Miniflux 2.2.14

Miniflux 2.2.14

Miniflux 2.2.13

✨ New Features

* **UI:** Added a "Back to top" link for easier navigation.
* **Integrations:**
  * Added support for **Wallabag tags**.
  * Added support for **LinkTaco** service to save articles.

🐛 Bug Fixes

* **API:** Fixed issue where `removed` entries could still be returned. It was generating an error when fetching entries.
* **Icons:** Improved handling of relative icon URLs within subfolders.
* **Timezone:** Ensured only current IANA time zones are used. This avoids issues with Debian Trixie where deprecated time zones have been removed.

🛠 Refactoring & Improvements

* Complete rewrite of the config parser with validation and consistency improvements.
* Combined YouTube subscription parsing functions into a single function.
* Simplified and optimized JavaScript files (`modal_handler.js`, removed `isTouchSupported()`).
* Refactored internal code to consistently use `time.Duration` for time values across CLI, server, fetcher, metrics, and HTTP components.
* Replaced "Bookmarks" with "Starred" across UI and codebase for consistency.
* Template and UI cleanups: explicit template dependencies, moved inline SVGs to `sprite.svg`, improved `layout.html` consistency.
* Strengthened the JavaScript Trusted Types policy to enhance security.
* Updated translations for German, Polish, and French.

⚡ Performance

* **XML Parsing:** Optimized `filterValidXMLChars` (~4% faster).
* **Sanitizer:** Improved sanitization performance by ~10% using `slices.Contains`.
* Converted slices to arrays in some internal structures for efficiency.

📦 Dependency Updates

* **go-webauthn/webauthn:** 0.13.4 → 0.14.0
* **golang.org/x/net:** 0.43.0 → 0.44.0
* **golang.org/x/image:** 0.30.0 → 0.31.0
* **golang.org/x/crypto:** 0.41.0 → 0.42.0
* **golang.org/x/term:** 0.34.0 → 0.35.0
* **golang.org/x/oauth2:** 0.30.0 → 0.31.0
* **tdewolff/minify/v2:** 2.23.11 → 2.24.3
* **prometheus/client\_golang:** 1.23.0 → 1.23.2
* GitHub Actions: `setup-go` and `setup-python` bumped from v5 → v6

Miniflux 2.2.13

✨ New Features

* **UI:** Added a "Back to top" link for easier navigation.
* **Integrations:**
  * Added support for **Wallabag tags**.
  * Added support for **LinkTaco** service to save articles.

🐛 Bug Fixes

* **API:** Fixed issue where `removed` entries could still be returned. It was generating an error when fetching entries.
* **Icons:** Improved handling of relative icon URLs within subfolders.
* **Timezone:** Ensured only current IANA time zones are used. This avoids issues with Debian Trixie where deprecated time zones have been removed.

🛠 Refactoring & Improvements

* Complete rewrite of the config parser with validation and consistency improvements.
* Combined YouTube subscription parsing functions into a single function.
* Simplified and optimized JavaScript files (`modal_handler.js`, removed `isTouchSupported()`).
* Refactored internal code to consistently use `time.Duration` for time values across CLI, server, fetcher, metrics, and HTTP components.
* Replaced "Bookmarks" with "Starred" across UI and codebase for consistency.
* Template and UI cleanups: explicit template dependencies, moved inline SVGs to `sprite.svg`, improved `layout.html` consistency.
* Strengthened the JavaScript Trusted Types policy to enhance security.
* Updated translations for German, Polish, and French.

⚡ Performance

* **XML Parsing:** Optimized `filterValidXMLChars` (~4% faster).
* **Sanitizer:** Improved sanitization performance by ~10% using `slices.Contains`.
* Converted slices to arrays in some internal structures for efficiency.

