Repository navigation
Releases
Releases · dsh2dsh/miniflux
v2.4.5
Changelog
- 48f7795 Merge branch 'upstream-main'
- faecfa2 fix(storage): look up categories by title case-insensitively
- df36373 fix(googlereader): avoid infinite recursion in StreamType.String
- d57da7c fix(fever): honor the before timestamp when marking all items as read
- a0cc2e4 fix(fever): set the starred state instead of toggling it
- 707d3c3 fix(locale): add or reuse translation keys missing from all locales
- 400e6b6 fix(validator): validate username format on modification
- b8da688 fix(ui): stop caching shared entry pages in public caches
- 378ce7d fix(ui): only persist web sessions on routes that start a flow
- bb61fe0 build(deps): update Go dependencies
- 1df2daa Merge branch 'upstream-main'
- b59230f Merge branch 'upstream-main'
- 70adb66 docs(man): review man page for accuracy and readability
- b475d6b fix(oauth2): read the OIDC group claim from the ID token too
- 14c070b build(deps): bump the github-actions group with 6 updates
- 36ce522 backport: prevent administrators from editing their own account
- 0ab0e1f Merge branch 'upstream-main'
- 5f881ad ci: harden GitHub Actions workflows
- 752793f fix(ui): prevent administrators from editing their own account
- f6f36f3 Use everywhere locale.Error interface
- c0794ae Add implementations of error interface into LocalizedError
- 58af255 backport: Ask for the current password before changing it
- d0176da Merge branch 'upstream-main'
- 6c6d614 Bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6
- f654f7c feat(ui): ask for the current password before changing it
- 7882941 Send feed cookies to the feed's site only
- d398ea4 Always use original hostname for ResponseHandler
- f1b07c6 Fix gopls warnings for errors.AsType
- f9b63fd Bump golang.org/x/net from 0.61.0 to 0.62.0
- 2aac20e Validate values of feed's custom cookies
- 9e5893f Sync icons.svg with sprite.svg,
- 982cbd0 Merge branch 'upstream-main'
- 229035a fix(security): revoke other sessions when the password changes
- 572ac7d refactor(ui): move authentication settings to a dedicated page
- 0877d29 fix(security): only send feed cookies to the feed's website
- 7833b22 fix(googlereader): avoid logging the auth token in clear text
- 0388db7 build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6
- 8542ea4 build(deps): bump the gomod group with 2 updates
- a8abeaf Fix TestFetcherDenyNetworks after last change
- b669ed2 Merge branch 'upstream-main'
- 3945f3d fix(security): block 6to4 and IPv4-compatible addresses in SSRF filter
- e5a9d94 Merge branch 'upstream-main'
- d5c529b fix(ui): don't create web sessions for unauthenticated protected routes
- 12eb4d8 test(date): check the trimmed lower-case date in its own test
- 04fc79f fix(date): parse RFC 3339 dates with a lower-case t or z
- 4d8f63f Fix error after previous change
- 804008b Move current session data into session cookie on logout
- 32e6bc5 Merge branch 'upstream-main'
- 5f5efd7 fix(auth): enable WebAuthn-only login and document setup
- 000f8ce feat(auth): allow WebAuthn with disabled local authentication
- a4c0033 fix(fever): always order the items endpoint by entry id
- 54e2cc7 refactor(model): remove unused WebSession language and theme setters
- 030eceb fix(ui): keep logged-out preferences in a cookie instead of the session
- 2f42a1f Move CSP into Content-Security-Policy HTTP header
- 043ff52 Refactor FindClientIP()
- daba608 Bump github.com/dsh2dsh/gofeed/v2 from 2.8.2 to 2.8.3
- 8de58f8 build(deps): bump the gomod group with 3 updates
- 73e1fd1 Bump github.com/dsh2dsh/gofeed/v2 from 2.8.1 to 2.8.2
- 4e46f00 Merge branch 'upstream-main'
- 287c573 adopt: add one more test for X-Forwarded-For
- 881f032 adopt: reject invalid CSS selectors in rewrite and scraper rule
- 6d98b33 Revert "Refactor a little (*EntryQueryBuilder).lowArgs()"
- e97fdb5 Validate rewrite selectors in validation mode only
- 6d95ec1 Refactor a little (*EntryQueryBuilder).lowArgs()
- bdd8087 fix(ui): don't create web sessions for media proxy requests
- 927e0e8 fix(json): accept JSON feeds that start with a UTF-8 byte order mark
- 523940c Merge branch 'upstream-main'
- a7d842a Fix store: unable to count entries: expected 3 arguments, got 4
- 97fa1d3 fix(http): take the client IP from the right side of X-Forwarded-For
- fb4f1b0 feat(rewrite): reject invalid CSS selectors in rewrite and scraper rules
- c573f2e feat(api): add force parameter to the feed refresh endpoint
- 05b24c9 feat(oauth2): admin role mapping
- 71091f0 feat(locale): update Polish translation
v2.4.4
Changelog
- 5a58b89 adopt: block more reserved IP range
- 48bf30c Merge branch 'upstream-main'
- 238c561 fix(security): block reserved IP ranges in SSRF filter
- 214aca7 fix(gotify): avoid nil feed dereference in notifications
- 942ea1d fix(security): prevent WebAuthn open redirect
- 21a5e94 Merge branch 'upstream-main'
- f17c8fd fix(fetcher): restrict private per-feed proxy access
- f66e876 feat(integration): add Gotify push notification support
- 37b5afb Merge pull request #55 from dsh2dsh/dependabot/go_modules/gomod-968d26446f
- 45e4b5e Merge pull request #54 from dsh2dsh/dependabot/github_actions/github-actions-d5b5847ff0
- 539a525 build(deps): bump the gomod group with 7 updates
- 7ac9ac2 build(deps): bump goreleaser/goreleaser-action
- 5eeb373 Merge branch 'upstream-main'
- 71cfdb8 feat(scraper): Added 2 Steam related scraper rules
- 0cde269 build(deps): bump the gomod group with 6 updates
- 76a3227 Handle "x-ratelimit-reset" header like "Retry-After" for rate limiting
- 4a0f4ce backport: validate content rewrite rules at save time
- f836d04 Merge pull request #53 from dsh2dsh/dependabot/go_modules/gomod-ebb7a74231
- 5fca76c build(deps): bump the gomod group with 3 updates
- 3ff71b6 During feed refresh any error from fetcher is a bad feed error
- da730ea Restore lost returns,
- 5d09b9c backport: validate entry url rewrite rules at save time
- a75940f backport: add timeouts to ACME challenge listener
- d394a94 Merge branch 'upstream-main'
- b5e1fa4 Refactor fetcher and use context.WithTimeout,
- 851a6ac exec curl
--compressedby default - c317f84 fix(server): add timeouts to ACME challenge listener
- 5c80660 fix(response): prefer server order to client order for response encoding
- 6333ca1 feat(rewrite): validate rewrite rules at save time with helpful error messages
- 275c343 backport: report the HTTP status when saving an entry to karakeep fails
- c92b5fe Merge branch 'upstream-main'
- 717c500 Support feed fetch and/or scraping using curl-impersonate
- 249b340 fix(karakeep): report the HTTP status when saving an entry fails
- f4f655b refactor(response): unified response builder
- 899fe04 build(deps): bump the gomod group with 2 updates
- 06408fa Refactor config validator a little
- d43b788 Merge pull request #52 from dsh2dsh/dependabot/go_modules/gomod-194a163442
- 2fcfcd2 build(deps): bump github.com/klauspost/compress
- 6851e1b Refactor how fetcher handles proxy
- 93c9deb Allow connecting to a private proxy configured via env vars
- 83f33f8 Merge branch 'upstream-main'
- c52bdef fix(ui): restart pagination when the feed or category page falls past the end
- b683d3b fix(fetcher): trust every proxy selected during a redirect chain
- cedbb39 fix(fetcher): allow connecting to a proxy set through the environment
