head	1.30;
access;
symbols
	pkgsrc-2026Q3:1.26.0.2
	pkgsrc-2026Q3-base:1.26
	pkgsrc-2026Q2:1.19.0.2
	pkgsrc-2026Q2-base:1.19
	pkgsrc-2026Q1:1.13.0.2
	pkgsrc-2026Q1-base:1.13
	pkgsrc-2025Q4:1.7.0.2
	pkgsrc-2025Q4-base:1.7;
locks; strict;
comment	@# @;


1.30
date	2026.11.02.07.19.05;	author drixter;	state Exp;
branches;
next	1.29;
commitid	LTNAGSGk9c8Y9R1H;

1.29
date	2026.10.21.18.31.24;	author drixter;	state Exp;
branches;
next	1.28;
commitid	9o4WtXFPJc4zgn0H;

1.28
date	2026.10.20.20.28.23;	author bsiegert;	state Exp;
branches;
next	1.27;
commitid	dJKI2rPaaRPrWf0H;

1.27
date	2026.10.13.18.38.03;	author bsiegert;	state Exp;
branches;
next	1.26;
commitid	wvHFFhdcWIkzylZG;

1.26
date	2026.09.05.19.10.05;	author bsiegert;	state Exp;
branches
	1.26.2.1;
next	1.25;
commitid	9ZfzZiM9sH3jXsUG;

1.25
date	2026.08.31.19.19.10;	author bsiegert;	state Exp;
branches;
next	1.24;
commitid	w58ayX00lU4maPTG;

1.24
date	2026.08.22.15.19.18;	author bsiegert;	state Exp;
branches;
next	1.23;
commitid	y6FJlsYJaKI18ESG;

1.23
date	2026.08.15.12.53.39;	author bsiegert;	state Exp;
branches;
next	1.22;
commitid	5lqJISwxui9ZxJRG;

1.22
date	2026.07.25.10.23.43;	author drixter;	state Exp;
branches;
next	1.21;
commitid	jaXVenO7WnECo1PG;

1.21
date	2026.07.08.18.32.44;	author bsiegert;	state Exp;
branches;
next	1.20;
commitid	cDbYxmIrkrXYDSMG;

1.20
date	2026.06.28.11.04.21;	author drixter;	state Exp;
branches;
next	1.19;
commitid	zbSOPhNjQJHkuyLG;

1.19
date	2026.06.07.19.24.18;	author wiz;	state Exp;
branches
	1.19.2.1;
next	1.18;
commitid	xcTEjRMCya3LVTIG;

1.18
date	2026.06.05.10.21.55;	author bsiegert;	state Exp;
branches;
next	1.17;
commitid	jt8yVpLxXvatZAIG;

1.17
date	2026.05.17.09.56.16;	author wiz;	state Exp;
branches;
next	1.16;
commitid	tVovTNRAIbvJs9GG;

1.16
date	2026.05.07.18.50.11;	author bsiegert;	state Exp;
branches;
next	1.15;
commitid	MMrI2EXGAt3HJUEG;

1.15
date	2026.04.08.05.45.13;	author bsiegert;	state Exp;
branches;
next	1.14;
commitid	FFJx9trbRMg7k7BG;

1.14
date	2026.04.05.08.18.17;	author wiz;	state Exp;
branches;
next	1.13;
commitid	YqugA0NrgmLHgKAG;

1.13
date	2026.03.15.13.14.59;	author wiz;	state Exp;
branches
	1.13.2.1;
next	1.12;
commitid	OSBIEbfXEHUqA4yG;

1.12
date	2026.03.06.21.08.07;	author bsiegert;	state Exp;
branches;
next	1.11;
commitid	AQtIeR1eh5qvuXwG;

1.11
date	2026.02.24.08.45.42;	author bsiegert;	state Exp;
branches;
next	1.10;
commitid	IrpU9bGVDwSIHBvG;

1.10
date	2026.02.16.12.15.55;	author wiz;	state Exp;
branches;
next	1.9;
commitid	oA6X1LyI7h008BuG;

1.9
date	2026.01.15.19.54.59;	author bsiegert;	state Exp;
branches;
next	1.8;
commitid	Zuo9UmMrkrU4HwqG;

1.8
date	2026.01.07.21.19.29;	author wiz;	state Exp;
branches;
next	1.7;
commitid	ud6xnJDhkmlbqvpG;

