All File Changes

v503_preview to v503_preview2 (2026-08-17 to 2026-08-24) v503

• .gitignore
  • lines changed 1, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• .gitmodules
  • lines changed 4, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• confs/asia.hg.conf
  • lines changed 9, context: html, text, full: html, text
    b8657fad9bac3c8148a6c942a60ef8a6f919e0db Sun Aug 23 01:11:18 2026 -0700
    Installing updated hg.conf files from UCSC servers
• confs/euro.hg.conf
  • lines changed 9, context: html, text, full: html, text
    b8657fad9bac3c8148a6c942a60ef8a6f919e0db Sun Aug 23 01:11:18 2026 -0700
    Installing updated hg.conf files from UCSC servers
• confs/hgwbeta.hg.conf
  • lines changed 3, context: html, text, full: html, text
    b8657fad9bac3c8148a6c942a60ef8a6f919e0db Sun Aug 23 01:11:18 2026 -0700
    Installing updated hg.conf files from UCSC servers
• confs/hgwdev.hg.conf
  • lines changed 8, context: html, text, full: html, text
    b8657fad9bac3c8148a6c942a60ef8a6f919e0db Sun Aug 23 01:11:18 2026 -0700
    Installing updated hg.conf files from UCSC servers
• confs/rr.hg.conf
  • lines changed 17, context: html, text, full: html, text
    b8657fad9bac3c8148a6c942a60ef8a6f919e0db Sun Aug 23 01:11:18 2026 -0700
    Installing updated hg.conf files from UCSC servers
• src/browserbox/home/browser/.hg.conf
  • lines changed 6, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
• src/browserbox/root/hg.conf.offline
  • lines changed 6, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
• src/browserbox/usr/local/apache/cgi-bin/hg.conf
  • lines changed 6, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
• src/hg/cartDump/cartDump.c
  • lines changed 61, context: html, text, full: html, text
    403ab7c9c2b204f487bb2f86260ffdab355e9517 Wed Aug 19 05:49:25 2026 -0700
    Faceted composites should apply the active sort order to the tracks being displayed; changing the sort changes the display order. We also preserve that order when returning to the page. refs #36320
• src/hg/cartReset/cartReset.c
  • lines changed 2, context: html, text, full: html, text
    ee89e6768015d512b5ca8db8a62e8a129dfd5c7f Sun Aug 23 15:56:57 2026 -0700
    hgSession, cartReset: send the content policy header on their own pages Both CGIs write their own http header block, so neither reaches addHttpHeaders in cart.c, the hook that carries the policy header. hgSession lets each output path write its own Content-Type, and cartReset gets its header from htmShellWithHead. Add the call ahead of each html Content-Type: the two main page functions in hgSession.c, three more in backup.c, and the one in cartReset. The json paths and the tar download are left alone, since they print no html. With the hg.conf option off this changes nothing. With it on, both pages now carry the header, and its nonce matches the one in the meta tag and on the inline script tags.
• src/hg/cgilib/api.c
  • lines changed 3, context: html, text, full: html, text
    a4befd9382fadf413884d2215012535d5d667063 Mon Aug 17 13:46:45 2026 -0700
    hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057 Add isValidJsonpCallback() and apply it to the callback-name paths in apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are echoed back.
• src/hg/cgilib/pcrResult.c
  • lines changed 6, context: html, text, full: html, text
    554396e44745165ee4baf5214aa771f2b17b3be6 Mon Aug 17 16:04:26 2026 -0700
    hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623 The hgPcrResult_<db> cart variable holds two file names and an optional target name in one value. The cart.c arrays compare a whole value against isServerUserFilePath(), so none of them fit that shape. Add a fourth array for it and check the first two words. hgPcrResult_targetStyle shares the prefix and is a display setting, so it is excluded by name. Check both names where they are used as well, in pcrResultParseCart() and in hgPcr's append path, the way dupTrack.c already does. Two other things in writePcrResultTrack(). pcrFiles[2] was read without ever being set whenever the value held only two words, which is the usual case. And the saved-session test was a plain prefix compare that missed sessionDataDirOld; it now asks whether the file is in the trash instead. hg/utils/cartFileVarCatalog knows about the new array and has a row for hgPcrResult_<db> saying why its scan cannot see this one.
• src/hg/hgBlat/hgBlat.c
  • lines changed 4, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/hgGenome/configure.c
  • lines changed 1, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
• src/hg/hgHubConnect/hgHubConnect.c
  • lines changed 12, context: html, text, full: html, text
    139e158c2b2817ea64048290f046105d25f97198 Tue Aug 18 11:15:51 2026 -0700
    hgHubConnect: encode hub label and contact fields consistently, refs #38123
  • lines changed 10, context: html, text, full: html, text
    b388a136dae20cfd65849c2412c3d011ce9b5f12 Tue Aug 18 11:21:42 2026 -0700
    hgHubConnect: encode assembly names in the genome list, refs #38123
  • lines changed 10, context: html, text, full: html, text
    a43625b78a309952c8017aee3c3e92adca5739e8 Tue Aug 18 12:03:17 2026 -0700
    hgHubConnect: encode the hub url in the genome list, refs #38123
  • lines changed 1, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgLogin/gbMemberIdentity.sql
  • lines changed 1, context: html, text, full: html, text
    82ed0007436eefbd85d22eb846628c3dba4a0b89 Fri Aug 21 13:16:52 2026 -0700
    Adding ENGINE=InnoDB to gbMemberIdentity.sql, per Max's request. refs #37984
• src/hg/hgLogin/hgLogin.c
  • lines changed 17, context: html, text, full: html, text
    f75ffeed34d2a51f88fb338562bb7e1187ead08d Tue Aug 18 06:30:37 2026 -0700
    hgLogin: match OAuth/OpenID login on recovery email too, not just primary, refs #37984 When a provider returns a verified email, resolveIdentity() and the account chooser only matched it against gbMembers.email, so a user whose provider email is stored as their recovery address (recovEmail) could not auto-link or sign into that account. Password login and the passwordless email link already match email OR recovEmail; this brings social login in line. The provider email is guaranteed non-empty before the query runs (the existing isNotEmpty/isEmpty guards), so a blank recovEmail='' row can never match the empty string. Updated all three queries: the resolveIdentity auto-link, the OAuth branch of chooseAccountPage, and the chooseAccount confirmation, so the chooser cannot offer a row the finalize step rejects.
  • lines changed 21, context: html, text, full: html, text
    d91971402abfed81d749023106edbbcd4642c901 Tue Aug 18 16:36:22 2026 -0700
    hgLogin: update gbMembers.lastUse on OAuth logins, not just gbMemberIdentity.lastUse OAuth sign-ins recorded the login only in gbMemberIdentity.lastUse (via linkIdentity) and never touched gbMembers.lastUse, so a returning social-login user's gbMembers.lastUse went stale. Move the lastUse stamp into loginAndReturn, the shared funnel for all social and email-link logins, so every method that passes through it records the sign-in uniformly. Drop the now-redundant incidental lastUse writes on the two email-link paths. The password path keeps its own stamp via clearNewPasswordFields (it uses displayLoginSuccess, not loginAndReturn). refs #37984
  • lines changed 2, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
  • lines changed 75, context: html, text, full: html, text
    67f89eb6f4f5e8ca51c551cdf0918a2cc33ad864 Fri Aug 21 09:01:22 2026 -0700
    hgLogin: tighten validation and encoding of the return URL Validate the return URL in one place, in getReturnToURL: accept only http, https or a relative URL, and refuse characters that a properly encoded URL never contains. The login.approvedReturn host check is unchanged and stays optional, so a mirror that never set it behaves as before. Encode the value where it is written out: html encoding in the href attributes, javaScriptLiteralEncode in the location assignment. Also fix the argument order in the two mail-failure messages, which was rotated by one, so the values land where the format string means them to, and encode the user name put into the mail-success redirect. refs #38011
• src/hg/hgPal/hgPal.c
  • lines changed 1, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
• src/hg/hgPcr/hgPcr.c
  • lines changed 28, context: html, text, full: html, text
    554396e44745165ee4baf5214aa771f2b17b3be6 Mon Aug 17 16:04:26 2026 -0700
    hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623 The hgPcrResult_<db> cart variable holds two file names and an optional target name in one value. The cart.c arrays compare a whole value against isServerUserFilePath(), so none of them fit that shape. Add a fourth array for it and check the first two words. hgPcrResult_targetStyle shares the prefix and is a display setting, so it is excluded by name. Check both names where they are used as well, in pcrResultParseCart() and in hgPcr's append path, the way dupTrack.c already does. Two other things in writePcrResultTrack(). pcrFiles[2] was read without ever being set whenever the value held only two words, which is the usual case. And the saved-session test was a plain prefix compare that missed sessionDataDirOld; it now asks whether the file is in the trash instead. hg/utils/cartFileVarCatalog knows about the new array and has a row for hgPcrResult_<db> saying why its scan cannot see this one.
• src/hg/hgPhyloPlace/hgPhyloPlace.c
  • lines changed 6, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
• src/hg/hgSearch/hgSearch.c
  • lines changed 3, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
  • lines changed 3, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/hgSession/backup.c
  • lines changed 3, context: html, text, full: html, text
    ee89e6768015d512b5ca8db8a62e8a129dfd5c7f Sun Aug 23 15:56:57 2026 -0700
    hgSession, cartReset: send the content policy header on their own pages Both CGIs write their own http header block, so neither reaches addHttpHeaders in cart.c, the hook that carries the policy header. hgSession lets each output path write its own Content-Type, and cartReset gets its header from htmShellWithHead. Add the call ahead of each html Content-Type: the two main page functions in hgSession.c, three more in backup.c, and the one in cartReset. The json paths and the tar download are left alone, since they print no html. With the hg.conf option off this changes nothing. With it on, both pages now carry the header, and its nonce matches the one in the meta tag and on the inline script tags.
• src/hg/hgSession/hgSession.c
  • lines changed 15, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
  • lines changed 2, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
  • lines changed 499, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
  • lines changed 2, context: html, text, full: html, text
    ee89e6768015d512b5ca8db8a62e8a129dfd5c7f Sun Aug 23 15:56:57 2026 -0700
    hgSession, cartReset: send the content policy header on their own pages Both CGIs write their own http header block, so neither reaches addHttpHeaders in cart.c, the hook that carries the policy header. hgSession lets each output path write its own Content-Type, and cartReset gets its header from htmShellWithHead. Add the call ahead of each html Content-Type: the two main page functions in hgSession.c, three more in backup.c, and the one in cartReset. The json paths and the tar download are left alone, since they print no html. With the hg.conf option off this changes nothing. With it on, both pages now carry the header, and its nonce matches the one in the meta tag and on the inline script tags.
