aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-03Release FreshRSS 1.26.21.26.2Gravatar Alexandre Alapetite
2025-05-03ChangelogGravatar Alexandre Alapetite
2025-05-02Fix file serving for symlinked extensions (#7545)Gravatar Inverle
* Fix file serving for symlinked extensions from ext.php * Don't resolve symlink when deleting extension * Minor syntax --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-01Update phpmailer/phpmailer requirement from 6.9.3 to 6.10.0 in /lib (#7541)Gravatar dependabot[bot]
Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version. - [Release notes](https://github.com/PHPMailer/PHPMailer/releases) - [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md) - [Commits](https://github.com/PHPMailer/PHPMailer/compare/v6.9.3...v6.10.0) --- updated-dependencies: - dependency-name: phpmailer/phpmailer dependency-version: 6.10.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-01Updated italian translations (#7540)Gravatar FabioL
Co-authored-by: loviuz <loviuz@mailbox.org>
2025-05-01Bump the stylelint group with 2 updates (#7537)Gravatar dependabot[bot]
Bumps the stylelint group with 2 updates: [stylelint](https://github.com/stylelint/stylelint) and [stylelint-order](https://github.com/hudochenkov/stylelint-order). Updates `stylelint` from 16.17.0 to 16.19.1 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](https://github.com/stylelint/stylelint/compare/16.17.0...16.19.1) Updates `stylelint-order` from 6.0.4 to 7.0.0 - [Release notes](https://github.com/hudochenkov/stylelint-order/releases) - [Changelog](https://github.com/hudochenkov/stylelint-order/blob/master/CHANGELOG.md) - [Commits](https://github.com/hudochenkov/stylelint-order/compare/6.0.4...7.0.0) --- updated-dependencies: - dependency-name: stylelint dependency-version: 16.19.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: stylelint - dependency-name: stylelint-order dependency-version: 7.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: stylelint ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-01Bump the eslint group with 2 updates (#7536)Gravatar dependabot[bot]
Bumps the eslint group with 2 updates: [eslint](https://github.com/eslint/eslint) and [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js). Updates `eslint` from 9.23.0 to 9.25.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v9.23.0...v9.25.1) Updates `@eslint/js` from 9.23.0 to 9.25.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/commits/v9.25.1/packages/js) --- updated-dependencies: - dependency-name: eslint dependency-version: 9.25.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint - dependency-name: "@eslint/js" dependency-version: 9.25.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-01Bump phpstan/phpstan from 2.1.11 to 2.1.13 (#7534)Gravatar dependabot[bot]
* Bump phpstan/phpstan from 2.1.11 to 2.1.13 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Bump phpstan/phpstan from 2.1.11 to 2.1.13 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Fix PHPStan --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-01Bump squizlabs/php_codesniffer from 3.12.0 to 3.12.2 (#7533)Gravatar dependabot[bot]
Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 3.12.0 to 3.12.2. - [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases) - [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/CHANGELOG.md) - [Commits](https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.12.0...3.12.2) --- updated-dependencies: - dependency-name: squizlabs/php_codesniffer dependency-version: 3.12.2 dependency-type: direct:development update-type: version-update:semver-patch ...
2025-05-01Bump sass from 1.86.1 to 1.87.0 (#7538)Gravatar dependabot[bot]
Bumps [sass](https://github.com/sass/dart-sass) from 1.86.1 to 1.87.0. - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](https://github.com/sass/dart-sass/compare/1.86.1...1.87.0) --- updated-dependencies: - dependency-name: sass dependency-version: 1.87.0 dependency-type: direct:development update-type: version-update:semver-minor ...
2025-05-01Bump peter-evans/dockerhub-description from 4.0.1 to 4.0.2 (#7535)Gravatar dependabot[bot]
Bumps [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) from 4.0.1 to 4.0.2. - [Release notes](https://github.com/peter-evans/dockerhub-description/releases) - [Commits](https://github.com/peter-evans/dockerhub-description/compare/0505d8b04853a30189aee66f5bb7fd1511bbac71...432a30c9e07499fd01da9f8a49f0faf9e0ca5b77) --- updated-dependencies: - dependency-name: peter-evans/dockerhub-description dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-28HTTP Auth disallow multiple headers (#7528)Gravatar Alexandre Alapetite
When using HTTP Auth methods (including OpenID Connect), exactly 1 HTTP header should be received, not more.
