# Miniflux changelog

> A minimalist and opinionated feed reader.

- Vendor: Frédéric Guillot
- Category: Productivity
- Official site: https://miniflux.app
- Tracked by: What's New (https://whatsnew.fyi/product/miniflux)
- Harvested from: GitHub (miniflux/v2)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 2.3.3 — Miniflux 2.3.3

- Date: 2026-07-24
- Version: 2.3.3
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.3
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.3

- **added** — Miniflux now reads the language declared by feeds and entries from RSS, Atom, RDF/RSS, and JSON Feed sources and stores it on both feeds and entries
- **added** — Entries without their own language now inherit the language declared by the feed
- **added** — Article titles and content are rendered with a matching lang attribute for improved screen reader pronunciation, hyphenation, and browser translation prompts
- **added** — The language field is exposed through the API and the Go client for both feeds and entries
- **added** — Feed discovery now finds the feeds offered by GitHub pages
- **added** — TLS certificates are reloaded when the process receives SIGHUP
- **added** — The browser favicon is now served as SVG for a sharper icon on high-density displays
- **changed** — Compressed responses are negotiated with a more standard-compliant Accept-Encoding parser, including quality values and wildcards
- **changed** — Long entry and feed lists render noticeably faster by avoiding layout and paint work for off-screen rows
- **changed** — Reduced memory allocations when stripping and truncating HTML
- **changed** — Compression writers are now pooled instead of being allocated for every compressed response
- **security** — Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}
- **security** — Unix sockets are now created with 0660 permissions instead of being world-writable
- **security** — Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry
- **security** — Feed-declared language values are now validated before being stored
- **fixed** — Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language
- **fixed** — Fixed a race condition during template rendering that could return a page translated in another user's language
- **fixed** — Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining
- **fixed** — Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0
- **fixed** — Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists

###### New features

- **Feed and entry language detection**
  - Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS `<language>` and `<dc:language>` elements, `xml:lang` on Atom 1.0 and 0.3 documents, `dc:language` in RDF/RSS 1.0 feeds, and the `language` field of JSON Feed.
  - Entries without their own language now inherit the language declared by the feed.
  - Article titles and content are rendered with a matching `lang` attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  - The `language` field is exposed through the API and the Go client for both feeds and entries.

- **Other additions**
  - Feed discovery now finds the feeds offered by GitHub pages.
  - TLS certificates are reloaded when the process receives `SIGHUP`, so renewed certificates can be picked up without a restart.
  - The browser favicon is now served as SVG for a sharper icon on high-density displays.
  - Compressed responses are negotiated with a much more standard-compliant `Accept-Encoding` parser, including quality values and wildcards.

###### Performance improvements

- Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
- Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
- Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

###### Security

- Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through `GET /v1/icons/{iconID}`.
- Unix sockets are now created with `0660` permissions instead of being world-writable. **Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.**
- Fixed an issue where `limit=0` in entry queries bypassed the 1000-entry cap and returned every matching entry.
- Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

###### Bug fixes

- Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
- Fixed a race condition during template rendering that could return a page translated in another user's language.
- Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
- Fixed a division-by-zero crash with the `entry_frequency` scheduler when `SCHEDULER_ENTRY_FREQUENCY_FACTOR` was set to `0`; the value must now be greater than or equal to `1`.
- Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
- `MEDIA_PROXY_RESOURCE_TYPES` and `TRUSTED_REVERSE_PROXY_NETWORKS` now accept spaces and trailing commas in their list values instead of refusing to start.
- Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
- Fixed a category deletion check that could remove all of a user's categories.
- Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
- Fixed the `no_media_player` option being ignored when creating a feed.
- A feed proxy URL can now be cleared once it has been configured.
- Fixed `entry_sorting_order` validation on user modification, which returned a server error instead of a validation error for unsupported values.
- Fixed the `fetch_via_proxy` checkbox disappearing when the subscription page was re-rendered after an error.
- Fixed the `remove_tables` rewrite rule reordering article content.
- Fixed plain text `content_text` and `summary` values from JSON Feed being mangled when the

_[Truncated at 4000 characters — full notes: https://github.com/miniflux/v2/releases/tag/2.3.3]_

### 2.3.2 — Miniflux 2.3.2

- Date: 2026-06-27
- Version: 2.3.2
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.2
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.2

