b4a32568613691e447986a75ac2 Wed Aug 12 16:04:56 2026 -0700
    fixups per code review refs #38005
• src/hg/lib/blatShare.c
  • lines changed 6, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/cart.c
  • lines changed 127, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/customFactory.c
  • lines changed 5, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
  • lines changed 5, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/lib/customTrack.c
  • lines changed 8, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/dupTrack.c
  • lines changed 13, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/hubConnect.c
  • lines changed 73, context: html, text, full: html, text
    d05963670ee4c6b2b54366dc284d32e2b7896356 Fri Aug 14 09:22:16 2026 -0700
    candidate for patch fixing automatic redirect from GCA to GCF assemblies for track or assembly hubs refs #38082
• src/hg/lib/hubSpace.sql
  • lines changed 2, context: html, text, full: html, text
    7ba5c812bda048b28ade940e0030b8000a02ae4b Mon Aug 10 11:58:51 2026 -0700
    hubSpace: key rows on location so two hubs can hold the same file name, refs #37964 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/lib/hui.c
  • lines changed 19, context: html, text, full: html, text
    38bab7f62d250db395c83bd4b6b0d6c08799ef59 Sat Aug 15 20:01:54 2026 -0700
    Make maf UI species arrays dynamic to fix crash on large mafs. refs #38039 The Codon Translation dropdown in wigMafCfgUi built its option list in a fixed nodeNames[512] stack array, so a maf with more than 511 species wrote past the end of the frame and crashed hgTrackUi. Size it from slCount of the species list instead. Three more fixed arrays in the same path silently dropped data rather than crashing: wigMafGetSpecies chopped speciesOrder into species[2000] and speciesGroups into a 1000 entry array, and wigMafSpeciesTable chopped speciesDefaultOff into words[2000]. All now count with chopLineLen and allocate. Verified by driving wigMafCfgUi directly: 700 species segfaulted before and renders now, and 3000 species previously lost everything past 2000. hgTrackUi output for hg38 multiz470way is unchanged.
  • lines changed 1, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/lib/jksql.c
  • lines changed 9, context: html, text, full: html, text
    12a0dc62bdfc01eb3f94cc675657ab21b893c67a Tue Aug 11 09:22:06 2026 -0700
    lib: reject the reserved 0x01 escape marker in sqlSafef, htmlSafef and cgiDecode, refs #38051 sqlSafef does not escape values as it formats them. It formats first, then escapes in a second pass. To mark which spans need escaping it wraps each quoted %s in an in-band marker byte, escPunc = 0x01. sqlEscapeAllStrings then pairs up the 0x01 bytes, escapes the text between a pair, and copies text outside a pair raw. The marker shares the byte stream with the data. A value carrying its own pair of 0x01 bytes forges an extra pair and shifts the pairing, so part of the value is copied raw instead of escaped. For a value of "x\x01' OR '1'='1\x01x" the query came out as name='x' OR '1'='1x' with live quotes. cgiDecode turns %01 into a literal 0x01 and filtered nothing, so this was reachable from a plain GET parameter with no login. htmshell.c uses the same trick for htmlSafef, where the payoff is XSS instead of SQL. Two guards: vaSqlSafefNoAbort now rejects a quoted %s value that already contains escPunc. vaHtmlSafefNoAbort counts the markers after formatting and requires exactly two per escaped string. Both use errAbort rather than sqlCheckError or the noAbort return. sqlCheckError honors noSqlInj.level and can be downgraded to warn and then return, which would leave the injection live, and vaHtmlDyStringPrintf reads a negative return as "buffer too small" and would retry forever. A raw 0x01 is never legitimate in either place, so there is no false-positive cost. cgiDecode and cgiDecodeFull now drop 0x01, both percent-encoded and raw, so the marker never enters a cart or CGI string. Only 0x01. Tab, newline and CR are left alone because custom-track textarea uploads need them. Multipart uploads do not pass through cgiDecode, so the sqlSafef and htmlSafef guards are what cover that path. Pre-escaped %-s arguments are not checked individually. They come either from sqlSafef output, which now aborts before it can produce a marker, or from sqlCheckIdentifier and sqlCkIl, which whitelist from a disallow-all table that never permits 0x01. Removing the in-band marker altogether is the durable fix and is tracked separately, since it rewrites a hot path and needs its own performance testing.
  • lines changed 3, context: html, text, full: html, text
    c6a1b5637442d52ab61dca03453d11bfdf0db338 Wed Aug 12 19:26:21 2026 -0700
    code review revealed spelling error refs #38005
• src/hg/lib/liftOver.c
  • lines changed 26, context: html, text, full: html, text
    7f65d3da8f2138d847f15a8398f8dcee1a079027 Fri Aug 7 12:07:59 2026 -0700
    quickLift: clip an oversized item to the chains we loaded instead of dropping it, refs #38042 quickLift loads chains for the window plus padding, capped at 1 Mb. An item that reaches further than that has ends where no chain reaches, remapRangeList can place neither of them, and the whole item is dropped even though the part on screen maps fine. ClinVar copy number variants run to 159 Mb, so 44 of the 46 in one window disappeared. Pull the ends in to what the chains cover before mapping. The browser never draws the ends of an item that spans the window, so their exact position does not matter, and the existing spanned-item merge still reports it. A clipped end is snapped to a base inside an aligned block, since remapRangeList will only place a coordinate that lands on real alignment. The clip is in the quickLift code, not the shared liftOver remap path. Only hgTracks asks for it, so the details page keeps the item's true extent. Gated by quickLiftClipToChains, on by default.
• src/hg/lib/quickLift.c
  • lines changed 104, context: html, text, full: html, text
    7f65d3da8f2138d847f15a8398f8dcee1a079027 Fri Aug 7 12:07:59 2026 -0700
    quickLift: clip an oversized item to the chains we loaded instead of dropping it, refs #38042 quickLift loads chains for the window plus padding, capped at 1 Mb. An item that reaches further than that has ends where no chain reaches, remapRangeList can place neither of them, and the whole item is dropped even though the part on screen maps fine. ClinVar copy number variants run to 159 Mb, so 44 of the 46 in one window disappeared. Pull the ends in to what the chains cover before mapping. The browser never draws the ends of an item that spans the window, so their exact position does not matter, and the existing spanned-item merge still reports it. A clipped end is snapped to a base inside an aligned block, since remapRangeList will only place a coordinate that lands on real alignment. The clip is in the quickLift code, not the shared liftOver remap path. Only hgTracks asks for it, so the details page keeps the item's true extent. Gated by quickLiftClipToChains, on by default.
• src/hg/lib/sessionData.c
  • lines changed 6, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/tests/expected/sqlCheck/sqlCheck.10
  • lines changed 1, context: html, text, full: html, text
    af0aeebb6fbccc3364ce3c85e7052baa2b124f10 Tue Aug 11 09:22:17 2026 -0700
    hg/lib/tests: add a sqlCheck case for the 0x01 escape marker bypass, refs #38051 New XM type wraps the given value in the 0x01 marker that sqlSafef uses internally to delimit the spans it must escape, then calls sqlSafef. Two markers forge an extra delimiter pair and used to leave the text between them unescaped, so this must now abort. The payload is built inside sqlCheck.c rather than passed in from the makefile, so the test does not need a control byte in a shell argument. This case passes whether or not HGDB_CONF is set, because the guard it exercises uses a hard errAbort rather than sqlCheckError. Note that sqlCheck is not in the default test target, and that case 3 does need HGDB_CONF set in order to abort.
• src/hg/lib/tests/sqlCheck.c
  • lines changed 12, context: html, text, full: html, text
    af0aeebb6fbccc3364ce3c85e7052baa2b124f10 Tue Aug 11 09:22:17 2026 -0700
    hg/lib/tests: add a sqlCheck case for the 0x01 escape marker bypass, refs #38051 New XM type wraps the given value in the 0x01 marker that sqlSafef uses internally to delimit the spans it must escape, then calls sqlSafef. Two markers forge an extra delimiter pair and used to leave the text between them unescaped, so this must now abort. The payload is built inside sqlCheck.c rather than passed in from the makefile, so the test does not need a control byte in a shell argument. This case passes whether or not HGDB_CONF is set, because the guard it exercises uses a hard errAbort rather than sqlCheckError. Note that sqlCheck is not in the default test target, and that case 3 does need HGDB_CONF set in order to abort.
• src/hg/lib/tests/sqlCheck.mk
  • lines changed 2, context: html, text, full: html, text
    af0aeebb6fbccc3364ce3c85e7052baa2b124f10 Tue Aug 11 09:22:17 2026 -0700
    hg/lib/tests: add a sqlCheck case for the 0x01 escape marker bypass, refs #38051 New XM type wraps the given value in the 0x01 marker that sqlSafef uses internally to delimit the spans it must escape, then calls sqlSafef. Two markers forge an extra delimiter pair and used to leave the text between them unescaped, so this must now abort. The payload is built inside sqlCheck.c rather than passed in from the makefile, so the test does not need a control byte in a shell argument. This case passes whether or not HGDB_CONF is set, because the guard it exercises uses a hard errAbort rather than sqlCheckError. Note that sqlCheck is not in the default test target, and that case 3 does need HGDB_CONF set in order to abort.
• src/hg/lib/trackDbCustom.c
  • lines changed 8, context: html, text, full: html, text
    b53f0365865b5449ef209ea86c5220dd07dc8b28 Fri Aug 7 12:07:45 2026 -0700
    quickLift: don't report items that failed to lift as filtered out, refs #38033 Items that could not be mapped through the chain were counted by the same variable the track filters use, so a lifted view claimed a number of items had been filtered out when no filter had removed anything. Count the two cases apart: failing a filter is a filter rejection, while passing the filters and then getting nothing back from the lift is a lift failure, and say so in the label.
• src/hg/lib/trackHub.c
  • lines changed 29, context: html, text, full: html, text
    cdb3401bc60e54dae514885304914b5cd70c45ae Fri Aug 7 12:07:40 2026 -0700
    quickLift: keep the source track order on the target, refs #38032 The hub writer replaced each track's priority with a counter handed out in walk order. The hub file is appended to across requests, and new tracks started after the highest priority already in the file, so a track added in a later request always sorted below one added earlier no matter where it sat on the source. Carry the source priority across instead. The group setting already survives into the hub, so the target orders within a group on the same key the source does. The append-after-existing bookkeeping is no longer needed.
