OAUTH2_PROVIDER.Cache-Control: immutable for static resources.framatube.org.SKIP LOCKED in archive operations.ar_SA).--info and --version.Content-Type.gorilla/mux across the codebase.Update multiple dependencies, including:
github.com/lib/pqgithub.com/go-jose/go-jose/v4github.com/go-webauthn/webauthngithub.com/andybalholm/brotligithub.com/tdewolff/minify/v2golang.org/x/imagegithub.com/PuerkitoBio/goqueryAs always, thank you to all contributors who helped improve Miniflux in this release.
]]>100.64.0.0/10) as non-public.To prevent potential SSRF, Miniflux now blocks access to services hosted on private networks by default.
FETCHER_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access feeds hosted on a local network.INTEGRATION_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access third-party integration services hosted on a local network.ignore_entry_updates feed option to skip updating existing entries during scheduled polling.ar_SA) translation.gl_ES) translation.golang.org/x/net to 0.52.0.golang.org/x/crypto to 0.49.0.golang.org/x/image to 0.37.0.golang.org/x/oauth2 to 0.36.0.github.com/go-webauthn/webauthn to 0.16.1.github.com/tdewolff/minify/v2 to 2.24.10.go:fix directive for deprecated client.New() to ease migration to NewClient().CharsetReader.As always, thank you to all contributors who helped improve Miniflux in this release.
]]>golang.org/x/net/html parser to better match browser behavior and reduce the risk of injection issues.srcset URLs.TRUSTED_REVERSE_PROXY_NETWORKS configuration to prevent silent misconfiguration.Rewrite srcset parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly.
Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling).
Handle deeply nested HTML more robustly in the sanitizer.
Add scraper and rewrite rules for:
bleepingcomputer.comvnexpress.netImprove JSON Feed support:
author objects in the authors array.null feeds.external_url in JSON entry hash fallback.Ignore WordPress wp-json API endpoint during JSON feed discovery.
Add unread status filter to search results.
Improve timezone handling internals and performance.
Improve API payload structures and Godoc comments.
Improve JavaScript code readability and keyboard shortcut handling.
Restore cmd/ctrl/shift-click behavior on main navigation.
Fix Safari PWA behavior for the v shortcut to open links in the main browser.
sql.ErrNoRows properly in IconByFeedID.FindRemoteIP to fall back to 127.0.0.1.FILTER_ENTRY_MAX_AGE_DAYS.
This option can be replaced with a filter rule such as max-age:<duration>.
Global environment variables should be reserved for process-level configuration.Update github.com/lib/pq to 1.11.2.
Update:
golang.org/x/net to 0.50.0golang.org/x/crypto to 0.48.0golang.org/x/image to 0.36.0golang.org/x/oauth2 to 0.35.0golang.org/x/term to 0.40.0Update Debian packager Docker image to Trixie.
As always, thank you to all contributors who helped improve Miniflux in this release.
]]>TRUSTED_REVERSE_PROXY_NETWORKS configuration option to prevent spoofing of HTTP headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip. This option must be configured when AUTH_PROXY_HEADER is enabled.miniflux(1) manual page.version key from Docker Compose examples.go:1-trixie.As always, thank you to all contributors who helped improve Miniflux in this release.
]]><i> and <small> tagsvideo player configuration error) in various scenariosfetchContent endpoint now properly rewrites media URLs when using the media proxyredirectURL parameterreplace instead of remove/add, minor regex cleanupThis release includes updates to several dependencies:
golang.org/x/* modules (net, oauth2, image, crypto)github.com/tdewolff/minify/v2github.com/coreos/go-oidc/v3github.com/go-webauthn/webauthngithub.com/PuerkitoBio/goqueryactions/checkout v6actions/upload-artifact v5golangci/golangci-lint-action v9For more details, look at the Git commit history.
]]>http.Client and add context support to API methods.default-src to 'none' for stronger security.remove_img_blur_params rule.add_image_title rule for explainxkcd.com.<dialog> element for simpler, more accessible UI.hasRequiredAttributes, hasValidURIScheme, isBlockedResource).fmt.Errorf with errors.New where applicable.hstore in the database layer and relaxed implicit NOT NULL for serial types.external_url when url is missing.POLLING_FREQUENCY environment variable in the documentation.Updated dependencies:
github.com/tdewolff/minify/v2 → 2.24.4golang.org/x/net → 0.46.0golang.org/x/image → 0.32.0golang.org/x/oauth2 → 0.32.0github.com/coreos/go-oidc/v3 → 3.16.0github/codeql-action → 4Updated make lint and enabled additional Go linters (perfsprint, goheader).
If you are seeing this Postgres error: Error: pq: must be owner of extension hstore, you can fix it by running the following SQL command as a superuser for the Miniflux database:
DROP EXTENSION hstore;
This error means you initially created the hstore extension as a different database user than the one you are currently using for Miniflux.
For more details, look at the Git commit history.
]]>removed entries could still be returned. It was generating an error when fetching entries.modal_handler.js, removed isTouchSupported()).time.Duration for time values across CLI, server, fetcher, metrics, and HTTP components.sprite.svg, improved layout.html consistency.filterValidXMLChars (~4% faster).slices.Contains.setup-go and setup-python bumped from v5 → v6For more details, look at the commit history.