- 434263c build(deps): bump the github-actions group with 6 updates
- 703fe82 build(deps): bump the gomod group across 1 directory with 2 updates
- efd8ec0 Feed custom proxies should be configured before using it
- 6b4fe49 Merge pull request #51 from dsh2dsh/dependabot/go_modules/gomod-78bc4a25a3
- 4c4f09f build(deps): bump the gomod group with 2 updates
- 8a4b1a3 Refactor internal/reader/fetcher.Client a little
- a22f666 Bump github.com/dsh2dsh/gofeed/v2 from 2.8.0 to 2.8.1
- 4e6d7f9 build(deps): bump the gomod group with 7 updates
- ca552a0 feat(locale): update Polish translation
- 14d9265 Merge pull request #50 from dsh2dsh/dependabot/go_modules/gomod-e07997e9fd
- b581773 build(deps): bump github.com/go-webauthn/webauthn in the gomod group
- 50a93c3 Refactor loading of entrys content w/o extra JS
- 99045ac Add global htmx indicator
- de53249 Extract inner HTML of common/item.html into item_inner.html
- e337209 Introduce (*ui/view.View).LookupRender()
- 093a59d Introduce (*template.Engine).LookupExecute()
- 09cc94f Inline content of unexpected response inside entry
- aee966c Show remote response status for failed article download
- 724bb2c Merge pull request #49 from dsh2dsh/dependabot/go_modules/gomod-59f998c33b
- 93828f7 build(deps): bump the gomod group with 9 updates
- 59bfb74 Don't allow enable googlereader with empty password
- 2c61898 enforce DISABLE_LOCAL_AUTH on the API and password changes
- e1bc592 Merge branch 'upstream-main'
- 76889f0 fix(auth): enforce DISABLE_LOCAL_AUTH on the API and password changes
- 589659f fix(googlereader): reject auth tokens when no password is set
- bbf082a build(deps): bump the gomod group across 1 directory with 6 updates
- 562c027 build(deps): bump the github-actions group with 4 updates
- 5e106f8 Bump github.com/dsh2dsh/gofeed/v2 from 2.7.1 to 2.8.0
- 7802144 Merge pull request #48 from dsh2dsh/dependabot/go_modules/gomod-a43429f62f
- d76749c build(deps): bump the gomod group with 4 updates
- 7684185 Merge pull request #47 from dsh2dsh/dependabot/go_modules/gomod-77434a4775
- 763607c build(deps): bump github.com/dsh2dsh/bluemonday/v2 in the gomod group
- 9d01fa2 Reserve scrollbar and avoid visual jumps
- b7499b1 Upgrade HTMX to 4.0.0
- 2ca9038 Use scrollIntoViewOnBoost=false, instead of swapOverride = "show:html:top"
- bbe89dd Merge branch 'upstream-main'
- a84533d perf(database): index enclosure URL digest as bytea instead of hex
- 5e12331 Merge branch 'upstream-main'
- 9b4b261 Merge pull request #46 from dsh2dsh/dependabot/go_modules/gomod-78109a4945
- 20b07f5 build(deps): bump the gomod group with 2 updates
- b79ba93 fix(urllib): reject surrounding whitespace in IsRelativePath
- a7f93d8 fix: avoid panic when creating a feed without any category
- e615d07 Merge branch 'upstream-main'
- caf231a Switch to go 1.27
- ca24133 perf(database): drop redundant entries_user_status_changed_idx
- 59c1573 build(deps): bump the gomod group across 1 directory with 5 updates
- 28602a9 importcomment: canonical import path comment is ignored in module mode (modernize)
- 902c710 golangci-lint: fix gofumpt.extra
- f60a670 golangci-lint: fix gofumpt.extra-rules
- 5800285 Merge pull request #45 from dsh2dsh/dependabot/go_modules/gomod-d58e3db81c
- d606abe build(deps): bump the gomod group with 5 updates
- 5b6d445 Redirect to starting page after passkey login
- 66949bb Merge branch 'upstream-main'
- 106cdd0 fix(webauthn): preserve redirect_url after passkey login
- 2c03f95 Bump github.com/dsh2dsh/gofeed/v2 from 2.7.0 to 2.7.1
- d3f2232 backport: raise item IDs limit to 1000
- 7f32543 Merge branch 'upstream-main'
- 2f9e07b fix(googlereader): raise item IDs limit to 10000
- b3039d6 fix(ui): add accessible name to documentation links
- 94324ea Backport two new tests from upstream
- 792cf64...
v2.4.3
Changelog
- 8a8ed5d Reuse loaded feeds when loading entries
- 7ba0a91 Merge branch 'upstream-main'
- c4d54f8 build(deps): bump github.com/prometheus/client_golang in the gomod group
- 3c155b9 Fix linter warning
- 54c5092 Add 2 new tests for worker.Pool
- 7c4fa3d Merge branch 'upstream-main'
- 1d10e7a fix(config): accept spaces and trailing commas in list option values
- 0e26f12 fix(locale): protect translation catalog from concurrent map writes
- e4e7dc5 fix(ui): keep proxy checkbox on subscription choose error re-render
- c8c414e fix(worker): prevent panic when jobs are pushed during graceful shutdown
- 8253761 fix(integration): stop sending empty tags to Raindrop
- 61f50e6 Hard limit max num of entries to 1000
- 0eb46f3 apply no_media_player option during feed creation
- c3a0257 allow clearing the feed proxy URL
- 97944cf restrict entry_sorting_order to database enum values
- 8a5951c Add more e2e tests
- bfd903d backport: use <> ALL when counting remaining categories
- 3ed889d Merge branch 'upstream-main'
- 308e1f9 fix(config): reject non-positive SCHEDULER_ENTRY_FREQUENCY_FACTOR values
- fbbff63 fix(storage): clamp non-positive entry query limits to the maximum
- c342187 fix(handler): apply no_media_player option during feed creation
- 5c62899 fix(validator): allow clearing the feed proxy URL
- a21029d fix(validator): restrict entry_sorting_order to database enum values
- 4237f8b fix(storage): return correct total when offset is beyond the last entry
- c119273 fix(storage): use <> ALL when counting remaining categories
- 92057dd fix(server): restrict unix socket permissions to 0660
- af0039b backport: scope icon lookup by user in icons endpoin
- dd759ba Merge branch 'upstream-main'
- 6088397 Merge pull request #41 from dsh2dsh/dependabot/github_actions/github-actions-e986305a06
- 1c1644c build(deps): bump actions/setup-go in the github-actions group
- 4d84eee fix(api): scope icon lookup by user in icons endpoint
- a40d26f Merge branch 'upstream-main'
- aa509b8 feat(ui): use SVG for browser favicon
- c4a4996 backport: factorize JSON request construction
- a9fb1ff backport: find github feeds
- 4efd659 backport: speed up fetcher timeout test
- 771785a Merge branch 'upstream-main'
- 56eb812 feat(server): reload TLS certificates on SIGHUP
- 69a788a feat(finder): find github feeds
- 706a92e refactor(integration): factorize JSON request construction
- 0939195 perf(tests): speed up fetcher timeout test
- ff01425 test(api): run integration tests in parallel
- 3fd9592 Add paralleltest linter
- b15b6cf Reload TLS certificates on SIGHUP
- 8cb90ca Refactor internal/http/server into *Server
- c0a32d7 Extract Listener() into listener.go
- 8d57428 Make E2E tests parallel
- 4790fe7 Merge branch 'upstream-main'
- 79d920b fix(database): skip orphaned entries in migration v127
- cf5ae57 fix(rewrite): keep content order when remove_tables unwraps tables
- 59ab581 Optimize
WriteString(key + " " + value + ";") - e041456 Fix typo s/girhub-actions/github-actions/
- dfe29c7 Bump deps (bluemonday, x/net)
- 77c0936 Merge branch 'upstream-main'
- 070bc9e fix(storage): respect category hide_globally when marking all as read
- e7888e3 perf(ui): defer off-screen layout/paint on entry and feed list rows
- 8528e5e build(deps): bump the gomod group with 6 updates
- 0c632c3 Merge branch 'upstream-main'
- 5cf52c4 Bump deps (gofeed)
- e43381d perf(sanitizer): avoid Token() allocations in stripIter
- b86fdda Bump github.com/dsh2dsh/gofeed/v2 from 2.5.1 to 2.6.0