  • lines changed 21, context: html, text, full: html, text
    c2f76c5303384cddb6b48852c54c30437ee029f2 Sat Aug 8 08:49:33 2026 -0700
    quickLift: order the target by rank in the source list, refs #38032 cdb3401bc60 carried each track's source priority into its hub stanza, on the assumption that the source group survives the lift and orders the target the same way it orders the source. It does not. trackHubAddGroupName rewrites the group of every hub track to the hub's own name, so all lifted tracks land in one QuickLift group and priorities from different source groups end up compared against each other. MANE is priority 100 in the genes group; wgEncodeRegDnaseWig is 1.8 in regulation. The group puts MANE on top on hg38; the raw priority put it at the bottom on the target. Write the track's rank in the list the caller has already sorted on group priority and then track priority. The rank counts every track walked past, not only the ones written out, so it depends only on how the source is laid out and does not shift with the append-per-request behaviour this ticket is about. A superTrack parent is not in that list and has no rank of its own, so it takes the rank of the first child that pulled it in, less a half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 1, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/trashDir.c
  • lines changed 80, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/lib/userdata.c
  • lines changed 97, context: html, text, full: html, text
    7ba5c812bda048b28ade940e0030b8000a02ae4b Mon Aug 10 11:58:51 2026 -0700
    hubSpace: key rows on location so two hubs can hold the same file name, refs #37964 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/doc/Cardiomyopathy.txt
  • lines changed 8, context: html, text, full: html, text
    6796b337521a06767307b5c273bf89903d5a3bd6 Tue Aug 11 17:05:08 2026 -0700
    Fix Variant Evidence Summary SpliceAI/BP7 issues per code review. refs #37446 - Use the released spliceAIsnvsMasked.bb instead of a superseded symlink; the older /gbdb/hg38/bbi/spliceAi.bb pointed at a stale file the live track no longer serves. - Distinguish a SpliceAI lookup miss from a measured 0.00 in the mouseover. A miss now reads "no record (below the 0.02 reporting floor)"; BP7 still applies because the file's 0.02 floor means a missing score is below 0.1. - Correct the BP7 mouseover threshold text from "<= 0.1" to "< 0.1" to match the code, docstring, and makedoc. - Record PM1 suppression in the codeNotes field so it matches the autoSql description instead of leaving the field empty on every row.
  • lines changed 8, context: html, text, full: html, text
    d8b6c80ed8ff14976691a387275e5632861f9b66 Tue Aug 11 17:21:12 2026 -0700
    Use raw (unmasked) SpliceAI file for BP7 to match the Walker 2023 calibration. refs #37446 Walker 2023 (PMID 37352859), which the CM VCEP cited for the BP7 SpliceAI < 0.1 rule, derived that threshold on the raw max delta score. The masked SNV file zeroes losses at unannotated (cryptic) splice sites; for our 8 genes that would grant BP7 to 66 synonymous variants whose raw score is up to 0.87. Switching to the released raw file spliceAIsnvs.bb keeps the score type matched to the calibration and is the more conservative benign call. BP7 count 2,415 -> 2,334.
  • lines changed 20, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/doc/asmHubs/mkSymLinks.pl
  • lines changed 1, context: html, text, full: html, text
    1b64478747b87c045f07b9a56b2ca3179260e4c4 Wed Aug 12 16:20:20 2026 -0700
    protect a string substitution against odd characters per code review refs #38005
• src/hg/makeDb/doc/hg38/cactus447.txt
  • lines changed 40, context: html, text, full: html, text
    a29276ca751e3fa5f0fc03784014b56e74aa840a Tue Aug 11 05:03:46 2026 -0700
    adding makedoc for cactus447 update, refs #37841
• src/hg/makeDb/doc/hg38/lrSv.txt
  • lines changed 26, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
• src/hg/makeDb/doc/hg38/singleCellSignalsPeaks.txt
  • lines changed 11, context: html, text, full: html, text
    fe02c55d26614f1d5059c884fb2594f9b4d5ad50 Wed Aug 12 08:02:19 2026 -0700
    singleCellSignalsPeaks: point at the hub build's new home, fix the file-copy script The hub build now lives in the cellBrowser repo under ucsc/allTracksHub, so the makeDocs link there instead of a personal work dir. HUB_BUILD in these scripts is the build's output dir, not its code; comments say so now, paths unchanged. copySingleCellSignalsPeaksFiles.py was silently copying nothing: it compared a whole line against "parent <composite>", but stanzas are now indented and read "parent <composite> off". Now dedents, matches the first token, and refuses to run on zero subtracks. Dry runs give 925 hg38 / 587 mm10, none missing. refs #37914
  • lines changed 1, context: html, text, full: html, text
    2162be65d294e930dfca338b0a3ef2a054449b36 Sat Aug 15 13:31:58 2026 -0700
    Make the singleCellSignalsPeaks metadata check mandatory, refs #38070 Missing facet metadata used to warn and write the .ra anyway, so a stanza file holding 22 of 925 subtracks produced a short .ra and exit 0. It is now an error, with --no-meta-check to skip it deliberately and --meta to point elsewhere. The metadata, palette and manifest are found relative to --stanzas instead of HUB_BUILD, so pointing --stanzas at another build no longer checks it against the default build's metadata. Moved the HUB_BUILD default off a personal hive directory to /hive/data/inside/cells/all-tracks-hub-build, beside the served hub. Both .ra files regenerate unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/doc/mm10/singleCellSignalsPeaks.txt
  • lines changed 15, context: html, text, full: html, text
    fe02c55d26614f1d5059c884fb2594f9b4d5ad50 Wed Aug 12 08:02:19 2026 -0700
    singleCellSignalsPeaks: point at the hub build's new home, fix the file-copy script The hub build now lives in the cellBrowser repo under ucsc/allTracksHub, so the makeDocs link there instead of a personal work dir. HUB_BUILD in these scripts is the build's output dir, not its code; comments say so now, paths unchanged. copySingleCellSignalsPeaksFiles.py was silently copying nothing: it compared a whole line against "parent <composite>", but stanzas are now indented and read "parent <composite> off". Now dedents, matches the first token, and refuses to run on zero subtracks. Dry runs give 925 hg38 / 587 mm10, none missing. refs #37914
  • lines changed 1, context: html, text, full: html, text
    2162be65d294e930dfca338b0a3ef2a054449b36 Sat Aug 15 13:31:58 2026 -0700
    Make the singleCellSignalsPeaks metadata check mandatory, refs #38070 Missing facet metadata used to warn and write the .ra anyway, so a stanza file holding 22 of 925 subtracks produced a short .ra and exit 0. It is now an error, with --no-meta-check to skip it deliberately and --meta to point elsewhere. The metadata, palette and manifest are found relative to --stanzas instead of HUB_BUILD, so pointing --stanzas at another build no longer checks it against the default build's metadata. Moved the HUB_BUILD default off a personal hive directory to /hive/data/inside/cells/all-tracks-hub-build, beside the served hub. Both .ra files regenerate unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPClinVar506161.py
  • lines changed 18, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPEvRepo.py
  • lines changed 7, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPProvisionalClass.py
  • lines changed 18, context: html, text, full: html, text
    6796b337521a06767307b5c273bf89903d5a3bd6 Tue Aug 11 17:05:08 2026 -0700
    Fix Variant Evidence Summary SpliceAI/BP7 issues per code review. refs #37446 - Use the released spliceAIsnvsMasked.bb instead of a superseded symlink; the older /gbdb/hg38/bbi/spliceAi.bb pointed at a stale file the live track no longer serves. - Distinguish a SpliceAI lookup miss from a measured 0.00 in the mouseover. A miss now reads "no record (below the 0.02 reporting floor)"; BP7 still applies because the file's 0.02 floor means a missing score is below 0.1. - Correct the BP7 mouseover threshold text from "<= 0.1" to "< 0.1" to match the code, docstring, and makedoc. - Record PM1 suppression in the codeNotes field so it matches the autoSql description instead of leaving the field empty on every row.
  • lines changed 5, context: html, text, full: html, text
    d8b6c80ed8ff14976691a387275e5632861f9b66 Tue Aug 11 17:21:12 2026 -0700
    Use raw (unmasked) SpliceAI file for BP7 to match the Walker 2023 calibration. refs #37446 Walker 2023 (PMID 37352859), which the CM VCEP cited for the BP7 SpliceAI < 0.1 rule, derived that threshold on the raw max delta score. The masked SNV file zeroes losses at unannotated (cryptic) splice sites; for our 8 genes that would grant BP7 to 66 synonymous variants whose raw score is up to 0.87. Switching to the released raw file spliceAIsnvs.bb keeps the score type matched to the calibration and is the more conservative benign call. BP7 count 2,415 -> 2,334.
  • lines changed 18, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPRevel.py
  • lines changed 66, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPWalsh2019.py
  • lines changed 12, context: html, text, full: html, text
    615721361f4baf75c0715bb931c5fc1015101622 Tue Aug 11 18:21:56 2026 -0700
    Address code-review findings on the Cardiomyopathy VCEP scripts. refs #37446 - Gate PM1 to missense variants per the CSpec ("applicable to missense variants"); a positional-only test wrongly gave synonymous/truncating/splice variants PM1 and let it collide with BA1/BP7. PM1 firing 1,293 -> 700. - Transcript-gate the Walsh-2019 ClinVar coordinate lookup so a classic-vs-MANE c.notation collision no longer mis-places TNNT2 R92Q (was drawn ~331 nt off with a different variant's VariationID); the gate applies only to the WALSH_TX genes. - Show the amino-acid change in the REVEL mouseover (computed from the MANE CDS) so the per-alt genomic-forward-strand score is not misread on minus-strand genes. - Resolve every build input relative to --output-dir (sibling track outputs and cmp_downloads sources) for otto portability; canonical build byte-identical. - Also key the diseaseTag off the counted PM1 code, and makedoc corrections (worked example REVEL/gnomAD values, PM1 count, universe and EvRepo notes).
