Miniflux

New features Feed and entry language detection Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries.

New features Improved full-text search Search queries now use PostgreSQL’s websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions.

Security Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.

Security Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login.

Security Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.

Security Block outbound requests to private networks made by the fetcher by default.

Security Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49).

Security Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues.

New Features New configuration option to disable the Miniflux API Added option to save entries to a specific Linkwarden collection YouTube subscription improvements: Provide multiple feeds for YouTube content: Channel, videos only, short videos, live stre…

New Features Go Client: Allow passing a custom http.Client and add context support to API methods.

New Features UI: Added a “Back to top” link for easier navigation.

New Features Keep only metadata of removed entries to reduce database size.

New Features TLS support for Unix sockets: Miniflux can now serve TLS over Unix domain sockets using CERT_FILE and KEY_FILE (#fcf86e3).

test(sanitizer): add unit test for 0x0 pixel tracker test(sanitizer): add test case to cover Vimeo iframe rewrite without query string refactor(youtube): Remove a regex and make use of fetchWatchTime refactor(youtube): initialize two maps to the proper le…

refactor(googlereader): remove redundant log message refactor(googlereader): move constants to separate files fix(webauthn): correct argument in debug log fix(sanitizer): MathML tags are not fully supported by golang.org/x/net/html fix(migrations): prevent

refactor(js): replace DomHelper methods with standalone functions refactor: avoid logging twice the feed errors in the background worker fix(api): hide_globally categories field should be a boolean fix(ui): add missing await when calling navigator.share()…

test(api): update base URL after upgrading Hugo refactor(rewrite): reorganize referer rules and remove obsolete mappings refactor: combine feed icon handlers to use only externalIconID fix(ui): update share feature to correctly select the title element and

test(encoding): add unit tests for CharsetReader function refactor(xml): improve the performances of NewXMLDecoder refactor(ui): remove superfluous cast refactor(request): broaden an error condition when parsing cookies refactor(processor): remove superfl…

test(js): improve .jshintrc (strict comparison, etc…) test(sanitizer): add a fuzzer refactor(rewriter): use custom title case converter implementation instead of golang.org/x/text/cases.Title() refactor(readingtime): replace whatlanggo package with an ad-…

test(rewrite): add unit test for referer rewrite function refactor(subscription): use strings.HasSuffix instead of a regex in FindSubscriptionsFromYouTubePlaylistPage refactor(sanitizer): use token.String() instead of html.EscapeString(token.Data) refacto…

fix: unable to change password due to a typo in SQL parameter fix: show only one player when there are several audio/video enclosures feat(mediaproxy): pass original filename in Content-Disposition header feat(mediaproxy): implement referer spoofing for r…

fix(webauthn): add backup eligibility flag workaround to avoid a 401 response fix: update Last-Modified if it changes in a 304 response feat(webauthn): show help message regarding username and non-discoverable credentials feat(rss): calculate hash based on

refactor: split processor package into smaller files fix(mediaproxy): forward client user-agent to origin to bypass bot protection fix: use root URL to generate absolute proxy URL fix: remove progression save on shared entry fix: add datasource variable a…

refactor: simplify Youtube feeds discovery fix(integration): define content encoding explicitly when sending article body to Readeck fix(fever): correct sorting direction when using max_id argument fix(client): Return nil and error if endpoint is an empty…

test: add unit tests for IsModified() behaviour refactor: improve YouTube page feed detection fix(ui): settings form is not populated correctly after validation errors fix(ui): playback speed indicator precision fix(ui): playback speed indicator on shared…

api: rand.Intn(math.MaxInt64) causes tests to fail on 32-bit architectures (use rand.Int() instead) ci: use docker/metadata-action instead of deprecated shell-scripts database: remove entries_feed_url_idx index because entry URLs can exceeds btree index s…

api: rewrite API integration tests without build tags ci: add basic ESLinter checks ci: enable go-critic linter and fix various issues detected ci: fix JavaScript linter path in GitHub Actions cli: avoid misleading error message when creating an admin user

Move search form to a dedicated page Add Readeck integration Add feed option to disable HTTP/2 to avoid fingerprinting Add Enter key as a hotkey to open selected item Proxify video element poster attribute Add a couple of new possible locations for feeds…

Add Linkwarden integration Add LinkAce integration Add FORCE_REFRESH_INTERVAL config option Add item-meta-info-reading-time CSS class Add add_dynamic_iframe rewrite function Add attribute data-original-mos to add_dynamic_image rewrite candidates Update en…

Add Omnivore integration Fixes for the regressions introduced in version 2.0.50: Ensure all HTML documents are encoded in UTF-8 Send default User-Agent and HTTP caching headers when making HTTP requests Allow Youtube links to be opened outside the iframe…

Add WebAuthn / Passkey integration (Define BASE_URL config option and set WEBAUTHN=1) Add RSS-Bridge integration Take RSS TTL field into consideration to schedule next check date Show number of visible entries instead of number of read entries in feed list

Implement structured logging using log/slog package.