• src/hg/hgSession/hgSession.h
  • lines changed 9, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/hgTables/bigBed.c
  • lines changed 8, context: html, text, full: html, text
    52cee2eff9e953d4584a415b8a9b84bd2326d3cd Tue Aug 18 11:14:37 2026 -0700
    hgTables: encode track menu and schema text consistently, refs #38123
• src/hg/hgTables/hgTables.c
  • lines changed 12, context: html, text, full: html, text
    52cee2eff9e953d4584a415b8a9b84bd2326d3cd Tue Aug 18 11:14:37 2026 -0700
    hgTables: encode track menu and schema text consistently, refs #38123
  • lines changed 12, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgTables/hgTables.h
  • lines changed 3, context: html, text, full: html, text
    52cee2eff9e953d4584a415b8a9b84bd2326d3cd Tue Aug 18 11:14:37 2026 -0700
    hgTables: encode track menu and schema text consistently, refs #38123
  • lines changed 3, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgTables/mainPage.c
  • lines changed 4, context: html, text, full: html, text
    52cee2eff9e953d4584a415b8a9b84bd2326d3cd Tue Aug 18 11:14:37 2026 -0700
    hgTables: encode track menu and schema text consistently, refs #38123
• src/hg/hgTables/schema.c
  • lines changed 2, context: html, text, full: html, text
    52cee2eff9e953d4584a415b8a9b84bd2326d3cd Tue Aug 18 11:14:37 2026 -0700
    hgTables: encode track menu and schema text consistently, refs #38123
• src/hg/hgTrackUi/hgTrackUi.c
  • lines changed 1, context: html, text, full: html, text
    074ea922bc80e0c46b93fb22b91426770022e4e2 Tue Aug 18 10:59:40 2026 -0700
    lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123
  • lines changed 11, context: html, text, full: html, text
    304e190d0af4be54569ac20edc26999673c44f8b Tue Aug 18 11:05:19 2026 -0700
    hgTrackUi, hui: encode trackDb-derived label text consistently, refs #38123
  • lines changed 24, context: html, text, full: html, text
    403ab7c9c2b204f487bb2f86260ffdab355e9517 Wed Aug 19 05:49:25 2026 -0700
    Faceted composites should apply the active sort order to the tracks being displayed; changing the sort changes the display order. We also preserve that order when returning to the page. refs #36320
• src/hg/hgTracks/config.c
  • lines changed 1, context: html, text, full: html, text
    5ee674363623678393bb186b1f5fdfd981ee743f Mon Aug 17 10:35:26 2026 -0700
    hgTracks: default multiRegionButtonTop TRUE in config.c too, refs #37977 Two places read multiRegionButtonTop through MULTI_REGION_CFG_BUTTON_TOP: the top-bar Multi-region button in hgTracks.c and the "Show all" checkbox in the multi-region dialog in config.c. Kate put the checkbox under this flag on purpose in 8ae222adb54. Then e1f7896a08f turned the flag on by default in 2022 and changed only the hgTracks.c read, so on a machine that does not set the flag the button moved to the top bar while the checkbox stayed hidden. It has been hidden for four years, although the cart variable it sets is read unconditionally at hgTracks.c:11115, so the feature works for anyone who can reach the variable another way. The hg.conf catalog row carried this as an open defect, so its note is rewritten and its recorded default now matches the tree.
  • lines changed 6, context: html, text, full: html, text
    20ca104b9897669e127e4ec8675321b12f780cff Tue Aug 18 11:19:44 2026 -0700
    lib, hgTracks: encode JSON object keys and configure/search text, refs #38123
  • lines changed 1, context: html, text, full: html, text
    b88e4615c7ce7ea3f0d05c84365509670493840c Tue Aug 18 14:49:17 2026 -0700
    lib, hgc, hgTracks: small output-encoding cleanups, refs #38123
  • lines changed 30, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
• src/hg/hgTracks/gtexTracks.c
  • lines changed 2, context: html, text, full: html, text
    535457b618d5a08927870d96f16fa900cc4a91ab Wed Aug 19 18:08:44 2026 -0700
    gtexTracks: match the guard on the description abbreviation to the bytes it writes, no redmine
• src/hg/hgTracks/hgTracks.c
  • lines changed 6, context: html, text, full: html, text
    a4befd9382fadf413884d2215012535d5d667063 Mon Aug 17 13:46:45 2026 -0700
    hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057 Add isValidJsonpCallback() and apply it to the callback-name paths in apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are echoed back.
  • lines changed 12, context: html, text, full: html, text
    99880a42ac57bb8b8aff144a9e4401c8a408b27b Tue Aug 18 07:06:40 2026 -0700
    hgTracks: derive BLAT Results group priority from hub increment, refs #38086 The synthetic BLAT Results track group was pinned to a hardcoded priority of 1.5. Hub groups, however, are assigned priorities dynamically starting at 1.0 + priorityInc and spanning up to 1.0 + 0.9*(minPriority-1), so when the smallest real group priority is high enough (e.g. map=2.0) some hub groups can land above 1.5 and the BLAT Results group is no longer guaranteed to sit directly below Custom Tracks -- it can be sandwiched among hub groups. Derive the group's priority from the same priorityInc the hub loop uses: place it at 1.0 + priorityInc/2, i.e. between Custom Tracks (1.0) and the first hub group (1.0 + priorityInc), so it always stays directly below Custom Tracks no matter how many hubs are connected. With no hubs, keep 1.5, which sits safely between Custom Tracks and the first real group.
  • lines changed 23, context: html, text, full: html, text
    764e1dff7737828ea9d3395804db520628e91a69 Tue Aug 18 10:59:46 2026 -0700
    hgTracks: encode assembly and group header text consistently, refs #38123
  • lines changed 3, context: html, text, full: html, text
    934a51aa2ebc7e11bfba57804642cd03e4e1e60a Tue Aug 18 11:45:11 2026 -0700
    trackHub: tighten group name validation, refs #38123
• src/hg/hgTracks/searchTracks.c
  • lines changed 4, context: html, text, full: html, text
    20ca104b9897669e127e4ec8675321b12f780cff Tue Aug 18 11:19:44 2026 -0700
    lib, hgTracks: encode JSON object keys and configure/search text, refs #38123
• src/hg/hgTracks/vcfTrack.c
  • lines changed 3, context: html, text, full: html, text
    a5b8db176c6bd1cca6e542bf57080cfc7c9b29e8 Wed Aug 19 18:08:20 2026 -0700
    vcfTrack: only abbreviate an allele that is longer than the per-allele display budget, refs #38154
• src/hg/hgUserSuggestion/hgUserSuggestion.c
  • lines changed 7, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
• src/hg/hgc/bamClick.c
  • lines changed 5, context: html, text, full: html, text
    af8f5fbc7beacd00970cc8d3d37109f6e979f431 Mon Aug 17 10:35:18 2026 -0700
    hgc: read the BAM pairEndsByName setting under the name the UI writes, refs #37979 The BAM track UI writes the checkbox as <track>.pairEndsByName, with a dot, and hgTracks reads it back with cartUsualBooleanClosestToHome. The details page built the name with an underscore instead, so it never saw the user's choice and always fell back to the trackDb setting: a reader who turned pairing off still got the joined-pair view when they clicked a read. Nothing in the tree writes the underscore spelling, and no saved session on hgwdev holds it, so there is no old name to keep working. 214 sessions hold the dot spelling. Verified with a two-read paired BAM in a hub: with the box checked the details page shows the pair, and with it unchecked it now shows the single read.
  • lines changed 5, context: html, text, full: html, text
    e6b0dc7877ae4b24f56682885e03263fd2da3582 Tue Aug 18 11:37:04 2026 -0700
    lib, hgc: encode barChart, BAM and VCF detail text consistently, refs #38123
• src/hg/hgc/barChartClick.c
  • lines changed 6, context: html, text, full: html, text
    e6b0dc7877ae4b24f56682885e03263fd2da3582 Tue Aug 18 11:37:04 2026 -0700
    lib, hgc: encode barChart, BAM and VCF detail text consistently, refs #38123
  • lines changed 1, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgc/bigBedClick.c
  • lines changed 3, context: html, text, full: html, text
    f2d3014a3cc95116346eab4675817cf0c65f6d62 Tue Aug 18 11:12:35 2026 -0700
    hgc: encode item detail text consistently, refs #38123
  • lines changed 1, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgc/hgc.c
  • lines changed 9, context: html, text, full: html, text
    25c1787f5c2fc9bf27c5da4e5d5a706e3c89e667 Tue Aug 18 14:53:47 2026 -0700
    hgc: read chain query sequence from the two bit file whenever the track names one, refs #38146 be4f99627b0 gated the otherTwoBitUrl branch of htcChainAli on the query database not existing. That is the wrong test. hs1 keeps its sequence in a hub, so the MySQL database hs1 does exist but holds only trackDb and hgFindSpec tables. sqlDatabaseExists said yes, control fell through to loadGenomePart, and findNib aborted with "Table 'hs1.chromInfo' doesn't exist" when the source of a quickLift was hs1. Take the otherTwoBitUrl branch whenever the track supplies the file, and keep the "Org.chrom" label when hOrganism knows the organism, so the hg38 chainSelf track still reads Human.chrN. Verified against cgi-bin-braney with genome-test as the baseline: hs1 to hg38 quickLift now renders and its query bases match /gbdb/hs1/hs1.2bit; hg19 to hg38 quickLift, hg38 chainSelf and hg38 chainMm39 all produce byte-identical output.
  • lines changed 34, context: html, text, full: html, text
    f2d3014a3cc95116346eab4675817cf0c65f6d62 Tue Aug 18 11:12:35 2026 -0700
    hgc: encode item detail text consistently, refs #38123
  • lines changed 13, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
  • lines changed 17, context: html, text, full: html, text
    9a83298f18860ef6d05232bf7e10f2df3c1c2b1d Sat Aug 22 10:26:22 2026 -0700
    hgc: route inline javascript through the standard helpers Three places in hgc wrote script markup by hand instead of using the helpers the rest of the tree uses. printIframe now emits its script block the way hgIntegrator does. The wiki track create-item form builds its function with jsInlineF, so the function lands in the same block as the handler that calls it. showSomePartialDnaAlignment sets the body frame's start position through the frame URL, which is how the sibling index links already address that frame, and matches showSomeAlignment just above it. No change to what any of the three pages contain.
  • lines changed 1, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/hgc/hgc.h
  • lines changed 3, context: html, text, full: html, text
    f2d3014a3cc95116346eab4675817cf0c65f6d62 Tue Aug 18 11:12:35 2026 -0700
    hgc: encode item detail text consistently, refs #38123
  • lines changed 3, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgc/vcfClick.c
  • lines changed 35, context: html, text, full: html, text
    e6b0dc7877ae4b24f56682885e03263fd2da3582 Tue Aug 18 11:37:04 2026 -0700
    lib, hgc: encode barChart, BAM and VCF detail text consistently, refs #38123
  • lines changed 1, context: html, text, full: html, text
    b88e4615c7ce7ea3f0d05c84365509670493840c Tue Aug 18 14:49:17 2026 -0700
    lib, hgc, hgTracks: small output-encoding cleanups, refs #38123
  • lines changed 1, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/hgc/wikiTrack.c
  • lines changed 6, context: html, text, full: html, text
    9a83298f18860ef6d05232bf7e10f2df3c1c2b1d Sat Aug 22 10:26:22 2026 -0700
    hgc: route inline javascript through the standard helpers Three places in hgc wrote script markup by hand instead of using the helpers the rest of the tree uses. printIframe now emits its script block the way hgIntegrator does. The wiki track create-item form builds its function with jsInlineF, so the function lands in the same block as the handler that calls it. showSomePartialDnaAlignment sets the body frame's start position through the frame URL, which is how the sibling index links already address that frame, and matches showSomeAlignment just above it. No change to what any of the three pages contain.
• src/hg/htdocs/goldenPath/newsarch.html
  • lines changed 2, context: html, text, full: html, text
    ca48d17f1e4bc1e975c84fd3bf3cf18d0d59f577 Tue Aug 18 14:38:25 2026 -0700
    Implementing Lou's suggestion from code review, refs #38138
• src/hg/htdocs/style/HGStyle.css
  • lines changed 15, context: html, text, full: html, text
    73f7f0fa4b3516871ff7a5f869b795372edcd185 Fri Aug 21 01:34:32 2026 -0700
    hgTracks: fix iPhone CSS - unreadable buttons and oversized text, refs #22278 On iOS Safari the nav/zoom/control buttons showed white text on the light-grey button background because the page declared no color-scheme, so Dark Mode auto-darkened the native buttons' text color while the author background stayed light. And iOS text auto-inflation enlarged body text (blue-bar group labels, tutorial notice, Zoom out, #size) but not form controls, giving wildly uneven sizes. Both are iPhone-only. In HGStyle.css :root, declare color-scheme: light and text-size-adjust: 100%, and set an explicit color on the shared button rule as a backstop.