1.7
date	2025.12.12.20.52.51;	author wiz;	state Exp;
branches;
next	1.6;
commitid	hGxtmhYJJmYR6amG;

1.6
date	2025.12.02.19.25.25;	author bsiegert;	state Exp;
branches;
next	1.5;
commitid	269raRGxaHJBWRkG;

1.5
date	2025.11.16.21.18.24;	author wiz;	state Exp;
branches;
next	1.4;
commitid	e7O6AnpS45Zr5PiG;

1.4
date	2025.10.16.18.00.05;	author bsiegert;	state Exp;
branches;
next	1.3;
commitid	RAGpkHmyeYCUYOeG;

1.3
date	2025.10.08.06.54.41;	author bsiegert;	state Exp;
branches;
next	1.2;
commitid	5p46uH9RJXSFyJdG;

1.2
date	2025.10.05.20.41.43;	author wiz;	state Exp;
branches;
next	1.1;
commitid	SzBjp2XcFdSzeqdG;

1.1
date	2025.10.05.20.33.45;	author wiz;	state Exp;
branches;
next	;
commitid	qoUDqAN3yXPQbqdG;

1.26.2.1
date	2026.10.21.20.45.54;	author maya;	state Exp;
branches;
next	;
commitid	IJL9kZcpR4sp0o0H;

1.19.2.1
date	2026.07.14.00.36.10;	author maya;	state Exp;
branches;
next	;
commitid	sHC3bIiGgkiEuyNG;

1.13.2.1
date	2026.04.22.14.32.21;	author maya;	state Exp;
branches;
next	;
commitid	iDHLLUhOplH6NXCG;


desc
@@


1.30
log
@miniflux: Update to version 2.3.5

New features
Added OpenID Connect admin role mapping: set OAUTH2_ADMIN_GROUP and OAUTH2_GROUP_CLAIM to grant or revoke the admin role at login based on the user's groups. The group claim is read from the user info response or the ID token, and OAUTH2_ADDITIONAL_SCOPES can request extra scopes from the provider.
Allowed WebAuthn/Passkeys as the only login method when DISABLE_LOCAL_AUTH is enabled. Register at least one passkey while another authentication method is still available before turning off local authentication.
Added a force parameter to the feed refresh API endpoint (PUT /v1/feeds/{id}/refresh?force=true) to bypass the HTTP cache and reprocess existing entries, matching the forced refresh in the web UI. The Go client gains ForceRefreshFeed.
Rejected invalid CSS selectors when saving rewrite and scraper rules, instead of silently ignoring them.
Moved the username, password, OAuth2 account linking, and passkey settings to a dedicated Authentication page under Settings.

Performance improvements
Stopped creating database web sessions for anonymous visitors, crawlers, media proxy requests, and other public pages that don't need one. Logged-out language and theme preferences are now kept in a cookie, and anonymous sessions are removed after 24 hours, which keeps the web_sessions table from growing with thousands of unused rows.

Security
Required the current password before setting a new one on the Authentication page.
Signed out other sessions when a password is changed, from the web UI, the API, or the -reset-password command. The current session gets a new identifier so a copied cookie stops working.
Prevented administrators from editing their own account through the user management page, which bypassed the current password check.
Restricted feed cookies to the feed's own website, so they are no longer sent to third-party hosts when scraping articles, fetching icons, or discovering feeds.
Blocked 6to4 and IPv4-compatible IPv6 addresses that could bypass the server-side request forgery filter.
Stopped caching shared entry pages in public caches and removed the CSRF token from them.
Took the client IP from the right side of X-Forwarded-For, skipping addresses in TRUSTED_REVERSE_PROXY_NETWORKS, so clients can no longer spoof the IP recorded in logs and sessions. If you chain several reverse proxies (e.g. Cloudflare in front of nginx), add the networks of every proxy to TRUSTED_REVERSE_PROXY_NETWORKS.
Stopped logging malformed Google Reader authentication tokens.
Hardened the GitHub Actions workflows and added provenance and SBOM attestations to Docker images.

Bug fixes
Fixed the Fever API toggling the starred state when saving or unsaving an entry that was already in that state.
Fixed the Fever API marking all entries as read, including newer ones, while ignoring the before timestamp.
Fixed the Fever API returning an arbitrary set of entries for some item requests, which could cause clients to miss entries.
Fixed a crash in the Google Reader API caused by an unknown stream type.
Matched category titles case-insensitively, fixing "category not found" errors with Google Reader labels and duplicate categories created by OPML imports.
Parsed RFC 3339 dates with a lower-case t or z.
Accepted JSON feeds that start with a UTF-8 byte order mark.
Validated the username format when renaming a user, not only at creation.

