miniflux Release Notes

New features

• Added Gotify push notification support.
• Added Steam scraper rules.
• Added validation with helpful error messages when saving rewrite rules.

Performance improvements

• Reduced database storage used by enclosure and entry indexes.
• Reduced memory used by internal data structures.

Security

• Blocked reserved IP address ranges to further protect against server-side request forgery.
• Hardened WebAuthn redirects against open-redirect attacks, including redirect URLs containing surrounding whitespace.
• Prevented per-feed proxy URLs from bypassing private-network restrictions by default. Set FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 to retain access to private per-feed proxies.
• Enforced DISABLE_LOCAL_AUTH for API password authentication and password changes; API clients must use an API key when local authentication is disabled.
• Rejected Google Reader authentication tokens when no password is configured.
• Restricted embedded iframe URLs to web schemes and tightened YouTube hostname validation.

Bug fixes

• Added timeouts to the ACME challenge listener.
• Fixed response compression negotiation to consistently prefer the server's configured encoding order.
• Improved Karakeep errors when saving an entry fails by reporting the HTTP status.
• Returned to the first unread page when marking entries as read leaves the current feed or category page empty.
• Restored support for proxies configured through HTTP_PROXY or HTTPS_PROXY, including across redirects.
• Returned a validation error instead of crashing when creating or importing feeds for users without a category.
• Preserved the requested redirect after passkey login.
• Increased the Google Reader item-ID limit to 10,000.
• Returned a bad-request response instead of crashing on POST requests to static asset paths.
• Improved accessibility by adding descriptive names to documentation links.
• Improved error logging and responses for failed database existence checks and shared-entry lookups.

Localization

• Updated Polish (pl_PL) translations.

Documentation

• Clarified the Unix socket permissions used with LISTEN_ADDR.

Dependencies

• Updated several Go modules and GitHub Actions dependencies.

As always, thank you to all contributors who helped improve Miniflux in this release.

New features

Feed and entry language detection

Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.

Entries without their own language now inherit the language declared by the feed.

Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.

The language field is exposed through the API and the Go client for both feeds and entries.

Other additions

• Feed discovery now finds the feeds offered by GitHub pages.
• TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
• The browser favicon is now served as SVG for a sharper icon on high-density displays.
• Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

• Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
• Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
• Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

• Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
• Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
• Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
• Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

• Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
• Fixed a race condition during template rendering that could return a page translated in another user's language.
• Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
• Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
• Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
• MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
• Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
• Fixed a category deletion check that could remove all of a user's categories.
• Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
• Fixed the no_media_player option being ignored when creating a feed.
• A feed proxy URL can now be cleared once it has been configured.
• Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
• Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
• Fixed the remove_tables rewrite rule reordering article content.
• Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
• Fixed empty tags being sent to Raindrop when no tag was configured.
• Fixed overlapping article headings that wrap onto multiple lines.
• Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies

Updated several Go modules and GitHub Actions dependencies, including:

• github.com/andybalholm/brotli 1.2.2
• github.com/coreos/go-oidc/v3 3.20.0
• github.com/prometheus/client_golang 1.24.0
• golang.org/x/crypto 0.54.0
• golang.org/x/net 0.57.0
• golang.org/x/text 0.40.0

As always, thank you to all contributors who helped improve Miniflux in this release.

New features

Improved full-text search

Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions.

API improvements

• Added GET /v1/entries/ids to efficiently retrieve paginated entry IDs.
• Added support for updating the starred status of multiple entries through PUT /v1/entries.
• API clients can now filter entries by tags.
• The Go client now exposes additional feed fields (description, icon, next_check_at, notification settings, no_media_player, etc.) and supports the new tag filter.

Atom feed improvements

When an Atom entry id contains an HTTP URL, it is now used as the entry URL when no dedicated link is available.

Performance improvements

• Improved full-text search performance by caching compiled regular expressions used by filtering rules.
• Reduced database work when computing category statistics.
• Improved browser caching of static assets.
• Reduced template rendering overhead by precomputing static icon URLs.

Security

• Prevent username enumeration through login timing differences.
• PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness. This change raises the minimum supported PostgreSQL version to 11.

Bug fixes

• Fixed validation of per-feed entry filter rules in the web interface.
• SOCKS proxy URLs can once again be configured for individual feeds.
• Fixed enclosure URL proxying consistency across API endpoints.
• Fixed several API handlers that incorrectly returned 404 Not Found or 400 Bad Request instead of proper server errors.
• Fixed inconsistent handling of invalid category filters in the Entries API.
• Fixed user lookup edge cases that could result in nil pointer dereferences.
• Fixed enclosure lookup to correctly scope results by user.
• Fixed the Google Reader Quick Add endpoint to honor the configured HTTP user agent.
• Fixed refresh-all keyboard shortcut (R) to correctly display the success notification.
• Fixed localization formatting issues affecting several languages.
• Fixed request builder state leaking during feed discovery.
• Improved accessibility by correcting an aria-labelledby issue.

Localization

• Updated German (de_DE) translations.
• Updated Galician (gl_ES) translations.

Documentation

• Clarified the units for POLLING_FREQUENCY.
• Improved documentation for TRUSTED_REVERSE_PROXY_NETWORKS.

Dependencies

Updated several Go modules and GitHub Actions dependencies.

Security

• Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
• Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
• Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
• Hardened metrics endpoint authentication by using constant-time credential comparisons.

Bug Fixes

• Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

Improvements

• Added Korean language support.
• Improved HTML truncation performance and reduced memory allocations.
• Optimized feed discovery, subscription detection, date parsing, and tag filtering.
• Simplified and refactored several storage and query-building components for better maintainability.

