Merge branch 'main' into clientsize_truncation_sql

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -63,3 +63,5 @@ body:
           required: true
         - label: "I understand that feature requests are not guaranteed to be implemented."
           required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/ISSUE_TEMPLATE/proposal.yml

@@ -84,3 +84,5 @@ body:
           required: true
         - label: "I agree to provide follow-up updates and maintain discussion on this proposal."
           required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/pull_request_template.md

@@ -4,4 +4,4 @@ Have you followed these guidelines?
 - [ ] There are no breaking changes
 - [ ] I have thoroughly tested my changes and verified there are no regressions
 - [ ] My commit messages follow the [Conventional Commits specification](https://www.conventionalcommits.org/)
-- [ ] I have read this document: https://miniflux.app/faq.html#pull-request
+- [ ] I have read and understood the [contribution guidelines](https://github.com/miniflux/v2/blob/main/CONTRIBUTING.md)

CONTRIBUTING.md

@@ -0,0 +1,178 @@
+# Contributing to Miniflux
+
+This document outlines how to contribute effectively to Miniflux.
+
+## Philosophy
+
+Miniflux follows a **minimalist philosophy**. The feature set is intentionally kept limited to avoid bloatware. Before contributing, please understand that:
+
+- **Improving existing features takes priority over adding new ones**
+- **Quality over quantity** - well-implemented, focused features are preferred
+- **Simplicity is key** - complex solutions are discouraged in favor of simple, maintainable code
+
+## Before You Start
+
+### Feature Requests
+
+Before implementing a new feature:
+
+- Check if it aligns with Miniflux's philosophy
+- Consider if the feature could be implemented differently to maintain simplicity
+- Remember that developing software takes significant time, and this is a volunteer-driven project
+- If you need a specific feature, the best approach is to contribute it yourself
+
+### Bug Reports
+
+When reporting bugs:
+
+- Search existing issues first to avoid duplicates
+- Provide clear reproduction steps
+- Include relevant system information (OS, browser, Miniflux version)
+- Include error messages, screenshots, and logs when applicable
+
+## Development Setup
+
+### Requirements
+
+- **Git**
+- **Go >= 1.24**
+- **PostgreSQL**
+
+### Getting Started
+
+1. **Fork the repository** on GitHub
+2. **Clone your fork locally:**
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/miniflux.git
+   cd miniflux
+   ```
+
+3. **Build the application binary:**
+   ```bash
+   make miniflux
+   ```
+
+4. **Run locally in debug mode:**
+   ```bash
+   make run
+   ```
+
+### Database Setup
+
+For development and testing, you can run a local PostgreSQL database with Docker:
+
+```bash
+# Start PostgreSQL container
+docker run --rm --name miniflux2-db -p 5432:5432 \
+  -e POSTGRES_DB=miniflux2 \
+  -e POSTGRES_USER=postgres \
+  -e POSTGRES_PASSWORD=postgres \
+  postgres
+```
+
+You can also use an existing PostgreSQL instance. Make sure to set the `DATABASE_URL` environment variable accordingly.
+
+## Development Workflow
+
+### Code Quality
+
+1. **Run the linter:**
+   ```bash
+   make lint
+   ```
+   Requires `staticcheck` and `golangci-lint` to be installed.
+
+2. **Run unit tests:**
+   ```bash
+   make test
+   ```
+
+3. **Run integration tests:**
+   ```bash
+   make integration-test
+   make clean-integration-test
+   ```
+
+### Building
+
+- **Current platform:** `make miniflux`
+- **All platforms:** `make build`
+- **Specific platforms:** `make linux-amd64`, `make darwin-arm64`, etc.