- e3e5f43 Add github-action dependabot group [skip ci]
- e5806b2 Merge pull request #40 from dsh2dsh/dependabot/go_modules/gomod-5ccb0dd8b1
- 508c8a0 Merge pull request #39 from dsh2dsh/dependabot/github_actions/golangci/golangci-lint-action-9.3.0
- 8cc7bde Merge pull request #38 from dsh2dsh/dependabot/github_actions/goreleaser/goreleaser-action-7.2.3
- 6fb6433 build(deps): bump github.com/klauspost/compress in the gomod group
- eb69572 build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
- a1b0375 build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
- 7e152fe Merge branch 'upstream-main'
- 5ebdc17 fix(css): set line-height on article headings to prevent overlap when they wrap
- 969304f Escape plain-text content_text and summary of JSON feeds
- 694f7f0 Merge branch 'upstream-main'
- 0abd9e7 fix(json): escape plain-text content_text and summary
- ef24215 perf(response): pool on-the-fly compression writers
- 96fa493 Accept
<dc:language>for rss channel - 86e10ae Accept
lang="de"event withoutxml:namespace - 95dfd0a Limit language tags to 50 bytes
- ce1a468 Add mote tests for parsing atom feeds with languages
- a9c69af Add test for concurrent Render
- ed462a1 Merge branch 'upstream-main'
- 56d0b31 fix(template): avoid race when rendering concurrently
- 5f710f9 feat(reader): inherit feed language on RSS, RDF, and JSON Feed entries
- 193fed7 Fix can't scan into dest[33] (col: feed_language)
- aac318d Set HTML lang attribute from feed-declared language
- 65cd6cd fix(language): reject tags outside the BCP-47 alphabet in Normalize
- 6972be2 refactor(reader): move language normalization out of model
- ab8f7f9 feat(atom): inherit feed-level xml:lang on entries
- 766d298 fix(atom): restrict language parsing to namespace-qualified xml:lang
- 64cb67a Bump github.com/dsh2dsh/gofeed/v2 from 2.5.0 to 2.5.1
- 14f85d4 Merge branch 'upstream-main'
- 68e2655 build(deps): bump library/alpine
- fe37c6b build(deps): bump the github-actions group with 9 updates
- 0dcefa7 build(deps): bump github.com/andybalholm/brotli in the gomod group
- 5d56902 feat(client): expose feed and entry language on public Go client structs
- 212c3e1 feat(rdf): parse feed and item language from RDF/RSS 1.0 dc:language
- 6dcb815 feat(ui): emit lang attribute on rendered article surfaces
- d456718 feat(reader): parse and persist feed and entry language from RSS, Atom, and JSON Feed
- ee03ed0 Merge branch 'upstream-main'
- 4aa60ba refactor(response): use strict Accept-Encoding parser
- 7769fa0 feat(response): almost standard-compliant Accept-Encoding parser
- 2c6d105 Bump github.com/dsh2dsh/gofeed/v2 from 2.4.5 to 2.5.0
- 22a2ce3 Merge pull request #37 from dsh2dsh/dependabot/go_modules/gomod-de5ff60fb3
- a1233bd build(deps): bump github.com/coreos/go-oidc/v3 in the gomod group
- b9a3a65 Init observer later, on afterSettle, instead of afterSwap
- d81401b Boostify feed name and author name links
v2.4.2
Changelog
- c0c966c Merge branch 'upstream-main'
- 51f2e0d feat(atom): use id for entry link if it is an http URL
- 62c1672 backport: test validation of subscription form
- c9292e5 Remove unused isValidFilterRules
- f192052 Merge branch 'upstream-main'
- 510d225 fix(ui): validate per-feed entry filter rules in web forms
- ecdc356 build(deps): bump the gomod group with 2 updates
- b8dbde2 backport: add missing fields to match API server
- 496f678 backport: remove duplicate category filter in entry list
- 9514bc8 backport: parse counts parameter with QueryBoolParam
- 022b63e backport: return server error on user lookup failure
- 9a68092 backport: proxify enclosure URLs in entry list endpoints
- ba4d44e Merge branch 'upstream-main'
- f96bee0 feat(client): add missing fields to match API server
- 1550514 refactor(api): move entryIDsResponse struct to messages.go
- 6ddddbc fix(api): remove duplicate category filter in entry list
- 063e3f1 refactor(api): parse counts parameter with QueryBoolParam
- ae1f135 fix(api): return server error on user lookup failure
- 5de36b6 fix(api): return server error when feed lookup fails on update
- 2ac3073 fix(api): check for nil user before using the result
- ae6ac73 fix(api): distinguish missing user from database error
- 9f4b2ef fix(api): proxify enclosure URLs in entry list endpoints
- 8c02fd0 Merge pull request #36 from dsh2dsh/dependabot/go_modules/gomod-44aec95eea
- d73fa5c Merge pull request #35 from dsh2dsh/dependabot/github_actions/actions/checkout-7.0.0
- ab0bfb1 build(deps): bump the gomod group with 2 updates
- 959f3ad build(deps): bump actions/checkout from 6.0.3 to 7.0.0
- 7f22ccb backport: Allow API client to set "starred" to true or false
- b82b4b0 Merge branch 'upstream-main'
- bcb2cf2 feat(api): Allow API client to set "starred" to true or false using the "PUT /v1/entries" endpoint
- e329bc9 Bump codeberg.org/readeck/go-readability/v2 from 2.1.1 to 2.1.2
- 5254ac0 Merge branch 'upstream-main'
- 530b0c5 fix(urllib): fix rejection of valid proxy URLs in feeds
- b0d25c1 fix(locale): de_DE updates
- bfed13b Pass
*fetcher.RequestBuilderto(*SubscriptionFinder).FindSubscriptions(), - d122c13 Merge branch 'upstream-main'
- 8699a1d fix(fetcher): clone request builder before disabling redirects
- a153965 fix(ui): show flash message when refreshing all feeds via keyboard
- 5f5afcd Merge branch 'master' of github.com:dsh2dsh/miniflux
- 71150eb Merge pull request #34 from dsh2dsh/dependabot/go_modules/gomod-22ce3baa1d
- 55aa1c8 Merge branch 'upstream-main'
- ba39ae1 build(deps): bump the gomod group with 7 updates
- 1975bc6 fix(storage): scope enclosure lookup by user
- f72957e chore(version): bump dev version to 2.3.x-dev
- 81a3e31 Merge branch 'upstream-main'
- ce5d84e feat(search): swap plainto_tsquery for websearch_to_tsquery
- 49d8f1d refactor(response): make response builder actually build stuff
- 91860ed refactor(fetcher): make request builder actually build
- e49c75f fix(storage): chain query builders
- a14a180 refactor(reader): use consistent naming for atom feed adapters
- 684ea3d feat(reader): split common sorting routine into separate function
- 4ce8151 refactor(reader): make code flow consistent for buildFeed
- 088df2f backport: add entry ID listing endpoint
- 9e36ed8 Merge branch 'upstream-main'
- 7d8ffd2 feat(api): add entry ID listing endpoint
- 02b2d73 Merge branch 'upstream-main'
- 05cd8da build(deps): bump the gomod group with 5 updates
- e87cbb0 Merge branch 'upstream-main'
- f22c088 fix(migrations): use SHA-256 instead of MD5 for the enclosures unique index
- 103618e Use atom entry ID as entry URL for entries without links
- bc9adc4 Merge branch 'upstream-main'
- f4de355 fix: correct an aria-labelledby error
- ee3f533 Merge pull request #32 from dsh2dsh/dependabot/go_modules/gomod-36de24d4fb
- 053d93b Merge pull request #33 from dsh2dsh/dependabot/github_actions/actions/checkout-6.0.3
- 4207e44 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
- fbde43d build(deps): bump the gomod group with 2 updates
- 7bf53de Merge branch 'upstream-main'
- f963ea3 refactor(cli): use cleaner syntax for common exit routine
- a569ea4 Merge branch 'upstream-main'
- 87d7891 refactor: remove the now-useless maxDepth limit in the sanitizer
- 939698f feat(locale): update gl_ES
- ddb38d4 Merge branch 'upstream-main'