2025-04-28Update CREDITS.md with myself (#7527)Gravatar Dezponia
Adding myself to CREDITS.md as requested in PR #7419 comment.
2025-04-27ChangelogGravatar Alexandre Alapetite
2025-04-27Themes fix CSS .as-link (#7526)Gravatar Alexandre Alapetite
* Themes fix CSS .as-link Add missing rules. fix https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2781146577 * More fixes
2025-04-26Changelog minorGravatar Alexandre Alapetite
2025-04-26ChangelogGravatar Alexandre Alapetite
2025-04-26Improve favicon hash (#7505)Gravatar Alexandre Alapetite
* Favicon hash proxy Content provided through a proxy may be completely different, so the feed hash must account for that * Fix typing * Hash of Web site in priority for favicons * Continue * Revert some minor changes
2025-04-18SimplePie: Fix support for feeds with XML preample + DTD (#7515)Gravatar Alexandre Alapetite
Regression from https://github.com/FreshRSS/FreshRSS/pull/4374 fix: https://github.com/FreshRSS/FreshRSS/issues/7514 https://github.com/FreshRSS/simplepie/pull/35 Upstream PR: https://github.com/simplepie/simplepie/pull/914
2025-04-14Update CREDITS.md (#7509)Gravatar Inverle
2025-04-13Update Polish translation (#7508)Gravatar Inverle
* Update Polish translation * corrections * make fix-all --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-13SimplePie forbit formaction attribute (#7506)Gravatar Alexandre Alapetite
Sanitize buttons with a form or formaction attribute.
2025-04-08Fix regression ext.php (#7499)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7498 Regression from https://github.com/FreshRSS/FreshRSS/pull/7495
2025-04-07ChangelogGravatar Alexandre Alapetite
2025-04-07Secure serving of user files from extensions (#7495)Gravatar Alexandre Alapetite
* Secure serving of user files from extensions fix https://github.com/FreshRSS/FreshRSS/issues/4930 * More fixes * Typo
2025-04-07Web scraping forbid security headers in cURL (#7496)Gravatar Alexandre Alapetite
Prevent using `Remote-User`, `X-WebAuth-User` during Web scraping.
2025-04-06Disallow iframe srcdoc for now (#7494)Gravatar Alexandre Alapetite
We do not sanitize this attribute well enough, so striped for now. It is rarely used: I have not seen any use of it in any of my many test feeds. Can be added back when we can handle its inherent security issues better.
2025-04-05Use HTTP POST for logout (#7489)Gravatar Alexandre Alapetite
* Use HTTP POST for logout To avoid potential CSRF risks * Fixed button font issue * Minor whitespace
2025-04-05Add :focus style to .dropdown-menu .item (#7491)Gravatar Frans de Jonge
So you can see keyboard focus. In reply to <https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2774759046>.
2025-04-03fix regression mapco/ansum theme (#7490)Gravatar maTh
fix of https://github.com/FreshRSS/FreshRSS/pull/7489#discussion_r2023760515 Regression #7314
2025-04-02Pass phpstan-strict-rules 2.0.4 (#7488)Gravatar Alexandre Alapetite
New check for Boolean in while conditions Replace https://github.com/FreshRSS/FreshRSS/pull/7481
2025-04-01Bump sass from 1.85.1 to 1.86.1 (#7487)Gravatar dependabot[bot]
Bumps [sass](https://github.com/sass/dart-sass) from 1.85.1 to 1.86.1. - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](https://github.com/sass/dart-sass/compare/1.85.1...1.86.1) --- updated-dependencies: - dependency-name: sass dependency-version: 1.86.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump stylelint from 16.16.0 to 16.17.0 in the stylelint group (#7486)Gravatar dependabot[bot]
Bumps the stylelint group with 1 update: [stylelint](https://github.com/stylelint/stylelint). Updates `stylelint` from 16.16.0 to 16.17.0 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](https://github.com/stylelint/stylelint/compare/16.16.0...16.17.0) --- updated-dependencies: - dependency-name: stylelint dependency-version: 16.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: stylelint ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump the eslint group with 2 updates (#7485)Gravatar dependabot[bot]
Bumps the eslint group with 2 updates: [eslint](https://github.com/eslint/eslint) and [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js). Updates `eslint` from 9.22.0 to 9.23.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v9.22.0...v9.23.0) Updates `@eslint/js` from 9.22.0 to 9.23.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/commits/v9.23.0/packages/js) --- updated-dependencies: - dependency-name: eslint dependency-version: 9.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint - dependency-name: "@eslint/js" dependency-version: 9.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump phpstan/phpstan-phpunit from 2.0.4 to 2.0.6 (#7484)Gravatar dependabot[bot]