• src/hg/htdocs/style/facetedComposite.css
  • lines changed 14, context: html, text, full: html, text
    403ab7c9c2b204f487bb2f86260ffdab355e9517 Wed Aug 19 05:49:25 2026 -0700
    Faceted composites should apply the active sort order to the tracks being displayed; changing the sort changes the display order. We also preserve that order when returning to the page. refs #36320
• src/hg/htdocs/style/floretStyle.css
  • lines changed 10, context: html, text, full: html, text
    d3f0b85414443b18f60a04da085238a558c8cd89 Fri Aug 21 13:52:08 2026 -0700
    floretStyle.css: make the background actually apply. refs #38159 The file had never worked. Four separate faults, each enough on its own to stop the background from showing: - The value was a bare URL, "background: http://genome-test.soe.ucsc.edu/...", with no url() wrapper, so the declaration was invalid and dropped. - The host was hardcoded to genome-test, wrong on dev, beta, the RR and every mirror. Now site-relative, and floret.jpg is at htdocs/images/floret.jpg. - The selector was a bare BODY, specificity 0,0,1. HGStyle.css has body.cgi and body.hgTracks rules at 0,1,1, so it lost the cascade regardless of source order. Now body.cgi, which ties both and wins on order. - background-image alone left HGStyle's body.hgTracks longhands in place, repeat-x / left bottom / fixed, so the image drew as a band across the bottom rather than tiling. Now the background shorthand. Also scope the TH rule with :not(:empty). web.c emits <TH HEIGHT=10></TH> as a vertical spacer in three places, webNewSectionHeaderEnd and two siblings, plus once in cgilib/gvUi.c. Coloring every TH turned those blank cells into visible boxes, one next to the Submit button on the configure page. On that page 2 of the 14 TH elements are the empty spacers and 12 are real group headers, so :not(:empty) hits exactly the ones that should be colored. Verified with headless Chrome: background tiles, populated TH keeps its color, empty spacer TH draws nothing.
• src/hg/htdocs/style/gbModern.css
  • lines changed 121, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/htdocs/style/hgBlat.css
  • lines changed 95, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/htdocs/style/hgSession.css
  • lines changed 100, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/htdocs/style/makefile
  • lines changed 1, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/hubApi/apiUtils.c
  • lines changed 2, context: html, text, full: html, text
    ae1b9adc9d85808683118f771703aeb8970306bf Sat Aug 22 10:19:03 2026 -0700
    hubApi: add X-Content-Type-Options: nosniff to responses, refs #38163 Set the nosniff header ahead of the Content-Type on every hubApi output path (JSON, text, and html), so responses declare their type explicitly.
• src/hg/hubApi/blat.c
  • lines changed 2, context: html, text, full: html, text
    ae1b9adc9d85808683118f771703aeb8970306bf Sat Aug 22 10:19:03 2026 -0700
    hubApi: add X-Content-Type-Options: nosniff to responses, refs #38163 Set the nosniff header ahead of the Content-Type on every hubApi output path (JSON, text, and html), so responses declare their type explicitly.
• src/hg/hubApi/hubApi.c
  • lines changed 2, context: html, text, full: html, text
    ae1b9adc9d85808683118f771703aeb8970306bf Sat Aug 22 10:19:03 2026 -0700
    hubApi: add X-Content-Type-Options: nosniff to responses, refs #38163 Set the nosniff header ahead of the Content-Type on every hubApi output path (JSON, text, and html), so responses declare their type explicitly.
  • lines changed 3, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
  • lines changed 4, context: html, text, full: html, text
    5a8e52dea2362f0f5417a19e95dca4f2ef0903d4 Sun Aug 23 15:20:33 2026 -0700
    Merge branch 'cspNonce' # Conflicts: # src/hg/hubApi/hubApi.c
• src/hg/inc/asmAlias.h
  • lines changed 6, context: html, text, full: html, text
    8d662255bea829d680d17220a0b049f5f9c02f16 Fri Aug 21 22:32:26 2026 -0700
    finalize asmAlias selection issue - if a given GenArk assembly is requested and it exists then use it, otherwise look for an alias refs #38082
• src/hg/inc/hCommon.h
  • lines changed 5, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/inc/hubConnect.h
  • lines changed 5, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
• src/hg/js/facetedComposite.js
  • lines changed 87, context: html, text, full: html, text
    403ab7c9c2b204f487bb2f86260ffdab355e9517 Wed Aug 19 05:49:25 2026 -0700
    Faceted composites should apply the active sort order to the tracks being displayed; changing the sort changes the display order. We also preserve that order when returning to the page. refs #36320
• src/hg/js/hgBlat.js
  • lines changed 54, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/js/hgSession.js
  • lines changed 792, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/js/makefile
  • lines changed 1, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/js/utils.js
  • lines changed 18, context: html, text, full: html, text
    403ab7c9c2b204f487bb2f86260ffdab355e9517 Wed Aug 19 05:49:25 2026 -0700
    Faceted composites should apply the active sort order to the tracks being displayed; changing the sort changes the display order. We also preserve that order when returning to the page. refs #36320
• src/hg/lib/asmAlias.c
  • lines changed 18, context: html, text, full: html, text
    8d662255bea829d680d17220a0b049f5f9c02f16 Fri Aug 21 22:32:26 2026 -0700
    finalize asmAlias selection issue - if a given GenArk assembly is requested and it exists then use it, otherwise look for an alias refs #38082
• src/hg/lib/barChartUi.c
  • lines changed 14, context: html, text, full: html, text
    e6b0dc7877ae4b24f56682885e03263fd2da3582 Tue Aug 18 11:37:04 2026 -0700
    lib, hgc: encode barChart, BAM and VCF detail text consistently, refs #38123
• src/hg/lib/botDelay.c
  • lines changed 1, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/lib/cart.c
  • lines changed 47, context: html, text, full: html, text
    554396e44745165ee4baf5214aa771f2b17b3be6 Mon Aug 17 16:04:26 2026 -0700
    hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623 The hgPcrResult_<db> cart variable holds two file names and an optional target name in one value. The cart.c arrays compare a whole value against isServerUserFilePath(), so none of them fit that shape. Add a fourth array for it and check the first two words. hgPcrResult_targetStyle shares the prefix and is a display setting, so it is excluded by name. Check both names where they are used as well, in pcrResultParseCart() and in hgPcr's append path, the way dupTrack.c already does. Two other things in writePcrResultTrack(). pcrFiles[2] was read without ever being set whenever the value held only two words, which is the usual case. And the saved-session test was a plain prefix compare that missed sessionDataDirOld; it now asks whether the file is in the trash instead. hg/utils/cartFileVarCatalog knows about the new array and has a row for hgPcrResult_<db> saying why its scan cannot see this one.
  • lines changed 10, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
  • lines changed 4, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/lib/customFactory.c
  • lines changed 49, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
  • lines changed 4, context: html, text, full: html, text
    983b7eff4b1c516c9cb7bb56cc1399216a127d51 Wed Aug 19 04:02:39 2026 -0700
    address v503 preview1 code review (#38141): escaping and oauth fixes Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the BLAT-results group work (#38086): - hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args; cartWebStart already escapes the title, so this was double-escaping. - hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded name to getSessionLink (same fix already applied at line 1544). - hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed into the mailto: href (reachable on the robot/captcha path). - hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of reusing the JSON-escaped copy meant for the JS string literal. - hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so the later oauthFetchIdentity call is not a read-after-free. - customFactory.c checkGroup: only accept group=blat when blatResultsGroup is on, matching hgTracks; otherwise the group is never created and the track would orphan into 'other'. refs #38141, refs #38057, refs #38086
• src/hg/lib/customTrack.c
  • lines changed 64, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
• src/hg/lib/hCommon.c
  • lines changed 19, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/hg/lib/hdb.c
  • lines changed 1, context: html, text, full: html, text
    997a9384be1a820ea0c35e2b551308bd6b5fb771 Tue Aug 18 09:08:34 2026 -0700
    hdb: drop limit 1 from the hDbForTaxon fallback query so all candidate dbs are checked The fallback query returned a single row, so the loop in firstExistingDbFromQuery had nothing to walk. If that one dbDb row had no real SQL database and no curated hub, hDbForTaxon returned NULL. Without the limit the loop sees every active row for the taxon in orderKey order and returns the first one that exists. refs #17886
• src/hg/lib/hubConnect.c
  • lines changed 14, context: html, text, full: html, text
    aca9143822a9c12b16b33d479a5abb6495b6b4f0 Wed Aug 19 06:59:39 2026 -0700
    lib, hgc, hgTables, hgHubConnect: share hubEncode, refs #38123 hgc.c and hgTables.c each had their own copy of hubEncode(). The two bodies were identical, so move the function to hubConnect.c next to isHubTrack() and let both CGIs call the one definition. Also use cgiEncode() rather than htmlEncode() for the db= value in the hgHubConnect assembly list. That value goes in a query string, so cgiEncode() is the right function there. Genome names are already limited to a safe character set, so this changes no output today.
  • lines changed 3, context: html, text, full: html, text
    8d662255bea829d680d17220a0b049f5f9c02f16 Fri Aug 21 22:32:26 2026 -0700
    finalize asmAlias selection issue - if a given GenArk assembly is requested and it exists then use it, otherwise look for an alias refs #38082
• src/hg/lib/hui.c
  • lines changed 1, context: html, text, full: html, text
    074ea922bc80e0c46b93fb22b91426770022e4e2 Tue Aug 18 10:59:40 2026 -0700
    lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123
  • lines changed 28, context: html, text, full: html, text
    304e190d0af4be54569ac20edc26999673c44f8b Tue Aug 18 11:05:19 2026 -0700
    hgTrackUi, hui: encode trackDb-derived label text consistently, refs #38123
  • lines changed 3, context: html, text, full: html, text
    1c7ec830118f006d5fde9d8cdb36596edcf6e055 Tue Aug 18 12:03:17 2026 -0700
    cheapcgi, hui: encode a bigBed-derived form control name, refs #38123
• src/hg/lib/jsHelper.c
  • lines changed 3, context: html, text, full: html, text
    20ca104b9897669e127e4ec8675321b12f780cff Tue Aug 18 11:19:44 2026 -0700
    lib, hgTracks: encode JSON object keys and configure/search text, refs #38123
  • lines changed 3, context: html, text, full: html, text
    b88e4615c7ce7ea3f0d05c84365509670493840c Tue Aug 18 14:49:17 2026 -0700
    lib, hgc, hgTracks: small output-encoding cleanups, refs #38123
• src/hg/lib/pgSnp.c
  • lines changed 8, context: html, text, full: html, text
    01fbc2b46b7fe918aa6628cca8ca8ee7ede0e598 Wed Aug 19 17:54:38 2026 -0700
    pgSnp: replace a fixed-size local array in alleleCountsFromVcfRecord with an allocation sized from the record, refs #38154
• src/hg/lib/trackHub.c
  • lines changed 7, context: html, text, full: html, text
    c4eb98684d52ed28bd00632854ca5c8385b1bb63 Tue Aug 18 11:24:43 2026 -0700
    trackHub: tighten genome name validation, refs #38123
  • lines changed 20, context: html, text, full: html, text
    934a51aa2ebc7e11bfba57804642cd03e4e1e60a Tue Aug 18 11:45:11 2026 -0700
    trackHub: tighten group name validation, refs #38123
• src/hg/lib/web.c
  • lines changed 2, context: html, text, full: html, text
    8d662255bea829d680d17220a0b049f5f9c02f16 Fri Aug 21 22:32:26 2026 -0700
    finalize asmAlias selection issue - if a given GenArk assembly is requested and it exists then use it, otherwise look for an alias refs #38082
• src/hg/liftRequest/liftRequest.c
  • lines changed 49, context: html, text, full: html, text
    8edca3cf0a86dfbcd71116bcd117ecd2aa29aac7 Fri Aug 21 22:45:23 2026 -0700
    remove temporary experiment that never went anywhere
• src/hg/liftRequest/makefile
  • lines changed 18, context: html, text, full: html, text
    8edca3cf0a86dfbcd71116bcd117ecd2aa29aac7 Fri Aug 21 22:45:23 2026 -0700
    remove temporary experiment that never went anywhere
• src/hg/makeDb/doc/archaeaAsmHub/archaea.orderList.tsv
  • lines changed 155, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/asmHubs/asmHubs.mk
  • lines changed 15, context: html, text, full: html, text
    25ea393c310876076793bbad0e093f83161e9d78 Tue Aug 18 14:39:58 2026 -0700
    improve efficiency of the trackData.pl an now using faSize to get sizes out of the 2bit files no redmine
• src/hg/makeDb/doc/asmHubs/mkAsmStats.pl
  • lines changed 2, context: html, text, full: html, text
    25ea393c310876076793bbad0e093f83161e9d78 Tue Aug 18 14:39:58 2026 -0700
    improve efficiency of the trackData.pl an now using faSize to get sizes out of the 2bit files no redmine
• src/hg/makeDb/doc/asmHubs/runBuild
  • lines changed 11, context: html, text, full: html, text
    90552b46adcb6b1641a0e027e1cf722e411c9664 Mon Aug 17 10:23:57 2026 -0700
    now running the oneLftp.sh to fetch the NCBI files for the build of the assembly refs #32596
• src/hg/makeDb/doc/asmHubs/trackData.pl
  • lines changed 416, context: html, text, full: html, text
    25ea393c310876076793bbad0e093f83161e9d78 Tue Aug 18 14:39:58 2026 -0700
    improve efficiency of the trackData.pl an now using faSize to get sizes out of the 2bit files no redmine
  • lines changed 1, context: html, text, full: html, text
    f3707c75a44a765397fd2c7f9144dc5dfd61f3c7 Wed Aug 19 09:46:50 2026 -0700
    restore the backslash r character which was lost in edits since it used to be an explicit control-M literal character found by claude code review no redmine
• src/hg/makeDb/doc/bacteriaAsmHub/bacteria.orderList.tsv
  • lines changed 1322, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/birdsAsmHub/birds.orderList.tsv
  • lines changed 11, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/enigma.txt
  • lines changed 51, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
  • lines changed 42, context: html, text, full: html, text
    1478a90404ea80636ae160b7b150fcaa34d80b50 Tue Aug 18 15:14:02 2026 -0700
    Adding Zanti et al 2025 case-control LRs to the ENIGMA BRCA1/BRCA2 PP4/BP5 track. refs #37886 New BRCAmlaZanti.py rebuilds the BRCAmla track with the case-control likelihood ratios from Zanti et al. 2025 (PMID 40413188) replacing the 20-variant iCOGS case-control component from Parsons et al. 2019, which overlaps the Zanti cohorts. Track grows from 4,436 to 13,481 variants per assembly, with new per-cohort columns (BRIDGES, CARRIERS, UK Biobank). Makedoc documents the build and release steps. Approach and combined-LR caveats reviewed with the ENIGMA collaborators on the ticket.
