Commits for max
switch to files view, user index
v503_preview to v503_preview2 (2026-08-17 to 2026-08-24) v503
Show details
78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
- lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099
VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS.
Several lrSv converters set chromStart = pos-1, which includes that anchor, so
each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets
handled this inconsistently, so the same deletion appeared at offset coordinates
and failed to merge in lrSvAll.
For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor
so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified
against the hg38 reference: the old left base is present in both REF and ALT
(i.e. retained by the sample), so it should not be inside the deletion.
Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed,
lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed,
lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed,
lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945).
Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based
source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the
first deleted base), chirmade101 (1-based-closed source).
Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge:
3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
- src/hg/makeDb/doc/hg38/lrSv.txt - lines changed 24, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSv1kLin1218VcfToBed.py - lines changed 7, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSv1kgOntVcfToBed.py - lines changed 6, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvAou1kCsvToBed.py - lines changed 4, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvAprVcfToBed.py - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvCardBbToBed.py - lines changed 6, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvColorsDbSvVcfToBed.py - lines changed 6, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvCpc1VcfToBed.py - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvDecodeVcfToBed.py - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvGa4kSvVcfToBed.py - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvGustafsonVcfToBed.py - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/lrSvVcfToBed.py - lines changed 5, context: html, text, full: html, text
68944f2aab4d002e1ca85879bb4caf00b1eb72b0 Mon Aug 17 15:39:19 2026 -0700
- lrSv: correct HPRC2 linear callset note - not used in Lin et al merge
Remove claim from lrSv.html that a linear HPRC2 callset was included for the
Lin et al. merge. Add a sentence to the lrSv1kLin methods explaining that the
HPRC year 2 linear callset was used only for comparison and did not contribute
to the merged callset, with a link to that callset. refs #38099
- src/hg/makeDb/trackDb/human/lrSv.html - lines changed 1, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv1kLin.html - lines changed 5, context: html, text, full: html, text
f75ffeed34d2a51f88fb338562bb7e1187ead08d Tue Aug 18 06:30:37 2026 -0700
- hgLogin: match OAuth/OpenID login on recovery email too, not just primary, refs #37984
When a provider returns a verified email, resolveIdentity() and the account
chooser only matched it against gbMembers.email, so a user whose provider
email is stored as their recovery address (recovEmail) could not auto-link
or sign into that account. Password login and the passwordless email link
already match email OR recovEmail; this brings social login in line.
The provider email is guaranteed non-empty before the query runs (the
existing isNotEmpty/isEmpty guards), so a blank recovEmail='' row can never
match the empty string. Updated all three queries: the resolveIdentity
auto-link, the OAuth branch of chooseAccountPage, and the chooseAccount
confirmation, so the chooser cannot offer a row the finalize step rejects.
- src/hg/hgLogin/hgLogin.c - lines changed 17, context: html, text, full: html, text
99880a42ac57bb8b8aff144a9e4401c8a408b27b Tue Aug 18 07:06:40 2026 -0700
- hgTracks: derive BLAT Results group priority from hub increment, refs #38086
The synthetic BLAT Results track group was pinned to a hardcoded
priority of 1.5. Hub groups, however, are assigned priorities
dynamically starting at 1.0 + priorityInc and spanning up to
1.0 + 0.9*(minPriority-1), so when the smallest real group priority is
high enough (e.g. map=2.0) some hub groups can land above 1.5 and the
BLAT Results group is no longer guaranteed to sit directly below Custom
Tracks -- it can be sandwiched among hub groups.
Derive the group's priority from the same priorityInc the hub loop uses:
place it at 1.0 + priorityInc/2, i.e. between Custom Tracks (1.0) and the
first hub group (1.0 + priorityInc), so it always stays directly below
Custom Tracks no matter how many hubs are connected. With no hubs, keep
1.5, which sits safely between Custom Tracks and the first real group.
- src/hg/hgTracks/hgTracks.c - lines changed 12, context: html, text, full: html, text
d91971402abfed81d749023106edbbcd4642c901 Tue Aug 18 16:36:22 2026 -0700
- hgLogin: update gbMembers.lastUse on OAuth logins, not just gbMemberIdentity.lastUse
OAuth sign-ins recorded the login only in gbMemberIdentity.lastUse (via
linkIdentity) and never touched gbMembers.lastUse, so a returning social-login
user's gbMembers.lastUse went stale. Move the lastUse stamp into loginAndReturn,
the shared funnel for all social and email-link logins, so every method that
passes through it records the sign-in uniformly. Drop the now-redundant
incidental lastUse writes on the two email-link paths. The password path keeps
its own stamp via clearNewPasswordFields (it uses displayLoginSuccess, not
loginAndReturn). refs #37984
- src/hg/hgLogin/hgLogin.c - lines changed 21, context: html, text, full: html, text
983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
- address v503 preview1 code review (#38141): escaping and oauth fixes
Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the
BLAT-results group work (#38086):
- hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args;
cartWebStart already escapes the title, so this was double-escaping.
- hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded
name to getSessionLink (same fix already applied at line 1544).
- hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed
into the mailto: href (reachable on the robot/captcha path).
- hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of
reusing the JSON-escaped copy meant for the JS string literal.
- hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so
the later oauthFetchIdentity call is not a read-after-free.
- customFactory.c checkGroup: only accept group=blat when blatResultsGroup is
on, matching hgTracks; otherwise the group is never created and the track
would orphan into 'other'.
refs #38141, refs #38057, refs #38086
- src/hg/hgGenome/configure.c - lines changed 1, context: html, text, full: html, text
- src/hg/hgLogin/hgLogin.c - lines changed 2, context: html, text, full: html, text
- src/hg/hgSearch/hgSearch.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgSession/hgSession.c - lines changed 2, context: html, text, full: html, text
- src/hg/hgUserSuggestion/hgUserSuggestion.c - lines changed 7, context: html, text, full: html, text
- src/hg/lib/customFactory.c - lines changed 4, context: html, text, full: html, text
3772b2f385c1c5991b9e01a4d503f19cc475fdc5 Thu Aug 20 02:03:46 2026 -0700
- decode docs update, after user question
- src/hg/makeDb/trackDb/human/lrSv.html - lines changed 5, context: html, text, full: html, text
73f7f0fa4b3516871ff7a5f869b795372edcd185 Fri Aug 21 01:34:32 2026 -0700
- hgTracks: fix iPhone CSS - unreadable buttons and oversized text, refs #22278
On iOS Safari the nav/zoom/control buttons showed white text on the light-grey
button background because the page declared no color-scheme, so Dark Mode
auto-darkened the native buttons' text color while the author background stayed
light. And iOS text auto-inflation enlarged body text (blue-bar group labels,
tutorial notice, Zoom out, #size) but not form controls, giving wildly uneven
sizes. Both are iPhone-only.
In HGStyle.css :root, declare color-scheme: light and text-size-adjust: 100%,
and set an explicit color on the shared button rule as a backstop.
- src/hg/htdocs/style/HGStyle.css - lines changed 15, context: html, text, full: html, text
9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
- hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157
Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in,
client-rendered "My Sessions" page gated by the sessionNewPage /
sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner),
with a banner linking between the classic and new pages so neither is a one-way
door. sessionNewPage also flips the site default.
hgSession.c stays the data/action backend: it emits the session list and page
config as an inline JSON global (hgSessionData) into an empty #sessionApp
container, and the new hgSession.js builds the UI - a save-current-view card
(name + optional description + "only I can load it"; empty name saves under a
random share_ name), a "most recently saved session" one-click Update, a
searchable/sortable/paged DataTable of sessions (assembly + position, created
with last-used on hover, views, a lock icon on private sessions), inline Share
(copy link / email / gallery), Edit (rename + description + private), Overwrite
and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions
POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson /
doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page
handlers and return JSON, so the table updates in place; loads, file up/downloads
and custom-track backup stay as ordinary form submits/links. The Advanced panel
keeps feature parity with the classic page (load another user's session, load
from URL/file, save to file, back up custom tracks, reset), minus the login/
change-password links that now live in the top menu.
Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip,
.gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are
factored into a new gbModern.css. hgBlat is migrated onto it: its generic
.blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js
and the #blatResults / #blatFormBox containers get class="gbApp"; verified
pixel-clean against the previous search form and results pages, including the
rename modal. hgSession.css holds only session-specific layout.
- src/hg/hgSession/hgSession.c - lines changed 499, context: html, text, full: html, text
- src/hg/hgSession/hgSession.h - lines changed 9, context: html, text, full: html, text
- src/hg/htdocs/style/gbModern.css - lines changed 121, context: html, text, full: html, text
- src/hg/htdocs/style/hgBlat.css - lines changed 95, context: html, text, full: html, text
- src/hg/htdocs/style/hgSession.css - lines changed 100, context: html, text, full: html, text
- src/hg/htdocs/style/makefile - lines changed 1, context: html, text, full: html, text
- src/hg/js/hgSession.js - lines changed 792, context: html, text, full: html, text
- src/hg/utils/hgConfCatalog/hgConfCatalog.py - lines changed 18, context: html, text, full: html, text
7cb2c8998e6c5bae70d4caac61d8fd6ffa1e064d Mon Aug 24 02:19:00 2026 -0700
- redmineCli: show related tickets by default; add "related" subcommand to list/add relations. No RM.
switch to files view, user index