]]>unread or read status.POLLING_LIMIT_PER_HOST to limit concurrent requests per host.
Limits the number of concurrent requests to the same hostname when polling feeds.
This helps prevent overwhelming a single server during batch processing by the worker pool.LDFLAGS.tsvector indexing to the first 500K characters to avoid PostgreSQL limits.rel=apple-touch-icon instead of rel=apple-touch-icon-precomposed.png.SameSiteStrict cookie mode because it forces people to authenticate each time when using the PWA on Android.FetchJobs, markFeedAsRead) by removing unnecessary joins and heavy-weight operations.webauthn.js) is no longer loaded when the feature is disabled.interface{} with any (Go 1.18+ idiomatic usage).app.js bundle and service worker files are now loaded as a JavaScript module.ChangeLog file (release notes are visible on GitHub and the official website - use the commit history for more details).Updated GitHub Actions workflows to use Go version 1.25.
Updated dependencies:
golang.org/x/net → 0.43.0golang.org/x/image → 0.30.0golang.org/x/term → 0.34.0github.com/tdewolff/minify/v2 → 2.23.11github.com/coreos/go-oidc/v3 → 3.15.0github.com/prometheus/client_golang → 1.23.0actions/checkout bumped to v5RequestBuilder.For more details, look at the commit history.
]]>CERT_FILE and KEY_FILE (#fcf86e3).SameSiteStrictMode is enforced for cookies when OAuth2/OIDC is not used (#135ce1d).content class during readability parsing (#66b269e).Massive readability engine refactoring and performance optimizations:
getClassWeight, getLinkDensity, and transformMisusedDivsIntoParagraphs.removeUnlikelyCandidates, getSelectionLength, and getArticle.Storage optimization: Strings are now truncated on the Go side to respect tsvector limits, reducing DB load and ensuring valid UTF-8 (#703f113).
Simplified and clarified internal code structure:
Feed, FeedCreationRequest, etc.).config, template, locale, subscription, and fetcher modules.startAutoCertTLSServer function when using Let’s Encrypt automatic certificates (#f7a6b02)readability, sanitizer, processor, locale, and storage.github.com/go-webauthn/webauthn to 0.13.4github.com/tdewolff/minify/v2 to 2.23.10golang.org/x/* modules: image, net, term, cryptogithub.com/andybalholm/brotli to 1.2.0fetchWatchTimeb.Loop() instead of for range b.NSprintfwww. prefixesisValidAttribute() check O(1)Rewriter function to ApplyContentRewriteRulesfetchWatchTime functionfilter packageFilterEntryMaxAgeDays filter to filter packageRewriteEntryURL function to rewrite packageurllib.DomainWithoutWWW functionhttpd to server for consistencyIsBlockedEntry and IsAllowedEntry functionsrand.Text() instead of a custom implementationNewXMLDecodergetLocation’s resultsRefreshFeedEntriesSprintf callsurl.Parse and make intensive use of itBuildFeedgetPredefinedRewriteRules O(1)RemoveTrackingParameterscipherSuitesTRUNCATE instead of DELETE FROM in migrationsmath/rand/v2 instead of math/rand for better performanceSaveURLtarget="_blank" on linkswidth and height attributes in img tagsfetchpriority and decoding attributes in img tagsparkablogs.com to the referer override listpreferred_username first instead of email claimEntryDate=max-age:duration filterSERVER_TIMING_HEADER config optionCONTRIBUTING.md fileX-UA-Compatible meta tag specific to Internet Explorerlibrary/alpine in /packaging/docker/alpinegolang.org/x/net from 0.40.0 to 0.41.0golang.org/x/image from 0.27.0 to 0.28.0golang.org/x/crypto from 0.38.0 to 0.39.0golang.org/x/net/html/items/contents should accept short form item IDsref parameter from urldiv.panel with paragraph tags for OAuth2 linksmark-all-as-read endpointreviewers field from dependantbot.ymlgolangci/golangci-lint-action from 7 to 8golang.org/x/oauth2 from 0.29.0 to 0.30.0golang.org/x/net from 0.39.0 to 0.40.0golang.org/x/image from 0.26.0 to 0.27.0golang.org/x/crypto from 0.37.0 to 0.38.0github.com/tdewolff/minify/v2 from 2.23.3 to 2.23.8github.com/tdewolff/minify/v2 from 2.23.1 to 2.23.3github.com/go-webauthn/webauthn from 0.12.3 to 0.13.0DomHelper methods with standalone functionshide_globally categories field should be a booleanawait when calling navigator.share() methodSCHEDULER_ROUND_ROBIN_MAX_INTERVAL option-reset-feed-next-check-at argumentupdate_content query parameter to /entries/{entryID}/fetch-content endpointCache-Control max-age and Expires headers to calculate next checkgolang.org/x/oauth2 from 0.28.0 to 0.29.0golang.org/x/net from 0.38.0 to 0.39.0golang.org/x/image from 0.25.0 to 0.26.0github.com/tdewolff/minify/v2 from 2.22.4 to 2.23.1github.com/PuerkitoBio/goquery from 1.10.2 to 1.10.3github.com/prometheus/client_golanggithub.com/mattn/go-sqlite3 from 1.14.24 to 1.14.28github.com/go-webauthn/webauthn from 0.12.2 to 0.12.3github.com/coreos/go-oidc/v3 from 3.13.0 to 3.14.1externalIconID/rss/feed.xml to the list of known feed URLswebtoons.comstreamItemContentsHandler response<u> tag in feeds<b> tagmake add string command to add new localized stringsgolangci/golangci-lint-action from 6 to 7golang.org/x/term from 0.29.0 to 0.30.0golang.org/x/oauth2 from 0.26.0 to 0.28.0golang.org/x/net from 0.35.0 to 0.38.0golang.org/x/image from 0.24.0 to 0.25.0golang.org/x/crypto from 0.33.0 to 0.36.0github.com/tdewolff/minify/v2 from 2.21.3 to 2.22.4github.com/prometheus/client_golanggithub.