• src/hg/makeDb/doc/fishAsmHub/fish.orderList.tsv
  • lines changed 13, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/fungiAsmHub/fungi.orderList.tsv
  • lines changed 8, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
  • lines changed 1, context: html, text, full: html, text
    0fa586e6489d2862fb499024ee66702b33056f55 Tue Aug 18 07:36:33 2026 -0700
    incorrectly identified as a fungi GCF_056827815.1 it is a bacteria refs #29545
• src/hg/makeDb/doc/hg38/cactus447.txt
  • lines changed 7, context: html, text, full: html, text
    321d01255edf455466f419eb4d9dba18722068b3 Fri Aug 14 13:45:12 2026 -0700
    Correct cactus447 makedoc size-check numbers to the genome-wide scan result, refs #37841 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/doc/hg38/lrSv.txt
  • lines changed 24, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/doc/invertebrateAsmHub/invertebrate.orderList.tsv
  • lines changed 18, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
  • lines changed 1, context: html, text, full: html, text
    b6d0ccc9abb33be090cbe30e5e8c1438b832ec35 Wed Aug 19 09:48:14 2026 -0700
    remove trailing dot on spider. name GCF_044657685.1 found by claude code review no redmine
• src/hg/makeDb/doc/mammalsAsmHub/mammals.orderList.tsv
  • lines changed 5, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/mm10.txt
  • lines changed 40, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/doc/mm39/mouseDevTimecourse.txt
  • lines changed 14, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/doc/plantsAsmHub/plants.orderList.tsv
  • lines changed 10, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
  • lines changed 1, context: html, text, full: html, text
    2a36871abda76518c9bfdc555355e6c8c5294c34 Tue Aug 18 20:04:05 2026 -0700
    adding one per user lift over request refs #29545
  • lines changed 1, context: html, text, full: html, text
    28fbabb3b0f5dc9c9d2cc410138b07d550ec760f Wed Aug 19 10:09:13 2026 -0700
    missing (parens) around meta data for grain cowpea GCF_037176805.1 found by claude code review no redmine
• src/hg/makeDb/doc/primatesAsmHub/primates.orderList.tsv
  • lines changed 2, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/vertebrateAsmHub/vertebrate.orderList.tsv
  • lines changed 2, context: html, text, full: html, text
    2b477adcbd343ade24789ebb6c4629e57e45222f Tue Aug 18 07:27:52 2026 -0700
    RefSeq update refs @29545
• src/hg/makeDb/doc/viralAsmHub/viral.orderList.tsv
  • lines changed 50, context: html, text, full: html, text
    049f3d331685a598d3fb2ee688b0599256fc3e0a Fri Aug 21 23:22:38 2026 -0700
    RefSeq update refs #29545
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPProvisionalClass.py
  • lines changed 11, context: html, text, full: html, text
    3632060685c8b5ca508635ff45b0c27bf0df0dc1 Fri Aug 21 10:32:48 2026 -0700
    Harden Cardiomyopathy VCEP scripts against silent data-source failures. refs #38139 - cmpVCEPProvisionalClass: a SpliceAI read failure (wrong/renamed bigBed path) now stops the script with a clear error instead of returning an empty dict, which had silently fired BP7 for every synonymous variant with the mouseover showing "no record" as if it were a measurement. Also stop suppressing bigBedToBed's stderr. - cmpVCEPWalsh2019: compare the ClinVar transcript by accession without the version so a ClinVar version bump does not silently drop every matched row for a gene.
• src/hg/makeDb/scripts/cardiomyopathyVCEP/cmpVCEPWalsh2019.py
  • lines changed 3, context: html, text, full: html, text
    3632060685c8b5ca508635ff45b0c27bf0df0dc1 Fri Aug 21 10:32:48 2026 -0700
    Harden Cardiomyopathy VCEP scripts against silent data-source failures. refs #38139 - cmpVCEPProvisionalClass: a SpliceAI read failure (wrong/renamed bigBed path) now stops the script with a clear error instead of returning an empty dict, which had silently fired BP7 for every synonymous variant with the mouseover showing "no record" as if it were a measurement. Also stop suppressing bigBedToBed's stderr. - cmpVCEPWalsh2019: compare the ClinVar transcript by accession without the version so a ClinVar version bump does not silently drop every matched row for a gene.
• src/hg/makeDb/scripts/enigma/BRCAfunctionalAssays.py
  • lines changed 23, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
• src/hg/makeDb/scripts/enigma/BRCAmlaZanti.py
  • lines changed 292, context: html, text, full: html, text
    1478a90404ea80636ae160b7b150fcaa34d80b50 Tue Aug 18 15:14:02 2026 -0700
    Adding Zanti et al 2025 case-control LRs to the ENIGMA BRCA1/BRCA2 PP4/BP5 track. refs #37886 New BRCAmlaZanti.py rebuilds the BRCAmla track with the case-control likelihood ratios from Zanti et al. 2025 (PMID 40413188) replacing the 20-variant iCOGS case-control component from Parsons et al. 2019, which overlaps the Zanti cohorts. Track grows from 4,436 to 13,481 variants per assembly, with new per-cohort columns (BRIDGES, CARRIERS, UK Biobank). Makedoc documents the build and release steps. Approach and combined-LR caveats reviewed with the ENIGMA collaborators on the ticket.
• src/hg/makeDb/scripts/enigma/BRCAsplicing.py
  • lines changed 28, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
• src/hg/makeDb/scripts/enigma/convertTable4toFlat.py
  • lines changed 128, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
• src/hg/makeDb/scripts/enigma/exportV12Sheets.py
  • lines changed 68, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
• src/hg/makeDb/scripts/lrSv/lrSv1kLin1218VcfToBed.py
  • lines changed 7, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSv1kgOntVcfToBed.py
  • lines changed 6, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvAou1kCsvToBed.py
  • lines changed 4, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvAprVcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvCardBbToBed.py
  • lines changed 6, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvColorsDbSvVcfToBed.py
  • lines changed 6, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvCpc1VcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvDecodeVcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvGa4kSvVcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvGustafsonVcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/lrSv/lrSvVcfToBed.py
  • lines changed 5, context: html, text, full: html, text
    78cdae7249c8609dcbc743e996ea7e5eec33d75a Mon Aug 17 08:15:39 2026 -0700
    lrSv: fix off-by-one anchor base in deletion coordinates across converters, refs #38099 VCF/pangenome deletions carry a non-deleted anchor (padding) base at POS. Several lrSv converters set chromStart = pos-1, which includes that anchor, so each deletion was 1 bp too wide on the left and svLen was 1 too big. Callsets handled this inconsistently, so the same deletion appeared at offset coordinates and failed to merge in lrSvAll. For deletions only (INS/INV/CPX unchanged), advance chromStart past the anchor so the interval covers exactly the deleted bases (svLen == |SVLEN|). Verified against the hg38 reference: the old left base is present in both REF and ALT (i.e. retained by the sample), so it should not be inside the deletion. Fixed 11 converters: lrSv1kLin1218VcfToBed, lrSv1kgOntVcfToBed, lrSvGustafsonVcfToBed, lrSvGa4kSvVcfToBed, lrSvDecodeVcfToBed, lrSvAou1kCsvToBed, lrSvColorsDbSvVcfToBed, lrSvCardBbToBed, lrSvAprVcfToBed, lrSvCpc1VcfToBed, lrSvVcfToBed (generic, used by han945). Left unchanged, verified already anchor-correct: hgsvc3 and hgsvc2 (0-based source), hprc2v21 (Ro converter prefix-trims), noyvert/tommoJp (POS is the first deleted base), chirmade101 (1-based-closed source). Rebuilt all affected bigBeds (hg38 + hs1 where present) and the lrSvAll merge: 3,111,026 -> 2,963,093 rows as ~148k duplicate deletions now merge.
• src/hg/makeDb/scripts/mouseDevTimecourse/generateBigwigTrackDb.py
  • lines changed 25, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/scripts/mouseDevTimecourse/sentenceCaseTissues.sh
  • lines changed 72, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/scripts/singleCellSignalsPeaks/copySingleCellSignalsPeaksFiles.py
  • lines changed 29, context: html, text, full: html, text
    423ffa0448b4e60620b62e201aae813f069ba832 Fri Aug 21 07:59:07 2026 -0700
    singleCellSignalsPeaks: fix the copy script's abort order and --stanzas, refs #38142 Two code-review items from Jairo. The zero-subtracks check ran after the facet metadata had already been copied, so in the one case it guards against, the bed directory was left holding fresh metadata and no matching data files. It now aborts before the copy. --manifest and the metadata path were still keyed off HUB_BUILD, while the sibling makeSingleCellSignalsPeaksRa.py had already moved to deriving them from --stanzas. Pointing --stanzas at a second build therefore read the default build's manifest and copied the default build's metadata. Both now resolve from the stanza file's build root, so the two scripts treat the flag the same way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 49, context: html, text, full: html, text
    678310fdb6c3c8f61955476a5002c26ef4bff95a Fri Aug 21 13:01:39 2026 -0700
    singleCellSignalsPeaks: fail loudly on an unusable copy, and copy atomically, refs #38142 Three things found while reviewing this script after the code review. Resolving every subtrack and then finding not one of their source files used to print a MISSING list and exit 0, which is the same silent success the zero- subtracks check guards against, one step further in. It now aborts and names both the stanza file and the manifest, since the usual cause is the two coming from different builds. Missing facet metadata was skipped quietly, leaving the bed directory advertising the previous build's facets against this build's data files. makeSingleCellSignalsPeaksRa.py already treats that as fatal; so does this now. The bed directory is served live, through the /gbdb/<asm>/bbi/singleCellSignalsPeaks symlink, so copying in place handed out a truncated bigBed for as long as each copy took. Copies now go to a temp file beside the destination and get renamed into place. While here, the already-copied test compares mtime as well as size: a rebuilt file often lands on the same size, and skipping it then served the old data indefinitely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/scripts/tp53/tp53AFfrequencies.py
  • lines changed 11, context: html, text, full: html, text
    ad8e7d43125d15461861a22ccb4d99e2b46c88c0 Fri Aug 21 10:46:04 2026 -0700
    Fix TP53 gnomAD PASS filtering and FLOSSIES carrier count, per code review. refs #37399 refs #38139 Two independent correctness fixes from CR #38139: - tp53AFfrequencies.py: skip non-PASS gnomAD records (mostly AC0, i.e. observed in nobody after QC). They were entering the present-set and wrongly counting as present in gnomAD, blocking the absent -> PM2_Supporting rule. 68 missense variants now correctly get PM2, changing 6 provisional classes at the 5/6 and -2/-1 boundaries. gnomAD frequency use is PASS-only regardless. - tp53Flossies.py: count carriers as het + hom by summing the per-population het and hom counts, instead of allele_count - hom_count. In this FLOSSIES export allele_count is already het + hom (not the usual het + 2*hom), so the old formula dropped homozygous carriers (e.g. P72R showed 4031 carriers, not 8372). No BS2 tier changes in the current export; fixes the mouseover count and a latent tier bug for low-count variants with homozygotes.
