Miniflux 2.3.1

2.3.1

Miniflux 2.3.1

Added 1
  • Added Korean language support
Changed 2
  • Improved HTML truncation performance and reduced memory allocations
  • Optimized feed discovery, subscription detection, date parsing, and tag filtering
Fixed 1
  • Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments by reverting the middleware
Security 4
  • Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account
  • Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs
  • Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses
  • Hardened metrics endpoint authentication by using constant-time credential comparisons
Security
  • Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
  • Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
  • Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
  • Hardened metrics endpoint authentication by using constant-time credential comparisons.
Bug Fixes
  • Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.
Improvements
  • Added Korean language support.
  • Improved HTML truncation performance and reduced memory allocations.
  • Optimized feed discovery, subscription detection, date parsing, and tag filtering.
  • Simplified and refactored several storage and query-building components for better maintainability.
Dependencies

Updated several dependencies, including:

  • github.com/go-webauthn/webauthn 0.17.4
  • golang.org/x/crypto 0.52.0
  • golang.org/x/image 0.41.0
  • golang.org/x/net 0.55.0

As always, thank you to all contributors who helped improve Miniflux in this release.

View original

Upgraded? How did it go?

Discussion