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2github.com/go-webauthn/webauthn from 0.11.2 to 0.12.2github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5github.com/coreos/go-oidc/v3 from 3.12.0 to 3.13.0CharsetReader functionNewXMLDecoderapp.jswindow.pageYOffset with window.scollYreturn= removal in webauthn_handler.js regexfallbackSelf in goToPage functiondefer in a loopnull dereferencestrings.ReplaceAlltfooter to tfootCDATA content correctlyde_DE.json--entry-content-aside-border-color is missing from system.css<details> tag in edit feed page when the feature is enabledimg tags with only a srcset and no src attributecommitlint to validate PR commit messagesgolang in /packaging/debiangolang.org/x/term from 0.28.0 to 0.29.0golang.org/x/oauth2 from 0.25.0 to 0.26.0golang.org/x/net from 0.34.0 to 0.35.0golang.org/x/image from 0.23.0 to 0.24.0golang.org/x/crypto from 0.32.0 to 0.33.0github.com/PuerkitoBio/goquery from 1.10.1 to 1.10.2.jshintrc (strict comparison, etc…)golang.org/x/text/cases.Title()whatlanggo package with an ad-hoc implementationio.WriteString when sha256 provides a way to obtain a sum in a single callkeyboard_handler.js{passive: true}touch_handler.jsapp.js<hr> tags%{?systemd_requires} with %{?systemd_ordering}fix_ghost_cards rewrite rule-race -cover only on Ubuntu jobsgo vet ./... as it’s run as part of golangci-lintgolang.org/x/oauth2 from 0.24.0 to 0.25.0golang.org/x/net from 0.33.0 to 0.34.0golang.org/x/crypto from 0.31.0 to 0.32.0github.com/tdewolff/minify/v2 from 2.21.2 to 2.21.3github.com/PuerkitoBio/goquery from 1.10.0 to 1.10.1github.com/coreos/go-oidc/v3 from 3.11.0 to 3.12.0strings.HasSuffix instead of a regex in FindSubscriptionsFromYouTubePlaylistPagetoken.String() instead of html.EscapeString(token.Data)isValidTaghasRequiredAttributesconfig.Opts is guaranteed to never be nilstrip_tags.gosrcset.gosanitizeAttributes and fix a bug in itsanitizeSrcsetAttrrewriteIframeURL()addDynamicImagereadability.gorewrite URL rule regexapp.jsstore.UserByID() as much as possible-ms-text-size-adjust with text-size-adjust-webkit-clip-path.pagination-next and .pagination-last togetherdoc.Find(…).First()min/max instead of math.Min/math.Maxinternal/reader/readability/testdatasanitizeAttributesnumberOfPluralFormsPerLanguage test-only variableparse_markdown rewrite ruleSendNotification to handle multiple entries and add logging/aboutarstechnica.comblog.laravel.com rewrite rulelibrary/alpine in /packaging/docker/alpine to 3.21golang.org/x/term from 0.26.0 to 0.27.0golang.org/x/net from 0.31.0 to 0.33.0golang.org/x/crypto from 0.30.0 to 0.31.0github.com/tdewolff/minify/v2 from 2.21.1 to 2.21.2Content-Disposition headergolang.org/x/text from 0.19.0 to 0.20.0golang.org/x/term from 0.25.0 to 0.26.0golang.org/x/oauth2 from 0.23.0 to 0.24.0golang.org/x/net from 0.30.0 to 0.31.0golang.org/x/crypto from 0.28.0 to 0.29.0Last-Modified if it changes in a 304 responsecustom_js field to Go API clientRetry-After header into consideration for rate limited feedsxurls third-party module with an ad-hoc regexpgolang.org/x/net from 0.29.0 to 0.30.0github.com/yuin/goldmark from 1.7.4 to 1.7.8github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1github.com/prometheus/client_golanggithub.com/andybalholm/brotli from 1.1.0 to 1.1.1golang.org/x/term from 0.23.0 to 0.24.0golang.org/x/oauth2 from 0.22.0 to 0.23.0golang.org/x/net from 0.28.0 to 0.29.0github.com/PuerkitoBio/goquery from 1.9.2 to 1.10.0github.com/prometheus/client_golang from 1.20.3 to 1.20.4github.com/go-webauthn/webauthn from 0.10.2 to 0.11.2max_id argumentnil and error if endpoint is an empty stringMEDIA_PROXY_MODE=allBASE_URL instead of r.Host to generate absolute media proxy URLhide_globally when creating a new feed through the apistore.GetEnclosure() should return nil if no rows are returned/v1/enclosures/{enclosureID}OAUTH2_PROVIDER config option valuemeta[itemprop="channelId"] no longer existsbase HTML element when discovering feedsaside HTML element in entry contentFETCH_BILIBILI_WATCH_TIME config optiongolang.org/x/oauth2 from 0.21.0 to 0.22.0golang.org/x/net from 0.27.0 to 0.28.0golang.org/x/crypto from 0.25.0 to 0.26.0github.com/tdewolff/minify/v2 from 2.20.36 to 2.20.37github.com/prometheus/client_golangPUBLISH_DOCKER_IMAGES=trueIsModified() behaviourCrawlTimeMsec to the correct precisionarm64v8/golang:1.22-bookwormdistroless suffix on latest tag in GitHub workflowETag as a stronger validator than Last-Modifiedtheverge.com rewrite rule to avoid duplicate imagereader/readingtimeCLEANUP_REMOVE_SESSIONS_DAYS<img> aspect ratio with height: autoviewport-fit=coverpitchfork.com scraping ruleFETCH_NEBULA_WATCH_TIME config optiongithub.com/PuerkitoBio/goquery from 1.9.1 to 1.9.2github.com/prometheus/client_golang from 1.19.0 to 1.19.1library/alpine in /packaging/docker/alpinegolangci/golangci-lint-action from 4 to 