• Milestone

This is a bug-fix release for FreshRSS 1.26.x

A few highlights ✨:

• Keep sort and order criteria during navigation
• Implement loading spinner for marking as favourite/read
• Many bug fixes

This release has been made by @Alkarex, @Inverle and newcomers @CarelessCaution, @the7thNightmare

Full changelog:

• Features
  • Keep sort and order criteria during navigation #7585
  • Add info about PDO::ATTR_CLIENT_VERSION (relevant for MySQL / MariaDB with obsolete driver) #7591
• Bug fixing
  • Fix SQL request for user labels with custom sort (affecting PostgreSQL) #7588
  • Fix regression for favicon in GReader and Fever APIs #7573
  • Fix newest articles (within last second) not shown #7577
  • Fix duplicate HTTP header for POST #7556
  • Fix important articles on reader view #7602
  • Fix remove last share method #7613
  • Fix API handling of default category #7610
  • Fix user self-deletion #7626
  • Move PHP minimum version check #7560
• Security
  • Fix encoding of themes #7565
  • Fix .htaccess.dist for access to /scripts/vendor/ #7598
• SimplePie
  • Strip more HTML deprecated styles attributes: bgcolor, text, background, link, alink, vlink #7606
• UI
  • Implement loading spinner for marking as favourite/read #7564
  • Provide theme class for CSS #7559
• Deployment
  • Use HTTP Cache-Control: immutable for some files #7552
  • Drop Apache 2.2 (only support Apache 2.4+) #7561
• I18n
  • Improve Indonesian #7622
  • Improve Polish #7587
• Misc.
  • Update to PHPMailer 6.10.0 #7542
  • Update dev dependencies #7630, #7631, #7632
    #7633, #7634, #7635

• Milestone

This is a security-focussed release for FreshRSS 1.26.x, addressing several CVEs (thanks @Inverle) 🛡

A few highlights ✨:

• Implement JSON string concatenation with & operator
• Support multiple JSON fragments in HTML+XPath+JSON mode (e.g. JSON-LD)
• Multiple security fixes with CVEs
• Bug fixes

Notes ℹ:

• Favicons will be reconstructed automatically when feeds gets refreshed. After that, you may need to refresh your Web browser as well.

This release has been made by @Alkarex, @Frenzie, @hkcomori, @loviuz, @math-GH
and newcomers @dezponia, @glyn, @Inverle, @Machou, @mikropsoft

Full changelog:

• Features
  • Implement JSON string concatenation with & operator #7414
  • Support multiple JSON fragments in HTML+XPath+JSON mode #7369
• Bug fixing
  • Fix escaping of tag search #7468
  • Fix CLI parsing of Boolean flags #7430
  • Fix API for labels with slash #7437
• SimplePie
  • Fix support for feeds with XML preamble + DTD #7515, simplepie#914
  • Merged upstream #7434
    • Upstream fix simplepie#912
• Security
  • Disallow <iframe srcdoc=""> #7494, CVE-2025-32015
  • Disallow <button formaction=""> #7506
  • Improve favicons hash to avoid favicon pollution #7505, CVE-2025-46339
  • Add Content-Security-Policy HTTP headers to favicons #7471, CVE-2025-31136
  • Web scraping forbid security HTTP headers in cURL #7496, CVE-2025-46341
  • Add some HTTP headers Referrer-Policy: same-origin #6303, #7478
  • Use HTTP POST for logout #7489, CVE-2025-31482
  • Make update URL read-only #7477
  • Fix for extensions: Restrict valid paths in ext.php #7479, CVE-2025-31134
  • Fix for extensions: Secure serving of user files #7495
• Extensions
  • Fix file serving for symlinked extensions #7545
  • Catch extension exceptions in override #7475
  • JavaScript: new event to detect context loaded #7452
• Deployment
  • Apache: add check for mod_filter to ensure that AddOutputFilterByType works #7419
• UI
  • Accessibility: Add :focus style to some dropdown menus #7491
  • New size option for the Mark as read button #7314
  • Update bcrypt.js from 2.4.4 to 3.0.2 #7449
  • Various UI and style improvements: #7168, #7526
• I18n
  • Rework credits #7426
  • Improve French #7432
  • Improve Italian #7540
  • Improve Polish #7508
  • Improve Turkish #7442
• Misc.
  • Improve PHP code #7431, #7488, #7534
  • Update dev dependencies #7480, #7482, #7483,
    #7484, #7485, #7486,
    #7487, #7533, #7535,
    #7536, #7537, #7538