📦 Dependency Updates

* **go-webauthn/webauthn:** 0.13.4 → 0.14.0
* **golang.org/x/net:** 0.43.0 → 0.44.0
* **golang.org/x/image:** 0.30.0 → 0.31.0
* **golang.org/x/crypto:** 0.41.0 → 0.42.0
* **golang.org/x/term:** 0.34.0 → 0.35.0
* **golang.org/x/oauth2:** 0.30.0 → 0.31.0
* **tdewolff/minify/v2:** 2.23.11 → 2.24.3
* **prometheus/client\_golang:** 1.23.0 → 1.23.2
* GitHub Actions: `setup-go` and `setup-python` bumped from v5 → v6

Miniflux 2.2.12

Miniflux 2.2.12

* Keep only metadata of removed entries to reduce database size.
* Removed entry status is now immutable and cannot be changed back to `unread` or `read` status.
* SVG favicons are now minified before storing them in the database.
* Added support for resizing WebP images.
* Main menu now includes icons.
* Added Progressive Web App (PWA) shortcuts for quick access to common actions.
* Added direct link to the Apache 2.0 license on the About page.
* Feed-level webhook URLs now take priority when saving entries.
* New option: `POLLING_LIMIT_PER_HOST` to limit concurrent requests per host.
  Limits the number of concurrent requests to the same hostname when polling feeds.
  This helps prevent overwhelming a single server during batch processing by the worker pool.
* Added a rewrite rule to remove useless heading images on Phoronix articles.
* Use Golang's built-in VCS feature to get commit and build date when not specified by `LDFLAGS`.
* Disable OAuth2 and WebAuthn routes when the feature is not enabled.
* Added request URI logging in authentication handlers.

* Limited `tsvector` indexing to the first 500K characters to avoid PostgreSQL limits.
* Use `rel=apple-touch-icon` instead of `rel=apple-touch-icon-precomposed.png`.
* Fixed broken WebAuthn error alert message on the settings page.
* Reverted `SameSiteStrict` cookie mode because it forces people to authenticate each time when using the PWA on Android.
* Prevent stale data by forcing reload when navigating back from articles (fix for Chrome's **bfcache**).
* Fixed URL detection capturing newlines in media descriptions.

* Optimized SQL queries (`FetchJobs`, `markFeedAsRead`) by removing unnecessary joins and heavy-weight operations.
* Improved memory usage by minimizing SVGs, static images, and templates.
* WebAuthn script (`webauthn.js`) is no longer loaded when the feature is disabled.
* Replaced regex-based YouTube and Invidious video ID extraction with URL parsing.
* Introspect the translation files at load time.
* Parse and merge filters only once per refresh.

* Extensive refactoring across UI, templates, storage, and fetcher to simplify code and reduce memory allocations.
* Replaced `interface{}` with `any` (Go 1.18+ idiomatic usage).
* Reorganized JavaScript code: simplified functions, reduced duplication, and modernized handlers.
* `app.js` bundle and service worker files are now loaded as a JavaScript module.
* Use request builder in media proxy handler.

* Fixed typos and updated default values in the man page.
* Removed `ChangeLog` file (release notes are visible on GitHub and the official website - use the commit history for more details).

* Updated GitHub Actions workflows to use Go version **1.25**.
* Updated dependencies:

  * `golang.org/x/net` → 0.43.0
  * `golang.org/x/image` → 0.30.0
  * `golang.org/x/term` → 0.34.0
  * `github.com/tdewolff/minify/v2` → 2.23.11
  * `github.com/coreos/go-oidc/v3` → 3.15.0
  * `github.com/prometheus/client_golang` → 1.23.0
  * GitHub Actions: `actions/checkout` bumped to v5

* Added API integration tests for fetching categories with counters.
* Added tests for icon URL discovery, SVG minification error handling, and version format enforcement.
* Added unit tests for `RequestBuilder`.
* Avoided building a temporary binary for integration tests.

For more details, look at the commit history.