Localization
Updated Polish (pl_PL) translations.
Fixed raw translation keys shown instead of messages for invalid usernames, invalid proxy URLs, unparsable HTML pages, and the tag entry count.

Documentation
Reviewed the man page for accuracy and readability, documenting option combinations checked at startup, media proxy modes, and systemd socket activation.

Dependencies
Updated several Go modules and GitHub Actions dependencies.
@
text
@# $NetBSD: Makefile,v 1.21 2026/07/08 18:32:44 bsiegert Exp $

DISTNAME=	miniflux-2.3.5
CATEGORIES=	www
MASTER_SITES=	${MASTER_SITE_GITHUB:=miniflux/}
GITHUB_PROJECT=	v2
GITHUB_TAG=	${PKGVERSION_NOREV}

MAINTAINER=	drixter@@e-utp.net
HOMEPAGE=	https://github.com/miniflux/v2/
COMMENT=	Minimalist and opinionated feed reader
LICENSE=	apache-2.0

USE_LANGUAGES=	c

INSTALLATION_DIRS+=	${PKGMANDIR}/man1

post-install:
	${INSTALL_DATA} ${WRKSRC}/miniflux.1 ${DESTDIR}${PREFIX}/${PKGMANDIR}/man1

.include "go-modules.mk"
.include "../../lang/go/go-module.mk"
.include "../../mk/bsd.pkg.mk"
@


1.29
log
@miniflux: Update to version 2.3.4

New features
Added Gotify push notification support.
Added Steam scraper rules.
Added validation with helpful error messages when saving rewrite rules.
Performance improvements
Reduced database storage used by enclosure and entry indexes.
Reduced memory used by internal data structures.

Security
Blocked reserved IP address ranges to further protect against server-side request forgery.
Hardened WebAuthn redirects against open-redirect attacks, including redirect URLs containing surrounding whitespace.
Prevented per-feed proxy URLs from bypassing private-network restrictions by default. Set FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 to retain access to private per-feed proxies.
Enforced DISABLE_LOCAL_AUTH for API password authentication and password changes; API clients must use an API key when local authentication is disabled.
Rejected Google Reader authentication tokens when no password is configured.
Restricted embedded iframe URLs to web schemes and tightened YouTube hostname validation.

Bug fixes
Added timeouts to the ACME challenge listener.
Fixed response compression negotiation to consistently prefer the server's configured encoding order.
Improved Karakeep errors when saving an entry fails by reporting the HTTP status.
Returned to the first unread page when marking entries as read leaves the current feed or category page empty.
Restored support for proxies configured through HTTP_PROXY or HTTPS_PROXY, including across redirects.
Returned a validation error instead of crashing when creating or importing feeds for users without a category.
Preserved the requested redirect after passkey login.
Increased the Google Reader item-ID limit to 10,000.
Returned a bad-request response instead of crashing on POST requests to static asset paths.
Improved accessibility by adding descriptive names to documentation links.
Improved error logging and responses for failed database existence checks and shared-entry lookups.

Localization
Updated Polish (pl_PL) translations.

Documentation
Clarified the Unix socket permissions used with LISTEN_ADDR.

Dependencies
Updated several Go modules and GitHub Actions dependencies.
@
text
@d3 1
a3 1
DISTNAME=	miniflux-2.3.4
@


1.28
log
@Revbump all Go packages after go127 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.27 2026/10/13 18:38:03 bsiegert Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.3.3
PKGREVISION=	6
@


1.27
log
@Revbump all Go packages after go127 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.26 2026/09/05 19:10:05 bsiegert Exp $
d4 1
a4 1
PKGREVISION=	5
@


1.26
log
@Revbump all Go packages after go127 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.25 2026/08/31 19:19:10 bsiegert Exp $
d4 1
a4 1
PKGREVISION=	4
@


1.26.2.1
log
@*: Revbump for go126, go127. Ticket #7311
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.26 2026/09/05 19:10:05 bsiegert Exp $
d4 1
a4 1
PKGREVISION=	5
@


1.25
log
@Revbump all Go packages after go127 became the default
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.24 2026/08/22 15:19:18 bsiegert Exp $
d4 1
a4 1
PKGREVISION=	3
@


1.24
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.23 2026/08/15 12:53:39 bsiegert Exp $
d4 1
a4 1
PKGREVISION=	2
@


1.23
log
@Revbump all Go packages after Go 1.26 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.22 2026/07/25 10:23:43 drixter Exp $
d4 1
a4 1
PKGREVISION=	1
@


1.22
log
@miniflux: Update to 2.3.3

New features
Feed and entry language detection
Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries.
Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
Entries without their own language now inherit the language declared by the feed.
Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
The language field is exposed through the API and the Go client for both feeds and entries.

