What's Changed
- Security fix (GHSA-6g83-8v98-rq5v): Removed the unauthenticated public route
/rss/import_opml/, which let anonymous users import OPML and make the server fetch arbitrary URLs (SSRF). OPML import is now only available through the authenticated admin interface. All self-hosted instances should upgrade.- Added regression tests to ensure anonymous OPML import is rejected.
Full Changelog: 2026.9.16...2026.10.13