+- **Docker image:** `make docker-image`
+
+### Cross-Platform Support
+
+Miniflux supports multiple architectures. When making changes, ensure compatibility across:
+- Linux (amd64, arm64, armv7, armv6, armv5)
+- macOS (amd64, arm64)
+- FreeBSD, OpenBSD, Windows (amd64)
+
+## Pull Request Guidelines
+
+### What Is Preferred
+
+✅ **Good Pull Requests:**
+
+- Focus on a single issue or feature
+- Include tests for new functionality
+- Maintain or improve performance
+- Follow existing code style and patterns
+- The commit messages follow the [conventional commit format](https://www.conventionalcommits.org/) (e.g., `feat: add new feature`, `fix: resolve bug`)
+- Update documentation when necessary
+
+### What to Avoid
+
+❌ **Pull Requests That Cannot Be Accepted:**
+
+- **Too many changes** - makes review difficult
+- **Breaking changes** - disrupts existing functionality
+- **New bugs or regressions** - reduces software quality
+- **Unnecessary dependencies** - conflicts with minimalist approach
+- **Performance degradation** - slows down the software
+- **Poor-quality code** - hard to maintain
+- **Dependent PRs** - creates review complexity
+- **Radical UI changes** - disrupts user experience
+- **Conflicts with philosophy** - doesn't align with minimalist approach
+
+### Pull Request Template
+
+When creating a pull request, please include:
+
+- **Description:** What does this PR do?
+- **Motivation:** Why is this change needed?
+- **Testing:** How was this tested?
+- **Breaking Changes:** Are there any breaking changes?
+- **Related Issues:** Link to any related issues
+
+## Code Style
+
+- Follow Go conventions and best practices
+- Use `gofmt` to format your Go code, and `jshint` for JavaScript
+- Write clear, descriptive variable and function names
+- Include comments for complex logic
+- Keep functions small and focused
+
+## Testing
+
+### Unit Tests
+- Write unit tests for new functions and methods
+- Ensure tests are fast and don't require external dependencies
+- Aim for good test coverage
+
+### Integration Tests
+- Add integration tests for new API endpoints
+- Tests run against a real PostgreSQL database
+- Ensure tests clean up after themselves
+
+## Communication
+
+- **Discussions:** Use GitHub Discussions for general questions and community interaction
+- **Issues:** Use GitHub issues for bug reports and feature requests
+- **Pull Requests:** Use PR comments for code-specific discussions
+- **Philosophy Questions:** Refer to the FAQ for common questions about project direction
+
+## Questions?
+
+- Check the [FAQ](https://miniflux.app/faq.html) for common questions
+- Review the [development documentation](https://miniflux.app/docs/development.html) and [internationalization guide](https://miniflux.app/docs/i18n.html)
+- Look at existing issues and pull requests for examples

ChangeLog

@@ -1,3 +1,87 @@
+Version 2.2.10 (June 23, 2025)
+------------------------------
+
+* test(sanitizer): add unit test for 0x0 pixel tracker
+* test(sanitizer): add test case to cover Vimeo iframe rewrite without query string
+* refactor(youtube): Remove a regex and make use of `fetchWatchTime`
+* refactor(youtube): initialize two maps to the proper length
+* refactor(tests): use `b.Loop()` instead of for range `b.N`
+* refactor(server): avoid double call to `Sprintf`
+* refactor(sanitizer): use global variables to avoid recreating slices on every call
+* refactor(sanitizer): use a map for iframe allow list
+* refactor(sanitizer): remove two useless `www.` prefixes
+* refactor(sanitizer): make `isValidAttribute()` check O(1)
+* refactor(rewrite): rename `Rewriter` function to `ApplyContentRewriteRules`
+* refactor(processor): simplify Bilibili processing