Other additions
Feed discovery now finds the feeds offered by GitHub pages.
TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
The browser favicon is now served as SVG for a sharper icon on high-density displays.
Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements
Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security
Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes
Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
Fixed a race condition during template rendering that could return a page translated in another user's language.
Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
Fixed a category deletion check that could remove all of a user's categories.
Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
Fixed the no_media_player option being ignored when creating a feed.
A feed proxy URL can now be cleared once it has been configured.
Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
Fixed the remove_tables rewrite rule reordering article content.
Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
Fixed empty tags being sent to Raindrop when no tag was configured.
Fixed overlapping article headings that wrap onto multiple lines.
Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies
Updated several Go modules and GitHub Actions dependencies, including:
github.com/andybalholm/brotli 1.2.2
github.com/coreos/go-oidc/v3 3.20.0
github.com/prometheus/client_golang 1.24.0
golang.org/x/crypto 0.54.0
golang.org/x/net 0.57.0
golang.org/x/text 0.40.0
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.21 2026/07/08 18:32:44 bsiegert Exp $
d4 1
@


1.21
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.20 2026/06/28 11:04:21 drixter Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.3.2
PKGREVISION=	1
@


1.20
log
@www/miniflux: Update to version 2.3.2

Miniflux 2.3.2

New features
Improved full-text search
Search queries now use PostgreSQL's websearch_to_tsquery, allowing quoted phrases, OR operators, and negation (-term) in search expressions.

API improvements
Added GET /v1/entries/ids to efficiently retrieve paginated entry IDs.
Added support for updating the starred status of multiple entries through PUT /v1/entries.
API clients can now filter entries by tags.
The Go client now exposes additional feed fields (description, icon, next_check_at, notification settings, no_media_player, etc.) and supports the new tag filter.

Atom feed improvements
When an Atom entry id contains an HTTP URL, it is now used as the entry URL when no dedicated link is available.

Performance improvements
Improved full-text search performance by caching compiled regular expressions used by filtering rules.
Reduced database work when computing category statistics.
Improved browser caching of static assets.
Reduced template rendering overhead by precomputing static icon URLs.

Security
Prevent username enumeration through login timing differences.
PostgreSQL installations running in FIPS mode are now fully supported by replacing MD5 with SHA-256 for enclosure uniqueness.
This change raises the minimum supported PostgreSQL version to 11.

Bug fixes
Fixed validation of per-feed entry filter rules in the web interface.
SOCKS proxy URLs can once again be configured for individual feeds.
Fixed enclosure URL proxying consistency across API endpoints.
Fixed several API handlers that incorrectly returned 404 Not Found or 400 Bad Request instead of proper server errors.
Fixed inconsistent handling of invalid category filters in the Entries API.
Fixed user lookup edge cases that could result in nil pointer dereferences.
Fixed enclosure lookup to correctly scope results by user.
Fixed the Google Reader Quick Add endpoint to honor the configured HTTP user agent.
Fixed refresh-all keyboard shortcut (R) to correctly display the success notification.
Fixed localization formatting issues affecting several languages.
Fixed request builder state leaking during feed discovery.
Improved accessibility by correcting an aria-labelledby issue.

Localization
Updated German (de_DE) translations.
Updated Galician (gl_ES) translations.

Documentation
Clarified the units for POLLING_FREQUENCY.
Improved documentation for TRUSTED_REVERSE_PROXY_NETWORKS.

Dependencies
Updated several Go modules and GitHub Actions dependencies.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.19 2026/06/07 19:24:18 wiz Exp $
d4 1
@


1.19
log
@miniflux: update to 2.3.1.

Security

    Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
    Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
    Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
    Hardened metrics endpoint authentication by using constant-time credential comparisons.