Dependencies

• Updated several dependencies, including:
  • github.com/go-webauthn/webauthn 0.17.4
  • golang.org/x/crypto 0.52.0
  • golang.org/x/image 0.41.0
  • golang.org/x/net 0.55.0

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login.
• Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support.
• Persist WebAuthn backup eligibility/state and validated credential state after login.
• Require POST requests for logout, feed refresh, and OAuth2 unlink actions.
• Apply CSRF protection to all non-safe HTTP methods.
• Add http.CrossOriginProtection middleware for the web UI.
• Validate redirect URL schemes in HTMLRedirect to prevent unsafe redirects.
• Restore URL scheme validation in templates for untrusted feed URLs.
• Sanitize filenames in Content-Disposition headers to prevent header injection.
• Reject empty OAuth2 state parameters when no authentication flow is in progress.
• Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects.
• Validate URI schemes case-insensitively according to RFC 3986.
• Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks.
• Cap the maximum entry limit to 1000 across the UI, API, and storage layer.

Improvements

• Add support for exporting and importing Miniflux-specific feed settings in OPML files, allowing full feed configuration backups and restores.
• Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients.
• Add support for the shortcuts: iOS URL scheme in sanitized content.
• Add Linux riscv64 builds.
• Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation.
• Improve Chinese Traditional (zh-TW) translations.
• Improve RSS parsing for feeds that reuse the same GUID across multiple entries.
• Improve UI consistency for authentication settings and external-link behavior.
• Automatically clean up orphaned feed icons from the database.
• Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message.
• Improve error handling and cleanup in WebAuthn login flows.
• Simplify large feed and user deletions using ON DELETE CASCADE.

Performance

• Improve sanitizer performance significantly and reduce allocations in multiple hot paths.
• Optimize reading-time calculation to avoid unnecessary allocations.
• Improve feed parsing performance by preallocating slices/maps and reducing string allocations.
• Optimize ISO8601 duration parsing for YouTube and podcast feeds.
• Reduce database queries for navigation metadata and storage operations.
• Optimize template rendering for icons and CSP generation.
• Avoid loading entry content from PostgreSQL when not needed.
• Reuse a singleton HTML minifier instance instead of allocating one per request.
• Optimize string handling in the reader and sanitizer packages.

Bug Fixes

• Fix incorrect read/starred toggling in Google Reader API.
• Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the removed entry status.
• Fix handling of slow HTTP headers.
• Fix "open in new tab" behavior for redirected external entry links.
• Fix Wallabag integration typo in error messages.

Dependency Updates

• Update github.com/go-webauthn/webauthn to v0.17.3.
• Update various golang.org/x/* packages.
• Update github.com/coreos/go-oidc/v3 to v3.18.0.
• Update github.com/tdewolff/minify/v2 to v2.24.13.

As always, thank you to all contributors who helped improve Miniflux in this release.

Security

• Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.
• Improve OAuth2 security:
  • Verify OIDC ID token signatures and claims.
  • Prevent OAuth identity overwrite when already linked.
  • Clear PKCE verifier and CSRF state after use.
  • Validate HTTP status from Google userinfo endpoint.
• Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication.
• Use constant-time comparison for token validation.
• Fix potential DoS when truncating large untrusted input in templates.
• Reject oversized favicons.

Improvements

• Improve configuration validation with cross-field consistency checks.
• OAuth2:
  • Explicit provider selection via OAUTH2_PROVIDER.
  • Better separation between Google and OIDC providers.
  • Updated Google OAuth endpoints to v2.
• UI:
  • Add cache-busting for static assets (JS, CSS, icons).
  • Add Cache-Control: immutable for static resources.
• Sanitizer:
  • Allow iframes from framatube.org.
  • Improve performance and parsing behavior.
• Metrics and workers:
  • Graceful shutdown support for worker pool and metrics collector.
  • Better error reporting for metrics.
• API / HTTP:
  • Support weak ETag comparison.
  • Improve response helpers and headers handling.

Performance

• Reduce number of SQL queries for unread entries and UI pages.
• Optimize database queries and locking behavior:
  • Use SKIP LOCKED in archive operations.
  • Reduce unnecessary queries and connections.
• Improve UI performance:
  • Cache keymaps instead of recomputing on each keypress.
  • Batch DOM updates when marking entries as read.
• Optimize sanitizer, media proxy, routing, and template rendering.
• Reduce allocations in various hot paths.

Bug Fixes

• Fix category update validation rendering.
• Fix redirect after marking a feed as read from category view.
• Fix timezone comparison logic.
• Fix Arabic pluralization rules (ar_SA).
• Fix validator behavior when clearing user filters.
• Fix CLI behavior for --info and --version.
• Fix CORS preflight responses (return 204).
• Ensure 204 responses do not include Content-Type.
• Ignore unsupported media proxy targets and handle MIME types correctly.

Refactoring

• Remove dependency on gorilla/mux across the codebase.
• Improve code structure and naming consistency (API, OAuth2, config, validators).
• Simplify timezone and server setup logic.
• Improve testability and documentation (GoDoc updates).

Dependencies

• Update multiple dependencies, including:
  • github.com/lib/pq
  • github.com/go-jose/go-jose/v4
  • github.com/go-webauthn/webauthn
  • github.com/andybalholm/brotli
  • github.com/tdewolff/minify/v2
  • golang.org/x/image
  • github.com/PuerkitoBio/goquery