• Milestone
• Discussion

A few highlights ✨:

• Focusing mostly on bug-fixes of 1.20.0
• Several UI / themes improvements
• Improved and new translations (Greek, Indonesian)

Detailed tracked changes.

Full changelog:

• Features
  • Add support for custom XPath date/time format #4703
  • Add default redirect when authenticating #4778
  • Force default user before rendering login page #4620
• API
  • Minor Google Reader API improvements #4763
• Bug fixing
  • Fix SQL transaction rollbacks during auto-update #4622
  • Fix opcache bug during Web update #4629, update.freshrss.org#4
  • Fix export bug #4822
  • Fix OPML import of special feed attributes #4708
  • Fix JavaScript bug with remembering opened categories #4827
  • Fix curlopt options for HTML+XPath #4759
  • Fix charset bug for HTML+XPath #4623
  • Fix HTML-encoding of CSS selectors #4707, #4823
  • Fix some broken author links #4743
  • Fix show settings page after adding new feed #4631
  • Fix login page when user does not exist #4621
  • Fix feed manage link on stats page #4768
  • Fix minor layout bugs #4830
  • Fix minor UI bugs with Safari #4643
• UI
  • Change some default settings related to marking articles as read #4736
  • Improve scrollbar when slider is open #4692
  • Improve Subscription Management: Show the category position number #4679
  • Improve Reader view: Mark article as read while scrolling #4652
  • Improve sharing / integration page #4774
  • Improve article summary text cut #4666
  • Improve HTML semantics for some boxes #4665
  • Change dynamic OPML icon #4673, #4810
  • Improve box layout for global view #4791
  • Improve logs layout #4594
  • Improve Feed configuration: number of articles #4625
  • Improve drop-down menus #4597
  • Show tile with explanation when hovering empty feeds #4617
  • Added bottom nav padding for iOS #4741
• Themes
  • Implement CSS variables for easy colour customisation #4641, #4693, #4789
  • Improve CSS line height #4671, #4782
  • Improved reader view with framed articles #4663
  • Improve themes
    Alternative Dark #4635, #4797;
    Blue Lagon #4786;
    Dark #4806;
    Mapco #4648, #4709, #4711;
    Origine #4842;
    Origine Compact #4636, #4735, #4787;
    Pafat #4783, #4792, #4793,
    #4796, #4811;
    Swage #4799, #4828, #4829
  • Rename template.css to frss.css #4644
  • Misc. #4596, #4619, #4696
• i18n
  • Rename tag to label in some languages #4770
  • Improve typographic quotes #4714
  • Remove invalid i18n string #4844
  • Add Greek #4718, #4754
  • Add Indonesian #4706
  • Improve Brazilian Portuguese #4669
  • Improve Czech #4670
  • Improve Italian #4803
  • Improve Japanese #4668
  • Improve Russian #4719
  • Improve Spanish #4676, #4725
  • Improve Turkish #4715
  • Improve i18n tools #4742, #4756
• Compatibility
  • Compatibility PHP 8.1+ strip_tags() #4688
  • Fix GLOB_BRACE is not available on all platforms #4628
• Deployment
  • Docker default image (Debian 11 Bullseye) updated to PHP 7.4.33
  • Docker: alternative image (Alpine 3.16) updated to PHP 8.0.25
• Misc.
  • Added Linkding as a sharing method #4721
  • Exclude .git/ from tests #4824
  • Exclude extensions/ from eslint and stylelint tests #4606
  • Update GitHub Actions version #4717