Bug Fixes

    Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

Improvements

    Added Korean language support.
    Improved HTML truncation performance and reduced memory allocations.
    Optimized feed discovery, subscription detection, date parsing, and tag filtering.
    Simplified and refactored several storage and query-building components for better maintainability.

Dependencies

Updated several dependencies
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.18 2026/06/05 10:21:55 bsiegert Exp $
d3 1
a3 1
DISTNAME=	miniflux-2.3.1
d9 1
a9 1
MAINTAINER=	pkgsrc-users@@NetBSD.org
@


1.19.2.1
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.19 2026/06/07 19:24:18 wiz Exp $
a3 1
PKGREVISION=	1
@


1.18
log
@Revbump all Go packages after go126 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.17 2026/05/17 09:56:16 wiz Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.3.0
PKGREVISION=	1
@


1.17
log
@miniflux: update to 2.3.0.

Security

    Only discoverable WebAuthn credentials (resident keys / passkeys) are supported for login.
    Non-resident credentials can no longer be used for first-factor authentication to prevent username enumeration before password verification. They are intended for post-password MFA flows, which Miniflux does not currently support.
    Persist WebAuthn backup eligibility/state and validated credential state after login.
    Require POST requests for logout, feed refresh, and OAuth2 unlink actions.
    Apply CSRF protection to all non-safe HTTP methods.
    Add http.CrossOriginProtection middleware for the web UI.
    Validate redirect URL schemes in HTMLRedirect to prevent unsafe redirects.
    Restore URL scheme validation in templates for untrusted feed URLs.
    Sanitize filenames in Content-Disposition headers to prevent header injection.
    Reject empty OAuth2 state parameters when no authentication flow is in progress.
    Allow configured private proxies while still enforcing private-network restrictions for direct requests and redirects.
    Validate URI schemes case-insensitively according to RFC 3986.
    Pin third-party GitHub Actions to immutable commit SHAs to reduce supply-chain risks.
    Cap the maximum entry limit to 1000 across the UI, API, and storage layer.

Improvements

    Add support for exporting and importing Miniflux-specific feed settings in OPML files, allowing full feed configuration backups and restores.
    Add enclosure links rewrite rule to expose podcast/video enclosure URLs inside entry content for external RSS clients.
    Add support for the shortcuts: iOS URL scheme in sanitized content.
    Add Linux riscv64 builds.
    Allow disabling local authentication without enabling automatic OAuth2/auth-proxy user creation.
    Improve Chinese Traditional (zh-TW) translations.
    Improve RSS parsing for feeds that reuse the same GUID across multiple entries.
    Improve UI consistency for authentication settings and external-link behavior.
    Automatically clean up orphaned feed icons from the database.
    Detect Cloudflare bot challenge pages during feed refresh and return a dedicated error message.
    Improve error handling and cleanup in WebAuthn login flows.
    Simplify large feed and user deletions using ON DELETE CASCADE.

Performance

    Improve sanitizer performance significantly and reduce allocations in multiple hot paths.
    Optimize reading-time calculation to avoid unnecessary allocations.
    Improve feed parsing performance by preallocating slices/maps and reducing string allocations.
    Optimize ISO8601 duration parsing for YouTube and podcast feeds.
    Reduce database queries for navigation metadata and storage operations.
    Optimize template rendering for icons and CSP generation.
    Avoid loading entry content from PostgreSQL when not needed.
    Reuse a singleton HTML minifier instance instead of allocating one per request.
    Optimize string handling in the reader and sanitizer packages.

Bug Fixes

    Fix incorrect read/starred toggling in Google Reader API.
    Prevent archived/deleted entries from reappearing as unread by using a tombstone table and removing the removed entry status.
    Fix handling of slow HTTP headers.
    Fix "open in new tab" behavior for redirected external entry links.
    Fix Wallabag integration typo in error messages.

Dependency Updates

    Update github.com/go-webauthn/webauthn to v0.17.3.
    Update various golang.org/x/* packages.
    Update github.com/coreos/go-oidc/v3 to v3.18.0.
    Update github.com/tdewolff/minify/v2 to v2.24.13.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.16 2026/05/07 18:50:11 bsiegert Exp $
d4 1
@


1.16
log
@Revbump all Go packages after go126 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.15 2026/04/08 05:45:13 bsiegert Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.2.19
PKGREVISION=	2
@


1.15
log
@Revbump all Go packages after security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.14 2026/04/05 08:18:17 wiz Exp $
d4 1
a4 1
PKGREVISION=	1
@


1.14
log
@miniflux: update to 2.2.19.

