Miniflux

New features

• Feed and entry language detection

  • Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
  • Entries without their own language now inherit the language declared by the feed.
  • Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  • The language field is exposed through the API and the Go client for both feeds and entries.

• Other additions

  • Feed discovery now finds the feeds offered by GitHub pages.
  • TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
  • The browser favicon is now served as SVG for a sharper icon on high-density displays.
  • Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

• Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
• Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
• Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

• Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
• Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
• Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
• Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

• Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
• Fixed a race condition during template rendering that could return a page translated in another user's language.
• Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
• Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
• Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
• MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
• Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
• Fixed a category deletion check that could remove all of a user's categories.
• Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
• Fixed the no_media_player option being ignored when creating a feed.
• A feed proxy URL can now be cleared once it has been configured.
• Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
• Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
• Fixed the remove_tables rewrite rule reordering article content.
• Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
• Fixed empty tags being sent to Raindrop when no tag was configured.
• Fixed overlapping article headings that wrap onto multiple lines.
• Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies

Updated several Go modules and GitHub Actions dependencies, including:

• github.com/andybalholm/brotli 1.2.2
• github.com/coreos/go-oidc/v3 3.20.0
• github.com/prometheus/client_golang 1.24.0
• golang.org/x/crypto 0.54.0
• golang.org/x/net 0.57.0
• golang.org/x/text 0.40.0

---

As always, thank you to all contributors who helped improve Miniflux in this release.

New features

• Improved full-text search

  • Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions.

• API improvements

  • Added GET /v1/entries/ids to efficiently retrieve paginated entry IDs.
  • Added support for updating the starred status of multiple entries through PUT /v1/entries.
  • API clients can now filter entries by tags.
  • The Go client now exposes additional feed fields (description, icon, next_check_at, notification settings, no_media_player, etc.) and supports the new tag filter.

• Atom feed improvements

  • When an Atom entry id contains an HTTP URL, it is now used as the entry URL when no dedicated link is available.

Performance improvements

• Improved full-text search performance by caching compiled regular expressions used by filtering rules.
• Reduced database work when computing category statistics.
• Improved browser caching of static assets.
• Reduced template rendering overhead by precomputing static icon URLs.

Security

• Prevent username enumeration through login timing differences.
• PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness. This change raises the minimum supported PostgreSQL version to 11.

Bug fixes

• Fixed validation of per-feed entry filter rules in the web interface.
• SOCKS proxy URLs can once again be configured for individual feeds.
• Fixed enclosure URL proxying consistency across API endpoints.
• Fixed several API handlers that incorrectly returned 404 Not Found or 400 Bad Request instead of proper server errors.
• Fixed inconsistent handling of invalid category filters in the Entries API.
• Fixed user lookup edge cases that could result in nil pointer dereferences.
• Fixed enclosure lookup to correctly scope results by user.
• Fixed the Google Reader Quick Add endpoint to honor the configured HTTP user agent.
• Fixed refresh-all keyboard shortcut (R) to correctly display the success notification.
• Fixed localization formatting issues affecting several languages.
• Fixed request builder state leaking during feed discovery.
• Improved accessibility by correcting an aria-labelledby issue.

Localization

• Updated German (de_DE) translations.
• Updated Galician (gl_ES) translations.

Documentation

• Clarified the units for POLLING_FREQUENCY.
• Improved documentation for TRUSTED_REVERSE_PROXY_NETWORKS.

Dependencies

• Updated several Go modules and GitHub Actions dependencies.

Security

• Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
• Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
• Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
• Hardened metrics endpoint authentication by using constant-time credential comparisons.

Bug Fixes

• Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

Improvements

• Added Korean language support.
• Improved HTML truncation performance and reduced memory allocations.
• Optimized feed discovery, subscription detection, date parsing, and tag filtering.
• Simplified and refactored several storage and query-building components for better maintainability.

Dependencies

Updated several dependencies, including:

• github.com/go-webauthn/webauthn 0.17.4
• golang.org/x/crypto 0.52.0
• golang.org/x/image 0.41.0
• golang.org/x/net 0.55.0

---

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login.
• Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support.
• Persist WebAuthn backup eligibility/state and validated credential state after login.
• Require POST requests for logout, feed refresh, and OAuth2 unlink actions.
• Apply CSRF protection to all non-safe HTTP methods.
• Add http.CrossOriginProtection middleware for the web UI.
• Validate redirect URL schemes in HTMLRedirect to prevent unsafe redirects.
• Restore URL scheme validation in templates for untrusted feed URLs.
• Sanitize filenames in Content-Disposition headers to prevent header injection.
• Reject empty OAuth2 state parameters when no authentication flow is in progress.
• Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects.
• Validate URI schemes case-insensitively according to RFC 3986.
• Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks.
• Cap the maximum entry limit to 1000 across the UI, API, and storage layer.

