❌

Normal view

Received today — 6 November 2026 ⏭ FreshRSS releases

FreshRSS 1.30.4

✇FreshRSS releases
By: Alkarex
21 October 2026 at 23:45

This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

This release has been made by @Alkarex, @Frenzie and newcomer @icco

Full changelog:

  • Security
    • Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475
    • Docker: disable PHP session.upload_progress.enabled for additional security #9476
  • I18n

FreshRSS 1.30.3

✇FreshRSS releases
By: Alkarex
21 October 2026 at 17:30

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

  • Deployment
    • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
  • Extensions
    • New hook: Minz_HookType::AutofillField for auth views #9362
  • I18n
    • Improve Brazilian Portuguese #9473
  • Misc.
    • Translate non-English code comments and identifiers #9383

FreshRSS 1.30.2

✇FreshRSS releases
By: Alkarex
19 October 2026 at 23:57

This is a second security and bug-fixing release in the continuation of 1.30.x.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

  • Fix PHP 8.5+ deprecation warning with SQLite
  • Block data: URI scheme in some cases

Performance highlights 🏎️:

  • Reduce memory consumption of export

This release has been made by @Alkarex, @Inverle and newcomers @abp002, @Arslan-TR, @Emredinho61, @HawkForge, @lordmarrik, @spa77k, @tomac4t, @tpq2030

Full changelog:

  • Security
    • SimplePie sanitizer: block data: URI scheme while keeping data:image for images #9417
    • Mitigate some 404 situations #9435
    • Do not log the Fever API key on authentication failure #9468
    • Fix local DNS leak when fetching feeds through a proxy #9451
  • Bug fixes
    • WebSub fix POST, fix warning, better message #9420
    • Fix PHP 8.5+ deprecation of sqliteCreateFunction for SQLite #9421
    • Preserve explicit sort overrides when searching #9467
    • Fix wrong order of args in extension compatibility check #9445
  • Performance
    • Reduce memory consumption of export #9350
  • Features
    • Better doc and log proxy cases #9436
  • Extensions
  • UI
    • Disallow user page navigation while refreshing feeds #9446
    • Various UI and style improvements #9426, #9441
  • I18n
  • Misc.
    • Update to GT\CssXPath 1.6.0 #9411
    • CI/CD: Fix login to Docker Hub #9433
    • Fix SVGO zero percent filtering in CI #9422
    • Update dev dependencies #9425

FreshRSS 1.30.1

✇FreshRSS releases
By: Alkarex
5 October 2026 at 22:40

This is a security-oriented release with several security patches and bug fixes in the continuation of 1.30.0.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

  • Some security attack scenarios patched
  • Fix domain-wide Retry-After
  • Fix muting of feeds gone with HTTP 410

Feature highlights✨:

  • CLI: Add optional feed argument to actualize-user.php

This release has been made by @Alkarex, @andris155, @fzlzjerry, @Inverle, @jamalkamaladdin, @jtracey, @Otolock and newcomers @akine, @colons, @ethanstoner, @gigioneggiando, @Juice-de-Orange, @pavel-miniutka, @qwist1233-cpu, @Sharawey74, @shcheglovnd, @TapuGithub, @yuchenshi, @ZainnQureshii

Full changelog:

  • Deployment
    • Reword recommendations and explanations for edge (rolling release) vs. latest (versioned release) channels #9270
  • Security
    • Config + increase default values for search max length and depth #9280
    • Accept a trusted proxy address given without a subnet #9301
    • Warn during session regenerate fail #9311, #9376
    • CI/CD add zizmor workflow for action security checks #9228, #9331
    • Use PHP #[\SensitiveParameter] #9322
    • Reject token access (RSS/OPML export, feed refresh) for disabled accounts #9336
    • Require POST+CSRF for self-update mutations #9335
    • Make the login challenge nonce one-time #9334
    • Bound ZIP import against decompression bombs #9332
    • Rotate session ID on all authenticated transitions #9333
    • Minz: Remove vulnerable and unused code path for displaying errors #9395
    • Fix NAT64 feed fetching on IPv6-only hosts #9372
  • Bug fixes
    • Fix domain-wide Retry-After #9390
    • Fix muting of feeds gone with HTTP 410 #9391
    • Fix infinite redirect loop due to SCRIPT_NAME in PATH_INFO #9282, #9287
    • Restore the automatic reading view after marking articles as read, while preserving explicit filters #9288
    • Fix adaptive reading state after marking articles read #9290
    • Fix regression sharing links #9303
    • Don’t disable anonymous refresh when anonymous feed access is disabled #9354
    • Fix regression with HTTPS proxies due to wrong TLS SNI resolution #9341
    • Better enforce limits for feeds and categories #9357
    • Fix JavaScript error when opening a label menu in sidebar #9377
    • Fix custom favicon with GReader API #9409
  • CLI
    • Add optional feed argument to actualize-user.php #9319
  • UI
  • Extensions
    • Call check_url_before_add hook when previewing a feed #9343
  • I18n
  • Misc.

There are no more articles
❌