Miniflux 2.3.3

Release date: July 24, 2026

Changes

New features

Feed and entry language detection
- Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
- Entries without their own language now inherit the language declared by the feed.
- Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
- The language field is exposed through the API and the Go client for both feeds and entries.
Other additions
- Feed discovery now finds the feeds offered by GitHub pages.
- TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
- The browser favicon is now served as SVG for a sharper icon on high-density displays.
- Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users’ feeds through GET /v1/icons/{iconID}.
Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
Fixed a race condition during template rendering that could return a page translated in another user’s language.
Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
Fixed “Mark all as read” on the unread page, which marked entries from categories hidden from the global unread list.
Fixed a category deletion check that could remove all of a user’s categories.
Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
Fixed the no_media_player option being ignored when creating a feed.
A feed proxy URL can now be cleared once it has been configured.
Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
Fixed the remove_tables rewrite rule reordering article content.
Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
Fixed empty tags being sent to Raindrop when no tag was configured.
Fixed overlapping article headings that wrap onto multiple lines.
Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies

Updated several Go modules and GitHub Actions dependencies, including:

github.com/andybalholm/brotli 1.2.2
github.com/coreos/go-oidc/v3 3.20.0
github.com/prometheus/client_golang 1.24.0
golang.org/x/crypto 0.54.0
golang.org/x/net 0.57.0
golang.org/x/text 0.40.0

As always, thank you to all contributors who helped improve Miniflux in this release.

Miniflux 2.3.3

Changes

New features

Performance improvements

Security

Bug fixes

Dependencies

Attachments