# Miniflux 2.2.16 — Miniflux 2.2.16

- Product: Miniflux (https://whatsnew.fyi/product/miniflux)
- Vendor: Frédéric Guillot
- Date: 2026-01-07
- Version: 2.2.16
- Original notes: https://github.com/miniflux/v2/releases/tag/2.2.16
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.2.16

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues, configurable at the instance level
- **security** — Disallow fetching feed icons from private networks to reduce the SSRF attack surface, configurable at the instance level
- **security** — Add the TRUSTED_REVERSE_PROXY_NETWORKS configuration option to prevent spoofing of HTTP headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip when AUTH_PROXY_HEADER is enabled
- **security** — Stop logging generated Google Reader API tokens even when debug mode is enabled
- **security** — Remove the CORS handler from the Google Reader API to reduce the overall attack surface
- **changed** — Avoid indexing the content of removed entries to significantly reduce database index size after cleanup
- **added** — Add a new API endpoint to import entries into an existing feed
- **changed** — Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization
- **changed** — Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers
- **added** — Add an auto-push option to the Readeck integration
- **added** — Add smooth page transitions for a more polished navigation experience
- **added** — Add a route to view individual starred entries directly from a category's starred list
- **added** — Add a link to the GitHub contributors page in templates
- **changed** — Update all translations
- **changed** — Improve consistency and fix typos in the miniflux(1) manual page
- **removed** — Remove the obsolete version key from Docker Compose examples
- **changed** — Update the Go devcontainer image to go:1-trixie
- **changed** — Update the Distroless container base image to Debian 13

###### Security

* Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues. This behavior is configurable at the instance level.
* Disallow fetching feed icons from private networks to reduce the SSRF attack surface. This is also configurable at the instance level.
* Add the `TRUSTED_REVERSE_PROXY_NETWORKS` configuration option to prevent spoofing of HTTP headers such as `X-Forwarded-For`, `X-Forwarded-Proto`, and `X-Real-Ip`. This option must be configured when `AUTH_PROXY_HEADER` is enabled.
* Stop logging generated Google Reader API tokens, even when debug mode is enabled.
* Remove the CORS handler from the Google Reader API, as it is not intended to be used by web clients, reducing the overall attack surface.

###### Performance and Storage

* Avoid indexing the content of removed entries, significantly reducing database index size after cleanup.
* Minor storage and database refactoring to simplify code paths and reduce unnecessary formatting overhead.

###### API and Integrations

* Add a new API endpoint to import entries into an existing feed.
* Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization.
* Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers.
* Add an auto-push option to the Readeck integration.

###### User Interface

* Add smooth page transitions for a more polished navigation experience.
* Add a route to view individual starred entries directly from a category’s starred list.
* Add a link to the GitHub contributors page in templates.
* Update all translations.

###### Documentation and Tooling

* Improve consistency and fix typos in the `miniflux(1)` manual page.
* Remove the obsolete `version` key from Docker Compose examples.
* Update the Go devcontainer image to `go:1-trixie`.
* Update the Distroless container base image to Debian 13.
* Update GitHub Actions dependencies.

---

As always, thank you to all contributors who helped improve Miniflux in this release.