• src/hg/makeDb/scripts/tp53/tp53Flossies.py
  • lines changed 6, context: html, text, full: html, text
    ad8e7d43125d15461861a22ccb4d99e2b46c88c0 Fri Aug 21 10:46:04 2026 -0700
    Fix TP53 gnomAD PASS filtering and FLOSSIES carrier count, per code review. refs #37399 refs #38139 Two independent correctness fixes from CR #38139: - tp53AFfrequencies.py: skip non-PASS gnomAD records (mostly AC0, i.e. observed in nobody after QC). They were entering the present-set and wrongly counting as present in gnomAD, blocking the absent -> PM2_Supporting rule. 68 missense variants now correctly get PM2, changing 6 provisional classes at the 5/6 and -2/-1 boundaries. gnomAD frequency use is PASS-only regardless. - tp53Flossies.py: count carriers as het + hom by summing the per-population het and hom counts, instead of allele_count - hom_count. In this FLOSSIES export allele_count is already het + hom (not the usual het + 2*hom), so the old formula dropped homozygous carriers (e.g. P72R showed 4031 carriers, not 8372). No BS2 tier changes in the current export; fixes the mouseover count and a latent tier bug for low-count variants with homozygotes.
• src/hg/makeDb/trackDb/human/eve.html
  • lines changed 25, context: html, text, full: html, text
    e0adf83220cfdb3ccee6d970465edfa5d4a626c9 Fri Aug 14 15:05:55 2026 -0700
    Clarify that EVE cell color and class are independent measures and correct the Class25 description to reflect that roughly three quarters of substitutions are labeled uncertain, drop the unverified ClinVar accuracy claim, switch the last download link to https, and name the MaveDB Heatmaps track, refs #37763 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/trackDb/human/hg38/gnomad.constraint.alpha.ra
  • lines changed 8, context: html, text, full: html, text
    e7627f2c8a0215940699e390bf24a17cb60fdeec Sun Aug 23 22:22:01 2026 -0700
    Changing the v2/v4/v4.1 constraint subtracks to hide by default. Updating the pliByTranscriptV4_1_1's mouseOver, plus some other minor updates. refs #37351
• src/hg/makeDb/trackDb/human/hg38/gnomad.constraint.public.ra
  • lines changed 5, context: html, text, full: html, text
    e7627f2c8a0215940699e390bf24a17cb60fdeec Sun Aug 23 22:22:01 2026 -0700
    Changing the v2/v4/v4.1 constraint subtracks to hide by default. Updating the pliByTranscriptV4_1_1's mouseOver, plus some other minor updates. refs #37351
• src/hg/makeDb/trackDb/human/hg38/gnomadMpc.html
  • lines changed 4, context: html, text, full: html, text
    a3b068a5c19262b2ad74db394e508fd61c7eb6b0 Sun Aug 23 22:23:09 2026 -0700
    Updating gnomadMpc.html's transcript count to the verified 18,245 and updating the tag to beta, refs #37478
• src/hg/makeDb/trackDb/human/hg38/gnomadV4.1.html
  • lines changed 1, context: html, text, full: html, text
    e7627f2c8a0215940699e390bf24a17cb60fdeec Sun Aug 23 22:22:01 2026 -0700
    Changing the v2/v4/v4.1 constraint subtracks to hide by default. Updating the pliByTranscriptV4_1_1's mouseOver, plus some other minor updates. refs #37351
• src/hg/makeDb/trackDb/human/hg38/trackDb.ra
  • lines changed 1, context: html, text, full: html, text
    a3b068a5c19262b2ad74db394e508fd61c7eb6b0 Sun Aug 23 22:23:09 2026 -0700
    Updating gnomadMpc.html's transcript count to the verified 18,245 and updating the tag to beta, refs #37478
• src/hg/makeDb/trackDb/human/lrSv.html
  • lines changed 1, context: html, text, full: html, text
    68944f2aab4d002e1ca85879bb4caf00b1eb72b0 Mon Aug 17 15:39:19 2026 -0700
    lrSv: correct HPRC2 linear callset note - not used in Lin et al merge Remove claim from lrSv.html that a linear HPRC2 callset was included for the Lin et al. merge. Add a sentence to the lrSv1kLin methods explaining that the HPRC year 2 linear callset was used only for comparison and did not contribute to the merged callset, with a link to that callset. refs #38099
  • lines changed 5, context: html, text, full: html, text
    3772b2f385c1c5991b9e01a4d503f19cc475fdc5 Thu Aug 20 02:03:46 2026 -0700
    decode docs update, after user question
• src/hg/makeDb/trackDb/human/lrSv1kLin.html
  • lines changed 5, context: html, text, full: html, text
    68944f2aab4d002e1ca85879bb4caf00b1eb72b0 Mon Aug 17 15:39:19 2026 -0700
    lrSv: correct HPRC2 linear callset note - not used in Lin et al merge Remove claim from lrSv.html that a linear HPRC2 callset was included for the Lin et al. merge. Add a sentence to the lrSv1kLin methods explaining that the HPRC year 2 linear callset was used only for comparison and did not contribute to the merged callset, with a link to that callset. refs #38099
• src/hg/makeDb/trackDb/human/popEve.html
  • lines changed 10, context: html, text, full: html, text
    45b6fe55c6520090418dc0d3651ecfabdb8b83de Fri Aug 14 15:07:29 2026 -0700
    Switch the hgdownload links to https, name the MaveDB Heatmaps track, and reflow the display conventions paragraph on the popEVE description page, refs #37791 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/makeDb/trackDb/mouse/mm10/developmentTimecourseSignalMm10.html
  • lines changed 17, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm10/developmentTimecourseSignalMm10.ra
  • lines changed 81, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm10/mouseDevTimecourse.html
  • lines changed 9, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm10/mouseDevTimecourse.ra
  • lines changed 8, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm39/developmentTimecourseM21mm39FPKM.html
  • lines changed 13, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm39/developmentTimecourseM21mm39TPM.html
  • lines changed 15, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm39/mouseDevTimecourse.html
  • lines changed 13, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouse/mm39/mouseDevTimecourse.ra
  • lines changed 4, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/mouseDevTimecourseDisplay.shared.html
  • lines changed 17, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/makeDb/trackDb/relatedTracks.ra
  • lines changed 4, context: html, text, full: html, text
    78988553dd9b460c26f0b9f21f15a1aacfad9dab Fri Aug 21 15:44:40 2026 -0700
    Polish pass on the mouseDevTimecourse tracks after a Playwright QA sweep. refs #37001 Sentence-case the tissue names and the facet column titles, so the barChart facet filter reads "Tissue / Spleen" rather than "tissue / spleen" and the bigWig matrix reads "Spleen". Only the first character is upper-cased. Added sentenceCaseTissues.sh, which does the .facets and .categories files and is idempotent, since the hub still ships lower-case and this has to be replayed after any refetch. The count and color column names are deliberately left lower-case: barChartUi.c requires a field literally named "count" to load the file at all, and facetedTable.c keys its merge logic on "count", "color" and "val". Renaming the faceted columns means trackDb matches, so the stanzas now read barChartFacets Tissue,Timepoint. Set priority on the container children so the default-visible M21 TPM sorts first and the signal composite sorts last. The composite needs an explicit value; without one it inherits the superTrack's 0.6 and floats to the top. Fix the All reads view, which was inert. Every all-reads subtrack shipped parent off, so switching the view to full revealed nothing. The view's own visibility already gates drawing, so the subtrack state should not encode the view as well. The default image is unchanged at 78 unique-reads rep1 tracks, and switching the view to full now yields 156. This also makes the Rep 2 toggle symmetric across the two views. Rename the bigWig subGroup3 display label from Age to Timepoint, matching the barChart facet and the .facets column. The group name stays "age" because dimensions and sortOrder reference it by name. Add relatedTracks cross-links between the mm10 container and Tabula Muris. Not Tabula Muris Senis, which is not on the RR. Description pages: reorder the mm10 subtrack list to match the new display order, "sub tracks" to "subtracks", capitalise the colour legend tissue names, and correct the mm39 Il11ra2 note - the gene appears three times, two of them stacked at one position and sharing a details page, with the third 497 kb away. Makedocs record the casing step, its ordering constraint relative to the reorder and colour steps, and the count/color naming constraint.
• src/hg/utils/automation/AsmHub.pm
  • lines changed 7, context: html, text, full: html, text
    62e62c6404011a058ce40b13b5d6a2a4d5724f29 Fri Aug 21 22:39:45 2026 -0700
    corresponding fix for updates to doNcbiGene.pl better indexing for ncbiGene refs #34917
• src/hg/utils/automation/HgAutomate.pm
  • lines changed 1, context: html, text, full: html, text
    902997abc3d6d90a569c219d1305e00535d2ef47 Tue Aug 18 13:42:07 2026 -0700
    just following orders refs #38021
  • lines changed 25, context: html, text, full: html, text
    2656c7a9162e938d9f9ae923985234a1561f480b Wed Aug 19 10:00:12 2026 -0700
    fixup nfsNoodge correctly to test filesystem gpfs/nfs refs #38021
  • lines changed 2, context: html, text, full: html, text
    75570fb95674659964f2488baffae618ba1de49c Thu Aug 20 09:38:11 2026 -0700
    nodge should check for file has contents not just exists claude review recommendation refs #38021
• src/hg/utils/automation/kmerPairs.pl
  • lines changed 65, context: html, text, full: html, text
    8709f15407b3ad4fdc8643cef50f65621a344a67 Wed Aug 19 14:28:29 2026 -0700
    4X speed improvement via claude analysis and rewrite - exact same inputs and outputs as before no redmine
• src/hg/utils/cartFileVarCatalog/cartFileVarCatalog.py
  • lines changed 42, context: html, text, full: html, text
    554396e44745165ee4baf5214aa771f2b17b3be6 Mon Aug 17 16:04:26 2026 -0700
    hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623 The hgPcrResult_<db> cart variable holds two file names and an optional target name in one value. The cart.c arrays compare a whole value against isServerUserFilePath(), so none of them fit that shape. Add a fourth array for it and check the first two words. hgPcrResult_targetStyle shares the prefix and is a display setting, so it is excluded by name. Check both names where they are used as well, in pcrResultParseCart() and in hgPcr's append path, the way dupTrack.c already does. Two other things in writePcrResultTrack(). pcrFiles[2] was read without ever being set whenever the value held only two words, which is the usual case. And the saved-session test was a plain prefix compare that missed sessionDataDirOld; it now asks whether the file is in the trash instead. hg/utils/cartFileVarCatalog knows about the new array and has a row for hgPcrResult_<db> saying why its scan cannot see this one.
• src/hg/utils/cartFileVarCatalog/harvestCartFileVars.py
  • lines changed 19, context: html, text, full: html, text
    554396e44745165ee4baf5214aa771f2b17b3be6 Mon Aug 17 16:04:26 2026 -0700
    hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623 The hgPcrResult_<db> cart variable holds two file names and an optional target name in one value. The cart.c arrays compare a whole value against isServerUserFilePath(), so none of them fit that shape. Add a fourth array for it and check the first two words. hgPcrResult_targetStyle shares the prefix and is a display setting, so it is excluded by name. Check both names where they are used as well, in pcrResultParseCart() and in hgPcr's append path, the way dupTrack.c already does. Two other things in writePcrResultTrack(). pcrFiles[2] was read without ever being set whenever the value held only two words, which is the usual case. And the saved-session test was a plain prefix compare that missed sessionDataDirOld; it now asks whether the file is in the trash instead. hg/utils/cartFileVarCatalog knows about the new array and has a row for hgPcrResult_<db> saying why its scan cannot see this one.
