# FreshRSS changelog See also [the FreshRSS releases](https://github.com/FreshRSS/FreshRSS/releases). ## 2025-0X-XX FreshRSS 1.26.4-dev * Features * Implement support for HTTP `429 Too Many Requests` and `503 Service Unavailable`, obey `Retry-After` [#7760](https://github.com/FreshRSS/FreshRSS/pull/7760) * Add sort by category title, or by feed title [#7702](https://github.com/FreshRSS/FreshRSS/pull/7702) * Add search operator `c:` for categories like `c:23,34` or `!c:45,56` [#7696](https://github.com/FreshRSS/FreshRSS/pull/7696) * Custom feed favicons [#7646](https://github.com/FreshRSS/FreshRSS/pull/7646), [#7704](https://github.com/FreshRSS/FreshRSS/pull/7704), [#7717](https://github.com/FreshRSS/FreshRSS/pull/7717), [#7792](https://github.com/FreshRSS/FreshRSS/pull/7792) * Rework fetch favicons for fewer HTTP requests [#7767](https://github.com/FreshRSS/FreshRSS/pull/7767) * Add more unicity criteria based on title and/or content [#7789](https://github.com/FreshRSS/FreshRSS/pull/7789) * Automatically restore user configuration from backup [#7682](https://github.com/FreshRSS/FreshRSS/pull/7682) * API add support for states in `s` parameter of `streamId` [#7695](https://github.com/FreshRSS/FreshRSS/pull/7695) * Improve sharing via Print [#7728](https://github.com/FreshRSS/FreshRSS/pull/7728) * Redirect to the login page from bookmarklet instead of 403 [#7782](https://github.com/FreshRSS/FreshRSS/pull/7782) * Clean local cache more often, when refreshing feeds [#7827](https://github.com/FreshRSS/FreshRSS/pull/7827) * Security * Implement reauthentication (*sudo* mode) [#7753](https://github.com/FreshRSS/FreshRSS/pull/7753) * Add `Content-Security-Policy: frame-ancestors` [#7677](https://github.com/FreshRSS/FreshRSS/pull/7677) * Ensure CSP everywhere [#7810](https://github.com/FreshRSS/FreshRSS/pull/7810) * Show warning when unsafe CSP policy is in use [#7804](https://github.com/FreshRSS/FreshRSS/pull/7804) * Fix access rights when creating a new user [#7783](https://github.com/FreshRSS/FreshRSS/pull/7783) * Improve security of form for user details [#7771](https://github.com/FreshRSS/FreshRSS/pull/7771), [#7786](https://github.com/FreshRSS/FreshRSS/pull/7786) * Disallow setting non-existent theme [#7722](https://github.com/FreshRSS/FreshRSS/pull/7722) * Regenerate cookie ID after logging out [#7762](https://github.com/FreshRSS/FreshRSS/pull/7762) * Require current password when setting new password [#7763](https://github.com/FreshRSS/FreshRSS/pull/7763) * Add missing access checks for feed-related actions [#7768](https://github.com/FreshRSS/FreshRSS/pull/7768) * Strip more unsafe attributes such as `referrerpolicy`, `ping` [#7770](https://github.com/FreshRSS/FreshRSS/pull/7770) * Remove unneeded execution permissions [#7802](https://github.com/FreshRSS/FreshRSS/pull/7802) * Bug fixing * Fix redirections when scraping from HTML [#7654](https://github.com/FreshRSS/FreshRSS/pull/7654), [#7741](https://github.com/FreshRSS/FreshRSS/pull/7741) * Fix multiple authentication HTTP headers [#7703](https://github.com/FreshRSS/FreshRSS/pull/7703) * Fix HTML queries with a single feed [#7730](https://github.com/FreshRSS/FreshRSS/pull/7730) * WebSub: only perform a redirection when coming from WebSub [#7738](https://github.com/FreshRSS/FreshRSS/pull/7738) * Include enclosures in entries’ hash [#7719](https://github.com/FreshRSS/FreshRSS/pull/7719) * Negative side-effect: users of the option to *automatically mark updated articles as unread* will once have some articles with enclosures re-appear as unread * Fix cancellation of slider exit UI [#7705](https://github.com/FreshRSS/FreshRSS/pull/7705) * Honor *disable update* on update page [#7733](https://github.com/FreshRSS/FreshRSS/pull/7733) * Fix no registration limit setting [#7751](https://github.com/FreshRSS/FreshRSS/pull/7751) * Fix XML encoding of sharing functions [#7822](https://github.com/FreshRSS/FreshRSS/pull/7822) * SimplePie * Fix propagation of HTTP error codes [#7670](https://github.com/FreshRSS/FreshRSS/pull/7670) * Fix support for XML feeds with HTML entities [#7689](https://github.com/FreshRSS/FreshRSS/pull/7689), [simplepie#915](https://github.com/simplepie/simplepie/pull/915) * Fix feeds encoded in UTF-16LE [#7691](https://github.com/FreshRSS/FreshRSS/pull/7691), [simplepie#916](https://github.com/simplepie/simplepie/pull/916) * Various upstream contributions [simplepie#917](https://github.com/simplepie/simplepie/pull/917), [simplepie#924](https://github.com/simplepie/simplepie/pull/924), [simplepie#926](https://github.com/simplepie/simplepie/pull/926), [simplepie#932](https://github.com/simplepie/simplepie/pull/932), [simplepie#933](https://github.com/simplepie/simplepie/pull/933) * Sync upstream [#7706](https://github.com/FreshRSS/FreshRSS/pull/7706), [FreshRSS/simplepie#45](https://github.com/FreshRSS/simplepie/pull/45), [#7775](https://github.com/FreshRSS/FreshRSS/pull/7775), [FreshRSS/simplepie#50](https://github.com/FreshRSS/simplepie/pull/50), [#7824](https://github.com/FreshRSS/FreshRSS/pull/7824), [#7825](https://github.com/FreshRSS/FreshRSS/pull/7825), * Fix regex *Backtrack limit was exhausted* in `clean_hash()` [#7813](https://github.com/FreshRSS/FreshRSS/pull/7813), [FreshRSS/simplepie#48](https://github.com/FreshRSS/simplepie/pull/48) * Deployment * Docker default image (Debian 12 Bookworm) updated to PHP 8.2.29 [#7805](https://github.com/FreshRSS/FreshRSS/pull/7805) * Docker alternative image updated to Alpine 3.22 with PHP 8.4.11 and Apache 2.4.65 [#7740](https://github.com/FreshRSS/FreshRSS/pull/7740), [#7740](https://github.com/FreshRSS/FreshRSS/pull/7740), [#7803](https://github.com/FreshRSS/FreshRSS/pull/7803) * Start supporting PHP 8.5+ [#7787](https://github.com/FreshRSS/FreshRSS/pull/7787), [#7826](https://github.com/FreshRSS/FreshRSS/pull/7826) * Docker Alpine dev image `:newest` updated to PHP 8.5-alpha and Apache 2.4.65 [#7773](https://github.com/FreshRSS/FreshRSS/pull/7773) * Docker: interpolate `FRESHRSS_INSTALL` and `FRESHRSS_USER` variables [#7725](https://github.com/FreshRSS/FreshRSS/pull/7725) * Docker: Reduce how much data needs to be chown/chmod’ed on container startup [#7793](https://github.com/FreshRSS/FreshRSS/pull/7793) * Test for database PDO typing support during install (relevant for MySQL / MariaDB with obsolete driver) [#7651](https://github.com/FreshRSS/FreshRSS/pull/7651) * Extensions * Add API endpoint for extensions [#7576](https://github.com/FreshRSS/FreshRSS/pull/7576) * Expose the reading modes for extensions [#7668](https://github.com/FreshRSS/FreshRSS/pull/7668), [#7688](https://github.com/FreshRSS/FreshRSS/pull/7688) * New extension hook `before_login_btn` [#7761](https://github.com/FreshRSS/FreshRSS/pull/7761) * UI * Improve *mark as read* request showing popup due to `onbeforeunload` [#7554](https://github.com/FreshRSS/FreshRSS/pull/7554) * Fix lazy-loading for `