Improvements

• Add support for exporting and importing Miniflux-specific feed settings in OPML files, allowing full feed configuration backups and restores.
• Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients.
• Add support for the shortcuts: iOS URL scheme in sanitized content.
• Add Linux riscv64 builds.
• Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation.
• Improve Chinese Traditional (zh-TW) translations.
• Improve RSS parsing for feeds that reuse the same GUID across multiple entries.
• Improve UI consistency for authentication settings and external-link behavior.
• Automatically clean up orphaned feed icons from the database.
• Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message.
• Improve error handling and cleanup in WebAuthn login flows.
• Simplify large feed and user deletions using ON DELETE CASCADE.

Performance

• Improve sanitizer performance significantly and reduce allocations in multiple hot paths.
• Optimize reading-time calculation to avoid unnecessary allocations.
• Improve feed parsing performance by preallocating slices/maps and reducing string allocations.
• Optimize ISO8601 duration parsing for YouTube and podcast feeds.
• Reduce database queries for navigation metadata and storage operations.
• Optimize template rendering for icons and CSP generation.
• Avoid loading entry content from PostgreSQL when not needed.
• Reuse a singleton HTML minifier instance instead of allocating one per request.
• Optimize string handling in the reader and sanitizer packages.

Bug Fixes

• Fix incorrect read/starred toggling in Google Reader API.
• Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the removed entry status.
• Fix handling of slow HTTP headers.
• Fix "open in new tab" behavior for redirected external entry links.
• Fix Wallabag integration typo in error messages.

Dependency Updates

• Update github.com/go-webauthn/webauthn to v0.17.3.
• Update various golang.org/x/* packages.
• Update github.com/coreos/go-oidc/v3 to v3.18.0.
• Update github.com/tdewolff/minify/v2 to v2.24.13.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.
• Improve OAuth2 security:
  • Verify OIDC ID token signatures and claims.
  • Prevent OAuth identity overwrite when already linked.
  • Clear PKCE verifier and CSRF state after use.
  • Validate HTTP status from Google userinfo endpoint.
• Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication.
• Use constant-time comparison for token validation.
• Fix potential DoS when truncating large untrusted input in templates.
• Reject oversized favicons.

Improvements

• Improve configuration validation with cross-field consistency checks.
• OAuth2:
  • Explicit provider selection via OAUTH2_PROVIDER.
  • Better separation between Google and OIDC providers.
  • Updated Google OAuth endpoints to v2.
• UI:
  • Add cache-busting for static assets (JS, CSS, icons).
  • Add Cache-Control: immutable for static resources.
• Sanitizer:
  • Allow iframes from framatube.org.
  • Improve performance and parsing behavior.
• Metrics and workers:
  • Graceful shutdown support for worker pool and metrics collector.
  • Better error reporting for metrics.
• API / HTTP:
  • Support weak ETag comparison.
  • Improve response helpers and headers handling.

Performance

• Reduce number of SQL queries for unread entries and UI pages.
• Optimize database queries and locking behavior:
  • Use SKIP LOCKED in archive operations.
  • Reduce unnecessary queries and connections.
• Improve UI performance:
  • Cache keymaps instead of recomputing on each keypress.
  • Batch DOM updates when marking entries as read.
• Optimize sanitizer, media proxy, routing, and template rendering.
• Reduce allocations in various hot paths.

Bug Fixes

• Fix category update validation rendering.
• Fix redirect after marking a feed as read from category view.
• Fix timezone comparison logic.
• Fix Arabic pluralization rules (ar_SA).
• Fix validator behavior when clearing user filters.
• Fix CLI behavior for --info and --version.
• Fix CORS preflight responses (return 204).
• Ensure 204 responses do not include Content-Type.
• Ignore unsupported media proxy targets and handle MIME types correctly.

Refactoring

• Remove dependency on gorilla/mux across the codebase.
• Improve code structure and naming consistency (API, OAuth2, config, validators).
• Simplify timezone and server setup logic.
• Improve testability and documentation (GoDoc updates).

Dependencies

• Update multiple dependencies, including:

  • github.com/lib/pq
  • github.com/go-jose/go-jose/v4
  • github.com/go-webauthn/webauthn
  • github.com/andybalholm/brotli
  • github.com/tdewolff/minify/v2
  • golang.org/x/image
  • github.com/PuerkitoBio/goquery

Security

• Block outbound requests to private networks made by the fetcher by default.
• Add SSRF protection for integration HTTP clients by blocking connections to private network addresses at connect time.
• Fix a possible SSRF TOCTOU / DNS-rebinding issue in the fetcher private network check.
• Ensure private network protections also apply to redirect targets.
• Treat RFC 6598 shared address space (100.64.0.0/10) as non-public.