- **added** — Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions
- **added** — Added GET /v1/entries/ids endpoint to efficiently retrieve paginated entry IDs
- **added** — Added support for updating the starred status of multiple entries through PUT /v1/entries
- **added** — API clients can now filter entries by tags
- **added** — The Go client now exposes additional feed fields (description, icon, next_check_at, notification settings, no_media_player) and supports the new tag filter
- **added** — When an Atom entry id contains an HTTP URL, it is now used as the entry URL when no dedicated link is available
- **changed** — Improved full-text search performance by caching compiled regular expressions used by filtering rules
- **changed** — Reduced database work when computing category statistics
- **changed** — Improved browser caching of static assets
- **changed** — Reduced template rendering overhead by precomputing static icon URLs
- **changed** — Minimum supported PostgreSQL version is now 11 due to SHA-256 replacement for MD5 in FIPS mode
- **security** — Prevent username enumeration through login timing differences
- **security** — PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness
- **fixed** — Fixed validation of per-feed entry filter rules in the web interface
- **fixed** — SOCKS proxy URLs can once again be configured for individual feeds
- **fixed** — Fixed enclosure URL proxying consistency across API endpoints
- **fixed** — Fixed several API handlers that incorrectly returned 404 Not Found or 400 Bad Request instead of proper server errors
- **fixed** — Fixed inconsistent handling of invalid category filters in the Entries API
- **fixed** — Fixed user lookup edge cases that could result in nil pointer dereferences
- **fixed** — Fixed enclosure lookup to correctly scope results by user

###### New features

- **Improved full-text search**
  - Search queries now use PostgreSQL's `websearch_to_tsquery`, allowing quoted phrases, `OR` operators, and negation (`-term`) in search expressions.

- **API improvements**
  - Added `GET /v1/entries/ids` to efficiently retrieve paginated entry IDs.
  - Added support for updating the starred status of multiple entries through `PUT /v1/entries`.
  - API clients can now filter entries by tags.
  - The Go client now exposes additional feed fields (`description`, `icon`, `next_check_at`, notification settings, `no_media_player`, etc.) and supports the new tag filter.

- **Atom feed improvements**
  - When an Atom entry `id` contains an HTTP URL, it is now used as the entry URL when no dedicated link is available.

###### Performance improvements

- Improved full-text search performance by caching compiled regular expressions used by filtering rules.
- Reduced database work when computing category statistics.
- Improved browser caching of static assets.
- Reduced template rendering overhead by precomputing static icon URLs.

###### Security

- Prevent username enumeration through login timing differences.
- PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness. This change raises the minimum supported PostgreSQL version to **11**.

###### Bug fixes

- Fixed validation of per-feed entry filter rules in the web interface.
- SOCKS proxy URLs can once again be configured for individual feeds.
- Fixed enclosure URL proxying consistency across API endpoints.
- Fixed several API handlers that incorrectly returned `404 Not Found` or `400 Bad Request` instead of proper server errors.
- Fixed inconsistent handling of invalid category filters in the Entries API.
- Fixed user lookup edge cases that could result in nil pointer dereferences.
- Fixed enclosure lookup to correctly scope results by user.
- Fixed the Google Reader Quick Add endpoint to honor the configured HTTP user agent.
- Fixed refresh-all keyboard shortcut (`R`) to correctly display the success notification.
- Fixed localization formatting issues affecting several languages.
- Fixed request builder state leaking during feed discovery.
- Improved accessibility by correcting an `aria-labelledby` issue.

###### Localization

- Updated German (`de_DE`) translations.
- Updated Galician (`gl_ES`) translations.

###### Documentation

- Clarified the units for `POLLING_FREQUENCY`.
- Improved documentation for `TRUSTED_REVERSE_PROXY_NETWORKS`.

###### Dependencies

- Updated several Go modules and GitHub Actions dependencies.

### 2.3.1 — Miniflux 2.3.1

- Date: 2026-05-29
- Version: 2.3.1
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.1
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.1

- **security** — Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account
- **security** — Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs
- **security** — Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses
- **security** — Hardened metrics endpoint authentication by using constant-time credential comparisons
- **fixed** — Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments by reverting the middleware
- **added** — Added Korean language support
- **changed** — Improved HTML truncation performance and reduced memory allocations
- **changed** — Optimized feed discovery, subscription detection, date parsing, and tag filtering

###### Security

* Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account. 
* Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs. 
* Fixed a potential SQL injection vulnerability in dynamically generated `ORDER BY` clauses. 
* Hardened metrics endpoint authentication by using constant-time credential comparisons. 

