miniflux/v2 2.3.3

Miniflux 2.3.3

on GitHub

New features

• Feed and entry language detection

  • Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
  • Entries without their own language now inherit the language declared by the feed.
  • Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  • The language field is exposed through the API and the Go client for both feeds and entries.

• Other additions

  • Feed discovery now finds the feeds offered by GitHub pages.
  • TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
  • The browser favicon is now served as SVG for a sharper icon on high-density displays.
  • Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

• Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
• Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
• Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

• Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
• Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
• Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
• Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

• Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
• Fixed a race condition during template rendering that could return a page translated in another user's language.
• Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
• Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
• Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
• MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
• Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
• Fixed a category deletion check that could remove all of a user's categories.
• Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
• Fixed the no_media_player option being ignored when creating a feed.
• A feed proxy URL can now be cleared once it has been configured.
• Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
• Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
• Fixed the remove_tables rewrite rule reordering article content.
• Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
• Fixed empty tags being sent to Raindrop when no tag was configured.
• Fixed overlapping article headings that wrap onto multiple lines.
• Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies

Updated several Go modules and GitHub Actions dependencies, including:

• github.com/andybalholm/brotli 1.2.2
• github.com/coreos/go-oidc/v3 3.20.0
• github.com/prometheus/client_golang 1.24.0
• golang.org/x/crypto 0.54.0
• golang.org/x/net 0.57.0
• golang.org/x/text 0.40.0

As always, thank you to all contributors who helped improve Miniflux in this release.