• src/hg/utils/cartTrackVarCatalog/cartVarsNotCataloged.txt
  • lines changed 1, context: html, text, full: html, text
    9be408c932a09fa56fb6b12b9d1e44eed3b0c5b8 Mon Aug 17 09:58:33 2026 -0700
    cartTrackVarCatalog: baseline delAll, which is an element id not a cart variable, refs #37838 hgTracks.c builds "%s_delAll" with safef to name the Delete all button in the BLAT Results group, then passes that string to jsOnEventByIdF. The harvester cannot tell a group-prefixed element id from a track-prefixed cart variable, so the name came out of the scan and failed the nightly reconcile. It is an HTML id, so it belongs in the baseline. Teaching the scan to skip strings that only reach jsOnEventById is on the #37979 list.
• src/hg/utils/hgConfCatalog/hgConfCatalog.py
  • lines changed 30, context: html, text, full: html, text
    352a5277845b6d8b40b008af386c18c35d83e6d7 Mon Aug 17 09:58:26 2026 -0700
    hgConfCatalog: repair 30 file:line citations that drifted, refs #37925 The two commits pushed today moved code under the catalog. hgBlat.c gained about 97 lines, hgTracks.c 17, hgc.c 36 and config.c 9, so every cited read below those points was off. Written by hgConfCatalog.py --fix-citations, which only moves a citation when it finds the same read elsewhere in the same file.
  • lines changed 10, context: html, text, full: html, text
    5ee674363623678393bb186b1f5fdfd981ee743f Mon Aug 17 10:35:26 2026 -0700
    hgTracks: default multiRegionButtonTop TRUE in config.c too, refs #37977 Two places read multiRegionButtonTop through MULTI_REGION_CFG_BUTTON_TOP: the top-bar Multi-region button in hgTracks.c and the "Show all" checkbox in the multi-region dialog in config.c. Kate put the checkbox under this flag on purpose in 8ae222adb54. Then e1f7896a08f turned the flag on by default in 2022 and changed only the hgTracks.c read, so on a machine that does not set the flag the button moved to the top bar while the checkbox stayed hidden. It has been hidden for four years, although the cart variable it sets is read unconditionally at hgTracks.c:11115, so the feature works for anyone who can reach the variable another way. The hg.conf catalog row carried this as an open defect, so its note is rewritten and its recorded default now matches the tree.
  • lines changed 18, context: html, text, full: html, text
    9f8d33c8b2b6bc61f6d02d781c4e02836f7099f9 Fri Aug 21 02:05:42 2026 -0700
    hgSession: new opt-in JavaScript "My Sessions" page; share gbModern.css with hgBlat. refs #38157 Applies the hgBlat facelift strategy (#37996) to hgSession: an opt-in, client-rendered "My Sessions" page gated by the sessionNewPage / sessionNewPageBanner hg.conf flags (mirroring blatNewForm / blatNewFormBanner), with a banner linking between the classic and new pages so neither is a one-way door. sessionNewPage also flips the site default. hgSession.c stays the data/action backend: it emits the session list and page config as an inline JSON global (hgSessionData) into an empty #sessionApp container, and the new hgSession.js builds the UI - a save-current-view card (name + optional description + "only I can load it"; empty name saves under a random share_ name), a "most recently saved session" one-click Update, a searchable/sortable/paged DataTable of sessions (assembly + position, created with last-used on hover, views, a lock icon on private sessions), inline Share (copy link / email / gallery), Edit (rename + description + private), Overwrite and Delete, and a bulk Select -> Delete-all-selected mode. The mutating actions POST to new JSON endpoints (hgS_doDeleteJson / doShareJson / doGalleryJson / doOverwriteJson / doDescribeJson) that run the same SQL as the classic full-page handlers and return JSON, so the table updates in place; loads, file up/downloads and custom-track backup stay as ordinary form submits/links. The Advanced panel keeps feature parity with the classic page (load another user's session, load from URL/file, save to file, back up custom tracks, reset), minus the login/ change-password links that now live in the top menu. Shared UCSC house-style components (design tokens, .gbPill, .gbCard, .gbStrip, .gbSection, .gbShareBox, .gbBanner, the .gbModal* dialog and a .gbTable) are factored into a new gbModern.css. hgBlat is migrated onto it: its generic .blat* classes are renamed to the shared .gb* names in hgBlat.css / hgBlat.js and the #blatResults / #blatFormBox containers get class="gbApp"; verified pixel-clean against the previous search form and results pages, including the rename modal. hgSession.css holds only session-specific layout.
• src/hg/utils/hubClone/hubClone.c
  • lines changed 50, context: html, text, full: html, text
    0afbe51b59a42ea8fd8e008b35dcb49159e8fcc6 Tue Aug 18 13:48:14 2026 -0700
    efficiency for hubClone to avoid reloading files repeatedly and fix error in reading include statements with trailing # comments refs #38147
• src/hg/utils/otto/g2p/doG2p.py
  • lines changed 10, context: html, text, full: html, text
    fd12b362b0ccddedbc7055cc08f7fbe34b1bbdea Fri Aug 21 07:59:17 2026 -0700
    G2P otto: report the raw unrecognized confidence value, refs #38142 Code-review item from Jairo. The tally is keyed on the normalized value, so the log printed the folded form rather than the text that is actually in the CSV. Keep one raw example alongside each count and print that, so the value can be found in the source file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 18, context: html, text, full: html, text
    62fad287d92a5937f768173e48381544043e7b3e Fri Aug 21 13:03:58 2026 -0700
    G2P otto: stop csv.writer putting quotes into the track text, refs #38142 The BED was written with csv.writer, whose default dialect treats the double quote as its own quote character. Any field containing a quotation therefore came out wrapped in quotes with the inner quotes doubled, and nine G2P comments carry one, so that punctuation is in the released track today: "Note, a 7-residue ""hot spot"" within the so-called hinge domain ... Fields now go through bedField(), which keeps the text as G2P wrote it and only takes out the tab and newline that would break the row. The same change drops the CRLF line endings the excel dialect was emitting; bedToBigBed was already stripping those, so they did no harm, but the BED is a plain tab file now. Rebuilding hg38 from the same CSV changes exactly those nine records and nothing else: same 4,214 items, same 29 fields, coordinates untouched. /gbdb/{hg19,hg38}/g2p/g2p.bb still point at the previous build, so this needs a rebuild to reach the track. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 43, context: html, text, full: html, text
    cd98d642c99cbe1e5648734f7735452b69c01c23 Fri Aug 21 13:05:22 2026 -0700
    G2P otto: a lock, an atomic install, and separate stderr, refs #38142 Four hardening items from the same review, none of which change the track data. install() claimed to be atomic but did rm followed by ln, leaving a window in which /gbdb/<db>/g2p/g2p.bb did not exist. It now builds the symlink under a temp name and renames it over the live one. bash() folded stderr into stdout, and loadCoordinates parses that return value as bigBed rows, so a single warning from bigBedToBed would have arrived looking like data. The two streams are separate now, with stderr passed through to ours so the otto mail still shows it. Two runs would share a build directory and race on the move of AllG2P.csv over prevAllG2P.csv, which decides whether the next run thinks anything changed. A non-blocking flock means the second run says so and stops. The hgnc_id field is stripped, as the value used to join on it already was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
  • lines changed 8, context: html, text, full: html, text
    ca19bd51444a79e823160124e602ac92b9c6469e Fri Aug 21 13:41:12 2026 -0700
    G2P otto: keep a successful build quiet again, refs #38142 Separating stdout from stderr in cd98d642c99 also echoed stderr onward, and bedToBigBed narrates its progress there, so every build gained a dozen lines of "pass1 - making usageList" in the otto mail. stderr is now only reported when the command fails. The streams stay separate, so the parsing fix holds. No change to the track data. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/hg/utils/otto/genArk/asmAlias/runUpdate.sh
  • lines changed 5, context: html, text, full: html, text
    fa9b7f8c38f8fcb9972330f886d0655b44dc0404 Wed Aug 19 23:30:22 2026 -0700
    need to get the message about about the disable refs #38082
• src/hg/utils/otto/genArk/ncbiMirror/fetch.sh
  • lines changed 48, context: html, text, full: html, text
    4b13d1c5636bf6f7d87a554787a7ccc79c1dccf7 Mon Aug 17 10:16:17 2026 -0700
    updated script to eliminate the obsolete rsync commands refs #32596
• src/hg/utils/otto/genArk/ncbiMirror/ncbiRsync.sh
  • lines changed 3, context: html, text, full: html, text
    881817e2d9a77d5df168ae466beb23c8e6415c78 Mon Aug 17 10:19:49 2026 -0700
    updated script to eliminate the obsolete rsync commands refs #32596
• src/hg/utils/otto/genArk/ncbiMirror/oneLftp.sh
  • lines changed 83, context: html, text, full: html, text
    4bb151f462489071d5ae8eac563e5ce212b8fe6e Mon Aug 17 10:21:34 2026 -0700
    updated script to eliminate the obsolete rsync commands refs #32596
• src/hg/utils/otto/methbase2/processMethbaseHub
  • lines changed 623, context: html, text, full: html, text
    26a65c8679a0d603e5d11c47f95e5e1b2704e017 Wed Aug 19 04:12:46 2026 -0700
    Adding a script for processing MethBase2 hub files to convert them to local native tracks, refs #36320
• src/hg/utils/otto/mitoMap/checkMitoMapUpdate.sh
  • lines changed 26, context: html, text, full: html, text
    92e0aa55b4aba9f659ca7fdbc6572c6c8ce356c9 Tue Aug 18 16:36:24 2026 -0700
    Switch the MitoMap otto job to the fr.mitomap.org mirror and stop the run when a download fails or comes back empty, refs #38097
• src/hg/utils/otto/otto.crontab
  • lines changed 8, context: html, text, full: html, text
    92bee1b2bdd55e432b33a9061b11e09859601d4e Sat Aug 22 10:24:00 2026 -0700
    commenting out DE worker lines from otto crontab, since they're now running on hgcompute-08, not hgwdev. But leaving them in this crontab file so that the lines can be recovered in case the hgcompute-08 cron is ever lost, refs #24912
• src/hg/utils/otto/ottoCompareGitVsHiveFiles.py
  • lines changed 70, context: html, text, full: html, text
    802d3d4568681ebb6d13fc878d57571847ec45f8 Tue Aug 18 17:07:54 2026 -0700
    Fix false positives in the otto git vs hive comparison by keying on full git paths instead of basenames. No RM.
• src/hg/utils/otto/userRequests/ottoLib.py
  • lines changed 29, context: html, text, full: html, text
    6b237159a15cc8957bc40b802ebfe1116e06b9e7 Fri Aug 21 15:17:28 2026 -0700
    quite output on the git source tree update refs #31811
• src/hg/utils/otto/vcepVersions/checkVcepVersions.py
  • lines changed 1, context: html, text, full: html, text
    0a48f8c6284efb6756f1d2ba23694b58c9aa6f47 Tue Aug 18 12:01:13 2026 -0700
    Update ENIGMA BRCA1/BRCA2 hub scripts and data to CSpec v1.2. refs #38130 Rebuilds the BRCAsplicing and BRCAfunctionalAssays tracks from the v1.2 specification tables downloaded from the ClinGen CSpec registry. Adds exportV12Sheets.py (xlsx to text with merged-cell expansion) and convertTable4toFlat.py (converts the v1.2 visual Table 4 layout back to the flat format the track script consumes, including NMD-boundary PTC sub-ranges). Build scripts now write to a versioned dir instead of overwriting the files the public hub serves, and the hgSearch coordinate scraper was fixed for the current page format and made to fail loudly on a missed lookup. Also updates the vcepVersions monitor regex for the corrected BRCA1/BRCA2 wording on the hub description page.
• src/inc/cheapcgi.h
  • lines changed 7, context: html, text, full: html, text
    a4befd9382fadf413884d2215012535d5d667063 Mon Aug 17 13:46:45 2026 -0700
    hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057 Add isValidJsonpCallback() and apply it to the callback-name paths in apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are echoed back.