###### Bug Fixes

* Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

###### Improvements

* Added Korean language support. 
* Improved HTML truncation performance and reduced memory allocations. 
* Optimized feed discovery, subscription detection, date parsing, and tag filtering. 
* Simplified and refactored several storage and query-building components for better maintainability. 

###### Dependencies

Updated several dependencies, including:

* `github.com/go-webauthn/webauthn` 0.17.4
* `golang.org/x/crypto` 0.52.0
* `golang.org/x/image` 0.41.0
* `golang.org/x/net` 0.55.0

---

As always, thank you to all contributors who helped improve Miniflux in this release.

### 2.3.0 — Miniflux 2.3.0

- Date: 2026-05-16
- Version: 2.3.0
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.0
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.0

- **security** — Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login
- **security** — Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification
- **security** — Persist WebAuthn backup eligibility/state and validated credential state after login
- **security** — Require POST requests for logout, feed refresh, and OAuth2 unlink actions
- **security** — Apply CSRF protection to all non-safe HTTP methods
- **security** — Add http.CrossOriginProtection middleware for the web UI
- **security** — Validate redirect URL schemes in HTMLRedirect to prevent unsafe redirects
- **security** — Restore URL scheme validation in templates for untrusted feed URLs
- **security** — Sanitize filenames in Content-Disposition headers to prevent header injection
- **security** — Reject empty OAuth2 state parameters when no authentication flow is in progress
- **security** — Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects
- **security** — Validate URI schemes case-insensitively according to RFC 3986
- **security** — Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks
- **security** — Cap the maximum entry limit to 1000 across the UI, API, and storage layer
- **added** — Add support for exporting and importing Miniflux-specific feed settings in OPML files
- **added** — Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients
- **added** — Add support for the shortcuts: iOS URL scheme in sanitized content
- **added** — Add Linux riscv64 builds
- **changed** — Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation
- **changed** — Improve Chinese Traditional (zh-TW) translations
- **changed** — Improve RSS parsing for feeds that reuse the same GUID across multiple entries
- **changed** — Improve UI consistency for authentication settings and external-link behavior
- **changed** — Automatically clean up orphaned feed icons from the database
- **changed** — Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message
- **changed** — Improve error handling and cleanup in WebAuthn login flows
- **changed** — Simplify large feed and user deletions using ON DELETE CASCADE
- **fixed** — Fix incorrect read/starred toggling in Google Reader API
- **fixed** — Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the removed entry status
- **fixed** — Fix handling of slow HTTP headers
- **fixed** — Fix open in new tab behavior for redirected external entry links
- **fixed** — Fix Wallabag integration typo in error messages

###### Security

* Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login.
* Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support. 
* Persist WebAuthn backup eligibility/state and validated credential state after login.
* Require `POST` requests for logout, feed refresh, and OAuth2 unlink actions.
* Apply CSRF protection to all non-safe HTTP methods.
* Add `http.CrossOriginProtection` middleware for the web UI.
* Validate redirect URL schemes in `HTMLRedirect` to prevent unsafe redirects.
* Restore URL scheme validation in templates for untrusted feed URLs.
* Sanitize filenames in `Content-Disposition` headers to prevent header injection.
* Reject empty OAuth2 state parameters when no authentication flow is in progress.
* Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects.
* Validate URI schemes case-insensitively according to RFC 3986.
* Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks.
* Cap the maximum entry limit to 1000 across the UI, API, and storage layer.

###### Improvements

* Add support for exporting and importing Miniflux-specific feed settings in OPML files, allowing full feed configuration backups and restores.
* Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients.
* Add support for the `shortcuts:` iOS URL scheme in sanitized content.
* Add Linux `riscv64` builds.
* Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation.
* Improve Chinese Traditional (`zh-TW`) translations.
* Improve RSS parsing for feeds that reuse the same GUID across multiple entries.
* Improve UI consistency for authentication settings and external-link behavior.
* Automatically clean up orphaned feed icons from the database.
* Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message.
* Improve error handling and cleanup in WebAuthn login flows.
* Simplify large feed and user deletions using `ON DELETE CASCADE`.

###### Performance

* Improve sanitizer performance significantly and reduce allocations in multiple hot paths.
* Optimize reading-time calculation to avoid unnecessary allocations.
* Improve feed parsing performance by preallocating slices/maps and reducing string allocations.
* Optimize ISO8601 duration parsing for YouTube and podcast feeds.
* Reduce database queries for navigation metadata and storage operations.
* Optimize template rendering for icons and CSP generation.
* Avoid loading entry content from PostgreSQL when not needed.
* Reuse a singleton HTML minifier instance instead of allocating one per request.
* Optimize string handling in the reader and sanitizer packages.

