• Milestone

This is a security-focussed release for FreshRSS 1.26.x, addressing several CVEs (thanks @Inverle) 🛡

A few highlights ✨:

• Implement JSON string concatenation with & operator
• Support multiple JSON fragments in HTML+XPath+JSON mode (e.g. JSON-LD)
• Multiple security fixes with CVEs
• Bug fixes

Notes ℹ:

• Favicons will be reconstructed automatically when feeds gets refreshed. After that, you may need to refresh your Web browser as well.

This release has been made by @Alkarex, @Frenzie, @hkcomori, @loviuz, @math-GH
and newcomers @dezponia, @glyn, @Inverle, @Machou, @mikropsoft

Full changelog:

• Features
  • Implement JSON string concatenation with & operator #7414
  • Support multiple JSON fragments in HTML+XPath+JSON mode #7369
• Bug fixing
  • Fix escaping of tag search #7468
  • Fix CLI parsing of Boolean flags #7430
  • Fix API for labels with slash #7437
• SimplePie
  • Fix support for feeds with XML preamble + DTD #7515, simplepie#914
  • Merged upstream #7434
    • Upstream fix simplepie#912
• Security
  • Disallow <iframe srcdoc=""> #7494, CVE-2025-32015
  • Disallow <button formaction=""> #7506
  • Improve favicons hash to avoid favicon pollution #7505, CVE-2025-46339
  • Add Content-Security-Policy HTTP headers to favicons #7471, CVE-2025-31136
  • Web scraping forbid security HTTP headers in cURL #7496, CVE-2025-46341
  • Add some HTTP headers Referrer-Policy: same-origin #6303, #7478
  • Use HTTP POST for logout #7489, CVE-2025-31482
  • Make update URL read-only #7477
  • Fix for extensions: Restrict valid paths in ext.php #7479, CVE-2025-31134
  • Fix for extensions: Secure serving of user files #7495
• Extensions
  • Fix file serving for symlinked extensions #7545
  • Catch extension exceptions in override #7475
  • JavaScript: new event to detect context loaded #7452
• Deployment
  • Apache: add check for mod_filter to ensure that AddOutputFilterByType works #7419
• UI
  • Accessibility: Add :focus style to some dropdown menus #7491
  • New size option for the Mark as read button #7314
  • Update bcrypt.js from 2.4.4 to 3.0.2 #7449
  • Various UI and style improvements: #7168, #7526
• I18n
  • Rework credits #7426
  • Improve French #7432
  • Improve Italian #7540
  • Improve Polish #7508
  • Improve Turkish #7442
• Misc.
  • Improve PHP code #7431, #7488, #7534
  • Update dev dependencies #7480, #7482, #7483,
    #7484, #7485, #7486,
    #7487, #7533, #7535,
    #7536, #7537, #7538

• Milestone

This is a quality-focussed release for the 1.24.x series meant to provide a good product to people blocked on PHP 7.4, while we will increase the requirements to PHP 8.1+ from the next release.

A few highlights ✨:

• Last version supporting PHP 7.4 before requiring PHP 8.1+
• Last version supporting PostgreSQL 9.5 before requiring PostgreSQL 10+
• Last version supporting MariaDB 5.5 before requiring MariaDB 10.0.5+
• Last version supporting MySQL 5.5.3 before requiring MySQL 8+
• Many bug and regression fixes

This release has been made by @Alkarex, @math-GH and newcomer @pando85

Full changelog:

• Bug fixing
  • Fix mark-as-read from user query #6738
  • Fix regression for shortcut to move between categories #6741
  • Fix feed title option #6771
  • Fix XPath for HTML documents with broken root (used by CSS selectors to fetch full content) #6774
  • Fix UI regression in Mapco/Ansum themes #6740
  • Fix minor style bug with some themes #6746
  • Fix export of OPML information for date format of JSON and HTML+XPath feeds #6779
• Security
  • OpenID Connect better definition of session parameters #6730
• Compatibility
  • Last version supporting PHP 7.4
• Misc.
  • Use charset for JSON requests from the UI #6710
  • Use .html extension for the local cache of full content pages instead of .spc #6724
  • Update dev dependencies #6739, #6758,
    #6759, #6760

• Milestone
• Discussion

A few highlights ✨:

• New shareable user query mechanism to share lists of articles by HTML, RSS, OPML
  • Deprecates RSS sharing with master token
• New CLI for database backup & restore
  • Can also be used to migrate from one database to another, or to upgrade SQLite schema
• New JSON scraping mode to consume JSON data and JSON Feeds
• New support for HTTP POST
• New option to automatically add labels to incoming articles
• New button to download a feed configuration as OPML
• Many bug fixes

This release has been made by several contributors: @aledeg, @Alkarex, @andris155, @CilgaIscan, @cn-tools, @den13501, @eta-orionis, @Frenzie, @FromTheMoon85, @gmgall, @hkcomori, @jakopo87, @laxmanpradhan, @loviuz, @math-GH, @MayMeow, @OctopusET, @PedroPMS, @roughnecks, @soniyaprasad77, @th0mcat, @thomasrenes, @tiborepcek, @wolfpld, @yzqzss, @zukizukizuki
and several newcomers @eta-orionis, @gmgall, @hkcomori, @jakopo87, @jgtorcal, @krm-shrftdnv, @laxmanpradhan, @loviuz, @PedroPMS, @roughnecks, @soniyaprasad77, @th0mcat, @zukizukizuki

