FreshRSS.org
FreshRSS 1.30.0
Von Alkarex — 09. September 2026 um 16:43
This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.
From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.
Breaking change 💥:
- Disallow access to local networks such as
127.0.0.1 by default, for security reasons
Feature highlights✨:
- Filter global view feed list by state and search
- New option to hide badges showing number of unread articles (Phantom Obligation)
- Refresh only feeds in the current view
- Offer to add a prefix when re-sharing user labels
Bug fixes highlights 🐛:
- Several security attack scenarios patched
- Fix lost elements while parsing search query
- Fix “mark as read older than…” widening the active search
- Fix saving user queries
- Fix SQL errors breaking some regex searches with MySQL / MariaDB
This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223
Full changelog:
- Security
- 💥 Disallow access to local networks such as
127.0.0.1 by default, for security reasons (breaking change) #8400,
#9195
- Selected local networks can be allowed under System configuration or using the
INTERNAL_HOST_ALLOWLIST environment variable
- Passing
* allows all networks like before (unsafe)
- Improve SSRF mitigations by restricting
CURLOPT_PROXY #8950
- Fix auth CSRFs (login and register actions) #9171
- Log invalid challenge and ignore JSON error during login #9278
- Disallow fetching of non remote URI #9215
- Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
- Fix access control in
rss and opml actions #8912
- Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
- Cleaner limit anonymous mode to default user #9235
- Fix HTML ingestions in templates #9146, #9170
- Fix bad header filtering bypass #8964
- Sanitize all fields during JSON import #9168
- Gate
greader (JSON) user query share format behind Share by OPML #9248
- Public OPML should not contain cURL parameters #9070
- Ignore security-relevant OPML attributes for dynamic OPML sources #9276
- Strip feed URL credentials from anonymous user query output #9246
- Set limits for regex during search #8913
- Fix path disclosure in cache error message #9206
- Limit the length and parentheses nesting depth of a search query #9277
- Use timing-safe comparison for tokens #8945
- Use
hash_equals() for GReader API token comparison #9183
- Mailer: allow disabling SMTPAutoTLS via config #9026
- Warn during install if document root does not point to
./p/ #9010
- Stop the unread-count poller after the session ends #9065
- Add remote IP address to warning on form login #8942
- Pin the GitHub actions using SHA #9200
- Harden cache and SimplePie cache deserialization #9273
- SimplePie
- Security: Disallow
javascript: URI scheme (protocol) #8263
- Fix wrong player parent logic leading to invalid type #8893, simplepie#978
- Consistently enable
XML_OPTION_PARSE_HUGE #8894, simplepie#977
- Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
- Fix sanitizer whitelist stripping order #9066
- Show only one representation per
media:group #9009
- Bump upstream SimplePie #8947
- Features
- Filter global view feed list by state and search #9132
- Use global view when searching from subscription page #9144
- New option to hide badges showing number of unread articles (Phantom Obligation) #8844
- Refresh only feeds in the current view #9060
- Offer to add a prefix when resharing user labels #9236
- Add log search to the logs page #9059
- Add configurable
log_level system setting #9185
- New option to keep or not the custom sort order when navigating between categories and feeds #8969
- New per-feed option to show or hide enclosures (attachments) #9015
- Detect JSON feeds from URLs containing
json #9058
- Also when subscribing via the API #9167
- Order categories during OPML import/export according to position #9203
- OPML: include each feed’s refresh interval (TTL) in export/import #8982
- Log failed CSS content retrieval (Web scraping) #9077
- Allow providing a category when adding a feed by bookmarklet #9047
- Add LinkAce sharing service #9024
- Add Nextcloud Bookmarks sharing service #9032
- Bug fixing
- Fix lost elements while parsing search query #8884
- Fix “mark as read older than…” widening the active search #9173
- Fix saving user queries #9190
- Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
- Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
- Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
- PostgreSQL: make committing new entries resilient to duplicate keys #9231
- Preserve negative timezone offsets in date intervals #9071
- Fix feed dropdown bugs due to hash desync #8949
- Fix slider not reinitializing after form submit #8973
- Minz: Skip loading duplicated JS/CSS assets #9000
- Respect
simplepie_syslog_enabled for the uses cache logs #8986
- Fix statistics repartition averages #8996
- Fix article hover date visibility #8997
- Keep search and state filters when marking articles as read #9007
- Fix
--db-prefix silently drops following CLI flags #9042
- Remove stale dynamic favicon links #9127
- Fix desync between favicon and title unread counters #9262
- Fix outdated username length hint on registration and install forms #9013
- Redirect away from wrong URL paths #9075
- Fix auto-share shortcut on first use #9072
- Exclude hidden feeds from global view counts #9152
- Fix only the last
<media:credit> being written to the RSS output #9174
- CLI
- New
cli/reconfigure-user.php to read/write per-user config attributes #8873
- Report new articles count per feed in
app/actualize_script.php output #8948
- Output a diagnostic when the
cli/health.php check fails #8980
- API
- Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
- Fever API: log the client IP address on authentication failure #8981
- WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
- Deployment
- Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
- Start supporting PHP 8.6+
- Docker dev
:newest with PHP 8.6 #9155
- Docker: attach provenance and SBOM attestations to the published image #9150
- Apache use only
CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
- Fix
.dockerignore being ignored during build in CI #9001
- New
ENABLE_ACCESS_LOG environment variable to disable access logs #9191
- Check GMP during 32-bit installation #9046
- Improve actualize mutex to allow multiple instances #9045
- OIDC: redirect to a default URL on expired auth state instead of 400 #9143
- UI
- Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
- Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
- Move disable button before remove button in user management #8944
- Keep scroll position of slider after form submit #8974
- Group export feeds by category #9079, #9154
- Sort feed names with locale-aware collation #8985
- Sort labels with locale-aware collation #9023
- Format unread counter in title on page load #9263
- Display slider after submit for all buttons in feed update UI #8999
- Improve aside keyboard navigation #9202
- Allows usage of Ctrl/Shift keys with the open website shortcut #9186
- Fix padding for
.nav_menu in Alternative-Dark, Flat, and Nord themes #8901
- Fix typo in alert error border
color variable #9266
- Use JavaScript
Event() constructor instead of deprecated initEvent() #9035
- Use
:user-invalid instead of :invalid for CSS form field styling #9025
- Remove unused simple layout #8998
- Various UI and style improvements: #8823, #8824,
#9140, #9145
- Extensions
- Minor
Minz_Extension typing #8952
- Improve extension list fetch diagnostics #9055
- Fix a PHP warning in Serve action #9267
- Fix extension settings cancel action #9053
- Fix sharing menu conflicts with extensions #9074
- Add read status hook for entries #8995
- Dispatch a new JavaScript event
freshrss:entryStateChange when an entry finishes being marked read/unread #9031
- Redirect after saving user CSS/JS so changes apply immediately #9006
- I18n
- Misc.
- Update to PHPMailer 7.1.1 #8907
- Improve PHP code #8906, #9156
- Fix PHPStan 2.2.2 in CLI #8911
- Migrate
markdownlint-cli to markdownlint-cli2 #8987
- Update dev dependencies #8904, #8905, #8926,
#8939, #8940, #8963,
#8961, #8959, #8958,
#8962, #8960, #9148,
#9162, #9165, #9158,
#9159, #9176, #9178,
#9179, #9219, #9253,
#9254, #9255, #9257
Anmelden
FreshRSS 