###### Bug Fixes

* Fix incorrect read/starred toggling in Google Reader API.
* Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the `removed` entry status.
* Fix handling of slow HTTP headers.
* Fix "open in new tab" behavior for redirected external entry links.
* Fix Wallabag integration typo in error messages.

###### Dependency Updates

* Update `github.com/go-webauthn/webauthn` to `v0.17.3`.
* Update various `golang.org/x/*` packages.
* Update `github.com/coreos/go-oidc/v3` to `v3.18.0`.
* Update `github.com/tdewolff/minify/v2` to `v2.24.13`.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

### 2.2.19 — Miniflux 2.2.19

- Date: 2026-04-05
- Version: 2.2.19
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.19
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.19

- **security** — Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages
- **security** — Verify OIDC ID token signatures and claims
- **security** — Prevent OAuth identity overwrite when already linked
- **security** — Clear PKCE verifier and CSRF state after use
- **security** — Validate HTTP status from Google userinfo endpoint
- **security** — Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication
- **security** — Use constant-time comparison for token validation
- **security** — Fix potential DoS when truncating large untrusted input in templates
- **security** — Reject oversized favicons
- **changed** — Improve configuration validation with cross-field consistency checks
- **added** — Add explicit provider selection via OAUTH2_PROVIDER
- **changed** — Improve separation between Google and OIDC providers
- **changed** — Update Google OAuth endpoints to v2
- **added** — Add cache-busting for static assets (JS, CSS, icons)
- **added** — Add Cache-Control: immutable for static resources
- **changed** — Allow iframes from framatube.org
- **changed** — Improve sanitizer performance and parsing behavior
- **added** — Add graceful shutdown support for worker pool and metrics collector
- **changed** — Improve error reporting for metrics
- **added** — Support weak ETag comparison

###### Security

* Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.
* Improve OAuth2 security:
  * Verify OIDC ID token signatures and claims.
  * Prevent OAuth identity overwrite when already linked.
  * Clear PKCE verifier and CSRF state after use.
  * Validate HTTP status from Google userinfo endpoint.
* Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication.
* Use constant-time comparison for token validation.
* Fix potential DoS when truncating large untrusted input in templates.
* Reject oversized favicons.

###### Improvements

* Improve configuration validation with cross-field consistency checks.
* OAuth2:
  * Explicit provider selection via `OAUTH2_PROVIDER`.
  * Better separation between Google and OIDC providers.
  * Updated Google OAuth endpoints to v2.
* UI:
  * Add cache-busting for static assets (JS, CSS, icons).
  * Add `Cache-Control: immutable` for static resources.
* Sanitizer:
  * Allow iframes from `framatube.org`.
  * Improve performance and parsing behavior.
* Metrics and workers:
  * Graceful shutdown support for worker pool and metrics collector.
  * Better error reporting for metrics.
* API / HTTP:
  * Support weak ETag comparison.
  * Improve response helpers and headers handling.

###### Performance

* Reduce number of SQL queries for unread entries and UI pages.
* Optimize database queries and locking behavior:
  * Use `SKIP LOCKED` in archive operations.
  * Reduce unnecessary queries and connections.
* Improve UI performance:
  * Cache keymaps instead of recomputing on each keypress.
  * Batch DOM updates when marking entries as read.
* Optimize sanitizer, media proxy, routing, and template rendering.
* Reduce allocations in various hot paths.

###### Bug Fixes

* Fix category update validation rendering.
* Fix redirect after marking a feed as read from category view.
* Fix timezone comparison logic.
* Fix Arabic pluralization rules (`ar_SA`).
* Fix validator behavior when clearing user filters.
* Fix CLI behavior for `--info` and `--version`.
* Fix CORS preflight responses (return 204).
* Ensure 204 responses do not include `Content-Type`.
* Ignore unsupported media proxy targets and handle MIME types correctly.

###### Refactoring

* Remove dependency on `gorilla/mux` across the codebase.
* Improve code structure and naming consistency (API, OAuth2, config, validators).
* Simplify timezone and server setup logic.
* Improve testability and documentation (GoDoc updates).

