Create separate `Retry-After` files for proxies (#8029)

2025-11-04T11:48:31+00:00

* Create separate `Retry-After` files for proxies Bad proxies are able to send a false `Retry-After` header and affect the availability of feeds (domain-wide) for other users. This PR starts including the address of the proxy if present in filenames for `Retry-After` to mitigate the issue. * Reduce code changes * Sync SimplePie fork https://github.com/FreshRSS/simplepie/pull/62 --------- Co-authored-by: Alexandre Alapetite

Implement whitelist for SimplePie sanitizer (#7924)

2025-11-01T23:28:35+00:00

* Implement whitelist for SimplePie sanitizer ref: https://github.com/FreshRSS/FreshRSS/pull/7770#issuecomment-3140334326 https://github.com/FreshRSS/simplepie/pull/53 https://github.com/simplepie/simplepie/pull/947 * Remove `` from whitelist * Improve order * Remove some tags from whitelist * Revert partially * sync * Display contents of `<noscript>` and `<noembed>` * sync * Allow use of `<track>` * sync again * Sync to SimplePie fork https://github.com/FreshRSS/simplepie/pull/53 * Alphabetic order * Reduce list of stripped attributes * Temporarily strip some attributes --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> </article> <article> <h1>SimplePie: apply HTTPS policy also on GUIDs and permalinks (#8037)</h1> <p>2025-10-01T21:13:23+00:00</p> * SimplePie: apply HTTPS policy also on GUIDs and permalinks Fix WordPress duplicates HTTP vs. HTTPS fix https://github.com/FreshRSS/FreshRSS/issues/5151 * Move code upstream * https://github.com/simplepie/simplepie/pull/951 * https://github.com/FreshRSS/simplepie/pull/59 </article> <article> <h1>Fix SimplePie support of HTTP trailer headers (#7983)</h1> <p>2025-10-01T21:07:38+00:00</p> * Fix SimplePie support of HTTP trailer headers fix https://github.com/FreshRSS/FreshRSS/discussions/7981 https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Trailer https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing We need to use content-length to know where the body stops, but content-length is wrong is any compression was used. So let cURL perform the separation of HTTP headers and body instead of using the SimplePie parser. * Minor whitespace * Same change for lib_rss * Move changes to SimplePie repo https://github.com/FreshRSS/simplepie/pull/55 https://github.com/FreshRSS/simplepie/pull/57 </article> <article> <h1>SimplePie merge upstream (#7967)</h1> <p>2025-09-15T11:40:14+00:00</p> * https://github.com/simplepie/simplepie/pull/936 (Normalize encoding uppercase) </article> <article> <h1>Bump SimplePie to 1.9.0 (#7955)</h1> <p>2025-09-12T22:19:31+00:00</p> Main change is https://github.com/simplepie/simplepie/pull/937 (PHP 8.5: Conditionally call deprecated functions) P.S. a sync with SimplePie upstream was already done recently, hence the limited changes: * https://github.com/FreshRSS/FreshRSS/pull/7775 </article> <article> <h1>Fix regression on_http_response (#7824)</h1> <p>2025-08-14T07:35:30+00:00</p> Fix regression (bad merge) from https://github.com/FreshRSS/FreshRSS/pull/7775 * https://github.com/FreshRSS/simplepie/pull/50 </article> <article> <h1>SimplePie Fix regex backtrack limit in clean_hash() (#7813)</h1> <p>2025-08-10T22:52:09+00:00</p> https://github.com/FreshRSS/simplepie/pull/48 and merge upstream https://github.com/FreshRSS/simplepie/pull/49 fix https://github.com/FreshRSS/FreshRSS/issues/7807 We had a risk of hitting `Backtrack limit was exhausted` in case of open XML comment `<!--` not closed and followed by a very long document. Fixed by: * Limiting the max length of the comment * Stopping at an apparent end of CDATA section `]]>` as it is likely an error It does not matter much if there are rare cases when the regex does not work perfectly, as it is only used for a cache hint. </article> <article> <h1>Bump SimplePie with PHPStan Level 8 (#7775)</h1> <p>2025-08-01T21:27:35+00:00</p> * Bump SimplePie with PHPStan Level 8 * https://github.com/FreshRSS/simplepie/pull/45 SimplePie increased to PHPStan Level 8: * https://github.com/simplepie/simplepie/pull/857 * Merge upstream Including my two PRs: * https://github.com/simplepie/simplepie/pull/932 * https://github.com/simplepie/simplepie/pull/933 * Resolve upstream sync of Expose HTTP status * https://github.com/FreshRSS/simplepie/pull/47 Finalise merge, following: * https://github.com/simplepie/simplepie/pull/905#issuecomment-3007605779 * https://github.com/simplepie/simplepie/pull/909 * https://github.com/FreshRSS/FreshRSS/issues/7038 </article> <article> <h1>Implement support for HTTP 429 Too Many Requests (#7760)</h1> <p>2025-07-31T07:17:42+00:00</p> * Implement support for HTTP 429 Too Many Requests Will obey the corresponding HTTP `Retry-After` header at domain level. * Implement 503 Service Unavailable * Sanitize Retry-After * Reduce default value when Retry-After is absent And make configuration parameter * Retry-After also for favicons </article> </main></body></html>

FreshRSS (Customized)/lib/simplepie, branch 1.28.0

Create separate `Retry-After` files for proxies (#8029)

Implement whitelist for SimplePie sanitizer (#7924)