  • lines changed 12, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
  • lines changed 9, context: html, text, full: html, text
    dbb0850c7935dec65d3394ef1ddcdc10dafac5cf Tue Aug 18 10:03:38 2026 -0700
    cheapcgi: parse %hh escapes directly instead of with sscanf, refs #37262 cgiDecode and cgiDecodeFull read each %hh escape with sscanf(in, "%2x", &code). glibc builds a stream over the whole remaining string on every sscanf call, so each call scans to the terminating null. That makes the cost of a decode quadratic in the length of one variable's value. The cost is real on data we already have. A saved session in hgcentraltest holds a single 699 KB hgFind.matches value with 58,930 escapes; decoding it takes 0.29 s of CPU, and cart.c loadHash does it on every load of that session. The database cart has no size cap, so this is not bounded by the 1 MB limit on request input that went in for #37452. At that 1 MB limit a single request still costs over 2 s. Reading the two hex digits directly is a few hundred times faster (430x on the 699 KB value) and never walks past them. Behavior is unchanged for well-formed input: verified byte-identical over the top 200 carts of namedSessionDb, sessionDb and userDb (2.4 million values, 14.7 MB), over an exhaustive sweep of every "%" plus two arbitrary bytes, and over cgiEncode/cgiDecode round trips of all 256 byte values. Decoding now differs only where a "%" is not followed by two hex digits, which nothing legitimate produces - none of the 659,624 escapes in those carts are malformed. The old code was worse there anyway: sscanf skips leading whitespace, so "% 0Z" decoded to a null byte in the middle of the value and silently truncated it. Malformed escapes now yield '?' like other bad input. Also removes the FAST_CGI_DECODE ifdef added earlier on this ticket. It never touched cgiDecode, so it does not describe anything now that the real cost is fixed. Its per-variable caps are superseded by the total input cap from #37452, which aborts with a message rather than dropping a variable silently, and cgiParseNext's variant silently skipped oversized variables for the ENCODE/CIRM tag tools that are its only callers.
• src/inc/common.mk
  • lines changed 16, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• src/inc/htmshell.h
  • lines changed 4, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/inc/userAppMulti.mk
  • lines changed 2, context: html, text, full: html, text
    e3b5136a693b38d20fb3e15dbf4d71e6d8163407 Tue Aug 18 08:51:21 2026 -0700
    userAppMulti.mk: fix broken install target, build shared objects first Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
• src/inc/vcf.h
  • lines changed 5, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
• src/lib/cheapcgi.c
  • lines changed 31, context: html, text, full: html, text
    a4befd9382fadf413884d2215012535d5d667063 Mon Aug 17 13:46:45 2026 -0700
    hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057 Add isValidJsonpCallback() and apply it to the callback-name paths in apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are echoed back.
  • lines changed 56, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
  • lines changed 111, context: html, text, full: html, text
    dbb0850c7935dec65d3394ef1ddcdc10dafac5cf Tue Aug 18 10:03:38 2026 -0700
    cheapcgi: parse %hh escapes directly instead of with sscanf, refs #37262 cgiDecode and cgiDecodeFull read each %hh escape with sscanf(in, "%2x", &code). glibc builds a stream over the whole remaining string on every sscanf call, so each call scans to the terminating null. That makes the cost of a decode quadratic in the length of one variable's value. The cost is real on data we already have. A saved session in hgcentraltest holds a single 699 KB hgFind.matches value with 58,930 escapes; decoding it takes 0.29 s of CPU, and cart.c loadHash does it on every load of that session. The database cart has no size cap, so this is not bounded by the 1 MB limit on request input that went in for #37452. At that 1 MB limit a single request still costs over 2 s. Reading the two hex digits directly is a few hundred times faster (430x on the 699 KB value) and never walks past them. Behavior is unchanged for well-formed input: verified byte-identical over the top 200 carts of namedSessionDb, sessionDb and userDb (2.4 million values, 14.7 MB), over an exhaustive sweep of every "%" plus two arbitrary bytes, and over cgiEncode/cgiDecode round trips of all 256 byte values. Decoding now differs only where a "%" is not followed by two hex digits, which nothing legitimate produces - none of the 659,624 escapes in those carts are malformed. The old code was worse there anyway: sscanf skips leading whitespace, so "% 0Z" decoded to a null byte in the middle of the value and silently truncated it. Malformed escapes now yield '?' like other bad input. Also removes the FAST_CGI_DECODE ifdef added earlier on this ticket. It never touched cgiDecode, so it does not describe anything now that the real cost is fixed. Its per-variable caps are superseded by the total input cap from #37452, which aborts with a message rather than dropping a variable silently, and cgiParseNext's variant silently skipped oversized variables for the ENCODE/CIRM tag tools that are its only callers.
  • lines changed 7, context: html, text, full: html, text
    074ea922bc80e0c46b93fb22b91426770022e4e2 Tue Aug 18 10:59:40 2026 -0700
    lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123
  • lines changed 3, context: html, text, full: html, text
    1c7ec830118f006d5fde9d8cdb36596edcf6e055 Tue Aug 18 12:03:17 2026 -0700
    cheapcgi, hui: encode a bigBed-derived form control name, refs #38123
• src/lib/htmshell.c
  • lines changed 14, context: html, text, full: html, text
    e6ddf60465deb96e43be6738c5ca6a7a6168cac8 Sat Aug 22 15:08:59 2026 -0700
    hg/lib: add an option to send the content policy as an http response header New cspWriteResponseHeader() in hg/lib/hCommon.c, gated on hg.conf's cspResponseHeader, which defaults off everywhere. The policy string itself is still built by the existing code in lib/htmshell.c, which now also knows how to format it as a response header. Both carry the same nonce, since getNonce() is one per process, so a page may safely have the header and the meta tag. Most pages pick it up from addHttpHeaders() in cart.c, the existing hook for extra response headers, which every cart based CGI already passes through. Six places build their own http header block and so call it directly: the two "too many requests" pages, the captcha and its error page, the hubApi help redirect, and the hgSearch redirect to hgTracks. Inline scripts on three of those pages now carry the nonce, and the policy allows the Cloudflare script the bot check loads, so the option works when it is turned on. The Cloudflare entry is the only part of this that takes effect with the option off.
• src/lib/jsonParse.c
  • lines changed 5, context: html, text, full: html, text
    20ca104b9897669e127e4ec8675321b12f780cff Tue Aug 18 11:19:44 2026 -0700
    lib, hgTracks: encode JSON object keys and configure/search text, refs #38123
• src/lib/jsonWrite.c
  • lines changed 7, context: html, text, full: html, text
    074ea922bc80e0c46b93fb22b91426770022e4e2 Tue Aug 18 10:59:40 2026 -0700
    lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123
• src/lib/linefile.c
  • lines changed 2, context: html, text, full: html, text
    7181c0af889a0eee451b91ff0b23d67f35e0e772 Tue Aug 18 08:39:08 2026 -0700
    cheapcgi, customTrack, hgSession, hgPhyloPlace: track in-memory uploads in a registry Uploaded file contents are handed to the reading code as a text address and size. Collect that bookkeeping in cheapcgi, which now records each block it makes and hands back a name for it, and have the custom track, session and phyloPlace upload paths look the block up by that name. Also removes the duplicated address/size parsing those callers each had, and makes lineFileDecompressMem ignore a too-small buffer. refs #38108
• src/lib/mailViaPipe.c
  • lines changed 1, context: html, text, full: html, text
    13790903b05424044d822006bf13c6b9a9f16e21 Fri Aug 21 22:42:31 2026 -0700
    correct email bounce receiver address no redmine
• src/lib/tests/expected/vcfParseBadGenotypeIx.out
  • lines changed 33, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
• src/lib/tests/expected/vcfParseManyAlleles.out
  • lines changed 11, context: html, text, full: html, text
    de609b7489963f32ad474619cb3dff0283ef7e76 Sun Aug 23 15:13:46 2026 -0700
    vcf: bound the genotype allele index by the field it is stored in, refs #38155 parseAlleleIx checked the index against alleleCount only. A record can hold up to VCF_MAX_INFO alleles, so an index of 128 or more could pass that check and then narrow on the way into the signed char field. The narrowed value was sometimes another real allele of the record: with 260 ALT alleles, index 260 came out as 4. The parser then reported a genotype the VCF never named. The check now also rejects an index above SCHAR_MAX, so an index too large for the field reads as missing data. SCHAR_MAX and not CHAR_MAX, because CHAR_MAX is 255 on the unsigned char platforms that the field is declared signed for. Every other assignment to hapIxA and hapIxB in this file is a literal in the range -1 to 2, so parseAlleleIx was the only path that could carry an out-of-range value. New test vcfParseManyAlleles, with a record of 260 ALT alleles. Without the fix, GT 128/1 reads as -128/1, 130/130 as -126/-126, and 260/260 as 4/4.
• src/lib/tests/input/badGenotypeIx.vcf.gz
  • lines changed 0, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
• src/lib/tests/input/badGenotypeIx.vcf.gz.tbi
  • lines changed 0, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
• src/lib/tests/input/manyAlleles.vcf.gz
  • lines changed 0, context: html, text, full: html, text
    de609b7489963f32ad474619cb3dff0283ef7e76 Sun Aug 23 15:13:46 2026 -0700
    vcf: bound the genotype allele index by the field it is stored in, refs #38155 parseAlleleIx checked the index against alleleCount only. A record can hold up to VCF_MAX_INFO alleles, so an index of 128 or more could pass that check and then narrow on the way into the signed char field. The narrowed value was sometimes another real allele of the record: with 260 ALT alleles, index 260 came out as 4. The parser then reported a genotype the VCF never named. The check now also rejects an index above SCHAR_MAX, so an index too large for the field reads as missing data. SCHAR_MAX and not CHAR_MAX, because CHAR_MAX is 255 on the unsigned char platforms that the field is declared signed for. Every other assignment to hapIxA and hapIxB in this file is a literal in the range -1 to 2, so parseAlleleIx was the only path that could carry an out-of-range value. New test vcfParseManyAlleles, with a record of 260 ALT alleles. Without the fix, GT 128/1 reads as -128/1, 130/130 as -126/-126, and 260/260 as 4/4.
• src/lib/tests/input/manyAlleles.vcf.gz.tbi
  • lines changed 0, context: html, text, full: html, text
    de609b7489963f32ad474619cb3dff0283ef7e76 Sun Aug 23 15:13:46 2026 -0700
    vcf: bound the genotype allele index by the field it is stored in, refs #38155 parseAlleleIx checked the index against alleleCount only. A record can hold up to VCF_MAX_INFO alleles, so an index of 128 or more could pass that check and then narrow on the way into the signed char field. The narrowed value was sometimes another real allele of the record: with 260 ALT alleles, index 260 came out as 4. The parser then reported a genotype the VCF never named. The check now also rejects an index above SCHAR_MAX, so an index too large for the field reads as missing data. SCHAR_MAX and not CHAR_MAX, because CHAR_MAX is 255 on the unsigned char platforms that the field is declared signed for. Every other assignment to hapIxA and hapIxB in this file is a literal in the range -1 to 2, so parseAlleleIx was the only path that could carry an out-of-range value. New test vcfParseManyAlleles, with a record of 260 ALT alleles. Without the fix, GT 128/1 reads as -128/1, 130/130 as -126/-126, and 260/260 as 4/4.
• src/lib/tests/makefile
  • lines changed 8, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
  • lines changed 9, context: html, text, full: html, text
    de609b7489963f32ad474619cb3dff0283ef7e76 Sun Aug 23 15:13:46 2026 -0700
    vcf: bound the genotype allele index by the field it is stored in, refs #38155 parseAlleleIx checked the index against alleleCount only. A record can hold up to VCF_MAX_INFO alleles, so an index of 128 or more could pass that check and then narrow on the way into the signed char field. The narrowed value was sometimes another real allele of the record: with 260 ALT alleles, index 260 came out as 4. The parser then reported a genotype the VCF never named. The check now also rejects an index above SCHAR_MAX, so an index too large for the field reads as missing data. SCHAR_MAX and not CHAR_MAX, because CHAR_MAX is 255 on the unsigned char platforms that the field is declared signed for. Every other assignment to hapIxA and hapIxB in this file is a literal in the range -1 to 2, so parseAlleleIx was the only path that could carry an out-of-range value. New test vcfParseManyAlleles, with a record of 260 ALT alleles. Without the fix, GT 128/1 reads as -128/1, 130/130 as -126/-126, and 260/260 as 4/4.