+* refactor(processor): remove a useless type declaration
+* refactor(processor): remove a duplicated function call
+* refactor(processor): refactor common code into a `fetchWatchTime` function
+* refactor(processor): move filters to a `filter` package
+* refactor(processor): move `FilterEntryMaxAgeDays` filter to filter package
+* refactor(processor): move `RewriteEntryURL` function to `rewrite` package
+* refactor(processor): minor simplification of a loop
+* refactor(internal): add an `urllib.DomainWithoutWWW` function
+* refactor(http): rename package from `httpd` to `server` for consistency
+* refactor(http): Don't hardcode TLS configuration
+* refactor(filter): avoid code duplication between `IsBlockedEntry` and `IsAllowedEntry` functions
+* refactor(database): drop 3 columns in a single transaction
+* refactor(crypto): use `rand.Text()` instead of a custom implementation
+* refactor(config): remove deprecated config options
+* refactor(appjs): no need to check if always present elements are always present
+* perf(xml): optimized `NewXMLDecoder`
+* perf(xml): optimize XML filtering
+* perf(validator): slightly optimize a regex
+* perf(timezone): cache `getLocation`'s results
+* perf(storage): pre-allocate a slice in `RefreshFeedEntries`
+* perf(storage): optimize away two `Sprintf` calls
+* perf(sanitizer): use a switch-case instead of a map
+* perf(sanitizer): minor simplifications of the sanitizer
+* perf(sanitizer): extract a call to `url.Parse` and make intensive use of it
+* perf(rss): optimize a bit `BuildFeed`
+* perf(rss): early return when looking for an item's author
+* perf(rewrite): make `getPredefinedRewriteRules` O(1)
+* perf(reader): use a non-cryptographic hash when possible
+* perf(reader): optimize `RemoveTrackingParameters`
+* perf(readability): minor regex improvement
+* perf(media): minor regex simplification
+* perf(fetcher): pre-allocate the cipherSuites
+* perf(database): use `TRUNCATE` instead of `DELETE FROM` in migrations
+* perf(database): marginally speeds migrations up
+* perf(api): use `math/rand/v2` instead of `math/rand` for better performance
+* fix(readability): do not remove elements within code blocks
+* fix(karakeep): correct method name and improve error handling in `SaveURL`
+* fix(filter): skip invalid rules instead of exiting the loop
+* feat(ui): display external link in single entry view because the URL was not visible on mobile (no mouse over)
+* feat(ui): avoid showing an excessive number of tags
+* feat(ui): add user setting to control `target="_blank"` on links
+* feat(sanitizer): validate MathML XML namespace
+* feat(sanitizer): consider images of size 0x0 as pixel trackers
+* feat(sanitizer): add validation for empty `width` and `height` attributes in img tags
+* feat(sanitizer): add support for `fetchpriority` and `decoding` attributes in img tags
+* feat(rewrite): add support for YouTube Shorts video URL pattern
+* feat(rewrite): add `parkablogs.com` to the referer override list
+* feat(oidc): use `preferred_username` first instead of `email` claim
+* feat(locale): update Polish translations
+* feat(locale): update locales using machine translation
+* feat(locale): update Indonesian translations
+* feat(locale): update German translations
+* feat(locale): update Chinese translations
+* feat(integration)!: remove Pocket integration (Pocket will no longer be available after July 8, 2025)
+* feat(filter): add `EntryDate=max-age:duration` filter
+* feat(css): add margin-bottom to input for consistent spacing
+* feat(config)!: remove `SERVER_TIMING_HEADER` config option
+* feat: Allow multiple listen addresses
+* feat: adding support for saving entries to Karakeep
+* feat: add entry filters at the feed level