• src/hg/makeDb/scripts/lrSv/databases.tsv
  • lines changed 3, context: html, text, full: html, text
    0bd565e053abc8c74475f352bedfd37e41312fd2 Wed Aug 12 02:15:40 2026 -0700
    lrSv: update noyvertSv docs and align merged-track source labels, refs #37888 Follow-up to author (Boris Noyvert) feedback on the Noyvert/Boehringer long-read SV dataset. noyvertSv.html: - restore neutral wording about the shared 1000G ONT reads; drop the "independent reprocessing" phrasing and the call-level overlap interpretation the authors objected to - note that singletons (SVs in a single sample) were excluded, so the panel is not exhaustive for the rarest variants - add the medRxiv preprint link alongside the eLife reference Give each dataset one consistent name across its subtrack and the merged (lrSvAll) source filter (databases.tsv + lrSvAll.ra + lrSv.ra): Noyvert 888 (1000G ONT) -> 1KG ONT Boehringer 888 1KG ONT Vienna 1,019 -> 1KG ONT 1019 1KG ONT 100 (Gustafson) -> 1KG ONT UW 100 The gustafsonSv subtrack short/long labels read 97 samples; the paper and our track docs report 100 (Gustafson et al. 2024, PMID 39358015), so those are corrected to 100 as well. Rebuilt lrSvAll.bb with lrSvMergeAll.py; item count unchanged (2,582,278).
  • lines changed 4, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
• src/hg/makeDb/scripts/singleCellSignalsPeaks/copySingleCellSignalsPeaksFiles.py
  • lines changed 16, context: html, text, full: html, text
    fe02c55d26614f1d5059c884fb2594f9b4d5ad50 Wed Aug 12 08:02:19 2026 -0700
    singleCellSignalsPeaks: point at the hub build's new home, fix the file-copy script The hub build now lives in the cellBrowser repo under ucsc/allTracksHub, so the makeDocs link there instead of a personal work dir. HUB_BUILD in these scripts is the build's output dir, not its code; comments say so now, paths unchanged. copySingleCellSignalsPeaksFiles.py was silently copying nothing: it compared a whole line against "parent <composite>", but stanzas are now indented and read "parent <composite> off". Now dedents, matches the first token, and refuses to run on zero subtracks. Dry runs give 925 hg38 / 587 mm10, none missing. refs #37914
  • lines changed 1, context: html, text, full: html, text
    2162be65d294e930dfca338b0a3ef2a054449b36 Sat Aug 15 13:31:58 2026 -0700
    Make the singleCellSignalsPeaks metadata check mandatory, refs #38070 Missing facet metadata used to warn and write the .ra anyway, so a stanza file holding 22 of 925 subtracks produced a short .ra and exit 0. It is now an error, with --no-meta-check to skip it deliberately and --meta to point elsewhere. The metadata, palette and manifest are found relative to --stanzas instead of HUB_BUILD, so pointing --stanzas at another build no longer checks it against the default build's metadata. Moved the HUB_BUILD default off a personal hive directory to /hive/data/inside/cells/all-tracks-hub-build, beside the served hub. Both .ra files regenerate unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/scripts/singleCellSignalsPeaks/makeSingleCellSignalsPeaksRa.py
  • lines changed 5, context: html, text, full: html, text
    fe02c55d26614f1d5059c884fb2594f9b4d5ad50 Wed Aug 12 08:02:19 2026 -0700
    singleCellSignalsPeaks: point at the hub build's new home, fix the file-copy script The hub build now lives in the cellBrowser repo under ucsc/allTracksHub, so the makeDocs link there instead of a personal work dir. HUB_BUILD in these scripts is the build's output dir, not its code; comments say so now, paths unchanged. copySingleCellSignalsPeaksFiles.py was silently copying nothing: it compared a whole line against "parent <composite>", but stanzas are now indented and read "parent <composite> off". Now dedents, matches the first token, and refuses to run on zero subtracks. Dry runs give 925 hg38 / 587 mm10, none missing. refs #37914
  • lines changed 0, context: html, text, full: html, text
    29afbb7595289b958dfb4fe966dc51c288d260cb Sat Aug 15 13:16:06 2026 -0700
    Count unrecognized G2P confidence values per record, not per output line, refs #38070 An HGNC ID can have several coordinate rows, so the old counter reported one record as many. Also fold case/whitespace so one new value is not logged as several, rename the remaining snake_case locals, and make makeSingleCellSignalsPeaksRa.py executable. Output is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 36, context: html, text, full: html, text
    2162be65d294e930dfca338b0a3ef2a054449b36 Sat Aug 15 13:31:58 2026 -0700
    Make the singleCellSignalsPeaks metadata check mandatory, refs #38070 Missing facet metadata used to warn and write the .ra anyway, so a stanza file holding 22 of 925 subtracks produced a short .ra and exit 0. It is now an error, with --no-meta-check to skip it deliberately and --meta to point elsewhere. The metadata, palette and manifest are found relative to --stanzas instead of HUB_BUILD, so pointing --stanzas at another build no longer checks it against the default build's metadata. Moved the HUB_BUILD default off a personal hive directory to /hive/data/inside/cells/all-tracks-hub-build, beside the served hub. Both .ra files regenerate unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/scripts/tp53/tp53AFfrequencies.py
  • lines changed 81, context: html, text, full: html, text
    1d0e2581c362c4971a20b464f5e593f23b01fba6 Thu Aug 13 16:01:04 2026 -0700
    Fix TP53 Provisional PM2 and BA1/BS1 frequency logic to match CSpec GN009. refs #37399 From the EvRepo cross-check. PM2_Supporting now applies to missense variants absent from gnomAD, not only rare-but-present ones: tp53AFfrequencies.py writes a per-assembly gnomAD present-set, and tp53ProvisionalClass.py applies PM2 when every nt path of a missense change is absent (a present-but-not-rare path blocks it, so variants seen at moderate frequency are not given PM2). BA1/BS1 now threshold on the non-founder ancestry-group max AF (AF_grpmax), per GN009's continental-subpopulation FAF rule, instead of the overall faf95, so variants common in a single ancestry group are no longer under-called. gnomAD v4.1 exposes only the single top group with no per-group filtering AF, so this uses raw AF_grpmax with a >=2000-allele floor as a documented approximation. Validated vs 137 EvRepo final classifications: PM2 disagreements 63->12, AF strength disagreements 4->2 (P47S/G360A/T312S now agree).
  • lines changed 127, context: html, text, full: html, text
    e28d9673130c2d129d7f7684897fb809b5a17325 Thu Aug 13 16:38:07 2026 -0700
    Read TP53 BA1/BS1 from source gnomAD VCF for exact per-ancestry faf95. refs #37399 Replace the raw AF_grpmax approximation with the CSpec-exact metric: the max faf95 across non-founder continental ancestry groups (afr/amr/eas/nfe/sas), read from the source gnomAD v4.1 sites VCF via tabix. The /gbdb bigBed only carries the overall faf95 and the raw grpmax AF, not per-group faf95. faf95 is a Poisson 95% CI lower bound, so it discounts small groups (subsuming the CSpec >=2000 allele rule) and removes the raw-AF over-calls. Founder groups (asj/fin/mid/remaining) are excluded by omission from the max. Effect vs the AF_grpmax approximation: AF-track BS1 75->53; Provisional over-calls eliminated (Y107H BA1->BS1, now matches the EvRepo final call, and no we-only BA1/BS1 remain); T312S drops to no AF code because its exact faf95 0.000299 is just under the 0.0003 BS1 threshold. Also repurposes the AF bed's chipNote column to fafGroup (the ancestry group giving the faf95).
• src/hg/makeDb/scripts/tp53/tp53Flossies.py
  • lines changed 50, context: html, text, full: html, text
    7fb0ec3d9354f0bb4b059b0106ecaf5c40889a05 Thu Aug 13 15:13:03 2026 -0700
    Tier TP53 FLOSSIES BS2 by carrier count; ClinGen wording, per VCEP meeting. refs #37399 Replace the flat BS2 (-4) with the VCEP's carrier-count tiers: 2-3 carriers BS2_Supporting (-1), 4-7 BS2_Moderate (-2), 8+ BS2 (-4); a single carrier does not meet BS2. Carriers = allele_count - hom_count. tp53Flossies.py assigns the tier and color per observation; tp53ProvisionalClass.py reads the tier from the FLOSSIES bed (load_flossies_lookup returns label+points, bs2_evidence picks the strongest matching tier) and feeds the matching point value into the Provisional point sum. Also change the Provisional disclaimer from 'NOT a VCEP classification' to 'NOT a ClinGen classification' in the mouseover, docstring, and AUTOSQL, and drop a now-unused POINTS['BS2'] entry.
  • lines changed 7, context: html, text, full: html, text
    44b6d9c6ca033c3f613b336cdc52b9a938e1a8e1 Fri Aug 14 12:58:26 2026 -0700
    Drop dead synonymous_variant from TP53 FLOSSIES coding set; fix comment. refs #37399 Per CR feedback: CODING_CONSEQUENCES listed 'synonymous_variant', but the FLOSSIES export labels synonymous variants 'silent', so they correctly fall to Informational (not BS2) as documented. The dead entry contradicted the comment and would have tiered synonymous as BS2 if the label ever changed. Remove it and correct the comment. Output is unchanged (no synonymous_variant-labeled variant exists in the data).
• src/hg/makeDb/scripts/tp53/tp53ProvisionalClass.py
  • lines changed 36, context: html, text, full: html, text
    7fb0ec3d9354f0bb4b059b0106ecaf5c40889a05 Thu Aug 13 15:13:03 2026 -0700
    Tier TP53 FLOSSIES BS2 by carrier count; ClinGen wording, per VCEP meeting. refs #37399 Replace the flat BS2 (-4) with the VCEP's carrier-count tiers: 2-3 carriers BS2_Supporting (-1), 4-7 BS2_Moderate (-2), 8+ BS2 (-4); a single carrier does not meet BS2. Carriers = allele_count - hom_count. tp53Flossies.py assigns the tier and color per observation; tp53ProvisionalClass.py reads the tier from the FLOSSIES bed (load_flossies_lookup returns label+points, bs2_evidence picks the strongest matching tier) and feeds the matching point value into the Provisional point sum. Also change the Provisional disclaimer from 'NOT a VCEP classification' to 'NOT a ClinGen classification' in the mouseover, docstring, and AUTOSQL, and drop a now-unused POINTS['BS2'] entry.
  • lines changed 40, context: html, text, full: html, text
    1d0e2581c362c4971a20b464f5e593f23b01fba6 Thu Aug 13 16:01:04 2026 -0700
    Fix TP53 Provisional PM2 and BA1/BS1 frequency logic to match CSpec GN009. refs #37399 From the EvRepo cross-check. PM2_Supporting now applies to missense variants absent from gnomAD, not only rare-but-present ones: tp53AFfrequencies.py writes a per-assembly gnomAD present-set, and tp53ProvisionalClass.py applies PM2 when every nt path of a missense change is absent (a present-but-not-rare path blocks it, so variants seen at moderate frequency are not given PM2). BA1/BS1 now threshold on the non-founder ancestry-group max AF (AF_grpmax), per GN009's continental-subpopulation FAF rule, instead of the overall faf95, so variants common in a single ancestry group are no longer under-called. gnomAD v4.1 exposes only the single top group with no per-group filtering AF, so this uses raw AF_grpmax with a >=2000-allele floor as a documented approximation. Validated vs 137 EvRepo final classifications: PM2 disagreements 63->12, AF strength disagreements 4->2 (P47S/G360A/T312S now agree).