Full changelog:

• Features
  • New shareable user query mechanism to share list of articles by HTML, RSS, OPML #6052
    • Deprecates RSS sharing with master token
  • New JSON scraping mode to consume JSON data #5662, #6317,
    #6369, #6476
  • New support for JSON Feeds #5662
  • New support for HTTP POST #5662
  • New options to automatically add labels to incoming articles #5954
  • New button to download a feed configuration as OPML #6312
  • Web scraping support more encodings such as EUC-JP #6112
  • Web scraping support password-protected queries (refactor some cURL options and use CURLOPT_USERPWD) #6177
  • Web scraping HTTP GET allow UTF-8 even when charset is far from top #6271
  • Allow manual refresh of disabled feeds #6408
  • Allow multiple authors on enclosures #6272
  • New system option in data/config.php for number of feeds to refresh in parallel from UI #6124
• CLI
  • New CLI for database backup & restore #6387
    • Can also be used to migrate from one database to another, or to upgrade SQLite schema
    • ./cli/db-backup.php ; ./cli/db-restore.php
  • Improve CLI parameters #6028, #6036,
    #6099, #6214
  • Fix i18n cli/manipulate.translation.php ignore behaviour #6041
• API
  • New compatible app Read You #4633, #6050
  • Reduce API memory consumption #6137
  • Allow negative feed IDs for future special cases #6010
  • Only return OK for requests without query parameters #6238
• Bug fixing
  • Better account for some edge cases for cron and automatic labels during feed refresh #6117
  • Better support for thumbnails in RSS feeds #5972
  • Auto-update PostgreSQL or MariaDB / MySQL databases for column details changes since FreshRSS 1.21.0 #6279
    • For SQLite, DB update require running ./cli/db-backup.php ; ./cli/db-restore.php --force-overwrite
  • Fix SQLite import of exports produced before FreshRSS 1.20.0 #6450
  • Fix SQLite release handle to fix deleting users on Microsoft Windows #6285
  • Fix to allow admins to create user even when there are Terms Of Service #6269
  • Fix updating the uncategorized category deletes the title #6073
  • Fix disable master authentication token #6185
  • Fix CSS selector preview #6423
  • Fix CSS selector encoding #6426
  • Fix export of CSS selector in OPML of individual feeds #6435
  • Fix OPML import of CURLOPT_PROXYTYPE #6439
  • Fix favicon with protocol-relative URLs have duplicate slashes #6068
  • Fix feed TTL+muted logic #6115
  • Fix apply mark as read to updated articles too #6334
  • Fix ZIP export on systems with custom temp folder #6392
  • Fix number of posts per page during paging #6268
  • Fix clipboard sharing UI #6301
  • Fix shortcut for clipboard sharing #6277
  • Fix user-query filter display #6421
• SimplePie
  • Fix absolutize URL for several cases #6270, simplepie/#861
• Security
  • Replace iframe allow attribute #6274
• Deployment
  • Disable unused PHP modules in our Debian-based Docker image #5994
• UI
  • No warning for muted feeds #6114
  • Various UI and style improvements #6055, #6074,
    #6241, #6242, #6289,
    #6299, #6314, #6357,
    #6373, #6376, #6385,
    #6390, #6444, #6445
  • Improve theme Origine compact #6197
• i18n
  • Improve Brazilian Portuguese #6067
  • Improve Czech #6344
  • Improve Dutch #6343
  • Improve German #6313
  • Improve Hungarian #6005, #6377, #6464
  • Improve Indonesian #6473
  • Improve Italian #6018, #6060, #6329
  • Improve Japanese #6108, #6294
  • Improve Korean #6342
  • Improve Polish #6358
  • Improve Portuguese #6345
  • Improve Russian #6467
  • Improve Simplified Chinese #6336
  • Improve Slovakian #6356
  • Improve Spanish #6471
  • Improve Traditional Chinese #6350
  • Improve Turkish #6328
  • Misc. #6460
• Extensions
  • Sanitize parsing list of extensions names and version number #6016,
    #6155, Extensions#214, #6186
  • Apply filter actions such as mark as read after the entry_before_insert hook for extensions #6091
  • New developer command to test all third-party extensions Extensions#228, #6273
    • composer run-script phpstan-third-party
  • New function Minz_Extension::amendCsp() for extensions to modify HTTP headers for Content Security Policy #6246
  • New property FreshRSS_Entry::isUpdated() for extensions to know whether an entry is new or updated #6334
• Compatibility
  • Fix PHP 7.4 compatibility for automated tests #6038, #6039
  • Fix PHP 8.2+ compatibility for e-mails #6130
  • Use PHP 8.3+ #[\Override] #6273
• Misc.
  • Improve PHPStan #6037, #6459
  • Update PHPMailer #6022
  • Remove noisy name parameters in user-query URL #6371
  • Code improvements #6046, #6075,
    #6132
  • Add Dependabot for GitHub Actions #6164
  • Allow Ctrl+C for make start #6239
  • Update dev dependencies #6023, #6265