# FreshRSS 1.27.0 — FreshRSS 1.27.0 - Product: FreshRSS (https://whatsnew.fyi/product/freshrss) - Vendor: FreshRSS - Date: 2025-08-18 - Version: 1.27.0 - Original notes: https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 - Permalink: https://whatsnew.fyi/product/freshrss/releases/1.27.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Implement support for HTTP 429 Too Many Requests and 503 Service Unavailable, obey Retry-After - **added** — Add sort by category title, or by feed title - **added** — Add search operator c: for categories like c:23,34 or !c:45,56 - **added** — Custom feed favicons - **added** — Rework fetch favicons for fewer HTTP requests - **added** — Add more unicity criteria based on title and/or content - **added** — Automatically restore user configuration from backup - **added** — API add support for states in s parameter of streamId - **added** — Improve sharing via Print - **added** — Redirect to the login page from bookmarklet instead of 403 - **added** — Clean local cache more often, when refreshing feeds - **security** — Implement reauthentication (sudo mode) - **security** — Add Content-Security-Policy: frame-ancestors - **security** — Ensure CSP everywhere - **security** — Show warning when unsafe CSP policy is in use - **security** — Fix access rights when creating a new user - **security** — Improve security of form for user details - **security** — Disallow setting non-existent theme - **security** — Regenerate cookie ID after logging out - **security** — Require current password when setting new password * [Milestone](https://github.com/FreshRSS/FreshRSS/milestones/1.27.0) A few highlights ✨: * Implement support for HTTP `429 Too Many Requests` and `503 Service Unavailable`, obey `Retry-After` * Add sort by category title, or by feed title * Add search operator `c:` for categories like `c:23,34` or `!c:45,56` * Custom feed favicons * Several security improvements, such as: * Implement reauthentication (*sudo* mode) * Add `Content-Security-Policy: frame-ancestors` * Ensure CSP everywhere * Fix access rights when creating a new user * Several bug fixes, such as: * Fix redirections when scraping from HTML * Fix feed redirection when coming from WebSub * Fix support for XML feeds with HTML entities, or encoded in UTF-16LE * Docker alternative image updated to Alpine 3.22 with PHP 8.4 (PHP 8.4 for default Debian image coming soon) * Start supporting PHP 8.5+ * And much more… This release has been made by @Alkarex, @Inverle, @the7thNightmare and newcomers @Deioces120, @Fraetor, @Tarow, @dotsam, @hilariousperson, @pR0Ps, @triatic, @tryallthethings Full [changelog](https://github.com/FreshRSS/FreshRSS/blob/1.27.70/CHANGELOG.md): * Features * Implement support for HTTP `429 Too Many Requests` and `503 Service Unavailable`, obey `Retry-After` [#7760](https://github.com/FreshRSS/FreshRSS/pull/7760) * Add sort by category title, or by feed title [#7702](https://github.com/FreshRSS/FreshRSS/pull/7702) * Add search operator `c:` for categories like `c:23,34` or `!c:45,56` [#7696](https://github.com/FreshRSS/FreshRSS/pull/7696) * Custom feed favicons [#7646](https://github.com/FreshRSS/FreshRSS/pull/7646), [#7704](https://github.com/FreshRSS/FreshRSS/pull/7704), [#7717](https://github.com/FreshRSS/FreshRSS/pull/7717), [#7792](https://github.com/FreshRSS/FreshRSS/pull/7792) * Rework fetch favicons for fewer HTTP requests [#7767](https://github.com/FreshRSS/FreshRSS/pull/7767) * Add more unicity criteria based on title and/or content [#7789](https://github.com/FreshRSS/FreshRSS/pull/7789) * Automatically restore user configuration from backup [#7682](https://github.com/FreshRSS/FreshRSS/pull/7682) * API add support for states in `s` parameter of `streamId` [#7695](https://github.com/FreshRSS/FreshRSS/pull/7695) * Improve sharing via Print [#7728](https://github.com/FreshRSS/FreshRSS/pull/7728) * Redirect to the login page from bookmarklet instead of 403 [#7782](https://github.com/FreshRSS/FreshRSS/pull/7782) * Clean local cache more often, when refreshing feeds [#7827](https://github.com/FreshRSS/FreshRSS/pull/7827) * Security * Implement reauthentication (*sudo* mode) [#7753](https://github.com/FreshRSS/FreshRSS/pull/7753) * Add `Content-Security-Policy: frame-ancestors` [#7677](https://github.com/FreshRSS/FreshRSS/pull/7677) * Ensure CSP everywhere [#7810](https://github.com/FreshRSS/FreshRSS/pull/7810) * Show warning when unsafe CSP policy is in use [#7804](https://github.com/FreshRSS/FreshRSS/pull/7804) * Fix access rights when creating a new user [#7783](https://github.com/FreshRSS/FreshRSS/pull/7783) * Improve security of form for user details [#7771](https://github.com/FreshRSS/FreshRSS/pull/7771), [#7786](https://github.com/FreshRSS/FreshRSS/pull/7786) * Disallow setting non-existent theme [#7722](https://github.com/FreshRSS/FreshRSS/pull/7722) * Regenerate cookie ID after logging out [#7762](https://github.com/FreshRSS/FreshRSS/pull/7762) * Require current password when setting new password [#7763](https://github.com/FreshRSS/FreshRSS/pull/7763) * Add missing access checks for feed-related actions [#7768](https://github.com/FreshRSS/FreshRSS/pull/7768) * Strip more unsafe attributes such as `referrerpolicy`, `ping` [#7770](https://github.com/FreshRSS/FreshRSS/pull/7770) * Remove unneeded execution permissions [#7802](https://github.com/FreshRSS/FreshRSS/pull/7802) * Bug fixing * Fix redirections when scraping from HTML [#7654]( _[Truncated at 4000 characters — full notes: https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0]_