- 350df63 fix(googlerea 8000 der): apply configured user agent in quickadd handler
- 0cfd079 fix(locale): drop unused arguments when formatting translations
- 96e4cfe Merge branch 'upstream-main'
- f4b3937 build(deps): bump the github-actions group with 9 updates
- b8fa579 Cache fragments of svg icons
- 3139e23 Faster build route path for last element
- dd2e825 backport: add max-age to Cache-Control
- 988537a backport: don't leak usernames existence via timing
- 333f91c Merge branch 'upstream-main'
- 1029896 perf(template): precompute static icon URLs at parse time
- 533ff80 perf(ui): add max-age to Cache-Control
- 83ea3d1 security(user): don't leak usernames existence via timing
- 0d95d42 Merge pull request #31 from dsh2dsh/dependabot/go_modules/gomod-0d33ab73b9
- 1c30f2d Merge pull request #30 from dsh2dsh/dependabot/github_actions/golangci/golangci-lint-action-9.2.1
- 323d110 Merge pull request #29 from dsh2dsh/dependabot/github_actions/actions/checkout-6.0.2
- aa341e8 build(deps): bump the gomod group with 4 updates
- e1752a0 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
- a2e90c8 build(deps): bump actions/checkout from 6 to 6.0.2
- 23829bb backport: replace correlated subqueries in CategoriesWithFeedCount
- 0cf7885 Merge branch 'upstream-main'
- 651fbd1 perf(filter): cache compiled regexes across entries
- 5e76633 perf(storage): replace correlated subqueries in CategoriesWithFeedCount
- 16c9084 Merge branch 'upstream-main'
v2.4.1
Changelog
- ad4e355 Merge branch 'upstream-main'
- 9a77408 refactor(response): use http.Header for header map
- 325dba4 Merge branch 'upstream-main'
- 79381e6 build(deps): bump the gomod group with 4 updates
- ab773f0 Restore lost WithoutRedirects for discovery of known feed URLs
- 69cf647 Fix WithTags condition after last merge
- 5dd9d1f backport: collapse WithTags into a single array-containment predicate
- 1fdbf2b Merge branch 'upstream-main'
- 161ed71 fix(api): forbid setting OAuth identity fields via user update
- c896baf fix(urllib): reject backslashes in relative path validation
- 66996e3 refactor(storage): use same API for list and singular items
- f050f23 refactor(storage): collapse WithTags into a single array-containment predicate
- 3ecabfa backport: walk feed tags in a single DOM pass
- 45a6146 Merge branch 'upstream-main'
- 5008840 perf(reader): walk feed tags in a single DOM pass
- d235a63 refactor(sanitizer): always trim spaces in StripTags
- a71b54f Merge pull request #28 from dsh2dsh/dependabot/github_actions/golangci/golangci-lint-action-9.2.0
- e08006c Merge pull request #27 from dsh2dsh/dependabot/github_actions/goreleaser/goreleaser-action-7.2.2
- 35d2399 build(deps): bump golangci/golangci-lint-action from 9 to 9.2.0
- cbaf6c0 build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2
- af3075e Merge branch 'upstream-main'
- 483da48 perf(finder): size findSubscriptionsFromWebPage dedup map
- e01a610 fix(readingtime): make CJK detection more reliable
- a725476 fix(readingtime): trim CJK text by rune not by bytes
- a7d352c Fix UI after changing
.entriesfrom slice to Seq2 some time ago - ec7597b Return LEFT JOIN for feed icons,
- 4038102 backport: optimize a tad findCanonicalURL
- 5d01e19 backport: use INNER JOIN where LEFT JOIN is redundant
- fb3f202 Merge branch 'upstream-main'
- 47e304f perf(integration): don't defer in a for loop
- 9dfed35 refactor(storage): consistent construction of query builders
- 95f5f1e refactor(storage): use query builder as builder
- a08f598 refactor(storage): return entryPaginationBuilder from builder methods
- 0e15235 perf(finder): optimize a tad findCanonicalURL
- eff9502 refactor(storage): use INNER JOIN where LEFT JOIN is redundant
- ab94f42 refactor(storage): Use INNER JOIN instead of LEFT JOIN in IconByFeedID
- f66772e feat(sanitizer): speed up TruncateHTML by a lot
- 43456da feat(sanitizer): TruncateHTML benchmarks
- 863d603 refactor(sanitizer): split common stripping code into iterator function
- fc3e548 refactor(sanitizer): move truncate tests to single table
- 096a15e feat(locale): add Korean translation
- c2c57ac Rename fetcher.(*RequestBuilder).RequestWithContext to Request
- 34d843b Merge branch 'upstream-main'
- 0976efd refactor(readingtime): get rid of the obnoxious casts dance
- 7277b3e Reuse TCP connections looking for subscriptions
- 09526b3 Add fetcher.(*RequestBuilder).NewClient(),
- a42c03c Add a shortcut method fetcher.(*Client).Request()
- a05371a Add fetcher.(*Client).Close() method,
- 1a32e78 Set Transport.MaxIdleConns = 100, like default http Transport.
- b371705 Refactor fetcher package
- 114d34c backport: use constant-time comparison for metrics endpoint credentials
- 9a8a148 Merge branch 'upstream-main'
- 06e36c3 Revert "feat(ui): add stdlib cross-origin protection middleware"
- 39772c3 perf(subscription): use a slice instead of a map for well-known feed paths
- 098270c refactor(misc): various minor code simplifications
- 24c6530 perf(date): cache timezone Locations for PST/PDT/EST/EDT fallback
- 3747e68 security(metrics): use constant-time comparison for metrics endpoint credentials
- 5049c73 backport: remove possible(?) SQL injection
- e745360 backport: drop two redundant indexes
- d116ced Merge branch 'upstream-main'
- cc1d39e perf(misc): preallocate some slices
- bdd7f4f perf(database): drop two redundant indexes
- 7628a21 fix(storage): remove possible SQL injection
v2.4.0
Changelog
- 80d9ee8 Update dependencies
- 71951e7 Merge branch 'upstream-main'
- 20545d2 refactor(storage): remove a useless ORDER BY in GetEnclosure
- 7719774 build(deps): bump the gomod group with 6 updates
- bf318fa Fix infinite scrolling, broken after last changes [skip ci]
- 4a18432 Refactor removing of scrolled entries for infinite scrolling
- daa2b19 Fix init of infinite scrolling after HTMX redirect
- cef7d24 Just remove extra empty line
- e7e7db4 Boostify couple of forms added in last changes
- 06f3f1c Require discoverable passkeys
- 0b84d07 Persist webauthn backup flag
- 31c841c Merge branch 'upstream-main'
- 0642e8a fix(webauthn): persist backup flags
- 059ec55 security(webauthn)!: require discoverable passkeys
- 9fd6f44 fix: typo in wallabag integration error message
- 018128e fix(storage): delete orphaned icons
- 3f05747 refactor(internal): use errors.Is instead of equality operator
- 7a5b4b1 fix(googlereader): avoid inlining validateApiKey at every call site
- b02c53c Merge branch 'upstream-main'
- c2661ca perf(processor): avoid per-char string allocation in parseISO8601Duration
- d1628c1 Load next items using our existing IntersectionObserver,
- 879f7da Preload next entries, instead of X unread entries,
- 7c44083 Refactor
.requestURIfield to dynamic template functionrequestURI - 5dddac0 Refactor internal/template.(*Engine).Render()
- f229d2d Tighten finishLogin and saveCredential
- d5ab4b1 Clean up variable naming
- 94c373c Drop unreachable uid==0 guards
- f99ec8b Check ownership in saveCredential on WebAuthn rename
- cb3026f Require POST for OAuth2 unlink endpoint
- 53aea15 Merge branch 'upstream-main'
- 30ad65e refactor(webauthn): tighten finishLogin and saveCredential
- 9a0e357 refactor(webauthn): clean up variable naming
- d4f362a refactor(webauthn): drop unreachable uid==0 guards
- 10bdbf8 fix(webauthn): check ownership in saveCredential on WebAuthn rename