  • lines changed 100, context: html, text, full: html, text
    c05b0aa800df56a3fd1a5c5cbb903e39a54b6396 Fri Aug 14 10:42:09 2026 -0700
    TP53 Provisional: nt-aware splicing, caveat 4, and per-nt divergence flags. refs #37399 From the ClinGen TP53 VCEP review. The Provisional summary is one row per missense protein change, but splicing and allele frequency are nt-specific: - Splicing PP3 (SpliceAI >= 0.2, supersedes a missense BP4) now applies only when UNAMBIGUOUS: every nt path yielding the protein change is >= 0.2. When paths straddle the threshold the row keeps its missense code (fixes e.g. L35F, where c.105G>T=0.35 but c.105G>C=0.13 was wrongly flagged via the codon max). - Caveat (GN009): when splicing PP3 is applied, drop the protein-level functional assay code (PS3/BS3) from the point sum, since the assay tests the missense protein not the splicing effect. - New ntVerify column (bed9+10 -> 9+11, filterable): flags rows whose nt variants disagree on SpliceAI or on gnomAD AF, with a mouseover pointer to verify the exact nt change in the Bioinformatic / Allele Frequencies track. load_s2 now tracks spliceai_min; af_code_and_points returns af_divergent (AF aggregation unchanged). Reviewed clean by a fresh-eyes pass.
• src/hg/makeDb/scripts/tp53/tp53VCEPClinVar.py
  • lines changed 41, context: html, text, full: html, text
    5b4e8221e9a3ce8c7cd18d4554ee95dc4b4abfbe Thu Aug 13 17:28:29 2026 -0700
    Restore BP4_Moderate strength in TP53 VCEP Curated track from Table S2. refs #37399 EvRepo's structured export emits a bare 'BP4' tag with no BP4_Moderate variant (unlike PP3_Moderate / PM2_Supporting, which it keeps), so the VCEP Curated track dropped the BP4 strength the panel actually applied. Restore it from the VCEP's Table S2 bioinformatic worksheet, matched on the exact nt change: tp53VCEPClinVar.py loads Table S2's BP4_Moderate set and upgrades a bare Met 'BP4' to 'BP4_Moderate' for the matching variant. Validated against the ClinVar interpretation prose: where that text is parseable its BP4 strength matches Table S2 for every missense variant. The enrichment changes 48 variants, all exactly BP4 -> BP4_Moderate with no off-target code changes, and removes all 34 BP4 strength disagreements in the EvRepo cross-check (full code agreement 37% -> 43%).
• src/hg/makeDb/simpleGap/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/makeDb/trackDb/human/clinPred.ra
  • lines changed 1, context: html, text, full: html, text
    dc0b1127adac16700c0cf8bdc32b5cdfc4b308e7 Wed Aug 12 15:29:32 2026 -0700
    Adding New pennantIcon for the ClinPred track on hg19 and hg38 and pointing the Deleteriousness Predictions container pennant at the Aug. 11, 2026 news post, refs #37510 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/trackDb/human/clinvar.alpha.ra
  • lines changed 3, context: html, text, full: html, text
    3258e4421c0a95ef8ca84445b077c77faaf04970 Mon Aug 10 18:14:37 2026 -0700
    clinvar: give clinvarSubLolly a maxHeightPixels ceiling, refs #38072 A bigLolly row is a fixed pixel height, so neither pix nor textSize reaches it. A figure rendered at three times the normal width left the ClinVar submitted interpretations row at 128 pixels while the tracks around it grew with the font, so it came out a sliver with unreadable y-axis labels. Docent asks for a taller row for a print render (see 140e29ae689, refs #37892), but each track's own maxHeightPixels clamps that request, and this track had no setting, so the ceiling fell back to the 128 default and the request was clamped straight back. Raise the ceiling to 512. The default stays at 128, so an ordinary view is unchanged and only a render that asks for more can get it. The two files are kept in step because the alpha stanza carries its own copy.
• src/hg/makeDb/trackDb/human/clinvar.ra
  • lines changed 5, context: html, text, full: html, text
    3258e4421c0a95ef8ca84445b077c77faaf04970 Mon Aug 10 18:14:37 2026 -0700
    clinvar: give clinvarSubLolly a maxHeightPixels ceiling, refs #38072 A bigLolly row is a fixed pixel height, so neither pix nor textSize reaches it. A figure rendered at three times the normal width left the ClinVar submitted interpretations row at 128 pixels while the tracks around it grew with the font, so it came out a sliver with unreadable y-axis labels. Docent asks for a taller row for a print render (see 140e29ae689, refs #37892), but each track's own maxHeightPixels clamps that request, and this track had no setting, so the ceiling fell back to the 128 default and the request was clamped straight back. Raise the ceiling to 512. The default stays at 128, so an ordinary view is unchanged and only a render that asks for more can get it. The two files are kept in step because the alpha stanza carries its own copy.
• src/hg/makeDb/trackDb/human/eve.html
  • lines changed 6, context: html, text, full: html, text
    a9aac9b1895c1d0aaa66b2e51e7414433e63a3ab Fri Aug 14 10:15:13 2026 -0700
    Bolding EVE and changing HTTP to HTTPS, refs #37763
• src/hg/makeDb/trackDb/human/geneHancer.html
  • lines changed 7, context: html, text, full: html, text
    c371c1318677ffa344af415690433ac058dd910e Wed Aug 12 17:00:15 2026 -0700
    Adding a note to point to the most recent version of the GeneHancer track, refs #38019
  • lines changed 19, context: html, text, full: html, text
    14904fc02baf944d1211efdb92ac6adb39bc2393 Wed Aug 12 17:21:36 2026 -0700
    Moving the note to the top of the page so it gets better attention, refs #38019
• src/hg/makeDb/trackDb/human/hprc2v21Sv.html
  • lines changed 5, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
• src/hg/makeDb/trackDb/human/hs1/html/lrSv.html
  • lines changed 42, context: html, text, full: html, text
    e11e10c01c975653b7f0102601cabd52967d2c80 Fri Aug 14 05:58:23 2026 -0700
    lrSv: author-provided noyvertSv description, Vienna ONT naming, hs1 Lin update, refs #38099 - noyvertSv.html: replace the Description with the author-provided text (imputation purpose, singletons excluded, subset-of-Vienna relationship) - rename "1KG ONT Vienna" -> "1KG Vienna ONT" to match the subtrack and merged-track labels (noyvertSv.html and the hs1 lrSv page) - hs1 lrSv page: add the 1KG Lin merged subtrack (now native on T2T-CHM13, 614,522 SVs) and reorder the summary table and detail sections to match the track (priority) order - lrSv1kLin.html: link the source Lin et al. dataset on GitHub
• src/hg/makeDb/trackDb/human/lrSv.html
  • lines changed 371, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
  • lines changed 10, context: html, text, full: html, text
    7e0dfcdd7ebd1eb552c2d7a367ac02b997e74026 Fri Aug 14 07:54:16 2026 -0700
    longReadVariants: add Boehringer ONT 888 callset to 1000 Genomes table, reword table intro
  • lines changed 4, context: html, text, full: html, text
    29c46a47cbb40f44c06103e8294e8864d82256a7 Mon Aug 17 05:56:59 2026 -0700
    lrSv: fix typos and HTML consistency in track description pages GitHub capitalization, Continuous, missing article/period in HPRC2 row, 1000 Genomes capitalization, quote target/id attributes
• src/hg/makeDb/trackDb/human/lrSv.ra
  • lines changed 2, context: html, text, full: html, text
    0bd565e053abc8c74475f352bedfd37e41312fd2 Wed Aug 12 02:15:40 2026 -0700
    lrSv: update noyvertSv docs and align merged-track source labels, refs #37888 Follow-up to author (Boris Noyvert) feedback on the Noyvert/Boehringer long-read SV dataset. noyvertSv.html: - restore neutral wording about the shared 1000G ONT reads; drop the "independent reprocessing" phrasing and the call-level overlap interpretation the authors objected to - note that singletons (SVs in a single sample) were excluded, so the panel is not exhaustive for the rarest variants - add the medRxiv preprint link alongside the eLife reference Give each dataset one consistent name across its subtrack and the merged (lrSvAll) source filter (databases.tsv + lrSvAll.ra + lrSv.ra): Noyvert 888 (1000G ONT) -> 1KG ONT Boehringer 888 1KG ONT Vienna 1,019 -> 1KG ONT 1019 1KG ONT 100 (Gustafson) -> 1KG ONT UW 100 The gustafsonSv subtrack short/long labels read 97 samples; the paper and our track docs report 100 (Gustafson et al. 2024, PMID 39358015), so those are corrected to 100 as well. Rebuilt lrSvAll.bb with lrSvMergeAll.py; item count unchanged (2,582,278).
  • lines changed 41, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
• src/hg/makeDb/trackDb/human/lrSv1kLin.html
  • lines changed 89, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
  • lines changed 4, context: html, text, full: html, text
    e11e10c01c975653b7f0102601cabd52967d2c80 Fri Aug 14 05:58:23 2026 -0700
    lrSv: author-provided noyvertSv description, Vienna ONT naming, hs1 Lin update, refs #38099 - noyvertSv.html: replace the Description with the author-provided text (imputation purpose, singletons excluded, subset-of-Vienna relationship) - rename "1KG ONT Vienna" -> "1KG Vienna ONT" to match the subtrack and merged-track labels (noyvertSv.html and the hs1 lrSv page) - hs1 lrSv page: add the 1KG Lin merged subtrack (now native on T2T-CHM13, 614,522 SVs) and reorder the summary table and detail sections to match the track (priority) order - lrSv1kLin.html: link the source Lin et al. dataset on GitHub
  • lines changed 1, context: html, text, full: html, text
    29c46a47cbb40f44c06103e8294e8864d82256a7 Mon Aug 17 05:56:59 2026 -0700
    lrSv: fix typos and HTML consistency in track description pages GitHub capitalization, Continuous, missing article/period in HPRC2 row, 1000 Genomes capitalization, quote target/id attributes
• src/hg/makeDb/trackDb/human/lrSvAll.ra
  • lines changed 1, context: html, text, full: html, text
    0bd565e053abc8c74475f352bedfd37e41312fd2 Wed Aug 12 02:15:40 2026 -0700
    lrSv: update noyvertSv docs and align merged-track source labels, refs #37888 Follow-up to author (Boris Noyvert) feedback on the Noyvert/Boehringer long-read SV dataset. noyvertSv.html: - restore neutral wording about the shared 1000G ONT reads; drop the "independent reprocessing" phrasing and the call-level overlap interpretation the authors objected to - note that singletons (SVs in a single sample) were excluded, so the panel is not exhaustive for the rarest variants - add the medRxiv preprint link alongside the eLife reference Give each dataset one consistent name across its subtrack and the merged (lrSvAll) source filter (databases.tsv + lrSvAll.ra + lrSv.ra): Noyvert 888 (1000G ONT) -> 1KG ONT Boehringer 888 1KG ONT Vienna 1,019 -> 1KG ONT 1019 1KG ONT 100 (Gustafson) -> 1KG ONT UW 100 The gustafsonSv subtrack short/long labels read 97 samples; the paper and our track docs report 100 (Gustafson et al. 2024, PMID 39358015), so those are corrected to 100 as well. Rebuilt lrSvAll.bb with lrSvMergeAll.py; item count unchanged (2,582,278).