###### Dependencies

* Update multiple dependencies, including:

  * `github.com/lib/pq`
  * `github.com/go-jose/go-jose/v4`
  * `github.com/go-webauthn/webauthn`
  * `github.com/andybalholm/brotli`
  * `github.com/tdewolff/minify/v2`
  * `golang.org/x/image`
  * `github.com/PuerkitoBio/goquery`

### 2.2.18 — Miniflux 2.2.18

- Date: 2026-03-15
- Version: 2.2.18
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.18
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.18

- **security** — Block outbound requests to private networks made by the fetcher by default
- **security** — Add SSRF protection for integration HTTP clients by blocking connections to private network addresses at connect time
- **security** — Fix a possible SSRF TOCTOU / DNS-rebinding issue in the fetcher private network check
- **security** — Ensure private network protections also apply to redirect targets
- **security** — Treat RFC 6598 shared address space (100.64.0.0/10) as non-public
- **added** — Add ignore_entry_updates feed option to skip updating existing entries during scheduled polling
- **added** — Add Arabic (ar_SA) translation
- **added** — Add Galician (gl_ES) translation
- **changed** — Apply entry blocking rules both before and after scraping to avoid unnecessary requests and allow matching on fetched content
- **changed** — Update Polish translation
- **changed** — Apply various performance improvements across multiple components (fetcher, parser, sanitizer, readability, URL cleaner, feed discovery, and Google Reader API)
- **changed** — Simplify parts of the Google Reader code and reduce allocations in several hot paths
- **changed** — Reduce fetcher request size slightly to improve packet efficiency
- **changed** — Upgrade to Go 1.26
- **fixed** — Fix multiple bugs and inconsistencies across integration sub-packages (error handling, logging, status checks, and naming)
- **fixed** — Fix potential panic in the Omnivore integration when handling empty error arrays
- **fixed** — Correct error prefixes and typos in several integrations

###### Security

* Block outbound requests to private networks made by the fetcher by default.
* Add SSRF protection for integration HTTP clients by blocking connections to private network addresses at connect time.
* Fix a possible SSRF TOCTOU / DNS-rebinding issue in the fetcher private network check.
* Ensure private network protections also apply to redirect targets.
* Treat RFC 6598 shared address space (`100.64.0.0/10`) as non-public.

###### Breaking Changes

To prevent potential SSRF, Miniflux now blocks access to services hosted on private networks by default.

* `FETCHER_ALLOW_PRIVATE_NETWORKS=1` must now be enabled to access feeds hosted on a local network.
* `INTEGRATION_ALLOW_PRIVATE_NETWORKS=1` must now be enabled to access third-party integration services hosted on a local network.

###### Improvements

* Apply entry blocking rules both before and after scraping to avoid unnecessary requests and allow matching on fetched content.
* Add `ignore_entry_updates` feed option to skip updating existing entries during scheduled polling.
* Add Arabic (`ar_SA`) translation.
* Add Galician (`gl_ES`) translation.
* Update Polish translation.
* Various performance improvements across multiple components (fetcher, parser, sanitizer, readability, URL cleaner, feed discovery, and Google Reader API).
* Simplify parts of the Google Reader code and reduce allocations in several hot paths.
* Reduce fetcher request size slightly to improve packet efficiency.

###### Bug Fixes

* Fix multiple bugs and inconsistencies across integration sub-packages (error handling, logging, status checks, and naming).
* Fix potential panic in the Omnivore integration when handling empty error arrays.
* Correct error prefixes and typos in several integrations.

###### Dependencies

* Update `golang.org/x/net` to 0.52.0.
* Update `golang.org/x/crypto` to 0.49.0.
* Update `golang.org/x/image` to 0.37.0.
* Update `golang.org/x/oauth2` to 0.36.0.
* Update `github.com/go-webauthn/webauthn` to 0.16.1.
* Update `github.com/tdewolff/minify/v2` to 2.24.10.