+* docs(readme): document a couple of nifty features
+* docs: add `CONTRIBUTING.md` file
+* chore(template): remove `X-UA-Compatible` meta tag specific to Internet Explorer
+* build(go): bump to go 1.24
+* build(deps): bump `library/alpine` in `/packaging/docker/alpine`
+* build(deps): bump `golang.org/x/net` from `0.40.0` to `0.41.0`
+* build(deps): bump `golang.org/x/image` from `0.27.0` to `0.28.0`
+* build(deps): bump `golang.org/x/crypto` from `0.38.0` to `0.39.0`
+
 Version 2.2.9 (May 26, 2025)
 ----------------------------
 

go.mod

@@ -4,7 +4,7 @@ module miniflux.app/v2
 
 require (
 	github.com/PuerkitoBio/goquery v1.10.3
-	github.com/andybalholm/brotli v1.1.1
+	github.com/andybalholm/brotli v1.2.0
 	github.com/coreos/go-oidc/v3 v3.14.1
 	github.com/go-webauthn/webauthn v0.13.0
 	github.com/gorilla/mux v1.8.1

go.sum

@@ -1,7 +1,7 @@
 github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
 github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
-github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
-github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
+github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

internal/database/migrations.go

@@ -1125,9 +1125,10 @@ var migrations = []func(tx *sql.Tx, driver string) error{
 	},
 	func(tx *sql.Tx, _ string) (err error) {
 		sql := `
-			ALTER TABLE integrations DROP COLUMN pocket_enabled;
-			ALTER TABLE integrations DROP COLUMN pocket_access_token;
-			ALTER TABLE integrations DROP COLUMN pocket_consumer_key;
+			ALTER TABLE integrations
+				DROP COLUMN pocket_enabled,
+				DROP COLUMN pocket_access_token,
+				DROP COLUMN pocket_consumer_key;
 		`
 		_, err = tx.Exec(sql)
 		return err

internal/http/server/httpd.go

@@ -139,14 +139,33 @@ func startUnixSocketServer(server *http.Server, socketFile string) {
 	}
 
 	go func() {
+		certFile := config.Opts.CertFile()
+		keyFile := config.Opts.CertKeyFile()
+
+		if certFile != "" && keyFile != "" {
+			slog.Info("Starting TLS server using a Unix socket",
+				slog.String("socket", socketFile),
+				slog.String("cert_file", certFile),
+				slog.String("key_file", keyFile),
+			)
+			// Ensure HTTPS is marked as true if any listener uses TLS
+			config.Opts.HTTPS = true
+			if err := server.ServeTLS(listener, certFile, keyFile); err != http.ErrServerClosed {
+				printErrorAndExit("TLS Unix socket server failed to start on %s: %v", socketFile, err)
+			}
+		} else {
 			slog.Info("Starting server using a Unix socket", slog.String("socket", socketFile))
 			if err := server.Serve(listener); err != http.ErrServerClosed {
 				printErrorAndExit("Unix socket server failed to start on %s: %v", socketFile, err)
 			}
+		}
 	}()
 }
 
 func startAutoCertTLSServer(server *http.Server, autoTLSConfig *tls.Config) {
+	if server.TLSConfig == nil {
+		server.TLSConfig = &tls.Config{}
+	}
 	server.TLSConfig.GetCertificate = autoTLSConfig.GetCertificate
 	server.TLSConfig.NextProtos = autoTLSConfig.NextProtos
 

miniflux.1

@@ -1,5 +1,5 @@
 .\" Manpage for miniflux.
-.TH "MINIFLUX" "1" "June 15, 2025" "\ \&" "\ \&"
+.TH "MINIFLUX" "1" "June 23, 2025" "\ \&" "\ \&"
 
 .SH NAME
 miniflux \- Minimalist and opinionated feed reader
@@ -344,6 +344,8 @@ Default is empty\&.
 .B LISTEN_ADDR
 Address to listen on. Use absolute path to listen on Unix socket (/var/run/miniflux.sock)\&.
 .br
+Multiple addresses can be specified, separated by commas. For example: 127.0.0.1:8080, 127.0.0.1:8081\&.
+.br
 Default is 127.0.0.1:8080\&.
 .TP
 .B LOG_DATE_TIME

packaging/docker/alpine/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/golang:alpine3.20 AS build
+FROM docker.io/library/golang:alpine3.22 AS build
 RUN apk add --no-cache build-base git make
 ADD . /go/src/app
 WORKDIR /go/src/app