- f467c2d refactor(ui): require POST for OAuth2 unlink endpoint
- 6b06c9f perf(readingtime): don't allocate words to count them
- 43421e7 Fix getting entries with search query after last changes
- 83cc919 Require POST for feed refresh endpoints
- 2e24e99 Require POST for /logout
- b205e90 Add rewrite helper, which adds enclosure links
- 7120944 Reject empty state when no flow is in progres
- b66ef50 Merge branch 'upstream-main'
- 30ede1c refactor(ui): require POST for feed refresh endpoints
- 16902a2 refactor(logout): require POST for /logout
- 08de954 fix(csrf): apply CSRF to all non-safe methods
- cf7474a feat(rewrite): add enclosure links
- 7892cb8 perf(reader): use a strings.Builder instead a string concatenation
- fc68e33 fix(oauth2): reject empty state when no flow is in progress
- 45bd42f Handle offsetID=X to render entries after entry with ID=X
- 355b4b5 EntryQueryBuilder doesn't use *Storage
- e565487 Delete unused EntryPaginationBuilder
- 5a514a3 Include feed settings in export and import
- 8dd5f23 Merge branch 'upstream-main'
- 622d757 perf(sanitizer): improve the sanitizer's performances twofold
- f74870d perf(template): improve a tad the rendering of icons
- bad9411 feat(opml): include feed settings in export and import
- b7da363 perf(misc): batch navigational information queries
- a06a0c9 Fix broken infinite scrolling after last changes
- cb60ba1 Merge branch 'upstream-main'
- e42177b Bump dependencies
- 8fc7d1f build(deps): bump github.com/go-webauthn/webauthn in the gomod group
- ebfab56 Merge pull request #26 from dsh2dsh/dependabot/github_actions/goreleaser/goreleaser-action-7.2.1
- aba81a7 Replace toggle_bookmark_status translations by toggle_star_status
- e42a900 Merge branch 'upstream-main'
- 7ec6bb3 Quarantine suspicious entry URLs,
- 7d80bbd fix(i18n): Improve the quality of zh-TW translations
- cd01413 perf(storage): preallocate some slices and a map
- abbdc6c Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.5 to 2.3.6
- 5419dca build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1
- be60577 Merge branch 'upstream-main'
- 0909323 feat(validator): cap entry limit at MaxEntryLimit
- 6543d65 fix(sanitizer): match URI schemes case-insensitively
- 64baeba fix(template): replace safeURL with untrustedURL scheme validator
- 7a2fd41 Fix greader incorrect read/starred toggling
- 5b4448c Merge branch 'upstream-main'
- d5e6802 fix(http): validate redirect URL scheme in HTMLRedirect
- e433895 fix(googlereader): fix incorrect read/starred toggling
- c395924 perf(sanitizer): don't sanitize parameters when they're no parameters
- 9467d5d build(deps): bump github/codeql-action in the github-actions group
- 55821b9 perf(reader): preallocate some slices/maps
- 07897ec Merge branch 'upstream-main'
- 45e2226 build(deps): bump github.com/tdewolff/minify/v2 in the gomod group
- a992868 Merge pull request #25 from dsh2dsh/dependabot/github_actions/goreleaser/goreleaser-action-7.1.0
- 95b5fe1 build(deps): bump goreleaser/goreleaser-action from 7 to 7.1.0
- 19680f0 Merge branch 'upstream-main'
- a684b6a feat(sanitizer): add iOS Shortcuts
shortcuts:scheme to validURISchemes - a600f86 Merge branch 'upstream-main'
- 3c05c35 Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2
- b9ea3d0 Bump github.com/go-webauthn/webauthn from 0.16.4 to 0.17.0
- 1e8ce07 build(deps): bump github.com/go-webauthn/webauthn in the gomod group
- 6a0184c Merge branch 'upstream-main'
- 10f95e9 ci: pin third-party actions to commit SHAs
- 3c4bb31 Remove just introduced .github/workflows/stale.yml
- 59265cd Merge branch 'upstream-main'
- 54259c6 ci: add workflow to close stale pull requests
- 489141a Update HTMX to 2.0.9
- 8976a0b Restore RETURNING lost from prev commit
- 8db80a5 Merge status update and visible count queries
- 478e873 Refactor CategoriesWithFeedCount w/o loading User from db
- c8e0511 Merge branch 'upstream-main'
- cdf0632 refactor(storage): take category sort order as parameter
- 08113e5 perf(storage): merge status update and visible count query
- 56c80f3 refactor(storage): simplify user removal via ON DELETE CASCADE
- bbd6730 refactor(storage): simplify RemoveFeed via ON DELETE CASCADE
- a7e22e1 Merge branch 'upstream-main'
- 2916831 fix(storage): prevent deleted entries from reappearing as unread
- 4597f24 Merge branch 'upstream-main'
- 19e7618 Allow disabling local auth without user creation
- 9702c62 feat(config): allow disabling local auth without user creation
- c8e823e...
v2.3.19
Changelog
- e92a67b Merge branch 'upstream-main'
- 0604418 Prevent mark entries as read on boosted history back
- 2be7dc6 Redirect back to category page after marking some feed as read
- 19f72e8 docs(docker-compose): add restart policy to postgres in basic example
- bf573b0 Add more config validation rules
- 8a74392 Use scalar comparison for single-element slices in query builder
- d6cfc56 Merge branch 'upstream-main'
- 9cd36ad Bump github.com/go-webauthn/webauthn from 0.16.1 to 0.16.3
- f5dee89 Bump github.com/go-playground/validator/v10 from 10.30.1 to 10.30.2
- 26d9195 perf(storage): use scalar comparison for single-element slices in query builder
- 5f3049d perf(storage): factorize away a query
- c591ea3 build(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3
- 8df6b82 build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
- fd75311 refactor(ui): skip app session creation for static asset routes
- 4e8a0e0 fix(ui): remove sensitive values from log messages
- 96989e2 fix(ui): render edit template on category update validation error
- 4f50449 fix(ui): redirect to category feeds page after marking feed as read
- 382e179 build(deps): bump github.com/go-webauthn/webauthn from 0.16.1 to 0.16.2
- 47ced3e build(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2
- e2f225f build(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1
- 932e013 build(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1
- d5c37d7 perf(ui): reduce amount of sql queries to get unread entries
- b160f92 refactor(config): move cross-field validation into config parser
- 31f077c refactor(oauth2): select provider explicitly by OAUTH2_PROVIDER value
- 0626413 refactor(oauth2): apply Go conventions and add GoDoc comments
- c61c202 feat(locale): update gl_ES translation
- 873416f perf(ui): don't parse the keymap on every keypress
- f8171fe perf(ui): batch changes in markPageAsRead
- ba684ca perf(ui): add
immutableto Cache-Control - 9151dc5 perf(storage): extract a query from a cursor lock
- ca7c38a perf(storage): Use SKIP LOCKED in ArchiveEntries
- 524d5e5 Merge branch 'upstream-main'
- 1ef7868 Protect
lastStorageMetricsAtwith sync.Mutex - f5bfd5a refactor(oauth2): make Google and OIDC providers mutually exclusive
- f6c5f2f fix(oauth2): scope OIDC client secret warning to OIDC configuration
- 2de3427 refactor(oauth2): update Google OAuth endpoints to v2
- 21703c8 perf(sanitizer): Use an io.MultiReader
- b79f22a perf(sanitizer): html.Parse already lowercases tag names
- 59bd092 build(deps): bump github.com/tdewolff/minify/v2 from 2.24.10 to 2.24.11
- 2fb3246 Merge branch 'upstream-main'
- 1d4ca6a fix(oauth2): check HTTP status from Google userinfo endpoint
- b4c9719 fix(oauth2): clear state and code verifier from session after use
- 5c9edf3 fix(oauth2): verify OIDC ID token signature before trusting claims