###### Other Changes

* Upgrade to Go 1.26.
* Add `go:fix` directive for deprecated `client.New()` to ease migration to `NewClient()`.
* Add KOI8-R encoding tests with a sample XML feed.
* Add additional tests for `CharsetReader`.
* Update several GitHub Actions used for CI and container builds.
* Avoid building Debian packages bi-weekly on forks.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

### 2.2.17 — Miniflux 2.2.17

- Date: 2026-02-13
- Version: 2.2.17
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.17
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.17

- **security** — Do not expose the Miniflux version on unauthenticated endpoints
- **security** — Improve HTML sanitizer by switching from the tokenizer to the golang.org/x/net/html parser to better match browser behavior and reduce the risk of injection issues
- **security** — Enforce blocked resource checks on srcset URLs
- **security** — Improve blocked resource handling including updates to blocked URL substrings
- **security** — Add validation for TRUSTED_REVERSE_PROXY_NETWORKS configuration to prevent silent misconfiguration
- **security** — Prevent possible deadlock when cleaning removed entries
- **security** — Ensure HTTP response bodies are always closed, even on client errors
- **changed** — Rewrite srcset parser to follow HTML specifications and handle edge cases more correctly
- **changed** — Improve sanitizer performance with various optimizations including reduced allocations and better attribute handling
- **changed** — Handle deeply nested HTML more robustly in the sanitizer
- **added** — Add scraper and rewrite rules for bleepingcomputer.com and vnexpress.net
- **changed** — Support malformed JSON feeds with author objects in the authors array
- **fixed** — Avoid panic when parsing null feeds
- **changed** — Improve JSON Feed title fallback logic
- **changed** — Include external_url in JSON entry hash fallback
- **changed** — Ignore WordPress wp-json API endpoint during JSON feed discovery
- **added** — Add unread status filter to search results
- **changed** — Improve timezone handling internals and performance
- **fixed** — Do not keep old enclosures when an updated entry has none
- **fixed** — Handle sql.ErrNoRows properly in IconByFeedID
- **removed** — Remove FILTER_ENTRY_MAX_AGE_DAYS configuration option

###### Security

* Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49).
* Improve HTML sanitizer by switching from the tokenizer to the `golang.org/x/net/html` parser to better match browser behavior and reduce the risk of injection issues.
* Enforce blocked resource checks on `srcset` URLs.
* Improve blocked resource handling (including updates to blocked URL substrings).
* Add validation for `TRUSTED_REVERSE_PROXY_NETWORKS` configuration to prevent silent misconfiguration.
* Prevent possible deadlock when cleaning removed entries.
* Ensure HTTP response bodies are always closed, even on client errors.

###### Improvements

* Rewrite `srcset` parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly.
* Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling).
* Handle deeply nested HTML more robustly in the sanitizer.
* Add scraper and rewrite rules for:

  * `bleepingcomputer.com`
  * `vnexpress.net`
* Improve JSON Feed support:

  * Support malformed feeds with `author` objects in the `authors` array.
  * Avoid panic when parsing `null` feeds.
  * Improve title fallback logic.
  * Include `external_url` in JSON entry hash fallback.
* Ignore WordPress `wp-json` API endpoint during JSON feed discovery.
* Add unread status filter to search results.
* Improve timezone handling internals and performance.
* Improve API payload structures and Godoc comments.
* Improve JavaScript code readability and keyboard shortcut handling.
* Restore cmd/ctrl/shift-click behavior on main navigation.
* Fix Safari PWA behavior for the `v` shortcut to open links in the main browser.

###### Bug Fixes

* Do not keep old enclosures when an updated entry has none.
* Handle `sql.ErrNoRows` properly in `IconByFeedID`.
* Change `FindRemoteIP` to fall back to `127.0.0.1`.

###### Configuration Changes

* Removed `FILTER_ENTRY_MAX_AGE_DAYS`.
  This option can be replaced with a filter rule such as `max-age:<duration>`.
  Global environment variables should be reserved for process-level configuration.

###### Dependencies

* Update `github.com/lib/pq` to 1.11.2.
* Update:

  * `golang.org/x/net` to 0.50.0
  * `golang.org/x/crypto` to 0.48.0
  * `golang.org/x/image` to 0.36.0
  * `golang.org/x/oauth2` to 0.35.0
  * `golang.org/x/term` to 0.40.0
* Update Debian packager Docker image to Trixie.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

### 2.2.16 — Miniflux 2.2.16

- Date: 2026-01-07
- Version: 2.2.16
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.16
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.16