Security

    Remove sensitive values (CSRF tokens, OAuth state, session cookies) from log messages.
    Improve OAuth2 security:
        Verify OIDC ID token signatures and claims.
        Prevent OAuth identity overwrite when already linked.
        Clear PKCE verifier and CSRF state after use.
        Validate HTTP status from Google userinfo endpoint.
    Use HMAC-SHA256 instead of SHA1 for Google Reader API authentication.
    Use constant-time comparison for token validation.
    Fix potential DoS when truncating large untrusted input in templates.
    Reject oversized favicons.

Improvements

    Improve configuration validation with cross-field consistency checks.
    OAuth2:
        Explicit provider selection via OAUTH2_PROVIDER.
        Better separation between Google and OIDC providers.
        Updated Google OAuth endpoints to v2.
    UI:
        Add cache-busting for static assets (JS, CSS, icons).
        Add Cache-Control: immutable for static resources.
    Sanitizer:
        Allow iframes from framatube.org.
        Improve performance and parsing behavior.
    Metrics and workers:
        Graceful shutdown support for worker pool and metrics collector.
        Better error reporting for metrics.
    API / HTTP:
        Support weak ETag comparison.
        Improve response helpers and headers handling.

Performance

    Reduce number of SQL queries for unread entries and UI pages.
    Optimize database queries and locking behavior:
        Use SKIP LOCKED in archive operations.
        Reduce unnecessary queries and connections.
    Improve UI performance:
        Cache keymaps instead of recomputing on each keypress.
        Batch DOM updates when marking entries as read.
    Optimize sanitizer, media proxy, routing, and template rendering.
    Reduce allocations in various hot paths.

Bug Fixes

    Fix category update validation rendering.
    Fix redirect after marking a feed as read from category view.
    Fix timezone comparison logic.
    Fix Arabic pluralization rules (ar_SA).
    Fix validator behavior when clearing user filters.
    Fix CLI behavior for --info and --version.
    Fix CORS preflight responses (return 204).
    Ensure 204 responses do not include Content-Type.
    Ignore unsupported media proxy targets and handle MIME types correctly.

Refactoring

    Remove dependency on gorilla/mux across the codebase.
    Improve code structure and naming consistency (API, OAuth2, config, validators).
    Simplify timezone and server setup logic.
    Improve testability and documentation (GoDoc updates).
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.13 2026/03/15 13:14:59 wiz Exp $
d4 1
@


1.13
log
@miniflux: update to 2.2.18.

Security

    Block outbound requests to private networks made by the fetcher by default.
    Add SSRF protection for integration HTTP clients by blocking connections to private network addresses at connect time.
    Fix a possible SSRF TOCTOU / DNS-rebinding issue in the fetcher private network check.
    Ensure private network protections also apply to redirect targets.
    Treat RFC 6598 shared address space (100.64.0.0/10) as non-public.

Breaking Changes

To prevent potential SSRF, Miniflux now blocks access to services hosted on private networks by default.

    FETCHER_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access feeds hosted on a local network.
    INTEGRATION_ALLOW_PRIVATE_NETWORKS=1 must now be enabled to access third-party integration services hosted on a local network.

Improvements

    Apply entry blocking rules both before and after scraping to avoid unnecessary requests and allow matching on fetched content.
    Add ignore_entry_updates feed option to skip updating existing entries during scheduled polling.
    Add Arabic (ar_SA) translation.
    Add Galician (gl_ES) translation.
    Update Polish translation.
    Various performance improvements across multiple components (fetcher, parser, sanitizer, readability, URL cleaner, feed discovery, and Google Reader API).
    Simplify parts of the Google Reader code and reduce allocations in several hot paths.
    Reduce fetcher request size slightly to improve packet efficiency.

Bug Fixes

    Fix multiple bugs and inconsistencies across integration sub-packages (error handling, logging, status checks, and naming).
    Fix potential panic in the Omnivore integration when handling empty error arrays.
    Correct error prefixes and typos in several integrations.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.12 2026/03/06 21:08:07 bsiegert Exp $
d3 1
a3 1
DISTNAME=	miniflux-2.2.18
@


1.13.2.1
log
@Revbump all Go packages after go126 security fix
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.13 2026/03/15 13:14:59 wiz Exp $
a3 1
PKGREVISION=	1
@


1.12
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.11 2026/02/24 08:45:42 bsiegert Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.2.17
PKGREVISION=	2
@


1.11
log
@Revbump all Go packages after default version bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.10 2026/02/16 12:15:55 wiz Exp $
d4 1
a4 1
PKGREVISION=	1
@


1.10
log
@miniflux: update to 2.2.17.

