Anmelden
FreshRSS 1.30.0
09. September 2026 um 16:43
This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.
From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.
Breaking change 💥:
- Disallow access to local networks such as
127.0.0.1by default, for security reasons
Feature highlights✨:
- Filter global view feed list by state and search
- New option to hide badges showing number of unread articles (Phantom Obligation)
- Refresh only feeds in the current view
- Offer to add a prefix when re-sharing user labels
Bug fixes highlights 🐛:
- Several security attack scenarios patched
- Fix lost elements while parsing search query
- Fix “mark as read older than…” widening the active search
- Fix saving user queries
- Fix SQL errors breaking some regex searches with MySQL / MariaDB
This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223
Full changelog:
- Security
- 💥 Disallow access to local networks such as
127.0.0.1by default, for security reasons (breaking change) #8400,
#9195- Selected local networks can be allowed under System configuration or using the
INTERNAL_HOST_ALLOWLISTenvironment variable - Passing
*allows all networks like before (unsafe)
- Selected local networks can be allowed under System configuration or using the
- Improve SSRF mitigations by restricting
CURLOPT_PROXY#8950 - Fix auth CSRFs (login and register actions) #9171
- Log invalid challenge and ignore JSON error during login #9278
- Disallow fetching of non remote URI #9215
- Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
- Fix access control in
rssandopmlactions #8912 - Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
- Cleaner limit anonymous mode to default user #9235
- Fix HTML ingestions in templates #9146, #9170
- Fix bad header filtering bypass #8964
- Sanitize all fields during JSON import #9168
- Gate
greader(JSON) user query share format behind Share by OPML #9248 - Public OPML should not contain cURL parameters #9070
- Ignore security-relevant OPML attributes for dynamic OPML sources #9276
- Strip feed URL credentials from anonymous user query output #9246
- Set limits for regex during search #8913
- Fix path disclosure in cache error message #9206
- Limit the length and parentheses nesting depth of a search query #9277
- Use timing-safe comparison for tokens #8945
- Use
hash_equals()for GReader API token comparison #9183 - Mailer: allow disabling SMTPAutoTLS via config #9026
- Warn during install if document root does not point to
./p/#9010 - Stop the unread-count poller after the session ends #9065
- Add remote IP address to warning on form login #8942
- Pin the GitHub actions using SHA #9200
- Harden cache and SimplePie cache deserialization #9273
- 💥 Disallow access to local networks such as
- SimplePie
- Security: Disallow
javascript:URI scheme (protocol) #8263 - Fix wrong player parent logic leading to invalid type #8893, simplepie#978
- Consistently enable
XML_OPTION_PARSE_HUGE#8894, simplepie#977 - Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
- Fix sanitizer whitelist stripping order #9066
- Show only one representation per
media:group#9009 - Bump upstream SimplePie #8947
- Security: Disallow
- Features
- Filter global view feed list by state and search #9132
- Use global view when searching from subscription page #9144
- New option to hide badges showing number of unread articles (Phantom Obligation) #8844
- Refresh only feeds in the current view #9060
- Offer to add a prefix when resharing user labels #9236
- Add log search to the logs page #9059
- Add configurable
log_levelsystem setting #9185 - New option to keep or not the custom sort order when navigating between categories and feeds #8969
- New per-feed option to show or hide enclosures (attachments) #9015
- Detect JSON feeds from URLs containing
json#9058- Also when subscribing via the API #9167
- Order categories during OPML import/export according to position #9203
- OPML: include each feed’s refresh interval (TTL) in export/import #8982
- Log failed CSS content retrieval (Web scraping) #9077
- Allow providing a category when adding a feed by bookmarklet #9047
- Add LinkAce sharing service #9024
- Add Nextcloud Bookmarks sharing service #9032
- Filter global view feed list by state and search #9132
- Bug fixing
- Fix lost elements while parsing search query #8884