Breaking Changes

To prevent potential SSRF, Miniflux now blocks access to services hosted on private networks by default.

• FETCHER_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access feeds hosted on a local network.
• INTEGRATION_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access third-party integration services hosted on a local network.

Improvements

• Apply entry blocking rules both before and after scraping to avoid unnecessary requests and allow matching on fetched content.
• Add ignore_entry_updates feed option to skip updating existing entries during scheduled polling.
• Add Arabic (ar_SA) translation.
• Add Galician (gl_ES) translation.
• Update Polish translation.
• Various performance improvements across multiple components (fetcher, parser, sanitizer, readability, URL cleaner, feed discovery, and Google Reader API).
• Simplify parts of the Google Reader code and reduce allocations in several hot paths.
• Reduce fetcher request size slightly to improve packet efficiency.

Bug Fixes

• Fix multiple bugs and inconsistencies across integration sub-packages (error handling, logging, status checks, and naming).
• Fix potential panic in the Omnivore integration when handling empty error arrays.
• Correct error prefixes and typos in several integrations.

Dependencies

• Update golang.org/x/net to 0.52.0.
• Update golang.org/x/crypto to 0.49.0.
• Update golang.org/x/image to 0.37.0.
• Update golang.org/x/oauth2 to 0.36.0.
• Update github.com/go-webauthn/webauthn to 0.16.1.
• Update github.com/tdewolff/minify/v2 to 2.24.10.

Other Changes

• Upgrade to Go 1.26.
• Add go:fix directive for deprecated client.New() to ease migration to NewClient().
• Add KOI8-R encoding tests with a sample XML feed.
• Add additional tests for CharsetReader.
• Update several GitHub Actions used for CI and container builds.
• Avoid building Debian packages bi-weekly on forks.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49).
• Improve HTML sanitizer by switching from the tokenizer to the golang.org/x/net/html parser to better match browser behavior and reduce the risk of injection issues.
• Enforce blocked resource checks on srcset URLs.
• Improve blocked resource handling (including updates to blocked URL substrings).
• Add validation for TRUSTED_REVERSE_PROXY_NETWORKS configuration to prevent silent misconfiguration.
• Prevent possible deadlock when cleaning removed entries.
• Ensure HTTP response bodies are always closed, even on client errors.

Improvements

• Rewrite srcset parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly.

• Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling).

• Handle deeply nested HTML more robustly in the sanitizer.

• Add scraper and rewrite rules for:

  • bleepingcomputer.com
  • vnexpress.net

• Improve JSON Feed support:

  • Support malformed feeds with author objects in the authors array.
  • Avoid panic when parsing null feeds.
  • Improve title fallback logic.
  • Include external_url in JSON entry hash fallback.

• Ignore WordPress wp-json API endpoint during JSON feed discovery.

• Add unread status filter to search results.

• Improve timezone handling internals and performance.

• Improve API payload structures and Godoc comments.

• Improve JavaScript code readability and keyboard shortcut handling.

• Restore cmd/ctrl/shift-click behavior on main navigation.

• Fix Safari PWA behavior for the v shortcut to open links in the main browser.

Bug Fixes

• Do not keep old enclosures when an updated entry has none.
• Handle sql.ErrNoRows properly in IconByFeedID.
• Change FindRemoteIP to fall back to 127.0.0.1.

Configuration Changes

• Removed FILTER_ENTRY_MAX_AGE_DAYS. This option can be replaced with a filter rule such as max-age:<duration>. Global environment variables should be reserved for process-level configuration.

Dependencies

• Update github.com/lib/pq to 1.11.2.

• Update:

  • golang.org/x/net to 0.50.0
  • golang.org/x/crypto to 0.48.0
  • golang.org/x/image to 0.36.0
  • golang.org/x/oauth2 to 0.35.0
  • golang.org/x/term to 0.40.0

• Update Debian packager Docker image to Trixie.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues. This behavior is configurable at the instance level.
• Disallow fetching feed icons from private networks to reduce the SSRF attack surface. This is also configurable at the instance level.
• Add the TRUSTED_REVERSE_PROXY_NETWORKS configuration option to prevent spoofing of HTTP headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip. This option must be configured when AUTH_PROXY_HEADER is enabled.
• Stop logging generated Google Reader API tokens, even when debug mode is enabled.
• Remove the CORS handler from the Google Reader API, as it is not intended to be used by web clients, reducing the overall attack surface.