  • lines changed 2, context: html, text, full: html, text
    44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
    adding lin et al long-read SV subtrack, refs #38099
• src/hg/makeDb/trackDb/human/noyvertSv.html
  • lines changed 31, context: html, text, full: html, text
    afff541e7fd736cc48695ecf2442bea316120582 Tue Aug 11 08:35:42 2026 -0700
    update to the noyvertSv docs, page, based on email from author
  • lines changed 11, context: html, text, full: html, text
    0bd565e053abc8c74475f352bedfd37e41312fd2 Wed Aug 12 02:15:40 2026 -0700
    lrSv: update noyvertSv docs and align merged-track source labels, refs #37888 Follow-up to author (Boris Noyvert) feedback on the Noyvert/Boehringer long-read SV dataset. noyvertSv.html: - restore neutral wording about the shared 1000G ONT reads; drop the "independent reprocessing" phrasing and the call-level overlap interpretation the authors objected to - note that singletons (SVs in a single sample) were excluded, so the panel is not exhaustive for the rarest variants - add the medRxiv preprint link alongside the eLife reference Give each dataset one consistent name across its subtrack and the merged (lrSvAll) source filter (databases.tsv + lrSvAll.ra + lrSv.ra): Noyvert 888 (1000G ONT) -> 1KG ONT Boehringer 888 1KG ONT Vienna 1,019 -> 1KG ONT 1019 1KG ONT 100 (Gustafson) -> 1KG ONT UW 100 The gustafsonSv subtrack short/long labels read 97 samples; the paper and our track docs report 100 (Gustafson et al. 2024, PMID 39358015), so those are corrected to 100 as well. Rebuilt lrSvAll.bb with lrSvMergeAll.py; item count unchanged (2,582,278).
  • lines changed 22, context: html, text, full: html, text
    e11e10c01c975653b7f0102601cabd52967d2c80 Fri Aug 14 05:58:23 2026 -0700
    lrSv: author-provided noyvertSv description, Vienna ONT naming, hs1 Lin update, refs #38099 - noyvertSv.html: replace the Description with the author-provided text (imputation purpose, singletons excluded, subset-of-Vienna relationship) - rename "1KG ONT Vienna" -> "1KG Vienna ONT" to match the subtrack and merged-track labels (noyvertSv.html and the hs1 lrSv page) - hs1 lrSv page: add the 1KG Lin merged subtrack (now native on T2T-CHM13, 614,522 SVs) and reorder the summary table and detail sections to match the track (priority) order - lrSv1kLin.html: link the source Lin et al. dataset on GitHub
• src/hg/makeDb/trackDb/human/popEve.html
  • lines changed 17, context: html, text, full: html, text
    e226ca32f92c500fb9294cd84eff5f7938ba45cb Tue Aug 11 14:19:27 2026 -0700
    Alphabetize popEVE references and credits by author per QA. refs #37791 List Frazer (2021) before Orenbuch (2025) in References, and order the Credits names by surname, per QA feedback on the description page.
• src/hg/makeDb/trackDb/human/predictionScoresSuper.ra
  • lines changed 1, context: html, text, full: html, text
    dc0b1127adac16700c0cf8bdc32b5cdfc4b308e7 Wed Aug 12 15:29:32 2026 -0700
    Adding New pennantIcon for the ClinPred track on hg19 and hg38 and pointing the Deleteriousness Predictions container pennant at the Aug. 11, 2026 news post, refs #37510 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 1, context: html, text, full: html, text
    5da26c4eac695429f6767b9a09472541d6e387b5 Thu Aug 13 15:09:46 2026 -0700
    Staging popEve on hgwbeta, refs #37791
  • lines changed 1, context: html, text, full: html, text
    952407a9d5ecd027e206ae8af70aadb9f02ae639 Fri Aug 14 10:28:32 2026 -0700
    Staging EVE on hgwbeta, refs #37763
• src/hg/mouseStuff/exonMap/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/near/hgNear/customColumn.c
  • lines changed 2, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/oneShot/kgName/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/oneShot/protDat/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/phyloPng/phyloPng.c
  • lines changed 2, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/pslCluster/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/pslDist/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/pslOneTwo/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/pslToFa/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/ratStuff/mafBedSubset/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/ratStuff/mafBreak/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/ratStuff/mafToProtein/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/testRewrite/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/utils/automation/doNcbiGene.pl
  • lines changed 55, context: html, text, full: html, text
    b8d17d29c4215bc9e7776173cbaa75d88f3ee9bd Wed Aug 12 15:34:01 2026 -0700
    fixups in response to code review refs #38001
  • lines changed 11, context: html, text, full: html, text
    889633f4b77694a53dcca81fb28cdd07f4db297b Wed Aug 12 15:54:36 2026 -0700
    make the cleanup step safe for rerun == idempotent refs #38005
  • lines changed 4, context: html, text, full: html, text
    d937f06fd5b42ae4621cd7d6bf0d048ab2863a41 Wed Aug 12 16:14:10 2026 -0700
    fixups per code review refs #38005
• src/hg/utils/automation/gffAttrsToIx.py
  • lines changed 4, context: html, text, full: html, text
    7a55a823e6fe9bc65ac0ecf5b6576e90fda64bcb Wed Aug 12 16:10:27 2026 -0700
    fixups per code review refs #38005
• src/hg/utils/cartFileVarCatalog/cartFileVarCatalog.py
  • lines changed 540, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/utils/cartFileVarCatalog/harvestCartFileVars.py
  • lines changed 513, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
• src/hg/utils/cartTrackVarCatalog/cartTrackVarCatalog.py
  • lines changed 130, context: html, text, full: html, text
    efc3f584c95755330510d53c767f103d222e20d1 Sat Aug 8 13:21:26 2026 -0700
    cartTrackVarCatalog: fix the autoScale values, check value lists, refs #37838 The autoScale entry had the wrong vocabulary. The cart holds one of three long literals from wiggleScaleOptionsParent (hui.c:1973). The catalog listed on/off/group, which are the trackDb spellings; wiggleCart.c:454-459 translates those into the literals and never stores them. It also listed "cumulative", which is the C enum identifier wiggleScaleCumulative (hui.h:576), not a value in either vocabulary. This is worth more than a documentation fix. wiggleScaleStringToEnum() errAborts on an unknown string, so autoScale=on in a cart crashes hgTracks instead of being ignored. Any writer generated from this file would have produced exactly that. There were two copies of the bug. The lolly type carried its own autoScale entry with on/off, but lollyTrack.c:485 calls the same wigFetchAutoScaleWithCart(), so it shares the vocabulary and the errAbort. Those two are the only readers of that function, so autoScale is now complete. smoothingWindow listed "..." as if the ellipsis were a value. Enumerated. The other eight wig enums were checked against their C arrays and were all working: stringArrayIx() compares with differentWord(), which ignores case, so the on/ON and Bar/bar mismatches did no harm. Their values now match the arrays exactly, and each entry names the array it was checked against. Two new fields on an entry, both needed by the JSON cart schema: aliases other spellings a writer may use, mapped to the cart value, so JSON can accept autoScale "on" and store the literal valuesSrc the C array the values were verified against --check grows check_values(), which fails on a placeholder in a values list, an alias on an entry with no values, an alias pointing at a non-value, and an alias that is also a value. It also reports the backlog: 39 enums whose value lists have not been checked against the array that gates them. Each one can crash a CGI the same way autoScale could.
• src/hg/utils/chainToBigChain/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/hg/utils/hgConfCatalog/hgConfCatalog.py
  • lines changed 23, context: html, text, full: html, text
    cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
    hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893 An opt-in modern alternative to the classic hyperlink output, gated by the blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with identity and query-coverage bars, a docked per-hit detail panel, a FASTA query viewer, and share-link and rename-track modals. - hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile (not injected from JS); layout uses CSS classes rather than inline styles. - utils.js: setupGenomeSelector, the combobox genome picker the form uses. - hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a user accumulate BLAT result tracks instead of each search replacing the last. - hgConfCatalog: register the blatNewForm / blatNewFormBanner gates. - blatExample.fa: the example query the form loads on demand. Markup is built in JS (escaped values via htmlEncode, everything else set through DOM properties); no HTML strings in the C or a template engine.
