• Milestone

This is a security-fix and bug-fix release for FreshRSS 1.27.x.

A few highlights ✨:

• Keep sort and order criteria after marking as read
• Automatic database recovery: skip broken entries during CLI export/import
• Add possibility of Docker healthcheck
• Add security option for CSP frame-ancestors
• Several security fixes
• Several bug fixes
• New translation to Ukrainian
• Improvements of some themes
• And much more…

This release has been made by @Alkarex, @Frenzie, @Inverle, @aledeg, @math-GH and newcomers @beerisgood, @nykula, @horvi28, @nhirokinet, @rnkln, @scmaybee.

Full changelog:

• Features
  • Automatic database recovery: skip broken entries during CLI export/import #7949
  • Add security option for CSP frame-ancestors #7857, #8021
  • Lazy-load <track src> #7997
• Security
  • Regenerate session ID on login #7829
  • Disallow setting non-existent language #7878, #7934
  • Safer calling of install.php #7971
  • Prevent log CR/LF injection #7883
  • Restrict allowed cURL parameters #7979, #8009
  • Fix reauthentication while updating #7989
  • Fix some CSRFs #8000
• Bug fixing
  • Include port number for HTTP Retry-After #7875
  • Fix logic for searching labels #7863
  • Fix cURL response parsing for HTTP redirections #7866
  • Fix fetching OPML URL with special characters #7843
  • Fix validation when creating a new user label #7890
  • Fix bug in user self-deletion #7877
  • Fix displaying of current date in main statistics #7892
  • Fix default values on stat processing #7891
  • Fix UI JavaScript error when navigating to last article with keyboard #7957
  • Fix some links in anonymous mode #8011, #8012
  • Fixes for no-cache.txt #7907
  • Fix Docker Traefik .yml and SERVER_DNS example #7858
• SimplePie
  • Upstream contribution: Normalize encoding uppercase simplepie#936, #7967
  • Sync upstream, including bump to 1.9.0 with better PHP 8.5+ support #7955
• Deployment
  • Docker improve CMD compatibility #7861
  • Add possibility of Docker healthcheck #7945
• UI
  • Keep sort and order after marking as read #7974
  • Improve leave validation #7830
  • Improve Origine theme visibility of toggle buttons #7956
  • Improve Dark pink theme #8020
  • Improve Mapco and Ansum themes: read all button in mobile view #7873
  • Improve Swage theme #7608
  • Use standard CSS overflow-wrap instead of word-wrap #7898
  • Various UI and style improvements: #7868, #7872,
    #7882, #7893, #7904,
    #7952
• I18n
  • Clarify the concepts of visibility hidden vs. archived in feeds settings #7970
  • Translate the API information page #7922
  • Add a default language constant #7933
  • Label config delete label #7871
  • Add Ukrainian #7961
  • Improve Dutch #7940
  • Improve German #7833
  • Improve Hungarian #7986
  • Improve Japanese #7903, #7918
  • Improve Polish #7963
  • Improve Simplified Chinese #7943, #7944
  • Minor improvements #7881
  • Add CLI command to add i18n file #7917
  • Add make target to generate the translation progress #7905
• Extensions
  • Add entry_before_update and entry_before_add hooks for extensions #7977
• Misc.
  • Improve make #7901
  • Improve PHP code #7906, #7916, #7939,
    #7941, #7960, #7991
  • Upgrade to PHP_CodeSniffer 4 #7993
  • Update dev dependencies #7902, #7895, #7896,
    #7899, #7966, #7969

• Milestone

This is a security-focussed release for FreshRSS 1.26.x, addressing several CVEs (thanks @Inverle) 🛡

A few highlights ✨:

• Implement JSON string concatenation with & operator
• Support multiple JSON fragments in HTML+XPath+JSON mode (e.g. JSON-LD)
• Multiple security fixes with CVEs
• Bug fixes

Notes ℹ:

• Favicons will be reconstructed automatically when feeds gets refreshed. After that, you may need to refresh your Web browser as well.

This release has been made by @Alkarex, @Frenzie, @hkcomori, @loviuz, @math-GH
and newcomers @dezponia, @glyn, @Inverle, @Machou, @mikropsoft

Full changelog:

• Features
  • Implement JSON string concatenation with & operator #7414
  • Support multiple JSON fragments in HTML+XPath+JSON mode #7369
• Bug fixing
  • Fix escaping of tag search #7468
  • Fix CLI parsing of Boolean flags #7430
  • Fix API for labels with slash #7437
• SimplePie
  • Fix support for feeds with XML preamble + DTD #7515, simplepie#914
  • Merged upstream #7434
    • Upstream fix simplepie#912
• Security
  • Disallow <iframe srcdoc=""> #7494, CVE-2025-32015
  • Disallow <button formaction=""> #7506
  • Improve favicons hash to avoid favicon pollution #7505, CVE-2025-46339
  • Add Content-Security-Policy HTTP headers to favicons #7471, CVE-2025-31136
  • Web scraping forbid security HTTP headers in cURL #7496, CVE-2025-46341
  • Add some HTTP headers Referrer-Policy: same-origin #6303, #7478
  • Use HTTP POST for logout #7489, CVE-2025-31482
  • Make update URL read-only #7477
  • Fix for extensions: Restrict valid paths in ext.php #7479, CVE-2025-31134
  • Fix for extensions: Secure serving of user files #7495
• Extensions
  • Fix file serving for symlinked extensions #7545
  • Catch extension exceptions in override #7475
  • JavaScript: new event to detect context loaded #7452
• Deployment
  • Apache: add check for mod_filter to ensure that AddOutputFilterByType works #7419
• UI
  • Accessibility: Add :focus style to some dropdown menus #7491
  • New size option for the Mark as read button #7314
  • Update bcrypt.js from 2.4.4 to 3.0.2 #7449
  • Various UI and style improvements: #7168, #7526
• I18n
  • Rework credits #7426
  • Improve French #7432
  • Improve Italian #7540
  • Improve Polish #7508
  • Improve Turkish #7442
• Misc.
  • Improve PHP code #7431, #7488, #7534
  • Update dev dependencies #7480, #7482, #7483,
    #7484, #7485, #7486,
    #7487, #7533, #7535,
    #7536, #7537, #7538

• Milestone
• Discussion 🎄

A few highlights ✨:

• New Important feeds group in the main view, with corresponding new priority level for feeds #5782
  • Entries from important feeds are not marked as read during scroll, during focus, nor during Mark all as read
• Add filter actions (auto mark as read) at category level and at global levels #5942
• Increase SQL fields length to maximum possible #5788, #5570
• Many bug fixes

Breaking changes 💥:

• Require PHP 7.4+
• Soft require Apache 2.4+ (but repair minimal compatibility with Apache 2.2)
• Use GitHub Actions to build Docker images, offering architectures amd64, arm32v7, arm64v8 with automatic detection #5808
  • So no -arm suffix anymore
• Upgraded extensions require FreshRSS 1.23.0+ Extensions#181

This release has been made by several contributors: @Alkarex, @ColonelMoutarde, @FireFingers21, @Frenzie, @kasimircash, @andris155, @b-reich, @foux, @jaden, @jan-vandenberg, @joestump, @jtracey, @mark-monteiro, @martinrotter, @math-GH, @passbe

Full changelog:

• Features
  • New Important feeds group in the main view, with corresponding new priority level for feeds #5782
    • Entries from important feeds are not marked as read during scroll, during focus, nor during Mark all as read
  • Add filter actions (auto mark as read) at category level and at global levels #5942
  • Improve reliability of Max number of articles to keep unread #5905
  • New option to mark entries as read when focused from keyboard shortcut 5812
  • New display option to hide My labels in article footers #5884
  • Add support for more thumbnail types in feeds enclosures #5806
  • Support for favicons with non-absolute paths #5839
  • Increase SQL (VARCHAR) text fields length to maximum possible #5788
  • Increase SQL date fields to 64-bit to be ready for year 2038+ #5570
• Compatibility
  • Require PHP 7.4+, and implement typed properties #5720
  • Require Apache 2.4+ (but repair minimal compatibility with Apache 2.2) #5791, #5804
• Bug fixing
  • Fix regression in Docker CRON_MIN if any environment variable contains a single quote #5795
  • Improve filtering of cron environment variables #5898
  • Fix the TRUSTED_PROXY environment variable used in combination with trusted sources #5853
  • Fix regression in marking as read if an identical title already exists #5937
  • Fix JavaScript regression in label dropdown #5785
  • Fix regression when renaming a label #5842
  • Fix API for adding feed with a title #5868
  • Fix regression in UI of update page #5802
  • Fix XPath encoding #5912
  • Fix notifications, in particular during login #5959
• Deployment
  • Use GitHub Actions to build Docker images, offering architectures amd64, arm32v7, arm64v8 with automatic detection #5808
  • Docker alternative image updated to Alpine 3.19 with PHP 8.2.13 and Apache 2.4.58 #5383
• Extensions
  • Upgrade extensions code to PHP 7.4+ #5901, #5957
  • Breaking change: upgraded extensions require FreshRSS 1.23.0+ Extensions#181
  • Pass FreshRSS version to JavaScript client side for extensions #5902
  • Add GitHub Actions and PHPStan for automatic testing of the Extensions repository Extensions#185
• API
  • Improve handling of new lines in enclosure descriptions (e.g., YouTube video descriptions) #5859
• Security
  • Avoid printing exceptions in favicons #5867
  • Remove unneeded execution permissions on some files #5831
• UI
  • Ensure that enough articles are loaded on window resize #5815
  • Improve Nord theme #5885
  • Do not show message Add some feeds #5827
  • Various UI and style improvements #5886
• i18n
  • Fix font priority for languages using Han characters #5930
  • Improve Dutch #5796
  • Improve Hungarian #5918
• Misc.
  • Increase PHPStan from Level 7 to Level 8 #5946
  • Compatibility PHP 8.2+ for running automated tests #5826
  • Use PHP declare(strict_types=1); #5830
  • Better stack trace for SQL errors #5916
  • Code improvements #5511, #5945
  • Update dev dependencies #5787