This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.
From this release, we are also making it clear that our rolling-release channel (edge ) is recommended for faster security patches.
Breaking change 💥:
Disallow access to local networks such as 127.0.0.1 by default, for security reasons
Feature highlights✨:
Filter global view feed list by state and search
New option to hide badges showing number of unread articles (Phantom Obligation )
Refresh only feeds in the current view
Offer to add a prefix when re-sharing user labels
Bug fixes highlights 🐛:
Several security attack scenarios patched
Fix lost elements while parsing search query
Fix “mark as read older than…” widening the active search
Fix saving user queries
Fix SQL errors breaking some regex searches with MySQL / MariaDB
This release has been made by @Alkarex , @andris155 , @ColonelMoutarde , @Frenzie , @IEEE-754 , @Inverle , @math-GH , @nykula , @polybjorn , @Stunkymonkey and newcomers @0xdeadrelay , @AdamKorcz , @aligundogar , @bossaarebecca-alt , @Cactys12 , @chrislongros , @Divinelink , @Elgeryy1 , @featurecreep-cron , @Fripix , @fzlzjerry , @georatas , @gshimo , @iatman ,@ihsanarifr , @jamalkamaladdin , @JamBalaya56562 , @jbrayton , @jeremy-code , @juherr , @kobihikri , @LeeXiaolan , @masskrdjn , @mohammadlashkari , @nathanpixodeo , @Otolock , @payaci , @salvador-castro , @SamCyber001 , @satyvm , @senti-man , @simitana , @ThomasVermeer , @Totara-thib , @TowyTowy , @utkutibet , @XiaoSong1223
Full changelog :
Security
💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400 ,#9195
Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
Passing * allows all networks like before (unsafe)
Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
Fix auth CSRFs (login and register actions) #9171
Log invalid challenge and ignore JSON error during login #9278
Disallow fetching of non remote URI #9215
Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
Fix access control in rss and opml actions #8912
Refactor to use CSRF field directly instead of borrowing it from a form #9169 , #9205
Cleaner limit anonymous mode to default user #9235
Fix HTML ingestions in templates #9146 , #9170
Fix bad header filtering bypass #8964
Sanitize all fields during JSON import #9168
Gate greader (JSON) user query share format behind Share by OPML #9248
Public OPML should not contain cURL parameters #9070
Ignore security-relevant OPML attributes for dynamic OPML sources #9276
Strip feed URL credentials from anonymous user query output #9246
Set limits for regex during search #8913
Fix path disclosure in cache error message #9206
Limit the length and parentheses nesting depth of a search query #9277
Use timing-safe comparison for tokens #8945
Use hash_equals() for GReader API token comparison #9183
Mailer: allow disabling SMTPAutoTLS via config #9026
Warn during install if document root does not point to ./p/ #9010
Stop the unread-count poller after the session ends #9065
Add remote IP address to warning on form login #8942
Pin the GitHub actions using SHA #9200
Harden cache and SimplePie cache deserialization #9273
SimplePie
Security: Disallow javascript: URI scheme (protocol) #8263
Fix wrong player parent logic leading to invalid type #8893 , simplepie#978
Consistently enable XML_OPTION_PARSE_HUGE #8894 , simplepie#977
Fix null warning in IRI for PHP 8.5+ #8918 , simplepie#979
Fix sanitizer whitelist stripping order #9066
Show only one representation per media:group #9009
Bump upstream SimplePie #8947
Features
Filter global view feed list by state and search #9132
Use global view when searching from subscription page #9144
New option to hide badges showing number of unread articles (Phantom Obligation ) #8844
Refresh only feeds in the current view #9060
Offer to add a prefix when resharing user labels #9236
Add log search to the logs page #9059
Add configurable log_level system setting #9185
New option to keep or not the custom sort order when navigating between categories and feeds #8969
New per-feed option to show or hide enclosures (attachments) #9015
Detect JSON feeds from URLs containing json #9058
Also when subscribing via the API #9167
Order categories during OPML import/export according to position #9203
OPML: include each feed’s refresh interval (TTL) in export/import #8982
Log failed CSS content retrieval (Web scraping) #9077
Allow providing a category when adding a feed by bookmarklet #9047
Add LinkAce sharing service #9024
Add Nextcloud Bookmarks sharing service #9032
Bug fixing
Fix lost elements while parsing search query #8884
Fix “mark as read older than…” widening the active search #9173
Fix saving user queries #9190
Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
PostgreSQL: make committing new entries resilient to duplicate keys #9231
Preserve negative timezone offsets in date intervals #9071
Fix feed dropdown bugs due to hash desync #8949
Fix slider not reinitializing after form submit #8973
Minz: Skip loading duplicated JS/CSS assets #9000
Respect simplepie_syslog_enabled for the uses cache logs #8986
Fix statistics repartition averages #8996
Fix article hover date visibility #8997
Keep search and state filters when marking articles as read #9007
Fix --db-prefix silently drops following CLI flags #9042
Remove stale dynamic favicon links #9127
Fix desync between favicon and title unread counters #9262
Fix outdated username length hint on registration and install forms #9013
Redirect away from wrong URL paths #9075
Fix auto-share shortcut on first use #9072
Exclude hidden feeds from global view counts #9152
Fix only the last <media:credit> being written to the RSS output #9174
CLI
New cli/reconfigure-user.php to read/write per-user config attributes #8873
Report new articles count per feed in app/actualize_script.php output #8948
Output a diagnostic when the cli/health.php check fails #8980
API
Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
Fever API: log the client IP address on authentication failure #8981
WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
Deployment
Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
Start supporting PHP 8.6+
Docker dev :newest with PHP 8.6 #9155
Docker: attach provenance and SBOM attestations to the published image #9150
Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
Fix .dockerignore being ignored during build in CI #9001
New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
Check GMP during 32-bit installation #9046
Improve actualize mutex to allow multiple instances #9045
OIDC: redirect to a default URL on expired auth state instead of 400 #9143
UI
Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
Move disable button before remove button in user management #8944
Keep scroll position of slider after form submit #8974
Group export feeds by category #9079 , #9154
Sort feed names with locale-aware collation #8985
Sort labels with locale-aware collation #9023
Format unread counter in title on page load #9263
Display slider after submit for all buttons in feed update UI #8999
Improve aside keyboard navigation #9202
Allows usage of Ctrl/Shift keys with the open website shortcut #9186
Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
Fix typo in alert error border color variable #9266
Use JavaScript Event() constructor instead of deprecated initEvent() #9035
Use :user-invalid instead of :invalid for CSS form field styling #9025
Remove unused simple layout #8998
Various UI and style improvements: #8823 , #8824 ,#9140 , #9145
Extensions
Minor Minz_Extension typing #8952
Improve extension list fetch diagnostics #9055
Fix a PHP warning in Serve action #9267
Fix extension settings cancel action #9053
Fix sharing menu conflicts with extensions #9074
Add read status hook for entries #8995
Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
Redirect after saving user CSS/JS so changes apply immediately #9006
I18n
Misc.
Update to PHPMailer 7.1.1 #8907
Improve PHP code #8906 , #9156
Fix PHPStan 2.2.2 in CLI #8911
Migrate markdownlint-cli to markdownlint-cli2 #8987
Update dev dependencies #8904 , #8905 , #8926 ,#8939 , #8940 , #8963 ,#8961 , #8959 , #8958 ,#8962 , #8960 , #9148 ,#9162 , #9165 , #9158 ,#9159 , #9176 , #9178 ,#9179 , #9219 , #9253 ,#9254 , #9255 , #9257
Login
