# Miniflux 2.3.3 — Miniflux 2.3.3

- Product: Miniflux (https://whatsnew.fyi/product/miniflux)
- Vendor: Frédéric Guillot
- Date: 2026-07-24
- Version: 2.3.3
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.3
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Miniflux now reads the language declared by feeds and entries from RSS, Atom, RDF/RSS, and JSON Feed sources and stores it on both feeds and entries
- **added** — Entries without their own language now inherit the language declared by the feed
- **added** — Article titles and content are rendered with a matching lang attribute for improved screen reader pronunciation, hyphenation, and browser translation prompts
- **added** — The language field is exposed through the API and the Go client for both feeds and entries
- **added** — Feed discovery now finds the feeds offered by GitHub pages
- **added** — TLS certificates are reloaded when the process receives SIGHUP
- **added** — The browser favicon is now served as SVG for a sharper icon on high-density displays
- **changed** — Compressed responses are negotiated with a more standard-compliant Accept-Encoding parser, including quality values and wildcards
- **changed** — Long entry and feed lists render noticeably faster by avoiding layout and paint work for off-screen rows
- **changed** — Reduced memory allocations when stripping and truncating HTML
- **changed** — Compression writers are now pooled instead of being allocated for every compressed response
- **security** — Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}
- **security** — Unix sockets are now created with 0660 permissions instead of being world-writable
- **security** — Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry
- **security** — Feed-declared language values are now validated before being stored
- **fixed** — Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language
- **fixed** — Fixed a race condition during template rendering that could return a page translated in another user's language
- **fixed** — Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining
- **fixed** — Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0
- **fixed** — Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists

###### New features

- **Feed and entry language detection**
  - Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS `<language>` and `<dc:language>` elements, `xml:lang` on Atom 1.0 and 0.3 documents, `dc:language` in RDF/RSS 1.0 feeds, and the `language` field of JSON Feed.
  - Entries without their own language now inherit the language declared by the feed.
  - Article titles and content are rendered with a matching `lang` attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  - The `language` field is exposed through the API and the Go client for both feeds and entries.

- **Other additions**
  - Feed discovery now finds the feeds offered by GitHub pages.
  - TLS certificates are reloaded when the process receives `SIGHUP`, so renewed certificates can be picked up without a restart.
  - The browser favicon is now served as SVG for a sharper icon on high-density displays.
  - Compressed responses are negotiated with a much more standard-compliant `Accept-Encoding` parser, including quality values and wildcards.

###### Performance improvements

- Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
- Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
- Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

###### Security

- Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through `GET /v1/icons/{iconID}`.
- Unix sockets are now created with `0660` permissions instead of being world-writable. **Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.**
- Fixed an issue where `limit=0` in entry queries bypassed the 1000-entry cap and returned every matching entry.
- Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

###### Bug fixes

- Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
- Fixed a race condition during template rendering that could return a page translated in another user's language.
- Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
- Fixed a division-by-zero crash with the `entry_frequency` scheduler when `SCHEDULER_ENTRY_FREQUENCY_FACTOR` was set to `0`; the value must now be greater than or equal to `1`.
- Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
- `MEDIA_PROXY_RESOURCE_TYPES` and `TRUSTED_REVERSE_PROXY_NETWORKS` now accept spaces and trailing commas in their list values instead of refusing to start.
- Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
- Fixed a category deletion check that could remove all of a user's categories.
- Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
- Fixed the `no_media_player` option being ignored when creating a feed.
- A feed proxy URL can now be cleared once it has been configured.
- Fixed `entry_sorting_order` validation on user modification, which returned a server error instead of a validation error for unsupported values.
- Fixed the `fetch_via_proxy` checkbox disappearing when the subscription page was re-rendered after an error.
- Fixed the `remove_tables` rewrite rule reordering article content.
- Fixed plain text `content_text` and `summary` values from JSON Feed being mangled when the

_[Truncated at 4000 characters — full notes: https://github.com/miniflux/v2/releases/tag/2.3.3]_