- 2b21269 fix(oauth2): reject link overwrite when user already has a linked identity
- d57774d build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0
- 46ee27e Bump golang.org/x/image from 0.37.0 to 0.38.0
- 2e61fd8 http/response/html.OK -> http/response.HTML
- 2e680cf Fix order of assert.Equal args
- 13e3bbe Allow iframes from framatube.org
- 1f9269e Reuse ValidateDirection in user modification
- c9f32c4 Merge branch 'upstream-main'
- 07a9685 ci(workflows): add consistent repository_owner guards
- cc06154 fix(timezone): compare locations by name instead of pointer
- fcde209 refactor(timezone): simplify AvailableTimezones and fix test typos
- 570227c refactor(validator): reuse ValidateDirection in user modification
- 2572809 refactor(worker): add graceful shutdown to worker pool
- 16ff071 feat(sanitizer): allow iframes from framatube.org
- 2932090 fix(sanitizer): strip inner elements of blocked iframes
- 478829a Fix some artefacts after refactoring of http/response
- f34cdf8 Add Text response helper
- 480c7fa Refactor http/response using generics as much as possible for JSON responses
- de10161 var nextRequestId uint64 may be simplified using atomic.Uint64
- 87074cf Replace hardcoded status labels with constants
- 1351aa8 Merge branch 'upstream-main'
- 64eea61 Bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.1
- 76452fa refactor(storage): return errors from count functions used by metrics
- 8c947e6 refactor(metric): replace hardcoded status labels with constants
- 96897a8 refactor(metric): support graceful shutdown of metrics collector
- 1b7619f Merge branch 'upstream-main'
- fa9ab92 docs(googlereader): update README to reflect HMAC-SHA256 change
- 6ea078c fix(googlereader): use HMAC-SHA256 instead of HMAC-SHA1 for auth tokens
- 3105e1e fix(googlereader): use constant-time comparison for auth token validation
- 7a0ad7d Log write response body errors using correct logger
- 2509502 Bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0
- 1b2c3c5 Bump github.com/klauspost/compress from 1.18.4 to 1.18.5
- 595855b Merge branch 'upstream-main'
- 9c28982 refactor(server): extract listen target resolution into testable functions
- 0162c46 refactor(ui): use consistent cache-busted URL pattern for all static assets
- d33544e feat(ui): add cache busting for static icon assets
- d07e82a Merge branch 'upstream-main'
- f032858 refactor: remove dependency on gorilla/mux
- 323c995 CORS preflight requests should be a 204 response
- 1a8a503 Move status only responses into response package
- ca13d1c Merge branch 'upstream-main'
- cd3ea68 fix(api): CORS preflight requests should be a 204 response
- 925b05f fix(response): 204 responses should not include the Content-Type header
- cc528b6 refactor(api): remove dependency on gorilla/mux
- 1e42cec feat(request): support ServeMux PathValue route params
- 6276d7e refactor(api): rename API handlers for consistency
- 5094731 refactor(mediaproxy): remove dependency on gorilla/mux in unit tests
- fa7184e build(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0
- b1713dc refactor(mediaproxy): remove dependency on gorilla/mux
- 88ced7d Merge branch 'upstream-main'
- a392b0d refactor(googlereader): remove dependency on gorilla/mux
- 6093819 docs(googlereader): add API documentation
- 4413c80 perf(googlereader): preallocate some slices
- 5c8810a Merge branch 'upstream-main'
- f50c5dd refactor(fever): remove dependency on gorilla/mux
- b965e45 perf(mediaproxy): convert to []byte in ProxifyAbsoluteURL only once
- 9660e8a perf(route): preallocate parameters in route.Path
- 8666cc4 Build correct ETag header from content hash
- 6f37a8a Merge branch 'upstream-main'
- 3f58f6d Merge branch 'upstream-main'
- e9edda8 refactor(response): add Te...
v2.3.18
Changelog
- 6ccd043 Bump github.com/PuerkitoBio/goquery from 1.11.0 to 1.12.0
- e82e0af Delete unused ResolvesToPrivateIP
- 249b124 Pass
-f BSDmakefileto submakes - f33e88b Merge branch 'upstream-main'
- 386efa2 Pass context from create feed handler
- c166f80 fix: block RFC 6598 shared address space as non-public
- 075127c chore: add go:fix inline to deprecated client.New
- 121884d Move "e2e" target into BSDmakefile
- cf9731b Merge branch 'main' of github.com:miniflux/v2 into upstream-main
- 8689f7b Bump github.com/go-webauthn/webauthn from 0.16.0 to 0.16.1
- 78339f4 Bump golang.org/x dependencies
- 34fcf0e build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0
- 7f4a109 build(deps): bump github.com/go-webauthn/webauthn from 0.16.0 to 0.16.1
- dbcbe12 Partly apply googlereader minor code simplifications
- 4b3713d Merge branch 'upstream-main'
- 7846ddb refactor(googlereader): minor code simplifications
- 6ff4f5a perf(fetcher): save 6 bytes per requests
- bf738d4 build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0
- 7242890 build(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0
- 396fd2f Merge branch 'upstream-main'
- f2a63d9 Bump github.com/dsh2dsh/gofeed/v2 from 2.4.2 to 2.4.3
- b624cfd build(deps): bump docker/setup-qemu-action from 3 to 4
- bce1697 build(deps): bump docker/login-action from 3 to 4
- 14462c4 build(deps): bump docker/build-push-action from 6 to 7
- 3ae595e build(deps): bump docker/metadata-action from 5 to 6
- 4d76de1 build(deps): bump docker/setup-buildx-action from 3 to 4
- 171ed7d build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
- 827f628 nolint:prealloc is unused for linter "prealloc"
- 391899f Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
- a18c975 Bump golang.org/x/time from 0.14.0 to 0.15.0
- e6e94c4 Bump golang.org/x/sync from 0.19.0 to 0.20.0
- 0f9c98a Extend protection of private hosts
- 283f944 Fix test after last change
- b627827 Merge branch 'upstream-main'
- 6e08fd0 Move youtube iframe out of details
- d9a97e2 build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10
- 365f2e6 build(deps): bump github.com/go-webauthn/webauthn from 0.15.0 to 0.16.0
- eda074c Handle an error from fetcher in media proxy
- 7c9863b Make integrations use fetcher.Do, instead of http.Client
- 0ea2481 Add fetcher.Do(req *http.Request)
- 7dbeaa8 Merge branch 'upstream-main'
- b87ea8c Bump github.com/dsh2dsh/gofeed/v2 from 2.4.1 to 2.4.2
- 3bf4620 Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.4 to 2.3.5
- 210993e build(deps): bump actions/upload-artifact from 6 to 7
- 96b6541 Merge branch 'upstream-main'
- fe2bfb2 fix(fetcher): avoid possible SSRF TOCTOU/DNS-rebinding in private network check
- 953ed7e Merge pull request #20 from dsh2dsh/dependabot/github_actions/actions/upload-artifact-7
- 2353d4d Permit access to configured list of hosts inside private networks
- 5bf4006 build(deps): bump actions/upload-artifact from 6 to 7
- f9b756e feat: add SSRF protection for integration HTTP clients
- e8b2785 feat(processor): apply entry blocking both before and after scraping
- df7fc1e fix(integration): fix bugs, naming, and inconsistencies across sub-packages
- 4d78dab Merge branch 'upstream-main'
- 0bdeff5 FETCHER_ALLOW_PRIVATE_NETWORKS
- 849c523 Bump github.com/go-webauthn/webauthn from 0.15.0 to 0.16.0
- 2682421 feat: add FETCHER_ALLOW_PRIVATE_NETWORKS option
- 436ff15 Just log missing tranlation keys, instead of fatal
- 8f00504 Merge branch 'upstream-main'
- 0e13773 feat(locale): add Arabic (ar_SA) translation
