Miniflux 2.3.5

Release date: November 1, 2026

Changes

Added OpenID Connect admin role mapping: set OAUTH2_ADMIN_GROUP and OAUTH2_GROUP_CLAIM to grant or revoke the admin role at login based on the user’s groups. The group claim is read from the user info response or the ID token, and OAUTH2_ADDITIONAL_SCOPES can request extra scopes from the provider.
Allowed WebAuthn/Passkeys as the only login method when DISABLE_LOCAL_AUTH is enabled. Register at least one passkey while another authentication method is still available before turning off local authentication.
Added a force parameter to the feed refresh API endpoint (PUT /v1/feeds/{id}/refresh?force=true) to bypass the HTTP cache and reprocess existing entries, matching the forced refresh in the web UI. The Go client gains ForceRefreshFeed.
Rejected invalid CSS selectors when saving rewrite and scraper rules, instead of silently ignoring them.
Moved the username, password, OAuth2 account linking, and passkey settings to a dedicated Authentication page under Settings.

Stopped creating database web sessions for anonymous visitors, crawlers, media proxy requests, and other public pages that don’t need one. Logged-out language and theme preferences are now kept in a cookie, and anonymous sessions are removed after 24 hours, which keeps the web_sessions table from growing with thousands of unused rows.

Required the current password before setting a new one on the Authentication page.
Signed out other sessions when a password is changed, from the web UI, the API, or the -reset-password command. The current session gets a new identifier so a copied cookie stops working.
Prevented administrators from editing their own account through the user management page, which bypassed the current password check.
Restricted feed cookies to the feed’s own website, so they are no longer sent to third-party hosts when scraping articles, fetching icons, or discovering feeds.
Blocked 6to4 and IPv4-compatible IPv6 addresses that could bypass the server-side request forgery filter.
Stopped caching shared entry pages in public caches and removed the CSRF token from them.
Took the client IP from the right side of X-Forwarded-For, skipping addresses in TRUSTED_REVERSE_PROXY_NETWORKS, so clients can no longer spoof the IP recorded in logs and sessions. If you chain several reverse proxies (e.g. Cloudflare in front of nginx), add the networks of every proxy to TRUSTED_REVERSE_PROXY_NETWORKS.
Stopped logging malformed Google Reader authentication tokens.
Hardened the GitHub Actions workflows and added provenance and SBOM attestations to Docker images.

Fixed the Fever API toggling the starred state when saving or unsaving an entry that was already in that state.
Fixed the Fever API marking all entries as read, including newer ones, while ignoring the before timestamp.
Fixed the Fever API returning an arbitrary set of entries for some item requests, which could cause clients to miss entries.
Fixed a crash in the Google Reader API caused by an unknown stream type.
Matched category titles case-insensitively, fixing “category not found” errors with Google Reader labels and duplicate categories created by OPML imports.
Parsed RFC 3339 dates with a lower-case t or z.
Accepted JSON feeds that start with a UTF-8 byte order mark.
Validated the username format when renaming a user, not only at creation.

Updated Polish (pl_PL) translations.
Fixed raw translation keys shown instead of messages for invalid usernames, invalid proxy URLs, unparsable HTML pages, and the tag entry count.

Reviewed the man page for accuracy and readability, documenting option combinations checked at startup, media proxy modes, and systemd socket activation.

As always, thank you to all contributors who helped improve Miniflux in this release.