Bumps [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit) from 2.0.4 to 2.0.6. - [Release notes](https://github.com/phpstan/phpstan-phpunit/releases) - [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.4...2.0.6) --- updated-dependencies: - dependency-name: phpstan/phpstan-phpunit dependency-version: 2.0.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump squizlabs/php_codesniffer from 3.11.3 to 3.12.0 (#7483)Gravatar dependabot[bot]
Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 3.11.3 to 3.12.0. - [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases) - [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/CHANGELOG.md) - [Commits](https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.11.3...3.12.0) --- updated-dependencies: - dependency-name: squizlabs/php_codesniffer dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump phpstan/phpstan from 2.1.8 to 2.1.11 (#7482)Gravatar dependabot[bot]
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.8 to 2.1.11. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](https://github.com/phpstan/phpstan/compare/2.1.8...2.1.11) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.11 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Bump peter-evans/dockerhub-description from 4.0.0 to 4.0.1 (#7480)Gravatar dependabot[bot]
Bumps [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/peter-evans/dockerhub-description/releases) - [Commits](https://github.com/peter-evans/dockerhub-description/compare/e98e4d1628a5f3be2be7c231e50981aee98723ae...0505d8b04853a30189aee66f5bb7fd1511bbac71) --- updated-dependencies: - dependency-name: peter-evans/dockerhub-description dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01Fix ext.php: Restrict valid paths in ext.php for extensions (#7479)Gravatar Alexandre Alapetite
* Fix ext.php: Restrict valid paths in ext.php for extensions Rework https://github.com/FreshRSS/FreshRSS/pull/7474 * Fix wrong variable
2025-04-01Update 10_filter.md to provide detailed explanations of the time syntax. (#7464)Gravatar 22cs
* Update 10_filter.md to provide detailed explanations of the time syntax. * Update 03_Main_view.md to provide detailed explanations of the time syntax. * Reworded --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01Catch extension exceptions in override (#7475)Gravatar Alexandre Alapetite
* Catch extension exceptions in override https://github.com/FreshRSS/Extensions/pull/300#issuecomment-2768578464 * Fix error message
2025-04-01Make update URL readonly (#7477)Gravatar Alexandre Alapetite
The security risks look higher than the minor convinience Modify https://github.com/FreshRSS/FreshRSS/pull/1024
2025-04-01Restrict valid paths in ext.php for extensions (#7474)Gravatar Alexandre Alapetite
* Restrict valid paths in ext.php for extensions * Disallow absolute paths as well
2025-04-01Partial revert Referrer-Policy (#7478)Gravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/pull/6303#issuecomment-2768907702 Was already implemented conditionally https://github.com/FreshRSS/FreshRSS/pull/1198
2025-04-01Referrer-Policy: same-origin (#6303)Gravatar maTh
* Referrer-Policy: same-origin * same-origin for our own images --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01Update CREDITS.md (#7476)Gravatar 𝗛𝗼𝗹𝗢
* Update CREDITS.md Credit for myself * Fix --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01Improve Turkish Language (#7442)Gravatar 𝗛𝗼𝗹𝗢
* Improve Turkish Language * fix * Update gen.php * Update app/i18n/tr/gen.php Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * Update sub.php * edit * edit * make fix-all * Mark lines as ignored * Typo * Update sub.php --------- Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01Fix escaping of tag search (#7468)Gravatar Alexandre Alapetite
* Fix escaping of tag search fix https://github.com/FreshRSS/FreshRSS/issues/7466 * Minor clarity
2025-04-01Add CSP to favicons (#7471)Gravatar Alexandre Alapetite
E.g. for the case of SVGs
2025-03-25Update bcrypt.js from 2.4.4 to 3.0.2 (#7449)Gravatar Alexandre Alapetite
https://github.com/dcodeIO/bcrypt.js/releases/tag/v3.0.0 Can be updated to the latest version with: `curl -L https://unpkg.com/bcryptjs/umd/index.js > p/scripts/vendor/bcrypt.js`
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-10 12:55:24 +0000