Miniflux 2.2.11

* **TLS support for Unix sockets**: Miniflux can now serve TLS over Unix domain sockets using `CERT_FILE` and `KEY_FILE` ([#fcf86e3](fcf86e3)).
* **RSS fallback**: If a feed entry has no URL, Miniflux now uses the enclosure URL as a fallback ([#d9de9d1](d9de9d1)).
* **Bearer token for Linkwarden**: The Linkwarden integration now uses Bearer token authorization instead of cookies ([#1d11623](1d11623)).
* **Cookie policy improvement**: `SameSiteStrictMode` is enforced for cookies when OAuth2/OIDC is not used ([#135ce1d](135ce1d)).
* **Readability engine**: Avoid removing elements with the `content` class during readability parsing ([#66b269e](66b269e)).

* **Massive readability engine refactoring** and performance optimizations:

  * Improved performance of `getClassWeight`, `getLinkDensity`, and `transformMisusedDivsIntoParagraphs`.
  * Simplified and optimized internal logic of `removeUnlikelyCandidates`, `getSelectionLength`, and `getArticle`.
  * Reduced memory allocation in sanitizer and readability components.
* **Storage optimization**: Strings are now truncated on the Go side to respect `tsvector` limits, reducing DB load and ensuring valid UTF-8 ([#703f113](703f113)).
* **Simplified and clarified internal code structure**:

  * Major cleanup and size optimization of internal structs (`Feed`, `FeedCreationRequest`, etc.).
  * Reduced memory use and improved CPU cache locality.
  * Numerous refactors across `config`, `template`, `locale`, `subscription`, and `fetcher` modules.

* Fixed an issue with feeds having excessive leading whitespace causing parser buffer issues ([#54abd0a](54abd0a)).
* Properly preserve UTF-8 when truncating strings for full-text search ([#703f113](703f113)).
* Fixed logic error in enclosure type detection ([#50d5cb9](50d5cb9)).
* Fixed incorrect filter rule parsing of Windows-style newlines ([#dc81725](dc81725)).
* Fixed a panic in `startAutoCertTLSServer` function when using Let's Encrypt automatic certificates ([#f7a6b02](f7a6b02))
* Improved UI spacing consistency around header/footer ([#32fbb4e](32fbb4e)).

* **Windows binary no longer distributed**: Windows is no longer a supported platform for binary distribution. Users must build from source if needed ([#b470b18](b470b18)).

* Test coverage significantly increased for modules like `readability`, `sanitizer`, `processor`, `locale`, and `storage`.
* Commit linter updated to support new Git revert message format.

* Base Docker image updated to Alpine 3.22.
* PostgreSQL Docker example updated to use the latest version.

* Updated Chinese and German translations.

* Bumped `github.com/go-webauthn/webauthn` to `0.13.4`
* Bumped `github.com/tdewolff/minify/v2` to `2.23.10`
* Bumped `golang.org/x/*` modules: `image`, `net`, `term`, `crypto`
* Bumped `github.com/andybalholm/brotli` to `1.2.0`

Miniflux 2.2.11

* **TLS support for Unix sockets**: Miniflux can now serve TLS over Unix domain sockets using `CERT_FILE` and `KEY_FILE` ([#fcf86e3](fcf86e3)).
* **RSS fallback**: If a feed entry has no URL, Miniflux now uses the enclosure URL as a fallback ([#d9de9d1](d9de9d1)).
* **Bearer token for Linkwarden**: The Linkwarden integration now uses Bearer token authorization instead of cookies ([#1d11623](1d11623)).
* **Cookie policy improvement**: `SameSiteStrictMode` is enforced for cookies when OAuth2/OIDC is not used ([#135ce1d](135ce1d)).
* **Readability engine**: Avoid removing elements with the `content` class during readability parsing ([#66b269e](66b269e)).