- **security** — Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues, configurable at the instance level
- **security** — Disallow fetching feed icons from private networks to reduce the SSRF attack surface, configurable at the instance level
- **security** — Add the TRUSTED_REVERSE_PROXY_NETWORKS configuration option to prevent spoofing of HTTP headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip when AUTH_PROXY_HEADER is enabled
- **security** — Stop logging generated Google Reader API tokens even when debug mode is enabled
- **security** — Remove the CORS handler from the Google Reader API to reduce the overall attack surface
- **changed** — Avoid indexing the content of removed entries to significantly reduce database index size after cleanup
- **added** — Add a new API endpoint to import entries into an existing feed
- **changed** — Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization
- **changed** — Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers
- **added** — Add an auto-push option to the Readeck integration
- **added** — Add smooth page transitions for a more polished navigation experience
- **added** — Add a route to view individual starred entries directly from a category's starred list
- **added** — Add a link to the GitHub contributors page in templates
- **changed** — Update all translations
- **changed** — Improve consistency and fix typos in the miniflux(1) manual page
- **removed** — Remove the obsolete version key from Docker Compose examples
- **changed** — Update the Go devcontainer image to go:1-trixie
- **changed** — Update the Distroless container base image to Debian 13

###### Security

* Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues. This behavior is configurable at the instance level.
* Disallow fetching feed icons from private networks to reduce the SSRF attack surface. This is also configurable at the instance level.
* Add the `TRUSTED_REVERSE_PROXY_NETWORKS` configuration option to prevent spoofing of HTTP headers such as `X-Forwarded-For`, `X-Forwarded-Proto`, and `X-Real-Ip`. This option must be configured when `AUTH_PROXY_HEADER` is enabled.
* Stop logging generated Google Reader API tokens, even when debug mode is enabled.
* Remove the CORS handler from the Google Reader API, as it is not intended to be used by web clients, reducing the overall attack surface.

###### Performance and Storage

* Avoid indexing the content of removed entries, significantly reducing database index size after cleanup.
* Minor storage and database refactoring to simplify code paths and reduce unnecessary formatting overhead.

###### API and Integrations

* Add a new API endpoint to import entries into an existing feed.
* Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization.
* Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers.
* Add an auto-push option to the Readeck integration.

###### User Interface

* Add smooth page transitions for a more polished navigation experience.
* Add a route to view individual starred entries directly from a category’s starred list.
* Add a link to the GitHub contributors page in templates.
* Update all translations.

###### Documentation and Tooling

* Improve consistency and fix typos in the `miniflux(1)` manual page.
* Remove the obsolete `version` key from Docker Compose examples.
* Update the Go devcontainer image to `go:1-trixie`.
* Update the Distroless container base image to Debian 13.
* Update GitHub Actions dependencies.

---

As always, thank you to all contributors who helped improve Miniflux in this release.

### 2.2.15 — Miniflux 2.2.15

- Date: 2025-12-10
- Version: 2.2.15
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.15
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.15

- **added** — New configuration option to disable the Miniflux API
- **added** — Added option to save entries to a specific Linkwarden collection
- **added** — Provide multiple feeds for YouTube content: Channel, videos only, short videos, live streams
- **added** — Better canonical URL detection for YouTube with its own dedicated step
- **added** — Allow feed entries with <i> and <small> tags
- **changed** — Improved YouTube channel parsing, including default playlists
- **changed** — URL Cleaner: Remove additional trackers from URLs
- **fixed** — YouTube embeds: Avoid Error 153 (video player configuration error) in various scenarios
- **fixed** — API: fetchContent endpoint now properly rewrites media URLs when using the media proxy
- **security** — Only relative paths are now allowed for the redirectURL parameter

###### ✨ New Features

* New configuration option to disable the Miniflux API
* Added option to save entries to a specific Linkwarden collection
* YouTube subscription improvements:
  * Provide multiple feeds for YouTube content: Channel, videos only, short videos, live streams
  * Better canonical URL detection (now has its own dedicated step)
  * Improved YouTube channel parsing, including default playlists
* Allow feed entries with `<i>` and `<small>` tags
* URL Cleaner: Remove additional trackers from URLs

###### 🐛 Bug Fixes

* **YouTube embeds:** Avoid Error 153 (`video player configuration error`) in various scenarios
* **API:** `fetchContent` endpoint now properly rewrites media URLs when using the media proxy
* **Security:** Only relative paths are now allowed for the `redirectURL` parameter
* **CI fixes:**
  * Improved CodeQL workflow (language matrix + dynamic analysis)
  * Fixed missing GitHub Actions permissions
  * Fixed RPM package versioning for scheduled and pull_request triggers

###### 🧹 Refactoring & Maintenance

* JavaScript optimizations: use `replace` instead of `remove/add`, minor regex cleanup
* Performance improvement: removed string concatenation in loops
* Updated Polish translation
* Updated Postgres volume path in Docker Compose examples
* Added new CI workflow to mirror the Git repo to Codeberg

###### 📦 Dependency Updates

This release includes updates to several dependencies:

* `golang.org/x/*` modules (`net`, `oauth2`, `image`, `crypto`)
* `github.com/tdewolff/minify/v2`
* `github.com/coreos/go-oidc/v3`
* `github.com/go-webauthn/webauthn`
* `github.com/PuerkitoBio/goquery`
* Docker base image updates (Alpine 3.23)
* GitHub Actions:
  * `actions/checkout` v6
  * `actions/upload-artifact` v5
  * `golangci/golangci-lint-action` v9

For more details, look at the Git commit history.