6golang.org/x/term from 0.19.0 to 0.22.0golang.org/x/oauth2 from 0.19.0 to 0.21.0golang.org/x/net from 0.22.0 to 0.27.0golang.org/x/crypto from 0.24.0 to 0.25.0github.com/yuin/goldmark from 1.7.1 to 1.7.4github.com/tdewolff/minify/v2 from 2.20.20 to 2.20.36github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0docker/build-push-action from 5 to 6api: rand.Intn(math.MaxInt64) causes tests to fail on 32-bit architectures (use rand.Int() instead)ci: use docker/metadata-action instead of deprecated shell-scriptsdatabase: remove entries_feed_url_idx index because entry URLs can exceeds btree index size limitfinder: find feeds from YouTube playlisthttp/response: add brotli compression supportintegration/matrix: fix function name in commentpackaging: specify container registry explicitly (e.g., Podman does not use docker.io by default)packaging: use make miniflux instead of duplicating go build arguments (this leverages Go’s PIE build mode)reader/fetcher: add brotli content encoding supportreader/processor: minimize feed entries HTML contentreader/rewrite: add a rule for oglaf.comstorage: change GetReadTime() function to use entries_feed_id_hash_key indexui: add seek and speed controls to media playerui: add tag entries pageui: fix JavaScript error when clicking on unread counterui: use FORCE_REFRESH_INTERVAL config for category refreshgithub.com/tdewolff/minify/v2 from 2.20.19 to 2.20.20golang.org/x/net from 0.22.0 to 0.24.0golang.org/x/term from 0.18.0 to 0.19.0golang.org/x/oauth2 from 0.18.0 to 0.19.0github.com/yuin/goldmark from 1.7.0 to 1.7.1api: rewrite API integration tests without build tagsci: add basic ESLinter checksci: enable go-critic linter and fix various issues detectedci: fix JavaScript linter path in GitHub Actionscli: avoid misleading error message when creating an admin user automaticallyconfig: add FILTER_ENTRY_MAX_AGE_DAYS optionconfig: bump the number of simultaneous workersconfig: rename PROXY_* options to MEDIA_PROXY_*config: use crypto.GenerateRandomBytes instead of doing it by handhttp/request: refactor conditions to be more idiomatichttp/response: remove legacy X-XSS-Protection headerintegration/rssbrige: fix rssbrige importintegration/shaarli: factorize the header+payload concatenation as dataintegration/shaarli: no need to base64-encode then remove the padding when we can simply encode without paddingintegration/shaarli: the JWT token was declared as using HS256 as algorithm, but was using HS512integration/webhook: add category title to request bodylocale: update Turkish translationsman page: sort config options in alphabetical ordermediaproxy: reduce the internal indentation of ProxifiedUrl by inverting some conditionsmediaproxy: simplify and refactor the packagemodel: replace Optional{Int,Int64,Float64} with a generic function OptionalNumber()model: use struct embedding for FeedCreationRequestFromSubscriptionDiscovery to reduce code duplicationreader/atom: avoid debug message when the date is emptyreader/atom: change if !a { a = } if !a {a = } constructs into if !a { a = ; if !a {a = }} to reduce the number of comparisons and improve readabilityreader/atom: Move the population of the feed’s entries into a new function, to make BuildFeed easier to understand/separate concerns/implementation detailsreader/atom: refactor Atom parser to use an adapterreader/atom: use sort+compact instead of compact+sort to remove duplicatesreader/atom: when detecting the format, detect its version as wellreader/encoding: inline a one-liner functionreader/handler: fix force refresh featurereader/json: refactor JSON Feed parser to use an adapterreader/media: remove a superfluous error-check: strconv.ParseInt returns 0 when passed an empty stringreader/media: simplify switch-case by moving a common condition above itreader/processor: compile block/keep regex only once per feedreader/rdf: refactor RDF parser to use an adapterreader/rewrite: inline some one-line functionsreader/rewrite: simplify removeClickbaitreader/rewrite: transform a free-standing function into a methodreader/rewrite: use a proper constant instead of a magic number in applyFuncOnTextContentreader/rss: add support for <media:category> elementreader/rss: don’t add empty tags to RSS itemsreader/rss: refactor RSS parser to use a default namespace to avoid some limitations of the Go XML parserreader/rss: refactor RSS Parser to use an adapterreader/rss: remove some duplicated code in RSS parserreader: ensure that enclosure URLs are always absolutereader: move iTunes and GooglePlay XML definitions to their own packagesreader: parse podcast categoriesreader: remove trailing space in SiteURL and FeedURLstorage: do not store empty tagsstorage: simplify removeDuplicates() to use a sort+compact construct instead of doing it by hand with a hashmapstorage: Use plain strings concatenation instead of building an array and then joining ittimezone: make sure the tests pass when the timezone database is not installed on the hostui/css: align min-width with the other min-width valuesui/css: fix regression: “Add to Home