* **Massive readability engine refactoring** and performance optimizations:

  * Improved performance of `getClassWeight`, `getLinkDensity`, and `transformMisusedDivsIntoParagraphs`.
  * Simplified and optimized internal logic of `removeUnlikelyCandidates`, `getSelectionLength`, and `getArticle`.
  * Reduced memory allocation in sanitizer and readability components.
* **Storage optimization**: Strings are now truncated on the Go side to respect `tsvector` limits, reducing DB load and ensuring valid UTF-8 ([#703f113](703f113)).
* **Simplified and clarified internal code structure**:

  * Major cleanup and size optimization of internal structs (`Feed`, `FeedCreationRequest`, etc.).
  * Reduced memory use and improved CPU cache locality.
  * Numerous refactors across `config`, `template`, `locale`, `subscription`, and `fetcher` modules.

* Fixed an issue with feeds having excessive leading whitespace causing parser buffer issues ([#54abd0a](54abd0a)).
* Properly preserve UTF-8 when truncating strings for full-text search ([#703f113](703f113)).
* Fixed logic error in enclosure type detection ([#50d5cb9](50d5cb9)).
* Fixed incorrect filter rule parsing of Windows-style newlines ([#dc81725](dc81725)).
* Fixed a panic in `startAutoCertTLSServer` function when using Let's Encrypt automatic certificates ([#f7a6b02](f7a6b02))
* Improved UI spacing consistency around header/footer ([#32fbb4e](32fbb4e)).

* **Windows binary no longer distributed**: Windows is no longer a supported platform for binary distribution. Users must build from source if needed ([#b470b18](b470b18)).

* Test coverage significantly increased for modules like `readability`, `sanitizer`, `processor`, `locale`, and `storage`.
* Commit linter updated to support new Git revert message format.

* Base Docker image updated to Alpine 3.22.
* PostgreSQL Docker example updated to use the latest version.

* Updated Chinese and German translations.

* Bumped `github.com/go-webauthn/webauthn` to `0.13.4`
* Bumped `github.com/tdewolff/minify/v2` to `2.23.10`
* Bumped `golang.org/x/*` modules: `image`, `net`, `term`, `crypto`
* Bumped `github.com/andybalholm/brotli` to `1.2.0`