### 2.2.14 — Miniflux 2.2.14

- Date: 2025-10-23
- Version: 2.2.14
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.14
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.14

- **added** — Allow passing a custom http.Client and add context support to API methods in the Go Client
- **added** — Redirect users back to the original page after logging in
- **added** — Add tags option for the Karakeep integration
- **added** — Add new Archive.org integration
- **added** — Add remove_img_blur_params rewrite rule
- **added** — Add add_image_title rewrite rule for explainxkcd.com
- **changed** — Improve Content Security Policy by extracting CSP generation into a function, adding systematic nonces, and changing default-src to 'none'
- **changed** — Replace custom modal with native dialog element for simpler, more accessible UI
- **changed** — Simplify date parsing in the reader and XML encoding logic
- **changed** — Optimize sanitizer functions hasRequiredAttributes, hasValidURIScheme, and isBlockedResource
- **changed** — Replace fmt.Errorf with errors.New where applicable
- **changed** — Remove dependency on hstore in the database layer and relax implicit NOT NULL for serial types
- **changed** — Simplify Fever API slice sizing and various internal cleanups
- **changed** — Preallocate slices and optimize string and number conversions for better performance
- **fixed** — Fix CSS layout overflow when external links are too long
- **fixed** — Fix JSON Feed parser to fallback to external_url when url is missing
- **fixed** — Update scraper rule for Dark Reading

###### ✨ New Features

* **Go Client:** Allow passing a custom `http.Client` and add context support to API methods.
* **UI:** Redirect users back to the original page after logging in.
* **Template:** Improved Content Security Policy: extracted CSP generation into a function, added systematic nonces, and changed `default-src` to `'none'` for stronger security.
* **Integrations:**
  * Added **tags option** for the Karakeep integration.
  * Added new **Archive.org** integration.
* **Rewrite Rules:**
  * Added `remove_img_blur_params` rule.
  * Added `add_image_title` rule for *explainxkcd.com*.

###### 🧰 Improvements & Refactoring

* Replaced custom modal with native `<dialog>` element for simpler, more accessible UI.
* Simplified date parsing in the reader and XML encoding logic.
* Optimized sanitizer functions (`hasRequiredAttributes`, `hasValidURIScheme`, `isBlockedResource`).
* Replaced `fmt.Errorf` with `errors.New` where applicable.
* Removed dependency on `hstore` in the database layer and relaxed implicit `NOT NULL` for serial types.
* Simplified Fever API slice sizing and various internal cleanups.
* Preallocated slices and optimized string/number conversions for better performance.

###### 🧪 Tests

* Added test cases for XML encoding behavior.

###### 🐛 Bug Fixes

* Fixed CSS layout overflow when external links are too long.
* Fixed JSON Feed parser to fallback to `external_url` when `url` is missing.
* Updated scraper rule for *Dark Reading*.

###### 📚 Documentation

* Clarified the `POLLING_FREQUENCY` environment variable in the documentation.

###### 🏗️ Build & CI

* Updated dependencies:

  * `github.com/tdewolff/minify/v2` → 2.24.4
  * `golang.org/x/net` → 0.46.0
  * `golang.org/x/image` → 0.32.0
  * `golang.org/x/oauth2` → 0.32.0
  * `github.com/coreos/go-oidc/v3` → 3.16.0
  * `github/codeql-action` → 4
* Updated `make lint` and enabled additional Go linters (`perfsprint`, `goheader`).


###### 📝 Additional Notes

If you are seeing this Postgres error: `Error: pq: must be owner of extension hstore`, you can fix it by running the following SQL command as a superuser for the Miniflux database:

```sql
DROP EXTENSION hstore;
```

This error means you initially created the `hstore` extension as a different database user than the one you are currently using for Miniflux.

For more details, look at the Git commit history.