Screen” button is unreadableui/js: don’t use lambdas to return a function, use directly the function insteadui/js: enable trusted-typesui/js: fix download button loading labelui/js: fix JavaScript error on the login page when the user not authenticatedui/js: inline one-line functionsui/js: inline some querySelectorAll callsui/js: reduce the scope of some variablesui/js: remove a hack for “Chrome 67 and earlier” since it was released in 2018ui/js: replace DomHelper.findParent with .closestui/js: replace let with constui/js: simplify DomHelper.getVisibleElements by using a filter instead of a loop with an indexui/js: use a Set instead of an array in a KeyboardHandler’s memberui/js: use some ternaries where it makes senseui/static: make use of HashFromBytes everywhereui/static: set minifier ECMAScript versionui: add keyboard shortcuts for scrolling to top/bottom of the item listui: add media player control playback speedui: remove unused variables and improve JSON decoding in saveEnclosureProgression()validator: display an error message on edit feed page when the feed URL is not uniquegithub.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0github.com/go-webauthn/webauthn from 0.10.1 to 0.10.2github.com/tdewolff/minify/v2 from 2.20.18 to 2.20.19google.golang.org/protobuf from 1.32.0 to 1.33.0Enter key as a hotkey to open selected itemvideo element poster attributeindex.xmlfeed.atom and feed.rss are used by enterprise-scale/old-school gigantic CMS<title> elementsgit describe and rev-parse stderr: When building from a tarball instead of a cloned git repo, there would be two fatal: not a git repository errors emitted even though the build succeeds. This is because of how VERSION and COMMIT are set in the Makefile. This PR suppresses the stderr for these variable assignments.CGO_ENABLED=0 for miniflux targetstaticcheck and golangci-lint insteadgo.mod and add .exe suffix to Windows binaryio.ReadSeeker instead of an io.Reader to parse feedswwwstrings.Builder instead of a bytes.Bufferstrings.NewReader instead of a bytes.NewBufferStringcontinue to make the code-flow more obviousinList, and put their parameters in the right orderisPixelTrackerisValidIframeSource, by extracting the hostname and comparing it directly, instead of using the full url and checking if it starts with multiple variations of the same one (//, http:, https:// multiplied by /www.)slices instead of hand-rolled loops
collector/allocator involvements.Reader instead of copying to a buffer when parsing an Atom feedview.New after logging the user in: There is no need to do extra work like creating a session and its associated view until the user has been properly identified and as many possibly-failing sql request have been successfully rungenericProxyRewriter
shouldProxy function to reduce the copy-pasta.removeUnlikelyCandidates: .Not returns a brand new Selection, copied element by elementEstimateReadingTime’s speed by a factor 7
whatlanggo.Detect is abysmally slow.username generation for the integration tests: No need to generate random numbers 10 times, generate a single big-enough one. A single int64 should be more than enoughArchiveEntries and updateEnclosuresline is positive since we’re checking afterwards that it contains the = signdefer() in a loopstrings.ReplaceAll instead of strings.Replace(…, -1)strings.EqualFold instead of strings.ToLower(…) ==.WriteString( instead of .Write([]byte(…%q instead of "%s"internal/worker/worker.go read-onlyinternal/locale/plural.go instead of an avalanche of ifformatFileSize and duration implementationprinter.Print when possibleprinter.Print to internal/locale/printer.go: No need to use variadic functions with string format interpolation to generate static stringsinternal/ui/view/view.go: No need to create the map item by item when we can create it in one goCountAllFeeds(): No need to build an empty map to then add more fields in it one by oneinternal/reader/subscription/finder.go:
localizedError in FindSubscriptionsFromWellKnownURLs via slogsubscriptions slice when using an RSS-bridge,MarkCategoryAsRead instead of a subqueryCleanOldUserSessions’ query: No need for a subquery, filtering on created_at directly is enoughcleanupEntries’ query
NOT (hash=ANY(%4)) can be expressed as hash NOT IN $4ArchiveEntries’s query for consistency’s sake and replace the =ANY with an INGetEntryIDs and GetReadTime’s query for consistency’s sakeWeeklyFeedEntryCount: No need for a BETWEEN: we want to filter on entries published in the last week, no need to express is as “entries published between now and last week”, “entries published after last week” is enoughadd_image_titlegithub.com/google/uuid dependencies: Replace it with a hand-rolled implementation. Heck, an UUID isn’t even a requirement according to Omnivore API docsinternal/reader/icon/finder.go:
apple-touch-icon-precomposed.png as a fallback faviconicon first, since it seems to be the most popular one. It used to be last, meaning that pages had to be parsed completely 4 times, instead of one now.findIconURLsFromHTMLDocumentinternal/reader/date/parser.go:
Entry struct to save some memorygolang.org/x/oauth2 from 0.17.0 to 0.18.0github.com/prometheus/client_golang from 1.18.0 to 1.19.0github.com/tdewolff/minify/v2 from 2.20.16 to 2.20.18github.com/PuerkitoBio/goquery from 1.8.1 to 1.9.1golang.org/x/crypto from 0.19.0 to 0.20.0github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3FORCE_REFRESH_INTERVAL config optionitem-meta-info-reading-time CSS classadd_dynamic_iframe rewrite functiondata-original-mos to add_dynamic_image rewrite candidatesAccept header when fetching feedssecurityContext error in Kubernetes)type attribute in OPML export as per OPML 2.0 specserror.unable_to_parse_feedarmhf architecturefor attributedetails and summary when expandedalert role to alert message elementh2 heading to the article element so that the screen reader users can navigate the article through the heading levelaria-label attribute for the article element for screen readersalt attribute in feeds list to prevent screen reader to announce it before entry titlesr-only CSS class for screen reader users (provides more context)nav landmark to page header linksgolang.org/x/term from 0.16.0 to 0.17.0github.com/google/uuid from 1.5.0 to 1.6.0github.com/yuin/goldmark from 1.6.0 to 1.7.0golang.org/x/oauth2 from 0.15.0 to 0.17.0github.com/tdewolff/minify/v2 from 2.20.10 to 2.20.12golang.org/x/term from 0.15.0 to 0.16.0github.com/prometheus/client_golang from 1.17.0 to 1.18.0github.com/tdewolff/minify/v2 from 2.20.9 to 2.20.16golang.org/x/crypto from 0.16.0 to 0.19.0github.com/go-webauthn/webauthn from 0.9.4 to 0.10.1golang.org/x/net from 0.20.0 to 0.21.0iframe (avoid ERR_BLOCKED_BY_RESPONSE error)nb_jobs only when number of jobs is larger than 0 in background schedulerPOLLING_SCHEDULER=entry_frequency)SCHEDULER_ROUND_ROBIN_MIN_INTERVAL config optiongithub.com/google/uuid from 1.4.0 to 1.5.0github.com/coreos/go-oidc/v3 from 3.7.0 to 3.9.0github.com/tdewolff/minify/v2 from 2.20.6 to 2.20.9github.com/go-webauthn/webauthn from 0.8.6 to 0.9.4golang.org/x/oauth2 from 0.14.0 to 0.15.0BASE_URL config option and set WEBAUTHN=1)user/{userID}/state/com.google/read is missing in categories section for read entriesExcludeTargets into consideration in feed stream handlerhide_globally property defined for categories in /v1/entries API endpointLocalizedError packagesnext_check_at in the web ui and APIgithub-cli and docker-outside-of-docker features to devcontainergolang.org/x/* dependenciesgithub.com/gorilla/mux from 1.8.0 to 1.8.1github.com/tdewolff/minify/v2 from 2.19.9 to 2.20.6github.com/yuin/goldmark from 1.5.6 to 1.6.0github.com/coreos/go-oidc/v3 from 3.6.0 to 3.7.0log/slog package. New config options available:
LOG_FORMAT: json or textLOG_LEVEL: debug, info, warning, or errorLOG_FILE: sdterr, stdout, or a file pathDEBUG option is now deprecated in favor of LOG_LEVEL/v1/versionPUT /v1/entries to update entry title and content/v1/icons/{iconID}/v1/flush-history to flush historyGET /v1/entries endpointpublished_after, published_before, changed_after and changed_before options to /v1/entries endpointcontrib folder (Bruno is an open source alternative to Postman/Insomnia)add_hn_links_using_hack and add_hn_links_using_opener to open HN comments with iOS appsExpires response headerPreferServerCipherSuites TLS optiongithub.com/rylans/getlang with github.com/abadojack/whatlanggo because getlang doesn’t seems to be updated anymoregithub.com/mccutchen/go-httpbin/v2 from 2.11.0 to 2.11.1golang.org/x/* dependenciesgo-telegram-bot-api librarygomatrix libraryprofile scope to OIDC integration to support accounts without email addressfactor for entry_frequency scheduler:
entry_frequency
scheduler by a configurable factor in order to shorten the time between
updates.username and password form fieldsreturn statement in fetchContent UI handlerreplace_title rewrite rule to adjust entry titleshide_globally property to use it with third-party clients.webtoons.comurl package to urllib to avoid overlap with net/urlinternal folder
/entries/{entryID}/savegolang.org/x/* dependenciesgithub.com/yuin/goldmarkgithub.com/tdewolff/minify/v2github.com/mccutchen/go-httpbin/v2golang.org/x/* dependencies and go-oidc to v3.6.0go-httpbin to run tests locally and avoid remote calls to httpbin.orgtotal_unread and feed_countpq: time zone displacement out of range errorsenclosures_user_entry_url_idxchanged_at and published_atgithub.com/tdewolff/minify/v2, github.com/prometheus/client_golang, golang.org/x/* dependenciesilpost.ittheverge.comPROXY_IMAGES option is backward compatible with PROXY_OPTION and PROXY_MEDIA_TYPESword-wrap rule to break very long entry title into multiple linesnone, double-tap, and swipe.Quay.io (RedHat)golang.org/x/*, github.com/lib/pq, mvdan.cc/xurls/v2 and github.com/prometheus/client_golang dependenciesAvoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592)
Creating an RSS feed item with the inline description containing an <img> tag
with a srcset attribute pointing to an invalid URL like
http:a<script>alert(1)</script>, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.