Security

    Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49).
    Improve HTML sanitizer by switching from the tokenizer to the golang.org/x/net/html parser to better match browser behavior and reduce the risk of injection issues.
    Enforce blocked resource checks on srcset URLs.
    Improve blocked resource handling (including updates to blocked URL substrings).
    Add validation for TRUSTED_REVERSE_PROXY_NETWORKS configuration to prevent silent misconfiguration.
    Prevent possible deadlock when cleaning removed entries.
    Ensure HTTP response bodies are always closed, even on client errors.

Improvements

    Rewrite srcset parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly.

    Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling).

    Handle deeply nested HTML more robustly in the sanitizer.

    Add scraper and rewrite rules for:
        bleepingcomputer.com
        vnexpress.net

    Improve JSON Feed support:
        Support malformed feeds with author objects in the authors array.
        Avoid panic when parsing null feeds.
        Improve title fallback logic.
        Include external_url in JSON entry hash fallback.

    Ignore WordPress wp-json API endpoint during JSON feed discovery.

    Add unread status filter to search results.

    Improve timezone handling internals and performance.

    Improve API payload structures and Godoc comments.

    Improve JavaScript code readability and keyboard shortcut handling.

    Restore cmd/ctrl/shift-click behavior on main navigation.

    Fix Safari PWA behavior for the v shortcut to open links in the main browser.

Bug Fixes

    Do not keep old enclosures when an updated entry has none.
    Handle sql.ErrNoRows properly in IconByFeedID.
    Change FindRemoteIP to fall back to 127.0.0.1.

Configuration Changes

    Removed FILTER_ENTRY_MAX_AGE_DAYS.
    This option can be replaced with a filter rule such as max-age:<duration>.
    Global environment variables should be reserved for process-level configuration.

Dependencies

    Update github.com/lib/pq to 1.11.2.

    Update:
        golang.org/x/net to 0.50.0
        golang.org/x/crypto to 0.48.0
        golang.org/x/image to 0.36.0
        golang.org/x/oauth2 to 0.35.0
        golang.org/x/term to 0.40.0

    Update Debian packager Docker image to Trixie.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.9 2026/01/15 19:54:59 bsiegert Exp $
d4 1
@


1.9
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2026/01/07 21:19:29 wiz Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.2.16
PKGREVISION=	1
@


1.8
log
@miniflux: update to 2.2.16.

Security

    Disallow the media proxy from fetching resources on private networks to mitigate potential SSRF issues. This behavior is configurable at the instance level.
    Disallow fetching feed icons from private networks to reduce the SSRF attack surface. This is also configurable at the instance level.
    Add the TRUSTED_REVERSE_PROXY_NETWORKS configuration option to prevent spoofing of HTTP headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip. This option must be configured when AUTH_PROXY_HEADER is enabled.
    Stop logging generated Google Reader API tokens, even when debug mode is enabled.
    Remove the CORS handler from the Google Reader API, as it is not intended to be used by web clients, reducing the overall attack surface.

Performance and Storage

    Avoid indexing the content of removed entries, significantly reducing database index size after cleanup.
    Minor storage and database refactoring to simplify code paths and reduce unnecessary formatting overhead.

API and Integrations

    Add a new API endpoint to import entries into an existing feed.
    Execute the content sanitizer when updating or importing entries through the API to ensure consistent sanitization.
    Improve Google Reader API compatibility by removing unnecessary output parameter checks and aligning behavior with other open-source RSS readers.
    Add an auto-push option to the Readeck integration.

User Interface

    Add smooth page transitions for a more polished navigation experience.
    Add a route to view individual starred entries directly from a category’s starred list.
    Add a link to the GitHub contributors page in templates.
    Update all translations.

Documentation and Tooling

    Improve consistency and fix typos in the miniflux(1) manual page.
    Remove the obsolete version key from Docker Compose examples.
    Update the Go devcontainer image to go:1-trixie.
    Update the Distroless container base image to Debian 13.
    Update GitHub Actions dependencies.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2025/12/12 20:52:51 wiz Exp $
d4 1
@


1.7
log
@miniflux: update to 2.2.15.

