M
v2.3.5
Miniflux 2.3.5
M
Miniflux 2.3.5
New features Added OpenID Connect admin role mapping: set OAUTH2_ADMIN_GROUP and OAUTH2_GROUP_CLAIM to grant or revoke the admin role at login based on the user's groups. The group claim is read from the user info response or the ID token, and OAUTH2_ADDITIONAL_SCOPES can request extra scopes from the provider. Allowed WebAuthn/Passkeys as the only login method when DISABLE_LOCAL_AUTH is enabled.…
M
Miniflux 2.3.4
New features Added Gotify push notification support. Added Steam scraper rules. Added validation with helpful error messages when saving rewrite rules. Performance improvements Reduced database storage used by enclosure and entry indexes. Reduced memory used by internal data structures. Security Blocked reserved IP address ranges to further protect against server-side request forgery. Hardened Web…
M
v2.3.4
Miniflux 2.3.4
M
Miniflux 2.3.3
New features Feed and entry language detection Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed. Entries without their own language now inherit the language declared b…
M
v2.3.3
Miniflux 2.3.3
M
Miniflux 2.3.2
New features Improved full-text search Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions. API improvements Added GET /v1/entries/ids to efficiently retrieve paginated entry IDs. Added support for updating the starred status of multiple entries through PUT /v1/entries. API clients can now filter entries by tag…
M
v2.3.2
Miniflux 2.3.2
M
v2.3.1
Miniflux 2.3.1
M
Miniflux 2.3.1
Security Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account. Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs. Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses. Hardened metrics endpoint authentication by using constant-time credential comparisons.…
M
Miniflux 2.3.0
Security Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login. Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support. Persist WebAuthn backup eligibility/state and validated credential st…
M
v2.3.0
Miniflux 2.3.0
M
Miniflux 2.2.19
Security Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages. Improve OAuth2 security: Verify OIDC ID token signatures and claims. Prevent OAuth identity overwrite when already linked. Clear PKCE verifier and CSRF state after use. Validate HTTP status from Google userinfo endpoint. Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication. Use constant-…
M
v2.2.19
Miniflux 2.2.19
M
Miniflux 2.2.18
Security Block outbound requests to private networks made by the fetcher by default. Add SSRF protection for integration HTTP clients by blocking connections to private network addresses at connect time. Fix a possible SSRF TOCTOU / DNS-rebinding issue in the fetcher private network check. Ensure private network protections also apply to redirect targets. Treat RFC 6598 shared address space (100.6…
M
v2.2.18
Miniflux 2.2.18