• src/lib/tests/vcfParseTest.c
  • lines changed 39, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
• src/lib/vcf.c
  • lines changed 30, context: html, text, full: html, text
    6c676a0e9ed642676008731762141e0c16822787 Sat Aug 22 09:31:14 2026 -0700
    vcf: tighten validation of the genotype allele index, refs #38155 New parseAlleleIx returns missing data for a GT allele index that the record has no allele for, and for a value that will not fit the field. It checks the value as an int, before it reaches the field. vcfParseGenotypes and vcfParseGenotypesGtOnly both go through it, and a check after the per-genotype loop covers the PL and SGT fallbacks, which choose an index without consulting the allele count. hapIxA and hapIxB become signed char. Plain char is unsigned on some architectures, and the negative missing-data value did not stay negative there. Size and field offsets are unchanged, and x86 code generation is identical. Adds a lib/tests case for malformed and boundary genotype indexes.
  • lines changed 5, context: html, text, full: html, text
    de609b7489963f32ad474619cb3dff0283ef7e76 Sun Aug 23 15:13:46 2026 -0700
    vcf: bound the genotype allele index by the field it is stored in, refs #38155 parseAlleleIx checked the index against alleleCount only. A record can hold up to VCF_MAX_INFO alleles, so an index of 128 or more could pass that check and then narrow on the way into the signed char field. The narrowed value was sometimes another real allele of the record: with 260 ALT alleles, index 260 came out as 4. The parser then reported a genotype the VCF never named. The check now also rejects an index above SCHAR_MAX, so an index too large for the field reads as missing data. SCHAR_MAX and not CHAR_MAX, because CHAR_MAX is 255 on the unsigned char platforms that the field is declared signed for. Every other assignment to hapIxA and hapIxB in this file is a literal in the range -1 to 2, so parseAlleleIx was the only path that could carry an out-of-range value. New test vcfParseManyAlleles, with a record of 260 ALT alleles. Without the fix, GT 128/1 reads as -128/1, 130/130 as -126/-126, and 260/260 as 4/4.
• src/makefile
  • lines changed 9, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• src/product/ex.hg.conf
  • lines changed 30, context: html, text, full: html, text
    a08ccd7dd4930bff5bcf0a32bd35ec22db71215f Sat Aug 22 06:14:41 2026 -0700
    Fix the browser.theme drop down, which has never applied a theme, and retire browser.background and browser.bgcolor from the example configs. refs #38158 themeDropDown built the menu label from the hg.conf key and posted that label back, while setThemeFromCart looks a theme up by key, so no entry carrying a sort prefix or an underscore could ever resolve. Broken since af6898753ba (2023) introduced that key format and changed the menu side without the lookup side. themeDropDown now passes the key suffix as the option value and the prettified label as the display text, using cgiMakeDropListWithVals. setThemeFromCart compared the generated link against "<>" instead of the config value, so the "no theme file" marker never fired. It also let an empty link from a missing CSS file overwrite browser.style with nothing. Both now test the right string and leave browser.style alone when there is no theme to apply. browser.background has not been read by any CGI since hBackgroundImage() and its callers were removed in 2012 (8e6fcda9f58), and browser.bgcolor has never been read at all, yet ex.hg.conf presented browser.background as a working setting. Commented both out with a note, in ex.hg.conf and the three browserbox configs. ex.hg.conf also documented two conflicting browser.theme formats in two places. The comma form stopped working in 2023. Consolidated to a single block that describes what the code actually does.
• src/submodules/README.md
  • lines changed 47, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• src/submodules/submoduleSetup
  • lines changed 29, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• src/submodules/zlib-ng
  • lines changed 1, context: html, text, full: html, text
    af126b8f0cf9ddc553a78869a3c820a4bd4fdc59 Mon Aug 17 13:36:13 2026 -0700
    build: link the browser against zlib-ng instead of the system zlib, refs #38125 Adds zlib-ng as a second git submodule, alongside htslib, and points ZLIB at it. It is built with --zlib-compat, so the header and the symbol names are the ordinary zlib ones and no calling code has to change. Measured over the eight Recommended Track Set pages, hgTracks uses 29 percent less processor time and 26 percent less wall clock, and the image it produces is pixel identical. Writing the PNG is about three times faster and reading a bigBed data block about twice as fast, which is why the gain is larger than the image work alone would give. This also makes the platforms agree. x86_64 was linking a static /lib64/libz.a only because that file happened to be present, the arm64 Docker build fell through to a shared -lz, and Darwin was taking MacPorts zlib. All three now use the submodule. Verified on x86_64 Linux, aarch64 Linux and Apple silicon: zlib-ng builds, its own test suite passes, the makefiles pick it up, and bigBedToBed output is byte identical to before the change.
• src/utils/makefile
  • lines changed 1, context: html, text, full: html, text
    4ae50fa5255be82566187f8cdbf5591152d3cf34 Sat Aug 22 14:49:40 2026 -0700
    ts: add the ticket-sandbox scripts, refs #37867 ts parks a Redmine ticket as its own frozen browser instance on hgwdev: a full copy of cgi-bin-$USER and htdocs-$USER served by a private loopback httpd, with the databases, /gbdb, and trash left shared. Generalized from the personal version: per-user sandbox paths, TS_ROOT for the instance directory, and existence checks in create.
• src/utils/qa/qaTestScript.py
  • lines changed 6, context: html, text, full: html, text
    78b8456edf41f793b4376cae60861035df2cd106 Fri Aug 21 11:24:17 2026 -0700
    Commenting out the hgBlat browser link click-through steps due to the new hgBlat results page still in testing, which removed the "browser" link and the ct_blatYourSeq custom track, No RM
  • lines changed 11, context: html, text, full: html, text
    72ca2b02e36e794d3ceadac2133af10588a35d49 Fri Aug 21 11:46:00 2026 -0700
    Commenting out the alt and fix patch sequence hgBlat browser link click-through steps due to hgBlat's new results page no longer having a "browser" link, and updating the allGenomes checkbox id to blat_allGenomes after it changed, No RM
• src/utils/redmineCli
  • lines changed 1, context: html, text, full: html, text
    65c950cd922b626ce3bce7de25f70e8d38237e5d Sat Aug 22 06:44:10 2026 -0700
    fixed redmine user name for markd
  • lines changed 110, context: html, text, full: html, text
    7cb2c8998e6c5bae70d4caac61d8fd6ffa1e064d Mon Aug 24 02:19:00 2026 -0700
    redmineCli: show related tickets by default; add "related" subcommand to list/add relations. No RM.
• src/utils/ts/README
  • lines changed 66, context: html, text, full: html, text
    4ae50fa5255be82566187f8cdbf5591152d3cf34 Sat Aug 22 14:49:40 2026 -0700
    ts: add the ticket-sandbox scripts, refs #37867 ts parks a Redmine ticket as its own frozen browser instance on hgwdev: a full copy of cgi-bin-$USER and htdocs-$USER served by a private loopback httpd, with the databases, /gbdb, and trash left shared. Generalized from the personal version: per-user sandbox paths, TS_ROOT for the instance directory, and existence checks in create.
  • lines changed 1, context: html, text, full: html, text
    798c382a4e6e6f2e9ecaf6c47300f8cc2a6e0074 Mon Aug 24 08:54:58 2026 -0700
    ts: add a conf subcommand to rewrite httpd.conf without re-freezing, refs #37867 The CORS scoping fix in 4d9755a1 changed the httpd.conf template, but a parked instance keeps the conf it was created with. All three parked instances therefore still set Access-Control-Allow-Origin at server scope, including on cgi-bin. That is the hole 4d9755a1 closed in the template only. The one way to pick up a template change was "ts sync", and cmd_sync calls freeze before writeConf. For a park whose whole point is the frozen code, re-freezing to the current live sandbox throws away the thing being kept. There was no way to update only the config. "ts conf NNNNN" rewrites httpd.conf from the current template, leaves the frozen cgi-bin and htdocs alone, and restarts the httpd if it was running. Ran it on all three parked instances: cgi-bin now sends no Access-Control header, htdocs and trash send both.
• src/utils/ts/ts
  • lines changed 328, context: html, text, full: html, text
    4ae50fa5255be82566187f8cdbf5591152d3cf34 Sat Aug 22 14:49:40 2026 -0700
    ts: add the ticket-sandbox scripts, refs #37867 ts parks a Redmine ticket as its own frozen browser instance on hgwdev: a full copy of cgi-bin-$USER and htdocs-$USER served by a private loopback httpd, with the databases, /gbdb, and trash left shared. Generalized from the personal version: per-user sandbox paths, TS_ROOT for the instance directory, and existence checks in create.
  • lines changed 11, context: html, text, full: html, text
    4d9755a177d6b6660e589ec9f322e3b932fdb391 Sun Aug 23 15:13:54 2026 -0700
    ts: scope the CORS header to the data directories, refs #37867 The per-ticket httpd.conf set Access-Control-Allow-Origin to * at server scope, which covered CGI responses too. The live /usr/local/apache/conf/httpd.conf sets that header on htdocs and on the trash directories only, never server-wide and never on cgi-bin. A parked instance has no password, so a wildcard on the CGI output let any page in the developer's browser read it through the open ssh tunnel. The header now sits in the htdocs and trash Directory blocks, with the Access-Control-Allow-Headers: Range line that accompanies it in the live config, so range requests on trash files behave the same as in production. Also replace a tab or newline in the free-text note with a space before it is written to ports.tsv. The registry is one tab-separated line per ticket, so those characters appended a malformed row instead of reading back as the note. Instances parked before this change need ts sync to pick up the new config.
  • lines changed 22, context: html, text, full: html, text
    798c382a4e6e6f2e9ecaf6c47300f8cc2a6e0074 Mon Aug 24 08:54:58 2026 -0700
    ts: add a conf subcommand to rewrite httpd.conf without re-freezing, refs #37867 The CORS scoping fix in 4d9755a1 changed the httpd.conf template, but a parked instance keeps the conf it was created with. All three parked instances therefore still set Access-Control-Allow-Origin at server scope, including on cgi-bin. That is the hole 4d9755a1 closed in the template only. The one way to pick up a template change was "ts sync", and cmd_sync calls freeze before writeConf. For a park whose whole point is the frozen code, re-freezing to the current live sandbox throws away the thing being kept. There was no way to update only the config. "ts conf NNNNN" rewrites httpd.conf from the current template, leaves the frozen cgi-bin and htdocs alone, and restarts the httpd if it was running. Ran it on all three parked instances: cgi-bin now sends no Access-Control header, htdocs and trash send both.
• src/utils/ts/ts.mac
  • lines changed 68, context: html, text, full: html, text
    4ae50fa5255be82566187f8cdbf5591152d3cf34 Sat Aug 22 14:49:40 2026 -0700
    ts: add the ticket-sandbox scripts, refs #37867 ts parks a Redmine ticket as its own frozen browser instance on hgwdev: a full copy of cgi-bin-$USER and htdocs-$USER served by a private loopback httpd, with the databases, /gbdb, and trash left shared. Generalized from the personal version: per-user sandbox paths, TS_ROOT for the instance directory, and existence checks in create.
  • lines changed 2, context: html, text, full: html, text
    798c382a4e6e6f2e9ecaf6c47300f8cc2a6e0074 Mon Aug 24 08:54:58 2026 -0700
    ts: add a conf subcommand to rewrite httpd.conf without re-freezing, refs #37867 The CORS scoping fix in 4d9755a1 changed the httpd.conf template, but a parked instance keeps the conf it was created with. All three parked instances therefore still set Access-Control-Allow-Origin at server scope, including on cgi-bin. That is the hole 4d9755a1 closed in the template only. The one way to pick up a template change was "ts sync", and cmd_sync calls freeze before writeConf. For a park whose whole point is the frozen code, re-freezing to the current live sandbox throws away the thing being kept. There was no way to update only the config. "ts conf NNNNN" rewrites httpd.conf from the current template, leaves the frozen cgi-bin and htdocs alone, and restarts the httpd if it was running. Ran it on all three parked instances: cgi-bin now sends no Access-Control header, htdocs and trash send both.

• lines changed: 8605
• files changed: 261