miniflux/v2 2.3.4

Miniflux 2.3.4

on GitHub

New features

• Added Gotify push notification support.
• Added Steam scraper rules.
• Added validation with helpful error messages when saving rewrite rules.

Performance improvements

• Reduced database storage used by enclosure and entry indexes.
• Reduced memory used by internal data structures.

Security

• Blocked reserved IP address ranges to further protect against server-side request forgery.
• Hardened WebAuthn redirects against open-redirect attacks, including redirect URLs containing surrounding whitespace.
• Prevented per-feed proxy URLs from bypassing private-network restrictions by default. Set FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 to retain access to private per-feed proxies.
• Enforced DISABLE_LOCAL_AUTH for API password authentication and password changes; API clients must use an API key when local authentication is disabled.
• Rejected Google Reader authentication tokens when no password is configured.
• Restricted embedded iframe URLs to web schemes and tightened YouTube hostname validation.

Bug fixes

• Added timeouts to the ACME challenge listener.
• Fixed response compression negotiation to consistently prefer the server's configured encoding order.
• Improved Karakeep errors when saving an entry fails by reporting the HTTP status.
• Returned to the first unread page when marking entries as read leaves the current feed or category page empty.
• Restored support for proxies configured through HTTP_PROXY or HTTPS_PROXY, including across redirects.
• Returned a validation error instead of crashing when creating or importing feeds for users without a category.
• Preserved the requested redirect after passkey login.
• Increased the Google Reader item-ID limit to 10,000.
• Returned a bad-request response instead of crashing on POST requests to static asset paths.
• Improved accessibility by adding descriptive names to documentation links.
• Improved error logging and responses for failed database existence checks and shared-entry lookups.

Localization

• Updated Polish (pl_PL) translations.

Documentation

• Clarified the Unix socket permissions used with LISTEN_ADDR.

Dependencies

• Updated several Go modules and GitHub Actions dependencies.

As always, thank you to all contributors who helped improve Miniflux in this release.