Performance and Storage

• Avoid indexing the content of removed entries, significantly reducing database index size after cleanup.
• Minor storage and database refactoring to simplify code paths and reduce unnecessary formatting overhead.

API and Integrations

• Add a new API endpoint to import entries into an existing feed.
• Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization.
• Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers.
• Add an auto-push option to the Readeck integration.

User Interface

• Add smooth page transitions for a more polished navigation experience.
• Add a route to view individual starred entries directly from a category’s starred list.
• Add a link to the GitHub contributors page in templates.
• Update all translations.

Documentation and Tooling

• Improve consistency and fix typos in the miniflux(1) manual page.
• Remove the obsolete version key from Docker Compose examples.
• Update the Go devcontainer image to go:1-trixie.
• Update the Distroless container base image to Debian 13.
• Update GitHub Actions dependencies.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

✨ New Features

• New configuration option to disable the Miniflux API
• Added option to save entries to a specific Linkwarden collection
• YouTube subscription improvements:
  • Provide multiple feeds for YouTube content: Channel, videos only, short videos, live streams
  • Better canonical URL detection (now has its own dedicated step)
  • Improved YouTube channel parsing, including default playlists
• Allow feed entries with <i> and <small> tags
• URL Cleaner: Remove additional trackers from URLs

🐛 Bug Fixes

• YouTube embeds: Avoid Error 153 (video player configuration error) in various scenarios
• API: fetchContent endpoint now properly rewrites media URLs when using the media proxy
• Security: Only relative paths are now allowed for the redirectURL parameter
• CI fixes:
  • Improved CodeQL workflow (language matrix + dynamic analysis)
  • Fixed missing GitHub Actions permissions
  • Fixed RPM package versioning for scheduled and pull_request triggers

🧹 Refactoring & Maintenance

• JavaScript optimizations: use replace instead of remove/add, minor regex cleanup
• Performance improvement: removed string concatenation in loops
• Updated Polish translation
• Updated Postgres volume path in Docker Compose examples
• Added new CI workflow to mirror the Git repo to Codeberg

📦 Dependency Updates

This release includes updates to several dependencies:

• golang.org/x/* modules (net, oauth2, image, crypto)
• github.com/tdewolff/minify/v2
• github.com/coreos/go-oidc/v3
• github.com/go-webauthn/webauthn
• github.com/PuerkitoBio/goquery
• Docker base image updates (Alpine 3.23)
• GitHub Actions:
  • actions/checkout v6
  • actions/upload-artifact v5
  • golangci/golangci-lint-action v9

For more details, look at the Git commit history.

✨ New Features

• Go Client: Allow passing a custom http.Client and add context support to API methods.
• UI: Redirect users back to the original page after logging in.
• Template: Improved Content Security Policy: extracted CSP generation into a function, added systematic nonces, and changed default-src to 'none' for stronger security.
• Integrations:
  • Added tags option for the Karakeep integration.
  • Added new Archive.org integration.
• Rewrite Rules:
  • Added remove_img_blur_params rule.
  • Added add_image_title rule for explainxkcd.com.

🧰 Improvements & Refactoring

• Replaced custom modal with native <dialog> element for simpler, more accessible UI.
• Simplified date parsing in the reader and XML encoding logic.
• Optimized sanitizer functions (hasRequiredAttributes, hasValidURIScheme, isBlockedResource).
• Replaced fmt.Errorf with errors.New where applicable.
• Removed dependency on hstore in the database layer and relaxed implicit NOT NULL for serial types.
• Simplified Fever API slice sizing and various internal cleanups.
• Preallocated slices and optimized string/number conversions for better performance.

🧪 Tests

• Added test cases for XML encoding behavior.

🐛 Bug Fixes

• Fixed CSS layout overflow when external links are too long.
• Fixed JSON Feed parser to fallback to external_url when url is missing.
• Updated scraper rule for Dark Reading.

📚 Documentation

• Clarified the POLLING_FREQUENCY environment variable in the documentation.

🏗️ Build & CI

• Updated dependencies:

  • github.com/tdewolff/minify/v2 → 2.24.4
  • golang.org/x/net → 0.46.0
  • golang.org/x/image → 0.32.0
  • golang.org/x/oauth2 → 0.32.0
  • github.com/coreos/go-oidc/v3 → 3.16.0
  • github/codeql-action → 4

• Updated make lint and enabled additional Go linters (perfsprint, goheader).

📝 Additional Notes

If you are seeing this Postgres error: Error: pq: must be owner of extension hstore, you can fix it by running the following SQL command as a superuser for the Miniflux database:

DROP EXTENSION hstore;

This error means you initially created the hstore extension as a different database user than the one you are currently using for Miniflux.

For more details, look at the Git commit history.