  • lines changed 61, context: html, text, full: html, text
    a47e3c796d32feca4b3747b6eeb37afb25d31ae1 Thu Aug 13 08:07:47 2026 -0700
    hgConfCatalog: classify the two new hgBlat form flags and quickLiftClipToChains as gates, refs #37925
  • lines changed 1, context: html, text, full: html, text
    ea99dac2c5ba8bc9de2e08c220b3929886cffd1c Sun Aug 16 12:27:17 2026 -0700
    hgConfCatalog: cite the new location of the sessionDataDirOld read The read moved from customFactory.c to trashDir.c when the two hand-rolled copies of that path test were folded into one. --fix-citations only repairs a line number inside the same file, so a read that changes file has to be pointed at its new home by hand. refs #37925
  • lines changed 9, context: html, text, full: html, text
    f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
    BLAT results: own track group, Delete-all button, clearer names, refs #38086 Behind hg.conf blatResultsGroup (default off, a release gate): - BLAT result custom tracks go into their own "BLAT Results" track group instead of the generic Custom Tracks group. - That group's header gets a "Delete all" button that removes every BLAT result track at once, so users are not stuck deleting them one by one. - Headerless queries are named by query size + the top hit's gene, e.g. "360bp SOD1", instead of the useless "blat YourSeq"; the date goes in the longLabel. hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers hgc.c buildBigPsl tags the results track group=blat customFactory.c checkGroup accepts the synthetic "blat" group hgTracks.c synthesize the BLAT Results group; Delete-all button; keep the per-track delete icon for the new group hgTracks.js deleteAllBlatTracks() hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks) hgConfCatalog.py register blatResultsGroup as a release gate
• src/hg/utils/otto/g2p/doG2p.py
  • lines changed 75, context: html, text, full: html, text
    29afbb7595289b958dfb4fe966dc51c288d260cb Sat Aug 15 13:16:06 2026 -0700
    Count unrecognized G2P confidence values per record, not per output line, refs #38070 An HGNC ID can have several coordinate rows, so the old counter reported one record as many. Also fold case/whitespace so one new value is not logged as several, rename the remaining snake_case locals, and make makeSingleCellSignalsPeaksRa.py executable. Output is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/utils/otto/genArk/asmAlias/asmAliasUpdate.py
  • lines changed 581, context: html, text, full: html, text
    01ee213725a474e44118c21fb0c3bd55b9197357 Tue Aug 11 08:27:06 2026 -0700
    running the asmAlias table update in otto cron job refs #31811
• src/hg/utils/otto/genArk/asmAlias/runUpdate.sh
  • lines changed 60, context: html, text, full: html, text
    7e3b5a8fb40226e35e2312321ac38f035e858e90 Tue Aug 11 08:26:14 2026 -0700
    running the asmAlias table update in otto cron job refs #31811
  • lines changed 1, context: html, text, full: html, text
    3a6f7a2ceb39e56238f5a5d3ffa8c40a6d39f14e Tue Aug 11 13:14:09 2026 -0700
    better organization of the asmAlias update procedure refs #31811
  • lines changed 4, context: html, text, full: html, text
    0fbe2a386b7e4408875e3877fd7add7358f6b11a Fri Aug 14 09:02:40 2026 -0700
    turn off asmAlias update until issue 38082 is fixed refs #38082
• src/hg/utils/otto/genArk/updateHgcentral.sh
  • lines changed 3, context: html, text, full: html, text
    6963a302c775bfdaa4aeca21205b006a93219e15 Tue Aug 11 08:29:49 2026 -0700
    running the asmAlias table update in otto cron job refs #31811
  • lines changed 42, context: html, text, full: html, text
    a44da9109b149669559c746cdee09821e279edf7 Tue Aug 11 13:10:42 2026 -0700
    better organization of the asmAlias update procedure refs #31811
• src/hg/utils/otto/geneReviews/buildGeneReviews.sh
  • lines changed 6, context: html, text, full: html, text
    e7b98d8286de2133b30617a7eb9c78cd355fd21e Thu Aug 13 14:32:17 2026 -0700
    geneReviews otto: survive a knownGene rebuild, and keep the bigBed in step with the tables, refs #38098 hg19 and hg18 take their gene coordinates from knownGene. The hg19 knownGene rebuild on 2026-07-15 moved the ends of most genes by a few bases, and the validation step compared chrom, chromStart, chromEnd and name exactly. That made 1325 of 1939 rows look new, far past the 10 percent ceiling, so the job has failed every week since July 21 and the tables have been stuck at their June 30 version. validateGeneReviews.sh now compares the overall span of each gene on each chromosome and counts a gene as unchanged when the old and new spans overlap. geneReviewsDetail still compares whole rows exactly. A zero-overlap result now fails with a message rather than an awk divide-by-zero. checkGeneReviews.sh validates all three assemblies before deciding, so one bad assembly no longer hides the state of the others. hg18 had not been checked since July. buildGeneReviews.sh pointed /gbdb at the new bigBed before validation ran, so a failed run left the browser image and the geneReviews tables six weeks apart. The relink moves to checkGeneReviews.sh, after validation passes and the tables are installed.
  • lines changed 7, context: html, text, full: html, text
    74f5343d5f22428477778d20a5dc6e9e39c213fd Thu Aug 13 14:36:56 2026 -0700
    geneReviews otto: pin the locale so a hand-run matches the cron run, refs #38098 The NCBI GeneReviews files are Latin-1. GRtitle_shortname_NBKid.txt holds two titles with high bytes, "Cantu syndrome" and "Stromme Syndrome". Under a UTF-8 locale GNU grep decides the file is binary, drops those two lines and writes a note to stderr that the wrapper's mail never shows. cron runs with no locale set and is safe, but a hand-run from a login shell quietly loses two disease titles and three geneReviewsDetail rows. Set LC_ALL=C in all three scripts. This also keeps sort and join in agreement in validateGeneReviews.sh whichever way the job is started.
• src/hg/utils/otto/geneReviews/checkGeneReviews.sh
  • lines changed 26, context: html, text, full: html, text
    e7b98d8286de2133b30617a7eb9c78cd355fd21e Thu Aug 13 14:32:17 2026 -0700
    geneReviews otto: survive a knownGene rebuild, and keep the bigBed in step with the tables, refs #38098 hg19 and hg18 take their gene coordinates from knownGene. The hg19 knownGene rebuild on 2026-07-15 moved the ends of most genes by a few bases, and the validation step compared chrom, chromStart, chromEnd and name exactly. That made 1325 of 1939 rows look new, far past the 10 percent ceiling, so the job has failed every week since July 21 and the tables have been stuck at their June 30 version. validateGeneReviews.sh now compares the overall span of each gene on each chromosome and counts a gene as unchanged when the old and new spans overlap. geneReviewsDetail still compares whole rows exactly. A zero-overlap result now fails with a message rather than an awk divide-by-zero. checkGeneReviews.sh validates all three assemblies before deciding, so one bad assembly no longer hides the state of the others. hg18 had not been checked since July. buildGeneReviews.sh pointed /gbdb at the new bigBed before validation ran, so a failed run left the browser image and the geneReviews tables six weeks apart. The relink moves to checkGeneReviews.sh, after validation passes and the tables are installed.
  • lines changed 6, context: html, text, full: html, text
    74f5343d5f22428477778d20a5dc6e9e39c213fd Thu Aug 13 14:36:56 2026 -0700
    geneReviews otto: pin the locale so a hand-run matches the cron run, refs #38098 The NCBI GeneReviews files are Latin-1. GRtitle_shortname_NBKid.txt holds two titles with high bytes, "Cantu syndrome" and "Stromme Syndrome". Under a UTF-8 locale GNU grep decides the file is binary, drops those two lines and writes a note to stderr that the wrapper's mail never shows. cron runs with no locale set and is safe, but a hand-run from a login shell quietly loses two disease titles and three geneReviewsDetail rows. Set LC_ALL=C in all three scripts. This also keeps sort and join in agreement in validateGeneReviews.sh whichever way the job is started.
• src/hg/utils/otto/geneReviews/geneReviewsWrapper.sh
  • lines changed 21, context: html, text, full: html, text
    707cff6538b51939df30f84525ff9295b1b17e10 Thu Aug 13 15:21:23 2026 -0700
    geneReviews otto: say FAILED in the subject when the run fails, refs #38098 A failed run mailed otto-group with the same "GENEREVIEW Build" subject as a good one, and opened with the same routine hgLoadBed and bedToBigBed output. The only sign of trouble was two lines at the bottom. Four failures went out that way between July 21 and August 11 and read like four normal weekly updates. Run the job to a log first so the exit status can choose the subject. A failure now arrives as "GENEREVIEW Build FAILED" with the exit code appended to the body, and the wrapper exits with the job's status rather than mail's. Two smaller things fall out of the same change. A failure that produced no output used to hit mail -E and be discarded, so it was silent; that case is now always mailed. And the run output is kept in lastRun.log for anyone looking into a failure after the fact. A week where NCBI posts nothing still produces no output and no mail.
• src/hg/utils/otto/geneReviews/validateGeneReviews.sh
  • lines changed 36, context: html, text, full: html, text
    e7b98d8286de2133b30617a7eb9c78cd355fd21e Thu Aug 13 14:32:17 2026 -0700
    geneReviews otto: survive a knownGene rebuild, and keep the bigBed in step with the tables, refs #38098 hg19 and hg18 take their gene coordinates from knownGene. The hg19 knownGene rebuild on 2026-07-15 moved the ends of most genes by a few bases, and the validation step compared chrom, chromStart, chromEnd and name exactly. That made 1325 of 1939 rows look new, far past the 10 percent ceiling, so the job has failed every week since July 21 and the tables have been stuck at their June 30 version. validateGeneReviews.sh now compares the overall span of each gene on each chromosome and counts a gene as unchanged when the old and new spans overlap. geneReviewsDetail still compares whole rows exactly. A zero-overlap result now fails with a message rather than an awk divide-by-zero. checkGeneReviews.sh validates all three assemblies before deciding, so one bad assembly no longer hides the state of the others. hg18 had not been checked since July. buildGeneReviews.sh pointed /gbdb at the new bigBed before validation ran, so a failed run left the browser image and the geneReviews tables six weeks apart. The relink moves to checkGeneReviews.sh, after validation passes and the tables are installed.
  • lines changed 4, context: html, text, full: html, text
    74f5343d5f22428477778d20a5dc6e9e39c213fd Thu Aug 13 14:36:56 2026 -0700
    geneReviews otto: pin the locale so a hand-run matches the cron run, refs #38098 The NCBI GeneReviews files are Latin-1. GRtitle_shortname_NBKid.txt holds two titles with high bytes, "Cantu syndrome" and "Stromme Syndrome". Under a UTF-8 locale GNU grep decides the file is binary, drops those two lines and writes a note to stderr that the wrapper's mail never shows. cron runs with no locale set and is safe, but a hand-run from a login shell quietly loses two disease titles and three geneReviewsDetail rows. Set LC_ALL=C in all three scripts. This also keeps sort and join in agreement in validateGeneReviews.sh whichever way the job is started.
  • lines changed 30, context: html, text, full: html, text
    6cdc3398485dd66c0a16e0b0ccaa840911f87308 Thu Aug 13 14:47:48 2026 -0700
    geneReviews otto: go back to the exact coordinate check, refs #38098 Reverts the span-overlap comparison from e7b98d8286d. A wholesale shift in the source coordinates, such as the one the July 15 hg19 knownGene rebuild caused, should stop the job and have someone look at the new data. Loosening the test would let the next one through unseen. The right response to a change like that is to review it and install it by hand. For geneReviews a row is again unchanged only when chrom, chromStart, chromEnd and name all match. A comment on the test says why it is strict, so the next person does not read the strictness as an oversight. Kept from the reverted commit: LC_ALL=C, and a guard so zero rows in common fails with a message rather than an awk divide-by-zero.