Miniflux 2.2.10

* test(sanitizer): add unit test for 0x0 pixel tracker
* test(sanitizer): add test case to cover Vimeo iframe rewrite without query string
* refactor(youtube): Remove a regex and make use of `fetchWatchTime`
* refactor(youtube): initialize two maps to the proper length
* refactor(tests): use `b.Loop()` instead of for range `b.N`
* refactor(server): avoid double call to `Sprintf`
* refactor(sanitizer): use global variables to avoid recreating slices on every call
* refactor(sanitizer): use a map for iframe allow list
* refactor(sanitizer): remove two useless `www.` prefixes
* refactor(sanitizer): make `isValidAttribute()` check O(1)
* refactor(rewrite): rename `Rewriter` function to `ApplyContentRewriteRules`
* refactor(processor): simplify Bilibili processing
* refactor(processor): remove a useless type declaration
* refactor(processor): remove a duplicated function call
* refactor(processor): refactor common code into a `fetchWatchTime` function
* refactor(processor): move filters to a `filter` package
* refactor(processor): move `FilterEntryMaxAgeDays` filter to filter package
* refactor(processor): move `RewriteEntryURL` function to `rewrite` package
* refactor(processor): minor simplification of a loop
* refactor(internal): add an `urllib.DomainWithoutWWW` function
* refactor(http): rename package from `httpd` to `server` for consistency
* refactor(http): Don't hardcode TLS configuration
* refactor(filter): avoid code duplication between `IsBlockedEntry` and `IsAllowedEntry` functions
* refactor(database): drop 3 columns in a single transaction
* refactor(crypto): use `rand.Text()` instead of a custom implementation
* refactor(config): remove deprecated config options
* refactor(appjs): no need to check if always present elements are always present
* perf(xml): optimized `NewXMLDecoder`
* perf(xml): optimize XML filtering
* perf(validator): slightly optimize a regex
* perf(timezone): cache `getLocation`'s results
* perf(storage): pre-allocate a slice in `RefreshFeedEntries`
* perf(storage): optimize away two `Sprintf` calls
* perf(sanitizer): use a switch-case instead of a map
* perf(sanitizer): minor simplifications of the sanitizer
* perf(sanitizer): extract a call to `url.Parse` and make intensive use of it
* perf(rss): optimize a bit `BuildFeed`
* perf(rss): early return when looking for an item's author
* perf(rewrite): make `getPredefinedRewriteRules` O(1)
* perf(reader): use a non-cryptographic hash when possible
* perf(reader): optimize `RemoveTrackingParameters`
* perf(readability): minor regex improvement
* perf(media): minor regex simplification
* perf(fetcher): pre-allocate the cipherSuites
* perf(database): use `TRUNCATE` instead of `DELETE FROM` in migrations
* perf(database): marginally speeds migrations up
* perf(api): use `math/rand/v2` instead of `math/rand` for better performance
* fix(readability): do not remove elements within code blocks
* fix(karakeep): correct method name and improve error handling in `SaveURL`
* fix(filter): skip invalid rules instead of exiting the loop
* feat(ui): display external link in single entry view because the URL was not visible on mobile (no mouse over)
* feat(ui): avoid showing an excessive number of tags
* feat(ui): add user setting to control `target="_blank"` on links
* feat(sanitizer): validate MathML XML namespace
* feat(sanitizer): consider images of size 0x0 as pixel trackers
* feat(sanitizer): add validation for empty `width` and `height` attributes in img tags
* feat(sanitizer): add support for `fetchpriority` and `decoding` attributes in img tags
* feat(rewrite): add support for YouTube Shorts video URL pattern
* feat(rewrite): add `parkablogs.com` to the referer override list
* feat(oidc): use `preferred_username` first instead of `email` claim
* feat(locale): update Polish translations
* feat(locale): update locales using machine translation
* feat(locale): update Indonesian translations
* feat(locale): update German translations
* feat(locale): update Chinese translations
* feat(integration)!: remove Pocket integration (Pocket will no longer be available after July 8, 2025)
* feat(filter): add `EntryDate=max-age:duration` filter
* feat(css): add margin-bottom to input for consistent spacing
* feat(config)!: remove `SERVER_TIMING_HEADER` config option
* feat: Allow multiple listen addresses
* feat: adding support for saving entries to Karakeep
* feat: add entry filters at the feed level
* docs(readme): document a couple of nifty features
* docs: add `CONTRIBUTING.md` file
* chore(template): remove `X-UA-Compatible` meta tag specific to Internet Explorer
* build(go): bump to go 1.24
* build(deps): bump `library/alpine` in `/packaging/docker/alpine`
* build(deps): bump `golang.org/x/net` from `0.40.0` to `0.41.0`
* build(deps): bump `golang.org/x/image` from `0.27.0` to `0.28.0`
* build(deps): bump `golang.org/x/crypto` from `0.38.0` to `0.39.0`