- Fix “mark as read older than…” widening the active search #9173
- Fix saving user queries #9190
- Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
- Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
- Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
- PostgreSQL: make committing new entries resilient to duplicate keys #9231
- Preserve negative timezone offsets in date intervals #9071
- Fix feed dropdown bugs due to hash desync #8949
- Fix slider not reinitializing after form submit #8973
- Minz: Skip loading duplicated JS/CSS assets #9000
- Respect
simplepie_syslog_enabledfor the uses cache logs #8986 - Fix statistics repartition averages #8996
- Fix article hover date visibility #8997
- Keep search and state filters when marking articles as read #9007
- Fix
--db-prefixsilently drops following CLI flags #9042 - Remove stale dynamic favicon links #9127
- Fix desync between favicon and title unread counters #9262
- Fix outdated username length hint on registration and install forms #9013
- Redirect away from wrong URL paths #9075
- Fix auto-share shortcut on first use #9072
- Exclude hidden feeds from global view counts #9152
- Fix only the last
<media:credit>being written to the RSS output #9174
- CLI
- API
- Deployment
- Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
- Start supporting PHP 8.6+
- Docker dev
:newestwith PHP 8.6 #9155
- Docker dev
- Docker: attach provenance and SBOM attestations to the published image #9150
- Apache use only
CONN_REMOTE_ADDRin logs whenmod_remoteipis available, for compatibility with LiteSpeed Web Server #8890 - Fix
.dockerignorebeing ignored during build in CI #9001 - New
ENABLE_ACCESS_LOGenvironment variable to disable access logs #9191 - Check GMP during 32-bit installation #9046
- Improve actualize mutex to allow multiple instances #9045
- OIDC: redirect to a default URL on expired auth state instead of 400 #9143
- UI
- Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
- Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
- Move disable button before remove button in user management #8944
- Keep scroll position of slider after form submit #8974
- Group export feeds by category #9079, #9154
- Sort feed names with locale-aware collation #8985
- Sort labels with locale-aware collation #9023
- Format unread counter in title on page load #9263
- Display slider after submit for all buttons in feed update UI #8999
- Improve aside keyboard navigation #9202
- Allows usage of Ctrl/Shift keys with the open website shortcut #9186
- Fix padding for
.nav_menuin Alternative-Dark, Flat, and Nord themes #8901 - Fix typo in alert error border
colorvariable #9266 - Use JavaScript
Event()constructor instead of deprecatedinitEvent()#9035 - Use
:user-invalidinstead of:invalidfor CSS form field styling #9025 - Remove unused simple layout #8998
- Various UI and style improvements: #8823, #8824,
#9140, #9145
- Extensions
- Minor
Minz_Extensiontyping #8952 - Improve extension list fetch diagnostics #9055
- Fix a PHP warning in Serve action #9267
- Fix extension settings cancel action #9053
- Fix sharing menu conflicts with extensions #9074
- Add read status hook for entries #8995
- Dispatch a new JavaScript event
freshrss:entryStateChangewhen an entry finishes being marked read/unread #9031 - Redirect after saving user CSS/JS so changes apply immediately #9006
- Minor
- I18n
- New plural system #8988
- Pluralize the new articles count message
- Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
- Add Azerbaijani #9269
- Add Lithuanian #9201, #9213
- Improve Brazilian Portuguese #9240, #9242
- Improve German #9149
- Improve Greek #8977, #9038
- Improve Hungarian #8879
- Improve Indonesian (Bahasa Indonesia) #9220
- Improve Italian #8880
- Improve Japanese #9064
- Improve Persian #8923
- Improve Spanish #8878, #9245
- Improve Traditional Chinese #9037, #9069, #9223
- Improve Turkish #8966, #8971, #8970,
#8989 - Improve Ukrainian #8871
- Refactor user query translation keys #9049
- New plural system #8988
- Misc.
- Update to PHPMailer 7.1.1 #8907
- Improve PHP code #8906, #9156
- Fix PHPStan 2.2.2 in CLI #8911
- Migrate
markdownlint-clitomarkdownlint-cli2#8987 - Update dev dependencies #8904, #8905, #8926,
#8939, #8940, #8963,
#8961, #8959, #8958,
#8962, #8960, #9148,
#9162, #9165, #9158,
#9159, #9176, #9178,
#9179, #9219, #9253,
#9254, #9255, #9257