• src/hg/utils/otto/otto.crontab
  • lines changed 16, context: html, text, full: html, text
    4c06f1b66ceec8ba9e8f4618f632ccb271e2aa07 Wed Aug 12 15:15:20 2026 -0700
    Adding line for Cell Browser differential expression worker, and moving cbAnnotServer line up to be next to some other CB cron lines, refs #24912
  • lines changed 4, context: html, text, full: html, text
    87f71f1d645d6a2091dd4a21ea069c7b20922e0d Wed Aug 12 15:18:03 2026 -0700
    Fixing lines for Cell Browser differential expression worker, refs #24912
• src/hg/utils/urlCommandCatalog/urlCommandCatalog.py
  • lines changed 20, context: html, text, full: html, text
    ece2ff8889e304cf8e873063b331ba710bbc21fc Thu Aug 13 08:18:44 2026 -0700
    urlCommandCatalog: describe hgLogin's login-flow cart variables, refs #37923
• src/hg/utils/urlCommandCatalog/urlNamesNotCataloged.txt
  • lines changed 1, context: html, text, full: html, text
    ece2ff8889e304cf8e873063b331ba710bbc21fc Thu Aug 13 08:18:44 2026 -0700
    urlCommandCatalog: describe hgLogin's login-flow cart variables, refs #37923
• src/hg/visiGene/hgVisiGene/hgVisiGene.c
  • lines changed 2, context: html, text, full: html, text
    9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68 Sun Aug 16 11:56:56 2026 -0700
    cart: validate file names read back out of the cart Several cart variables hold the name of a file the server created for a user. Route them through one shared check, isServerUserFilePath(), which accepts the trash directory, the session-data directories and myVariantsDataDir, and apply it both where values enter the cart and where the file names are used. A few of these variables may instead hold a remote URL. Those get their own list and isServerUserFileOrUrl(), because the code that reads them chooses between a fetch and a local open by looking for a protocol. Consolidates two hand-rolled copies of the same test in blatShare.c and customFactory.c, and drops the weaker private copy in sessionData.c. Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart value reaching a file call and reconciles what it finds against the lists in cart.c, so a new one of these cannot be added without somebody noticing. Its --reconcile is quiet enough for the nightly cron the other catalogs use, and it is what turned up seven of the names now on those lists. refs #37623
  • lines changed 2, context: html, text, full: html, text
    a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
    escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch.
• src/hg/visiGene/vgPrepImage/makefile
  • lines changed 2, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/inc/memgfx.h
  • lines changed 6, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/lib/cheapcgi.c
  • lines changed 16, context: html, text, full: html, text
    12a0dc62bdfc01eb3f94cc675657ab21b893c67a Tue Aug 11 09:22:06 2026 -0700
    lib: reject the reserved 0x01 escape marker in sqlSafef, htmlSafef and cgiDecode, refs #38051 sqlSafef does not escape values as it formats them. It formats first, then escapes in a second pass. To mark which spans need escaping it wraps each quoted %s in an in-band marker byte, escPunc = 0x01. sqlEscapeAllStrings then pairs up the 0x01 bytes, escapes the text between a pair, and copies text outside a pair raw. The marker shares the byte stream with the data. A value carrying its own pair of 0x01 bytes forges an extra pair and shifts the pairing, so part of the value is copied raw instead of escaped. For a value of "x\x01' OR '1'='1\x01x" the query came out as name='x' OR '1'='1x' with live quotes. cgiDecode turns %01 into a literal 0x01 and filtered nothing, so this was reachable from a plain GET parameter with no login. htmshell.c uses the same trick for htmlSafef, where the payoff is XSS instead of SQL. Two guards: vaSqlSafefNoAbort now rejects a quoted %s value that already contains escPunc. vaHtmlSafefNoAbort counts the markers after formatting and requires exactly two per escaped string. Both use errAbort rather than sqlCheckError or the noAbort return. sqlCheckError honors noSqlInj.level and can be downgraded to warn and then return, which would leave the injection live, and vaHtmlDyStringPrintf reads a negative return as "buffer too small" and would retry forever. A raw 0x01 is never legitimate in either place, so there is no false-positive cost. cgiDecode and cgiDecodeFull now drop 0x01, both percent-encoded and raw, so the marker never enters a cart or CGI string. Only 0x01. Tab, newline and CR are left alone because custom-track textarea uploads need them. Multipart uploads do not pass through cgiDecode, so the sqlSafef and htmlSafef guards are what cover that path. Pre-escaped %-s arguments are not checked individually. They come either from sqlSafef output, which now aborts before it can produce a marker, or from sqlCheckIdentifier and sqlCkIl, which whitelist from a disallow-all table that never permits 0x01. Removing the in-band marker altogether is the durable fix and is tracked separately, since it rewrites a hot path and needs its own performance testing.
• src/lib/common.c
  • lines changed 33, context: html, text, full: html, text
    6de494f9973ea14ac9610977c1f58ac3aba5c792 Fri Aug 14 13:06:16 2026 -0700
    replaceFieldInPattern: skip fields the pattern never mentions, refs #38094 This runs once per item of every bigBed track that has a mouseOver or URL pattern, and it looped over every field in the file. For each field it made two allocations and then called dyStringSub unconditionally. dyStringSub copies the whole string and allocates a new one even when it finds nothing to replace, so a file with twenty fields paid twenty full rewrites per item to substitute the one or two fields the pattern actually names. The braced form was already guarded with stringIn; the bare form was not. Guard the bare substitution the same way, stop early once no dollar sign is left in the string, and keep the two specs on the stack for normal length field names. Behavior is unchanged. dyStringSub with an absent pattern returns a byte identical copy, so the guard only skips work that had no effect. Measured: about 8% less processor time per page. Wall clock does not move, because tracks load in parallel and this work sits in loader threads that were not on the critical path. It is worth having for server capacity rather than for page latency, and it is recorded that way so nobody expects the page to feel faster.
• src/lib/freeType.c
  • lines changed 10, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/lib/fuzzyShow.c
  • lines changed 2, context: html, text, full: html, text
    e08ae97dc288749c2454fd98a10dc79f06e27cb5 Tue Aug 11 06:16:20 2026 -0700
    hgBlat/hgc: fixes from the v502 code review of the BLAT results pages, refs #37893 #4 blatOldTracks now falls back to "keep" (with a warning) on any value other than keep/hide/delete, instead of dropping into the destructive delete branch, so a typo in hg.conf can never silently discard a user's earlier BLAT tracks. #5 htmlEncode() (js/utils.js) now also escapes " and ', which the browser's text->markup conversion leaves alone. Every hgBlat caller puts the result in a double-quoted attribute, so an unescaped quote in the cart position string could break out of the attribute; the shared helper now honors its documented contract. #6 The non-BLAT alignment title no longer starts with a stray space. #7 open_memstream() is checked for NULL: on that failure the alignment renders straight to stdout instead of writing to a NULL FILE and calling fclose(NULL). The section reorder keys on the literal "<H4><A NAME=genomic>"/"<H4><A NAME=ali>" strings, so a note was added in fuzzyShow.c and pslShow.c to keep them intact. Found in the v502 final-build code review, refs #38069.
• src/lib/htmshell.c
  • lines changed 15, context: html, text, full: html, text
    12a0dc62bdfc01eb3f94cc675657ab21b893c67a Tue Aug 11 09:22:06 2026 -0700
    lib: reject the reserved 0x01 escape marker in sqlSafef, htmlSafef and cgiDecode, refs #38051 sqlSafef does not escape values as it formats them. It formats first, then escapes in a second pass. To mark which spans need escaping it wraps each quoted %s in an in-band marker byte, escPunc = 0x01. sqlEscapeAllStrings then pairs up the 0x01 bytes, escapes the text between a pair, and copies text outside a pair raw. The marker shares the byte stream with the data. A value carrying its own pair of 0x01 bytes forges an extra pair and shifts the pairing, so part of the value is copied raw instead of escaped. For a value of "x\x01' OR '1'='1\x01x" the query came out as name='x' OR '1'='1x' with live quotes. cgiDecode turns %01 into a literal 0x01 and filtered nothing, so this was reachable from a plain GET parameter with no login. htmshell.c uses the same trick for htmlSafef, where the payoff is XSS instead of SQL. Two guards: vaSqlSafefNoAbort now rejects a quoted %s value that already contains escPunc. vaHtmlSafefNoAbort counts the markers after formatting and requires exactly two per escaped string. Both use errAbort rather than sqlCheckError or the noAbort return. sqlCheckError honors noSqlInj.level and can be downgraded to warn and then return, which would leave the injection live, and vaHtmlDyStringPrintf reads a negative return as "buffer too small" and would retry forever. A raw 0x01 is never legitimate in either place, so there is no false-positive cost. cgiDecode and cgiDecodeFull now drop 0x01, both percent-encoded and raw, so the marker never enters a cart or CGI string. Only 0x01. Tab, newline and CR are left alone because custom-track textarea uploads need them. Multipart uploads do not pass through cgiDecode, so the sqlSafef and htmlSafef guards are what cover that path. Pre-escaped %-s arguments are not checked individually. They come either from sqlSafef output, which now aborts before it can produce a marker, or from sqlCheckIdentifier and sqlCkIl, which whitelist from a disallow-all table that never permits 0x01. Removing the in-band marker altogether is the durable fix and is tracked separately, since it rewrites a hot path and needs its own performance testing.