✨ New Features

    New configuration option to disable the Miniflux API
    Added option to save entries to a specific Linkwarden collection
    YouTube subscription improvements:
        Provide multiple feeds for YouTube content: Channel, videos only, short videos, live streams
        Better canonical URL detection (now has its own dedicated step)
        Improved YouTube channel parsing, including default playlists
    Allow feed entries with <i> and <small> tags
    URL Cleaner: Remove additional trackers from URLs

🐛 Bug Fixes

    YouTube embeds: Avoid Error 153 (video player configuration error) in various scenarios
    API: fetchContent endpoint now properly rewrites media URLs when using the media proxy
    Security: Only relative paths are now allowed for the redirectURL parameter
    CI fixes:
        Improved CodeQL workflow (language matrix + dynamic analysis)
        Fixed missing GitHub Actions permissions
        Fixed RPM package versioning for scheduled and pull_request triggers

🧹 Refactoring & Maintenance

    JavaScript optimizations: use replace instead of remove/add, minor regex cleanup
    Performance improvement: removed string concatenation in loops
    Updated Polish translation
    Updated Postgres volume path in Docker Compose examples
    Added new CI workflow to mirror the Git repo to Codeberg
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2025/12/02 19:25:25 bsiegert Exp $
d3 1
a3 1
DISTNAME=	miniflux-2.2.15
@


1.6
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2025/11/16 21:18:24 wiz Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.2.14
PKGREVISION=	1
@


1.5
log
@miniflux: update to 2.2.14.

✨ New Features

    Go Client: Allow passing a custom http.Client and add context support to API methods.
    UI: Redirect users back to the original page after logging in.
    Template: Improved Content Security Policy: extracted CSP generation into a function, added systematic nonces, and changed default-src to 'none' for stronger security.
    Integrations:
        Added tags option for the Karakeep integration.
        Added new Archive.org integration.
    Rewrite Rules:
        Added remove_img_blur_params rule.
        Added add_image_title rule for explainxkcd.com.

🧰 Improvements & Refactoring

    Replaced custom modal with native <dialog> element for simpler, more accessible UI.
    Simplified date parsing in the reader and XML encoding logic.
    Optimized sanitizer functions (hasRequiredAttributes, hasValidURIScheme, isBlockedResource).
    Replaced fmt.Errorf with errors.New where applicable.
    Removed dependency on hstore in the database layer and relaxed implicit NOT NULL for serial types.
    Simplified Fever API slice sizing and various internal cleanups.
    Preallocated slices and optimized string/number conversions for better performance.

🧪 Tests

    Added test cases for XML encoding behavior.

🐛 Bug Fixes

    Fixed CSS layout overflow when external links are too long.
    Fixed JSON Feed parser to fallback to external_url when url is missing.
    Updated scraper rule for Dark Reading.

📚 Documentation

    Clarified the POLLING_FREQUENCY environment variable in the documentation.

🏗️ Build & CI

    Updated dependencies:
        github.com/tdewolff/minify/v2 → 2.24.4
        golang.org/x/net → 0.46.0
        golang.org/x/image → 0.32.0
        golang.org/x/oauth2 → 0.32.0
        github.com/coreos/go-oidc/v3 → 3.16.0
        github/codeql-action → 4

    Updated make lint and enabled additional Go linters (perfsprint, goheader).

📝 Additional Notes

If you are seeing this Postgres error: Error: pq: must be owner of extension hstore, you can fix it by running the following SQL command as a superuser for the Miniflux database:

DROP EXTENSION hstore;

This error means you initially created the hstore extension as a different database user than the one you are currently using for Miniflux.

For more details, look at the Git commit history.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2025/10/16 18:00:05 bsiegert Exp $
d4 1
@


1.4
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2025/10/08 06:54:41 bsiegert Exp $
d3 1
a3 2
DISTNAME=	miniflux-2.2.13
PKGREVISION=	2
@


1.3
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2025/10/05 20:41:43 wiz Exp $
d4 1
a4 1
PKGREVISION=	1
@


1.2
log
@miniflux: install man page. Ride import.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2025/10/05 20:33:45 wiz Exp $
d4 1
@


1.1
log
@www/miniflux: import miniflux-2.2.13

Miniflux is a minimalist and opinionated feed reader.  It's simple,
fast, lightweight and super easy to install.
@
text
@d1 1
a1 1
# $NetBSD$
d16 5
@