- 8d01ca3 feat(locale): add Galician (gl_ES) translation
- 8b84a86 feat: add Galician plural
- d19052c Inline remote response if unable to refresh feed
- f521adc Inline remote response if we unable to find subscription
- 7cd115b Merge branch 'upstream-main'
- 193c951 Bump golang.org/x/net from 0.50.0 to 0.51.0
- be49cba build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
- 14fd8c8 hx-boostify redirects
- b56098b Don't try to fetch more entries,
- 5bfd6c5 Log stripped content of every reposponse witn unexpected status
- 154925e Rename
r *RequestBuildertoself *RequestBuilder - 16a8291 Rename
r *ResponseHandlertoself *ResponseHandler - cc039ad Delete require-trusted-types-for from tests,
- 43a9c9c Log content of unexpected responses during refresh
- 94490c5 Remove require-trusted-types-for CSP
- 24824ca Log value of Retry-After header
- 4f326b4 Merge branch 'upstream-main'
- d7e049f ci(debian): don't build debian packages bi-weekly on forks
- 4d7e8b2 build(deps): bump github.com/tdewolff/minify/v2 from 2.24.8 to 2.24.9
- fe7ba53 Merge pull request #18 from dsh2dsh/dependabot/github_actions/goreleaser/goreleaser-action-7
- c1b57e2 Bump github.com/caarlos0/env/v11 from 11.3.1 to 11.4.0
- 93c6f2c build(deps): bump goreleaser/goreleaser-action from 6 to 7
- 2c66e1a Merge branch 'upstream-main'
- 7f7f23d chore: upgrade to Go 1.26
- 01888d8 fix: run go fix
- 223d29e refactor(icon): remove two loops
- d58cb5b refactor(icon): remove a useless function
- 313f23f refactor(handler): factorize duplicate code into a function
- 54df471 refactor(reader): clarify a ScheduleNextCheck call
- 72784c4 perf(finder): don't parse the candidate page twice
- bb7b85d Merge branch 'upstream-main'
- 7fa38aa perf(urlcleaner): misc performance improvements
- fb7f16e test(encoding): add KOI8-R encoding tests with a sample XML feed
- 8898c42 test(encoding): add more tests regarding CharsetReader
- 12985d1 Merge branch 'upstream-main'
- df4d0bd Add (lsp-go-goimports-local . "miniflux.app/v2")
- 0054314 feat(locale): update Polish translation
- 28441d1 perf(readability): small performance improvements
- 86832e8 Don't update existing entries for configured feeds
- 7d84b99 Delete condition which never will be true
- 8028a77 Merge branch 'upstream-main'
- 8d19529 perf(parser): don't process the whole page to detect its format
- 6838f3a perf(sanitizer): use WriteByte for single characters instead of WriteString
- 8483f06 perf(sanitizer): refactor hasRequiredAttributes
- da15700 perf(sanitizer): inline getExtraAttributes
- cd6236b perf(sanitize): Use strings.Builder instead of manually concatenating
- 7b07b82 feat(feed): add ignore_entry_updates option to feeds
v2.3.17
Changelog
- 6c5bcd6 Use
new(expr)instead of model.SetOptionalField - 1066077 Merge branch 'upstream-main'
- d3a1e7d ci: update Debian packager Docker image to Trixie
- 7edf42f fix: run go fmt with Go 1.26
- e9997b3 Reuse slog.MultiHandler
- 71a650d Use errors.AsType instead of errors.As
- 38b9974 Switch go to 1.26
- dd36445 Merge branch 'upstream-main'
- 5513827 build(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2
- 8c6b084 Merge branch 'upstream-main'
- 6bffdce Bump golang.org/x/image from 0.35.0 to 0.36.0
- 58bc4c8 Bump github.com/dsh2dsh/gofeed/v2 from 2.4.0 to 2.4.1
- fbba6c4 Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.3 to 2.3.4
- 052ad27 build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
- 96c4587 build(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0
- 3e022fb build(deps): bump golang.org/x/image from 0.35.0 to 0.36.0
- aa81449 build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.35.0
- 90c2199 build(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
- d40e523 fix: 'v' shortcut uses main browser in Safari PWA
- e8c3c16 Auto auto generated title for web interface only (miniflux#4042)
- 9393302 Bump github.com/klauspost/compress from 1.18.3 to 1.18.4
- 78d9c50 Merge branch 'upstream-main'
- 46e77ec fix(request): change FindRemoteIP to fallback to 127.0.0.1
- f19fc2f feat: add validation for TRUSTED_REVERSE_PROXY_NETWORKS config
- 4a381cd Merge branch 'upstream-main'
- 0201c80 refactor(subscription): improve wp-json skip
- 4a51651 Exit early from parsing of subscriptions if context cancelled
- f6b656c Fix e2e test after last change
- e4649ab Bump golang.org/x/oauth2 from 0.34.0 to 0.35.0
- efc104c Refactor FindSubscriptions
- 1b9e555 Check detected feeds are parseable
- f5b72bc Merge branch 'upstream-main'
- 5139333 Refactor sanitizeTitle
- e651906 Convert bytes to string without data copy
- 0022d06 feat(subscription): ignore Wordpress API endpoint when discovering JSON feed
- 253119e refactor(http): minor code cleanup
- 2619eba security(http): don't expose miniflux' version on an unauthenticated endpoint
- 31f4f36 fix(commit-checker): add security to conventional commit pattern
- fc9cb9e refactor(googlereader): unexport two symbols
- 9b859e7 refactor(storage): unexport a bunch of symbols
- 6f3c92d perf(subscription): don't read the body twice
- 551b867 Add
overflow-wrap: break-wordto wrap titles with non-break spaces - bdea57e Simplify
ui/session - df4b8cb Bump codeberg.org/readeck/go-readability/v2 from 2.1.0 to 2.1.1
- 36a5ecf Merge branch 'upstream-main'
- 0dcc0a8 refactor(sanitizer): improve a bit sanitizeAttributes
- 7b65255 refactor(sanitizer): handle deeply nested recursion
- 877062a Merge branch 'upstream-main'
- 6a9d789 refactor(sanitizer): improve how attributes are sanitized
- 0241b9d Merge branch 'upstream-main'
- f3d0e03 refactor(workflows): don't run useless on forks job forks
- 4f54f56 Make comments URL from template during feed processing,
- f7e5d75 Merge branch 'upstream-main'
- 4d27f66 refactor(sanitizer): reorder non-public functions alphabetically
- 5a8431b refactor(sanitizer): enforce isBlockedResource() on srcset URLs
- 9e760e1 test(sanitizer): rewrite TestSelfClosingTags
- bf24fd1 perf(sanitizer): don't do a map lookup for every attribute of a tag
- b57ebac refactor(sanitizer): remove a useless case
- 62f316c refactor(sanitizer): html attributes keys are always lowercase
- 781e557 Use Entry.ParsedURL() as much as possible
- 6b4f775 Merge branch 'upstream-main'
- 89638b4 refactor(sanitizer): remove workaround that strip large img width attribute
- d8181b1 refactor(sanitizer): use a parser instead of a tokenizer
- ce6cd0b fix(rewrite): update rewrite rules for vnexpress.net
- ba05c96 feat(rewrite): add rewrite rules for vnexpress.net
- 58674b9 feat(scraper): add scraper rule for vnexpress.net
- 6b1f208 build(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1
- f3f9190 Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.2 to 2.3.3
- 93f96bb Merge branch 'upstream-main'
- cfc120a Refactor inline of youtube entries
- 7c41128 refactor(sanitizer): use uint instead of int when possible
- 3aea68e refactor(sanitizer): rewrite srcset parser according to HTML specs
- 30e9a5e Merge branch 'upstream-main'
- a5fb91e refactor(sanitizer): rename isValidTag to isAllowedTag
- 8357e6d refactor(sanitizer): don't process tags when len(blockedStack) != 0
- ad4ca71 feat(scraper): add scraper rule for bleepingcomputer.com
- 660c79b feat(rewrite): add rewrite rules for bleepingcomputer.com
- 4da128d Optionally mark blocked entries as read, instead of delete them.
