❌

Normale weergave

Vandaag ontvangen — 9 September 2026 ⏭

FreshRSS 1.30.0

✇FreshRSS
Door: Alkarex
9 September 2026 om 16:43

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

  • Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

  • Filter global view feed list by state and search
  • New option to hide badges showing number of unread articles (Phantom Obligation)
  • Refresh only feeds in the current view
  • Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

  • Several security attack scenarios patched
  • Fix lost elements while parsing search query
  • Fix “mark as read older than…” widening the active search
  • Fix saving user queries
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

  • Security
    • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
      #9195
      • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
      • Passing * allows all networks like before (unsafe)
    • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
    • Fix auth CSRFs (login and register actions) #9171
    • Log invalid challenge and ignore JSON error during login #9278
    • Disallow fetching of non remote URI #9215
    • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
    • Fix access control in rss and opml actions #8912
    • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
    • Cleaner limit anonymous mode to default user #9235
    • Fix HTML ingestions in templates #9146, #9170
    • Fix bad header filtering bypass #8964
    • Sanitize all fields during JSON import #9168
    • Gate greader (JSON) user query share format behind Share by OPML #9248
    • Public OPML should not contain cURL parameters #9070
    • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
    • Strip feed URL credentials from anonymous user query output #9246
    • Set limits for regex during search #8913
    • Fix path disclosure in cache error message #9206
    • Limit the length and parentheses nesting depth of a search query #9277
    • Use timing-safe comparison for tokens #8945
    • Use hash_equals() for GReader API token comparison #9183
    • Mailer: allow disabling SMTPAutoTLS via config #9026
    • Warn during install if document root does not point to ./p/ #9010
    • Stop the unread-count poller after the session ends #9065
    • Add remote IP address to warning on form login #8942
    • Pin the GitHub actions using SHA #9200
    • Harden cache and SimplePie cache deserialization #9273
  • SimplePie
    • Security: Disallow javascript: URI scheme (protocol) #8263
    • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
    • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
    • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
    • Fix sanitizer whitelist stripping order #9066
    • Show only one representation per media:group #9009
    • Bump upstream SimplePie #8947
  • Features
    • Filter global view feed list by state and search #9132
      • Use global view when searching from subscription page #9144
    • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
    • Refresh only feeds in the current view #9060
    • Offer to add a prefix when resharing user labels #9236
    • Add log search to the logs page #9059
    • Add configurable log_level system setting #9185
    • New option to keep or not the custom sort order when navigating between categories and feeds #8969
    • New per-feed option to show or hide enclosures (attachments) #9015
    • Detect JSON feeds from URLs containing json #9058
      • Also when subscribing via the API #9167
    • Order categories during OPML import/export according to position #9203
    • OPML: include each feed’s refresh interval (TTL) in export/import #8982
    • Log failed CSS content retrieval (Web scraping) #9077
    • Allow providing a category when adding a feed by bookmarklet #9047
    • Add LinkAce sharing service #9024
    • Add Nextcloud Bookmarks sharing service #9032
  • Bug fixing
    • Fix lost elements while parsing search query #8884
    • Fix “mark as read older than…” widening the active search #9173
    • Fix saving user queries #9190
    • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
    • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
    • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
    • PostgreSQL: make committing new entries resilient to duplicate keys #9231
    • Preserve negative timezone offsets in date intervals #9071
    • Fix feed dropdown bugs due to hash desync #8949
    • Fix slider not reinitializing after form submit #8973
    • Minz: Skip loading duplicated JS/CSS assets #9000
    • Respect simplepie_syslog_enabled for the uses cache logs #8986
    • Fix statistics repartition averages #8996
    • Fix article hover date visibility #8997
    • Keep search and state filters when marking articles as read #9007
    • Fix --db-prefix silently drops following CLI flags #9042
    • Remove stale dynamic favicon links #9127
    • Fix desync between favicon and title unread counters #9262
    • Fix outdated username length hint on registration and install forms #9013
    • Redirect away from wrong URL paths #9075
    • Fix auto-share shortcut on first use #9072
    • Exclude hidden feeds from global view counts #9152
    • Fix only the last <media:credit> being written to the RSS output #9174
  • CLI
    • New cli/reconfigure-user.php to read/write per-user config attributes #8873
    • Report new articles count per feed in app/actualize_script.php output #8948
    • Output a diagnostic when the cli/health.php check fails #8980
  • API
    • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
    • Fever API: log the client IP address on authentication failure #8981
    • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
  • Deployment
    • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
    • Start supporting PHP 8.6+
      • Docker dev :newest with PHP 8.6 #9155
    • Docker: attach provenance and SBOM attestations to the published image #9150
    • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
    • Fix .dockerignore being ignored during build in CI #9001
    • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
    • Check GMP during 32-bit installation #9046
    • Improve actualize mutex to allow multiple instances #9045
    • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
  • UI
    • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
    • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
    • Move disable button before remove button in user management #8944
    • Keep scroll position of slider after form submit #8974
    • Group export feeds by category #9079, #9154
    • Sort feed names with locale-aware collation #8985
    • Sort labels with locale-aware collation #9023
    • Format unread counter in title on page load #9263
    • Display slider after submit for all buttons in feed update UI #8999
    • Improve aside keyboard navigation #9202
    • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
    • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
    • Fix typo in alert error border color variable #9266
    • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
    • Use :user-invalid instead of :invalid for CSS form field styling #9025
    • Remove unused simple layout #8998
    • Various UI and style improvements: #8823, #8824,
      #9140, #9145
  • Extensions
    • Minor Minz_Extension typing #8952
    • Improve extension list fetch diagnostics #9055
    • Fix a PHP warning in Serve action #9267
    • Fix extension settings cancel action #9053
    • Fix sharing menu conflicts with extensions #9074
    • Add read status hook for entries #8995
    • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
    • Redirect after saving user CSS/JS so changes apply immediately #9006
  • I18n
  • Misc.

  •  
  • ↗️
Er zijn geen artikelen meer
❌