This results in JavaScript execution on the Miniflux instance as soon as the user is convinced to open the broken image.
Use r.RemoteAddr to check /metrics endpoint network access (CVE-2023-27591)
HTTP headers like X-Forwarded-For or X-Real-Ip can be easily spoofed. As
such, it cannot be used to test if the client IP is allowed.
The recommendation is to use HTTP Basic authentication to protect the metrics endpoint, or run Miniflux behind a trusted reverse-proxy.
Add HTTP Basic authentication for /metrics endpoint
Add proxy support for several media types
Parse feed categories from RSS, Atom and JSON feeds
Ignore empty link when discovering feeds
Disable CGO explicitly to make sure the binary is statically linked
Add CSS classes to differentiate between category/feed/entry view and icons
Add rewrite and scraper rules for blog.cloudflare.com
Add color-scheme to themes
Add new keyboard shortcut to toggle open/close entry attachments section
Sanitizer: allow id attribute in <sup> element
Add Indonesian Language
Update translations
Update Docker Compose examples:
depends_onversion elementUpdate scraping rules for ilpost.it
Bump github.com/PuerkitoBio/goquery from 1.8.0 to 1.8.1
Bump github.com/tdewolff/minify/v2 from 2.12.4 to 2.12.5
Bump github.com/yuin/goldmark from 1.5.3 to 1.5.4
Bump golang.org/x/* dependencies
golang.org/x/* dependenciesilpost.itgolang.org/x/net/* dependenciesContent-Type and Accept headers in CORS policygithub.com/mitchellh/go-server-timingcontinuation parameter and result for Google Reader API ID callsrecalbox.com/v1/Basic authorization headermake run command to execute migrations automaticallytheverge.com, royalroad.com, swordscomic.com, and smbc-comics.comgolang.org/x/* dependenciesgithub.com/tdewolff/minify/v2 from 2.12.0 to 2.12.4github.com/yuin/goldmark from 1.4.13 to 1.5.2github.com/lib/pq from 1.10.6 to 1.10.7List of changes:
github.com/prometheus/client_golang from 1.12.2 to 1.13.0parse_markdown rewrite functionexplosm.net scraper rulegithub.com/tdewolff/minify/v2 from 2.11.7 to 2.12.0srcset attribute with commawidth and height attributes for img tags-config-dump command line argument shows sensitive infoRequestBuilder.getCsrfToken() methodgithub.com/tdewolff/minify/v2 from 2.10.0 to 2.11github.com/prometheus/client_golang from 1.12.1 to 1.12.2github.com/lib/pq from 1.10.4 to 1.10.6+ keyboard shortcut for new subscription page(+) action next to Feeds to quickly add new feedsundefined when clicking on read/unreadM to toggle read/unread, and go to previous itemonClick() function call/unread pagemvdan.cc/xurls/v2 from 2.3.0 to 2.4.0github.com/prometheus/client_golang from 1.11.0 to 1.12.1github.com/tdewolff/minify/v2 from 2.9.28 to 2.10.0read-all permission to GITHUB_TOKEN for GitHub Actionsjshint version in linter jobgithub.com/tdewolff/minify/v2 from 2.9.22 to 2.9.28touch-item if successfully swipedUser-Agent header in image proxy to avoid being blockedadd_youtube_video_from_id to add Youtube videos in Quanta articlesquantamagazine.orgContent-Security-Policy header to feed icon and image proxy endpoints
<img> tag and Javascript is not interpreted.ikiwiki.iki.fiSystemCallFilter from miniflux.service<head> tag to OPML exportminiflux.serviceRuntimeDirectory to Systemd servicegithub.com/lib/pq from 1.10.3 to 1.10.4github.com/PuerkitoBio/goquery from 1.7.1 to 1.8.0model/icon.godata-srcset support to add_dynamic_image rewrite rewrite rulerole="article" to <article> elements for better accessibility with screen readerssrcset images with no space after comma-config-dump command to use KEY=VALUE format<template> tag in old browsersgithub.com/tdewolff/minify/v2 from 2.9.21 to 2.9.22github.com/lib/pq from 1.10.2 to 1.10.3RequestURI() hackzh_CN translationscraper.Fetch()application/feed+json to discover JSON Feed v1.1theregister.comgithub.com/tdewolff/minify/v2 from 2.9.17 to 2.9.21mvdan.cc/xurls/v2 from 2.2.0 to 2.3.0github.com/PuerkitoBio/goquery from 1.6.1 to 1.7.1github.com/prometheus/client_golang from 1.10.0 to 1.11.0/rss/ to the list of well known URLs during feed discoveryauthors entry for JSON 1.1 feedsen_US tooltip.logged_userInternalServerError errors$MINIFLUX_IMAGE env var in docker-composecomments_url entry field in Golang API clientchanged_at time through the APICLEANUP_ARCHIVE_BATCH_SIZEDATABASE_CONNECTION_LIFETIMEzh_CNgithub.com/tdewolff/minify/v2 from 2.9.16 to 2.9.17github.com/lib/pq from 1.10.1 to 1.10.251fb949)github.com/lib/pq from 1.10.0 to 1.10.1github.com/tdewolff/minify/v2 from 2.9.15 to 2.9.16reader/json/doc.goSECURITY.mdgolangci-lint Github Actiongithub.com/prometheus/client_golang from 1.9.0 to 