versun/RSSBox 2026.9.5

on GitHub

What's New

• New RSS_FETCH_USER_AGENT environment variable to set a custom User-Agent for feed fetching (default: empty, uses a random browser UA). See docs.

What's Fixed

• Feeds blocked by a WAF (e.g. Cloudflare returning 403 to browser-like UAs) are now retried once with a plain HTTP-client UA (curl/8.10.1) and a matching minimal header set, so such feeds can be fetched successfully.
• Feed fetching now reuses a single cached fake-useragent instance instead of reloading its dataset on every request, and the httpx.Client is properly closed after each manual fetch.

Security

• Fixed 72 dependency vulnerabilities flagged by GitHub Dependabot by upgrading locked dependencies: cryptography 50.0.1, django 6.1.1, idna 3.19, lxml 6.1.3, mistune 3.3.4, nltk 3.10.3, pillow 12.3.0, soupsieve 2.9.2, sqlparse 0.6.0, urllib3 2.7.0.
• One nltk advisory (<= 3.10.3, high) remains open: no patched release exists yet, 3.10.3 is the latest available version.

Full Changelog: 2026.8.4...2026.9.5