• src/lib/memgfx.c
  • lines changed 12, context: html, text, full: html, text
    bd85159b36db7ff8c02b32eb18d96ed6066feb8f Wed Aug 5 13:59:46 2026 -0700
    hgTracks: measure text with the same font engine that will draw it, refs #38027 Pack mode works out how many rows a track needs by measuring its item labels, and mgFontStringWidth answers from whichever text engine is loaded at the time. FreeType was only loaded when an image was created, so the measuring could happen on the bitmap engine while the drawing happened on FreeType -- and which one you got depended on whether the ideogram image had been built first. Load the engine in initTl(), alongside the rest of the font setup, before anything measures a string. maybeNewFonts() and the new initFontEngine() share chosenFreeTypeFont(), and mgLoadFontEngine() loads an engine without attaching it to an image. ftInitialize() now keeps the face it already has when asked for the same font file, so the glyph cache hanging off that face survives the extra call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/lib/pngwrite.c
  • lines changed 2, context: html, text, full: html, text
    443dc863b4872aa00e21a21d969f1bdf5c0f2b8d Fri Aug 14 13:06:03 2026 -0700
    pngwrite: set a fixed PNG row filter instead of searching, refs #38107 lib/pngwrite.c configures the image and never calls png_set_filter, so libpng falls back to trying all five row filters on every row and keeping whichever compresses best. That search is png_write_find_filter, which perf measures at 15.9% of a whole hgTracks run, and PNG encoding overall at 33.9%, more than three times what drawing costs. Fixing the filter to UP makes a page 19.2% faster over eight Recommended Track Set views, geometric mean ratio 0.808. A row filter is a lossless per-row transform, so the image is unchanged: 80 of 80 pixel comparisons identical with a difference of zero. Output grows 1.7% over the workload, and three of the eight images came out smaller. UP was chosen by measuring all the filters on real browser images rather than by reasoning about them. No filter at all is the obvious guess and is worse on both counts: slower than UP and 12% larger. The zlib compression level is the other half of the PNG cost and is deliberately not touched here. It is also lossless but it trades processor time for bytes on the wire, so it needs a decision rather than a patch. See #37398.
  • lines changed 4, context: html, text, full: html, text
    d2520682cc7cac8838925cf1c9f7d9159a82df92 Sun Aug 16 10:44:02 2026 -0700
    pngwrite: replace leftover experiment marker with a real comment, refs #38107 The png_set_filter call in 443dc863b48 kept a scratch comment that said "EXPERIMENT ONLY, refs #38094 - do not commit". The code is correct and intended, and the justification is #38107, not #38094. Comment only, no code change.
• src/lib/pslShow.c
  • lines changed 2, context: html, text, full: html, text
    e08ae97dc288749c2454fd98a10dc79f06e27cb5 Tue Aug 11 06:16:20 2026 -0700
    hgBlat/hgc: fixes from the v502 code review of the BLAT results pages, refs #37893 #4 blatOldTracks now falls back to "keep" (with a warning) on any value other than keep/hide/delete, instead of dropping into the destructive delete branch, so a typo in hg.conf can never silently discard a user's earlier BLAT tracks. #5 htmlEncode() (js/utils.js) now also escapes " and ', which the browser's text->markup conversion leaves alone. Every hgBlat caller puts the result in a double-quoted attribute, so an unescaped quote in the cart position string could break out of the attribute; the shared helper now honors its documented contract. #6 The non-BLAT alignment title no longer starts with a stray space. #7 open_memstream() is checked for NULL: on that failure the alignment renders straight to stdout instead of writing to a NULL FILE and calling fclose(NULL). The section reorder keys on the literal "<H4><A NAME=genomic>"/"<H4><A NAME=ali>" strings, so a note was added in fuzzyShow.c and pslShow.c to keep them intact. Found in the v502 final-build code review, refs #38069.
• src/lib/udc.c
  • lines changed 11, context: html, text, full: html, text
    2e48cc57a9fd1f065c439b14df8ddf805901e391 Tue Aug 11 11:14:20 2026 -0700
    udc: reject a ".." path component when turning a remote URL into a cache path, refs #38056 udc builds its on-disk cache path out of the remote URL. qEscaped deliberately leaves '.' and '/' unescaped so cached names stay readable, and longDirHash only rewrites components that are too long for the filesystem, so a ".." in the URL survives all the way into the cache path. makeDirsOnPath then creates those directories and we write bitmap and sparseData files into them, outside the cache root, as the web server user. A custom track or hub bigDataUrl gets here with no login. Demonstrated against an unpatched build with a local server standing in for a hostile hub host, since the escape needs a server that answers a request whose path contains "../". Opening http://host/a/../../../../../ESCAPED/pwn.bb created ESCAPED/pwn.bb five levels above the cache root and wrote the server's content into sparseData inside it. That is why the log review found no successful attempt: every one seen in the wild pointed at a legitimate third-party host, and those normalize the path and refuse. An attacker pointing at their own host would have succeeded. The check goes in udcPathAndFileNames rather than in udcParseUrl, which is where the draft on the ticket suggested it. That function is the one place a URL becomes a filesystem path, and it covers both callers that build cache paths. udcParseUrl is also used by udcIsLocal, which is only a predicate and is called from linefile.c, hdb.c, liftOver.c and elsewhere to decide how to open something; aborting in there would turn a question into a failure. Only the ".." component is rejected, so names that merely begin with dots, such as "..foo" or "a..b", keep working. Cache paths for ordinary URLs are byte for byte what they were, which matters because a change there would invalidate every cached file on every node. Verified by diffing the derived paths for a set of URLs across the change: the only lines that differ are the malicious ones. Escaping '.' in qEscaped would also have closed this, but it would rewrite every existing cache path and force a full re-download for no gain over rejecting "..".
  • lines changed 77, context: html, text, full: html, text
    954265a3a58f3a3a18475faf6106b4b9d485c696 Sun Aug 16 21:47:53 2026 -0700
    udc: resolve '.' and '..' in a remote URL instead of rejecting them. refs #38120 The #38056 cache-escape fix rejected any ".." path component when udc turns a remote URL into a cache path. That also broke hubs doing something legal: a relative trackDb or bigDataUrl that reaches up a level so two assemblies can share a file. The NHGRI T2T hub hit it four times in one afternoon on dev with TMP.MAT/../HG002v1.1/rep.trackDb.txt. Resolve the dot components the way the remote server resolves them and abort only when ".." would climb above the host. The escape #38056 closed stays closed and keeps the same error message, and the cache path now names the resource actually fetched, so a/x/../b and a/b share one cache entry. simplifyPathToDir in portable.h was not reusable here: it expands ~, eats //, strips a trailing /, and leaves /.. alone rather than catching the climb. Cache paths for URLs with no dot component are byte for byte unchanged, which matters because a change there would invalidate every cached file on every node. Verified by deriving cache paths for 16 URLs across the change; the only lines that differ are a/x/../b/file.txt and a/b/.. which used to abort, and a/./b/file.txt which used to cache under a path containing the dot. That last one orphans any existing cache entry for a URL with a "." component, costing one re-download; such URLs are rare and the new path is the correct one.
• src/makefile
  • lines changed 1, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/utils/bbTest/makefile
  • lines changed 2, context: html, text, full: html, text
    caab4045fa20627f1602955c53cacc05ea07de24 Fri Aug 14 11:01:17 2026 -0700
    stop directory makefiles from overriding the tree compiler flags, refs #38094 hg/hgTracks/makefile has carried "COPT = -ggdb" since 2019-02-01. Every directory makefile includes inc/common.mk on its first line, so that assignment came after the tree default and replaced it. The result is that hgTracks itself has shipped with no optimization for seven years, while every library it links against was built with -O3. Building it with the tree default is 17.5% faster over a set of eight sessions, and 1.95x faster on a wide clinical view, with byte identical PNG output. Twenty three makefiles had a COPT or CFLAGS override. All are removed here. hg/visiGene/vgPrepImage keeps its defines, but appends them with += instead of assigning over the tree flags, because the ERMapper JPEG2000 headers need them. Compiling hg/hgTracks with optimization exposed seven errors that only appear under -O3. Four source files are fixed: hgTracks.c used an uninitialized labelfont, expRatioTracks.c and simpleTracks.c had five strncpy calls that could leave a string unterminated, and netTrack.c had two int buffers too small to hold the value written into them. The last two look like real latent bugs, not warning noise. checkCompileFlags.sh is added to stop this from recurring. The topChecks target runs it, so every build path reaches it. It fails the build on any COPT assignment, any CFLAGS assignment that is not +=, and any CFLAGS += carrying an -O flag. The check cannot live in inc/common.mk, because at the point common.mk is parsed the overriding line has not been read yet. A command line override such as "make COPT='-O0 -g'" still works, since the check reads only file contents. The 2026 conversion of the tree to -O3 did not find this. That work was driven by the warnings -O3 produces, and a directory that overrides COPT never receives the flag, so it never warns. Verified: the tree builds at -O3 with no new errors and no new warnings, and 80 rendered images compare pixel identical against the old build.
• src/utils/codeReviewAi.py
  • lines changed 17, context: html, text, full: html, text
    b6040e23fd8490ae4ada8bceb147aa28be30313f Wed Aug 12 15:33:02 2026 -0700
    Quote the saved review file's absolute path in daily code review emails so authors can point a tool at it, refs #36890 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/utils/genark/genark
  • lines changed 48, context: html, text, full: html, text
    5c35098ff0bc6319b3c771ee8d683d2145fd75ac Tue Aug 11 08:02:17 2026 -0700
    genark: write contrib data into the GenArk build directory, not the served symlink trees addContrib was creating contrib/<name>/ symlink dirs and trackDb under assemblyDir(acc) = asmHubs/GCA/.../<acc>, which (like /gbdb/genark/<acc>) is only a tree of symlinks the GenArk build system regenerates, so the contrib files got clobbered. Replace assemblyDir() with buildDir(), which resolves the real build directory under asmHubs/{genbankBuild,refseqBuild}/... (GCA -> genbankBuild, GCF -> refseqBuild), globbing the accession to pick up the assembly-name suffix. contrib symlinks, the per-assembly trackDb, and the hub.txt wiring (now the build dir's <asmId>.singleFile.hub.txt) all land in the build directory. refs #35415
• src/utils/hubtools/hubtools
  • lines changed 1353, context: html, text, full: html, text
    844146c240ffb8979f6103439949793b760525fd Fri Aug 14 08:00:31 2026 -0700
    updating hubtools, no dependencies, refs 38100
• src/utils/redmineCli
  • lines changed 10, context: html, text, full: html, text
    a8f76e3fe849a2d1cde06b7f19bd9f4d8fbb81fb Tue Aug 11 09:50:19 2026 -0700
    redmineCli: watch the code reviewer on build-patch tickets, refs #37281 build-patch added the QA Team and the build meister as watchers, but not the person named in Suggested Code Reviewer. That reviewer has to set Code Review Status to Approved before QA can test, so they are the first person the ticket waits on, and they were the one person not told it existed. The reviewer name is now part of the default watcher list. Dedup is by user ID, so nothing changes when the reviewer is also the build meister, and --no-default-watchers still suppresses all three. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

• lines changed: 10078
• files changed: 262