New features

• Added Gotify push notification support.
• Added Steam scraper rules.
• Added validation with helpful error messages when saving rewrite rules.

Performance improvements

• Reduced database storage used by enclosure and entry indexes.
• Reduced memory used by internal data structures.

Security

• Blocked reserved IP address ranges to further protect against server-side request forgery.
• Hardened WebAuthn redirects against open-redirect attacks, including redirect URLs containing surrounding whitespace.
• Prevented per-feed proxy URLs from bypassing private-network restrictions by default. Set FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 to retain access to private per-feed proxies.
• Enforced DISABLE_LOCAL_AUTH for API password authentication and password changes; API clients must use an API key when local authentication is disabled.
• Rejected Google Reader authentication tokens when no password is configured.
• Restricted embedded iframe URLs to web schemes and tightened YouTube hostname validation.

Bug fixes

• Added timeouts to the ACME challenge listener.
• Fixed response compression negotiation to consistently prefer the server's configured encoding order.
• Improved Karakeep errors when saving an entry fails by reporting the HTTP status.
• Returned to the first unread page when marking entries as read leaves the current feed or category page empty.
• Restored support for proxies configured through HTTP_PROXY or HTTPS_PROXY, including across redirects.
• Returned a validation error instead of crashing when creating or importing feeds for users without a category.
• Preserved the requested redirect after passkey login.
• Increased the Google Reader item-ID limit to 10,000.
• Returned a bad-request response instead of crashing on POST requests to static asset paths.
• Improved accessibility by adding descriptive names to documentation links.
• Improved error logging and responses for failed database existence checks and shared-entry lookups.

Localization

• Updated Polish (pl_PL) translations.

Documentation

• Clarified the Unix socket permissions used with LISTEN_ADDR.

Dependencies

• Updated several Go modules and GitHub Actions dependencies.

As always, thank you to all contributors who helped improve Miniflux in this release.

New features

• Feed and entry language detection

  • Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
  • Entries without their own language now inherit the language declared by the feed.
  • Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  • The language field is exposed through the API and the Go client for both feeds and entries.

• Other additions

  • Feed discovery now finds the feeds offered by GitHub pages.
  • TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
  • The browser favicon is now served as SVG for a sharper icon on high-density displays.
  • Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

• Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
• Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
• Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

• Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
• Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
• Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
• Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

• Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
• Fixed a race condition during template rendering that could return a page translated in another user's language.
• Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
• Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
• Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
• MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
• Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
• Fixed a category deletion check that could remove all of a user's categories.
• Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
• Fixed the no_media_player option being ignored when creating a feed.
• A feed proxy URL can now be cleared once it has been configured.
• Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
• Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
• Fixed the remove_tables rewrite rule reordering article content.
• Fixed plain text content_text and summary values from JSON Feed being mangled when they containe

New features

• Improved full-text search

  • Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions.

• API improvements

  • Added GET /v1/entries/ids to efficiently retrieve paginated entry IDs.
  • Added support for updating the starred status of multiple entries through PUT /v1/entries.
  • API clients can now filter entries by tags.
  • The Go client now exposes additional feed fields (description, icon, next_check_at, notification settings, no_media_player, etc.) and supports the new tag filter.

• Atom feed improvements

  • When an Atom entry id contains an HTTP URL, it is now used as the entry URL when no dedicated link is available.

Performance improvements

• Improved full-text search performance by caching compiled regular expressions used by filtering rules.
• Reduced database work when computing category statistics.
• Improved browser caching of static assets.
• Reduced template rendering overhead by precomputing static icon URLs.

Security

• Prevent username enumeration through login timing differences.
• PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness. This change raises the minimum supported PostgreSQL version to 11.

Bug fixes

• Fixed validation of per-feed entry filter rules in the web interface.
• SOCKS proxy URLs can once again be configured for individual feeds.
• Fixed enclosure URL proxying consistency across API endpoints.
• Fixed several API handlers that incorrectly returned 404 Not Found or 400 Bad Request instead of proper server errors.
• Fixed inconsistent handling of invalid category filters in the Entries API.
• Fixed user lookup edge cases that could result in nil pointer dereferences.
• Fixed enclosure lookup to correctly scope results by user.
• Fixed the Google Reader Quick Add endpoint to honor the configured HTTP user agent.
• Fixed refresh-all keyboard shortcut (R) to correctly display the success notification.
• Fixed localization formatting issues affecting several languages.
• Fixed request builder state leaking during feed discovery.
• Improved accessibility by correcting an aria-labelledby issue.

Localization

• Updated German (de_DE) translations.
• Updated Galician (gl_ES) translations.

Documentation

• Clarified the units for POLLING_FREQUENCY.
• Improved documentation for TRUSTED_REVERSE_PROXY_NETWORKS.

Dependencies

• Updated several Go modules and GitHub Actions dependencies.

Security

• Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
• Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
• Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
• Hardened metrics endpoint authentication by using constant-time credential comparisons.

Bug Fixes

• Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

Improvements

• Added Korean language support.
• Improved HTML truncation performance and reduced memory allocations.
• Optimized feed discovery, subscription detection, date parsing, and tag filtering.
• Simplified and refactored several storage and query-building components for better maintainability.

Dependencies

Updated several dependencies, including:

• github.com/go-webauthn/webauthn 0.17.4
• golang.org/x/crypto 0.52.0
• golang.org/x/image 0.41.0
• golang.org/x/net 0.55.0

As always, thank you to all contributors who helped improve Miniflux in this release.