Miniflux 2.2.10

* test(sanitizer): add unit test for 0x0 pixel tracker
* test(sanitizer): add test case to cover Vimeo iframe rewrite without query string
* refactor(youtube): Remove a regex and make use of `fetchWatchTime`
* refactor(youtube): initialize two maps to the proper length
* refactor(tests): use `b.Loop()` instead of for range `b.N`
* refactor(server): avoid double call to `Sprintf`
* refactor(sanitizer): use global variables to avoid recreating slices on every call
* refactor(sanitizer): use a map for iframe allow list
* refactor(sanitizer): remove two useless `www.` prefixes
* refactor(sanitizer): make `isValidAttribute()` check O(1)
* refactor(rewrite): rename `Rewriter` function to `ApplyContentRewriteRules`
* refactor(processor): simplify Bilibili processing
* refactor(processor): remove a useless type declaration
* refactor(processor): remove a duplicated function call
* refactor(processor): refactor common code into a `fetchWatchTime` function
* refactor(processor): move filters to a `filter` package
* refactor(processor): move `FilterEntryMaxAgeDays` filter to filter package
* refactor(processor): move `RewriteEntryURL` function to `rewrite` package
* refactor(processor): minor simplification of a loop
* refactor(internal): add an `urllib.DomainWithoutWWW` function
* refactor(http): rename package from `httpd` to `server` for consistency
* refactor(http): Don't hardcode TLS configuration
* refactor(filter): avoid code duplication between `IsBlockedEntry` and `IsAllowedEntry` functions
* refactor(database): drop 3 columns in a single transaction
* refactor(crypto): use `rand.Text()` instead of a custom implementation
* refactor(config): remove deprecated config options
* refactor(appjs): no need to check if always present elements are always present
* perf(xml): optimized `NewXMLDecoder`
* perf(xml): optimize XML filtering
* perf(validator): slightly optimize a regex
* perf(timezone): cache `getLocation`'s results
* perf(storage): pre-allocate a slice in `RefreshFeedEntries`
* perf(storage): optimize away two `Sprintf` calls
* perf(sanitizer): use a switch-case instead of a map
* perf(sanitizer): minor simplifications of the sanitizer
* perf(sanitizer): extract a call to `url.Parse` and make intensive use of it
* perf(rss): optimize a bit `BuildFeed`
* perf(rss): early return when looking for an item's author
* perf(rewrite): make `getPredefinedRewriteRules` O(1)
* perf(reader): use a non-cryptographic hash when possible
* perf(reader): optimize `RemoveTrackingParameters`
* perf(readability): minor regex improvement
* perf(media): minor regex simplification
* perf(fetcher): pre-allocate the cipherSuites
* perf(database): use `TRUNCATE` instead of `DELETE FROM` in migrations
* perf(database): marginally speeds migrations up
* perf(api): use `math/rand/v2` instead of `math/rand` for better performance
* fix(readability): do not remove elements within code blocks
* fix(karakeep): correct method name and improve error handling in `SaveURL`
* fix(filter): skip invalid rules instead of exiting the loop
* feat(ui): display external link in single entry view because the URL was not visible on mobile (no mouse over)
* feat(ui): avoid showing an excessive number of tags
* feat(ui): add user setting to control `target="_blank"` on links
* feat(sanitizer): validate MathML XML namespace
* feat(sanitizer): consider images of size 0x0 as pixel trackers
* feat(sanitizer): add validation for empty `width` and `height` attributes in img tags
* feat(sanitizer): add support for `fetchpriority` and `decoding` attributes in img tags
* feat(rewrite): add support for YouTube Shorts video URL pattern
* feat(rewrite): add `parkablogs.com` to the referer override list
* feat(oidc): use `preferred_username` first instead of `email` claim
* feat(locale): update Polish translations
* feat(locale): update locales using machine translation
* feat(locale): update Indonesian translations
* feat(locale): update German translations
* feat(locale): update Chinese translations
* feat(integration)!: remove Pocket integration (Pocket will no longer be available after July 8, 2025)
* feat(filter): add `EntryDate=max-age:duration` filter
* feat(css): add margin-bottom to input for consistent spacing
* feat(config)!: remove `SERVER_TIMING_HEADER` config option
* feat: Allow multiple listen addresses
* feat: adding support for saving entries to Karakeep
* feat: add entry filters at the feed level
* docs(readme): document a couple of nifty features
* docs: add `CONTRIBUTING.md` file
* chore(template): remove `X-UA-Compatible` meta tag specific to Internet Explorer
* build(go): bump to go 1.24
* build(deps): bump `library/alpine` in `/packaging/docker/alpine`
* build(deps): bump `golang.org/x/net` from `0.40.0` to `0.41.0`
* build(deps): bump `golang.org/x/image` from `0.27.0` to `0.28.0`
* build(deps): bump `golang.org/x/crypto` from `0.38.0` to `0.39.0`