1.10.0github.com/tdewolff/minify/v2 from 2.9.13 to 2.9.15feed_icons service worker cache because it’s causing more problems than it solves (and HTTP cache seems faster)io/ioutil packageReferrer-Policy: no-referrerPOLLING_PARSING_ERROR_LIMITsystemctl edit for editing-1 can be used for CLEANUP_ARCHIVE_* optionsspellcheck="false" to input fieldsCAP_NET_BIND_SERVICE (allow the process to listen on privileged ports)/tmp for $CERT_CACHE (required when using Let’s Encrypt)autocomplete="username" to HTML formsextra column (HSTORE field) from users table and migrate key/value pairs to specific columns<abbr> HTML tagcreated_at instead of published_at for archiving entriescreated_at field for entriesUser-Agent/run writeableEXPOSE instruction in Dockerfilecharset.NewReader if the body is a valid UTF-8 documentnoscript content for images rendered with Javascriptgithub.com/prometheus/client_golang from 1.7.1 to 1.8.0github.com/PuerkitoBio/goquery from 1.5.1 to 1.6.0picture HTML tagsrcset, media, and sizes attributes to img and source tagssub and sup from affecting line-heighttouch-action on .items to prevent browser navigationfont-family specific CSS to the appropriate filefont-family for UI to be even more compatible with various operating systems.entry-content font-weight variable depending on font-family usedadd_invidious_video rule applicable for different invidious instancesjp, ko and zh languagesPOLLING_SCHEDULER description in man pagegorilla/mux from 1.7.4 to 1.8.0<media:title> to avoid overriding the default title if they are differentpt_BR) translation/version endpointrel="prev/next" on pagination linksV to open original link in current tab<details> disclosure elementconvert_text_link and nl2brde_DE translationf, s, and m.arm32v7CLEANUP_FREQUENCY_HOURS instead of CLEANUP_FREQUENCYCLEANUP_ARCHIVE_READ_DAYS instead of ARCHIVE_READ_DAYSadd_mailto_subjectj and k keyboard shortcutsallow-popups to iframe sandbox permissionsDockerfile to main repo/usr/local/bin to /usr/bin in Docker image<strong> elements are bold<pre> elements<details> for advanced feed optionsSameSite to Lax modeIMAGE_PROXY environment variable:
embedly.com to iframe whitelistadd_dynamic_image rewriter for JavaScript-loaded imagesautocomplete="off" or autocomplete="new-password" doesn’t change anythingautocomplete="new-password"/etc/miniflux.conf to 600 instead of 644 in RPM packagetzdata package to Docker imagesrc and title attributes (others are ignored)figure tag with the title attribute’s contents in a figcaption tagstyle, noscript and script tag contentshttps://www.youtube-nocookie.com/entries:
<q> tags for black thememod_security)Until now, Miniflux was designed to work for only one user. Handling multiple users was possible by using a Sqlite database for each user.
Now, the database schema and the code base have been modified to handle several users with only one database. Moreover, Miniflux supports Postgresql in addition to Sqlite.
Using Postgres could avoid some potential issues when the concurrency on the database is too high (locking problems). That also facilitates the deployment of Miniflux to some cloud providers that does not allow software to store persistent data on the local file system.
An experimental version of the Fever API has been implemented.
The goal of this feature is to be able to use existing mobile and desktop clients with Miniflux. It’s also interesting for reading your feeds offline.
The API have been tested with Reeder 2 (OSX version) and Press (Android).
When you add a new feed or edit an existing feed, you can force the RTL mode. The content will be displayed correctly regardless of the language specified in the RSS feed.
Each subscription can be modified, disabled or removed from this page.
A Dockerfile is available in the repository.
There is also many bug fixes and code cleanup.
]]>http://item.set_list_status to the APIContent-Security-Policy headertrim() when adding a feed manuallycollate nocasecount_bookmarks() to include only read/unread items and remove opacity.htaccess to the directory dataremove() call because there is “on delete casade”encode_item_id().gitignoreitem_id in base64 rather than urlencodeaction=default or action=history. It will flush all read items older than the specified number of days in the preferences--limit argumentcronjob.php to be called from webpdo_sqlite extension checkget_feeds_id)<q/> HTML element.gitignoresave_config()Etag and LastModified headersiframe from Youtube and Vimeo&format_bytes()secure parameter for session cookies for HTTPS connections.gitignorePicoTools\Crypto by the latest version of password_compatmodel.phpCrypto.php