# Miniflux 2.3.0 — Miniflux 2.3.0 - Product: Miniflux (https://whatsnew.fyi/product/miniflux) - Vendor: Frédéric Guillot - Date: 2026-05-16 - Version: 2.3.0 - Original notes: https://github.com/miniflux/v2/releases/tag/2.3.0 - Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login - **security** — Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification - **security** — Persist WebAuthn backup eligibility/state and validated credential state after login - **security** — Require POST requests for logout, feed refresh, and OAuth2 unlink actions - **security** — Apply CSRF protection to all non-safe HTTP methods - **security** — Add http.CrossOriginProtection middleware for the web UI - **security** — Validate redirect URL schemes in HTMLRedirect to prevent unsafe redirects - **security** — Restore URL scheme validation in templates for untrusted feed URLs - **security** — Sanitize filenames in Content-Disposition headers to prevent header injection - **security** — Reject empty OAuth2 state parameters when no authentication flow is in progress - **security** — Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects - **security** — Validate URI schemes case-insensitively according to RFC 3986 - **security** — Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks - **security** — Cap the maximum entry limit to 1000 across the UI, API, and storage layer - **added** — Add support for exporting and importing Miniflux-specific feed settings in OPML files - **added** — Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients - **added** — Add support for the shortcuts: iOS URL scheme in sanitized content - **added** — Add Linux riscv64 builds - **changed** — Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation - **changed** — Improve Chinese Traditional (zh-TW) translations - **changed** — Improve RSS parsing for feeds that reuse the same GUID across multiple entries - **changed** — Improve UI consistency for authentication settings and external-link behavior - **changed** — Automatically clean up orphaned feed icons from the database - **changed** — Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message - **changed** — Improve error handling and cleanup in WebAuthn login flows - **changed** — Simplify large feed and user deletions using ON DELETE CASCADE - **fixed** — Fix incorrect read/starred toggling in Google Reader API - **fixed** — Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the removed entry status - **fixed** — Fix handling of slow HTTP headers - **fixed** — Fix open in new tab behavior for redirected external entry links - **fixed** — Fix Wallabag integration typo in error messages ###### Security * Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login. * Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support. * Persist WebAuthn backup eligibility/state and validated credential state after login. * Require `POST` requests for logout, feed refresh, and OAuth2 unlink actions. * Apply CSRF protection to all non-safe HTTP methods. * Add `http.CrossOriginProtection` middleware for the web UI. * Validate redirect URL schemes in `HTMLRedirect` to prevent unsafe redirects. * Restore URL scheme validation in templates for untrusted feed URLs. * Sanitize filenames in `Content-Disposition` headers to prevent header injection. * Reject empty OAuth2 state parameters when no authentication flow is in progress. * Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects. * Validate URI schemes case-insensitively according to RFC 3986. * Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks. * Cap the maximum entry limit to 1000 across the UI, API, and storage layer. ###### Improvements * Add support for exporting and importing Miniflux-specific feed settings in OPML files, allowing full feed configuration backups and restores. * Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients. * Add support for the `shortcuts:` iOS URL scheme in sanitized content. * Add Linux `riscv64` builds. * Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation. * Improve Chinese Traditional (`zh-TW`) translations. * Improve RSS parsing for feeds that reuse the same GUID across multiple entries. * Improve UI consistency for authentication settings and external-link behavior. * Automatically clean up orphaned feed icons from the database. * Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message. * Improve error handling and cleanup in WebAuthn login flows. * Simplify large feed and user deletions using `ON DELETE CASCADE`. ###### Performance * Improve sanitizer performance significantly and reduce allocations in multiple hot paths. * Optimize reading-time calculation to avoid unnecessary allocations. * Improve feed parsing performance by preallocating slices/maps and reducing string allocations. * Optimize ISO8601 duration parsing for YouTube and podcast feeds. * Reduce database queries for navigation metadata and storage operations. * Optimize template rendering for icons and CSP generation. * Avoid loading entry content from PostgreSQL when not needed. * Reuse a singleton HTML minifier instance instead of allocating one per request. * Optimize string handling in the reader and sanitizer packages. ###### Bug Fixes * Fix incorrect read/starred toggling in Google Reader API. * Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the `removed` entry status. * Fix handling of slow HTTP headers. * Fix "open in new tab" behavior for redirected external entry links. * Fix Wallabag integration typo in error messages. ###### Dependency Updates * Update `github.com/go-webauthn/webauthn` to `v0.17.3`. * Update various `golang.org/x/*` packages. * Update `github.com/coreos/go-oidc/v3` to `v3.18.0`. * Update `github.com/tdewolff/minify/v2` to `v2.24.13`. --- As always, thank you to all contributors who helped improve Miniflux in this release.