Add generic webhook integration Send webhook events when new entries are detected Send wehbook events when saving an entry Sign the outgoing requests with HMAC-SHA256 Improve Telegram integration Add built-in Telegram client Remove dependency on go-telegr…

Update rules for webtoons.com Use HTTP client from the standard library for third-party integrations Rename internal url package to urllib to avoid overlap with net/url Add Shaarli integration Add Shiori integration Add Apprise integration Add Readwise Re…

Add scraper and rewrite rules for Webtoons Fix regression in integration page and simplify SQL query Wallabag integration: add more information in log messages Add support for custom Youtube embed URL Fix accessibility issues in modal component Fix modal…

Add media player to listen to audio and video podcasts with the possiblity to resume to last playback position Add default tag names for Linkding integration Mark only globally visible entries when marking all entries from UI Use image included in feeds as

Add link to the URL rewrite rules documentation Update scraping rules for ilpost.it Update rewrite rules for theverge.com Add a rewrite rule to remove clickbait titles Make sure PROXY_IMAGES option is backward compatible with PROXY_OPTION and PROXY_MEDIA_…

Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592) Creating an RSS feed item with the inline description containing an <img> tag with a srcset attribute pointing to an invalid URL like http:a<script>alert(…

Fix header items wrapping Add option to enable or disable double tap Improve PWA display mode label in settings page Bump golang.org/x/* dependencies Update translations Add scraping rule for ilpost.it Update reading time HTML element after fetching the o…

Reverted PR #1290 (follow the only link) because it leads to several panics/segfaults that prevent feed updates Disable double-tap mobile gesture if swipe gesture is disabled Skip integrations if there are no entries to push Enable TLS-ALPN-01 challenge f…

Update dependencies Pin Postgres image version in Docker Compose examples to avoid unexpected upgrades Make English and Spanish translation more consistent: Use “Feed” everywhere instead of “Subscription” Use “Entry” instead of “Article” Allow Content-Type

Add support for date filtering in Google Reader API item ID calls Handle RSS entries with only a GUID permalink Go API Client: Accept endpoint URLs ending with /v1/ CORS API headers: Allow Basic authorization header Log feed URL when submitting a subscrip…

Make sure to use the new Debian and RPM repositories: https://miniflux.app/docs/howto.html#apt-repo https://miniflux.app/docs/howto.html#rpm-repo List of changes: Rename default branch from master to main Update GitHub Actions Bump github.com/prometheus/c…

Add rewrite rule to decode base64 content Add Linkding integration Add comment button to Telegram message Add API endpoint to fetch unread and read counters Fixes logic bug in Google Reader API sanity check Reduce number of CORS preflight check to save ne…

Gray out pagination buttons when they are not applicable Use truncated entry description as title if unavailable Do not fallback to InnerXML if XHTML title is empty Add + keyboard shortcut for new subscription page Add (+) action next to Feeds to quickly…

Set read-all permission to GITHUB_TOKEN for GitHub Actions Pin jshint version in linter job Fix incorrect conversion between integer types Add new GitHub Actions workflows: CodeQL and Scorecards analysis Handle Atom feeds with space around CDATA Bump gith…

Add rewrite rule for comics website http://monkeyuser.com Add <head> tag to OPML export Tighten Systemd sandboxing and update comments in miniflux.service Add RuntimeDirectory to Systemd service Order disabled feeds at the end of the list Add support for…

Build RPM and Debian package with PIE mode enabled Add CSS rule to hide <template> tag in old browsers Bump github.com/tdewolff/minify/v2 from 2.9.21 to 2.9.22 Bump github.com/lib/pq from 1.10.2 to 1.10.3 Remove RequestURI() hack Improve zh_CN translation…

Bump github.com/tdewolff/minify/v2 from 2.9.17 to 2.9.21 Bump mvdan.cc/xurls/v2 from 2.2.0 to 2.3.0 Bump github.com/PuerkitoBio/goquery from 1.6.1 to 1.7.1 Bump github.com/prometheus/client_golang from 1.10.0 to 1.11.0 Add /rss/ to the list of well known…

Expose comments_url entry field in Golang API client Use unique file names for cache busting instead of query string Highlight and sort feeds with unread entries in feeds list Mark items as read on click/middle click of external links Fix: Firefox on Wind…