- b2b54c3 Add height and width to enclosures
- 7d02953 Bump github.com/dsh2dsh/gofeed/v2 from 2.3.2 to 2.4.0
- 4d27aac Bump go.yaml.in/yaml/v4 from 4.0.0-rc.3 to 4.0.0-rc.4
- 6b3739d Merge branch 'upstream-main'
- 2fa8995 fix: avoid possible deadlock when cleaning removed entries
- aa69aea Merge branch 'upstream-main'
- ffed2b4 fix(storage): do not keep any old enclosures if there is none in the updated entry
- a1a63ff Merge branch 'upstream-main'
- 9fc69fd refactor(storage): update IconByFeedID to handle sql.ErrNoRows
- c2d9276 Merge branch 'upstream-main'
- ffc6ef5 Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.1 to 2.3.2
- cddd2eb feat(jsonfeed): include
external_urlin JSON entry hash fallback - 33b780d fix(jsonfeed): stop the title fallback loop at the first non-empty value
- 5d8540b fix(jsonfeed): avoid panic when parsing null JSON feed
- a2a5244 feat(jsonfeed): support malformed feeds with author object in authors array
- 30fa163 Bump github.com/dsh2dsh/gofeed/v2 from 2.3.1 to 2.3.2
- 337a7fe Add entry blocking rules to categories
- 8c88d0e Merge branch 'upstream-main'
- 88859c1 docs(client): improve Godoc comments for exported functions
- e14fcf2 refactor(api): replace inlined map and structs with named payload structs
- 3a232d0 test(request): add 100% unit test coverage
- 5a8df8a fix(fetcher): ensure response body is closed even on client error
- a4883ca refactor(fetcher): use modern string functions and improve error messages
- 4cd66ae docs(client): improve Godoc comments for exported functions
- 0ab3bb5 refactor(api): replace inlined map and structs with named payload structs
- 9874440 Merge branch 'upstream-main'
- afeaac9 Rename AbsoluteURL to ResolveToAbsoluteURL
- 71c551f test(timezone): add test for
AvailableTimezones() - bb05b25 refactor(urllib): replace AbsoluteURL and GetAbsoluteURL
- dfdd18e Merg...
Contributors
media
Assets 8
v2.3.16
Changelog
- ab41c13 Always use BasePath + requestURI
- aa0baa3 Implement infinite scroll of unread entries
- c5854d3 Return back page.keyboard_shortcuts.toggle_bookmark_status
- e4b0e31 Merge branch 'upstream-main'
- 6439d35 docs(man): improve
miniflux.1consistency and fix typos - a33cfb2 feat(locale): update translations
- 590adb9 refactor(googlereader): remove output param check for user-info handler
- 9e817e6 feat(googlereader)!: remove CORS handler
- 5594586 fix(googlereader): generated tokens should not be logged even in debug mode
- 48c5e3d Add .lastEntry for templates
- a432435 Merge branch 'upstream-main'
- 9e709cb Refactor fmt.Sprintf in AnotherUserWithFieldExists
- 5db66fc refactor(storage): avoid using Sprintf to update session fields
- da91816 Attach all click event handlers to body
- 4c4477e Merge branch 'upstream-main'
- 561389d feat: add
TRUSTED_REVERSE_PROXY_NETWORKSconfig option - 1cc4ce8 Handle auth proxy from trusted proxies only
- 7eaf826 Change tags page to show feed tags,
- c8575c9 addEventListener's in capture mode
- 6a09183 refactor(database): dont' index removed entries' content
- 4532430 Merge branch 'upstream-main'
- cd7d619 refactor(database): dont' index removed entries' content
- 72e9891 Refactor mark read on scroll js
- 23319da Add simplified filter for blocking feed entries by authors
- 8a55bca Add API endpoint to import entries into existing feed
- f824df3 Add video thumbnail to youtube entries
- 14b64ed Bump github.com/dsh2dsh/gofeed/v2 from 2.2.0 to 2.3.0
- a7fd7b5 Force update means re-fetch the feed and update all entries,
- 239cf4e Add a test for a youtube feed
- a060104 Merge branch 'upstream-main'
- 135e730 Block access to internal networks from proxy and icon fetchers
- 172b2f4 Just sort options
- 09472cf One more place for sanitize + proxify
- 88a03c7 Change layout of youtube entries
- cd14ec3 Fix wrapping of tag list
- fe0eda1 Cleanup old $cspNonce := nonce
- 316535f Show original URL in the list of attachments, instead of proxied one
- 7805e11 Make proxy requests within user's context
- 90e1436 One pass sanitize + proxify downloaded content
- 9a251b6 Bump github.com/dsh2dsh/bluemonday/v2 from 2.3.0 to 2.3.1
- 29f6dc8 feat(icon): disallow fetching icon on private networks
- 6c83e8c feat(mediaproxy): disallow the media proxy to fetch resources on private networks
- f42ddde Merge branch 'upstream-main'
- 142c538 Move proxy handler into mediaproxy package
- d6593a6 Move proxifying of enclosures into mediaproxy package
- 6eb0eca Refactor mediaproxy package
- 3cecfaf Bump github.com/dsh2dsh/bluemonday/v2 from 2.2.0 to 2.3.0
- 2901590 feat(ui): smooth pages transitions
- 709e671 feat(api): execute the content sanitizer when updating or importing entries
- 473c9f2 refactor(config): reuse validateChoices in validateListChoices to avoid duplication
- 90a389a feat: add API endpoint to import entries into existing feed
- 1f39cef Bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0
- 2515a95 Bump github.com/go-playground/validator/v10 from 10.30.0 to 10.30.1
- a697a14 Bump github.com/dsh2dsh/bluemonday/v2 from 2.1.0 to 2.2.0
- 2ef8e95 Add BenchmarkProxy
- e694daa Change style of genericProxyRewriter a little
- 2d3ee56 Bump github.com/go-playground/validator/v10 from 10.29.0 to 10.30.0
- 2956285 Merge branch 'upstream-main'
- 6106546 test(rewrite): add additional test cases for
GetRefererForURL - ad82191 chore: remove obsolete docker compose 'version' key
- 6080d56 fix: Update go devcontainer image to go:1-trixie
- 2745e23 Merge branch 'upstream-main'
- e66b259 Make templates required arg for handler.Refresh()
- 854985b refactor(config): visibility reduction and assorted changes
- 78a13e6 Merge branch 'upstream-main'
- 1bf7c0b feat(ui): add route for viewing individual starred entries from category starred list
- b3ea40e Merge branch 'upstream-main'
- bc40948 build(deps): bump actions/upload-artifact from 5 to 6
- 043996a Merge branch 'upstream-main'
- 2b206be Merge pull request #14 from dsh2dsh/dependabot/github_actions/actions/upload-artifact-6
- 6234fbd build(deps): bump actions/upload-artifact from 5 to 6
- 3cb74e1 feat(locale): update Polish translation
- 038d6f6 Add FUNDING [skip ci]
- a9e5260 Merge branch 'upstream-main'
- fbc4d70 feat: add auto-push option to readeck integration
- 40d9965 feat(template): add link to the GitHub contributors page
- 28e670d build: update Distroless container to Debian 13
- 9236c25 Bump github.com/go-playground/validator/v10 from 10.28.0 to 10.29.0
- 52b2a9c Bump github.com/dsh2dsh/gofeed/v2 from 2.1.1 to 2.2.0
- 612d4ff New content rewrite rule:
html_unescape - 273046c Use width and height from youtube media group
- c6376b9 Bump github.com/dsh2dsh/gofeed/v2 from 2.1.0 to 2.1.1