❌

Normal view

FreshRSS 1.30.4

21 October 2026 at 23:45

This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights πŸ›:

This release has been made by @Alkarex, @Frenzie and newcomer @icco

Full changelog:

  • Security
    • Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475
    • Docker: disable PHP session.upload_progress.enabled for additional security #9476
  • I18n

FreshRSS 1.30.3

21 October 2026 at 17:30

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights πŸ›:

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

  • Deployment
    • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
  • Extensions
    • New hook: Minz_HookType::AutofillField for auth views #9362
  • I18n
    • Improve Brazilian Portuguese #9473
  • Misc.
    • Translate non-English code comments and identifiers #9383

FreshRSS 1.30.2

19 October 2026 at 23:57

This is a second security and bug-fixing release in the continuation of 1.30.x.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights πŸ›:

  • Fix PHP 8.5+ deprecation warning with SQLite
  • Block data: URI scheme in some cases

Performance highlights 🏎️:

  • Reduce memory consumption of export

This release has been made by @Alkarex, @Inverle and newcomers @abp002, @Arslan-TR, @Emredinho61, @HawkForge, @lordmarrik, @spa77k, @tomac4t, @tpq2030

Full changelog:

  • Security
    • SimplePie sanitizer: block data: URI scheme while keeping data:image for images #9417
    • Mitigate some 404 situations #9435
    • Do not log the Fever API key on authentication failure #9468
    • Fix local DNS leak when fetching feeds through a proxy #9451
  • Bug fixes
    • WebSub fix POST, fix warning, better message #9420
    • Fix PHP 8.5+ deprecation of sqliteCreateFunction for SQLite #9421
    • Preserve explicit sort overrides when searching #9467
    • Fix wrong order of args in extension compatibility check #9445
  • Performance
    • Reduce memory consumption of export #9350
  • Features
    • Better doc and log proxy cases #9436
  • Extensions
  • UI
    • Disallow user page navigation while refreshing feeds #9446
    • Various UI and style improvements #9426, #9441
  • I18n
  • Misc.
    • Update to GT\CssXPath 1.6.0 #9411
    • CI/CD: Fix login to Docker Hub #9433
    • Fix SVGO zero percent filtering in CI #9422
    • Update dev dependencies #9425

FreshRSS 1.30.1

5 October 2026 at 22:40

This is a security-oriented release with several security patches and bug fixes in the continuation of 1.30.0.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights πŸ›:

  • Some security attack scenarios patched
  • Fix domain-wide Retry-After
  • Fix muting of feeds gone with HTTP 410

Feature highlights✨:

  • CLI: Add optional feed argument to actualize-user.php

This release has been made by @Alkarex, @andris155, @fzlzjerry, @Inverle, @jamalkamaladdin, @jtracey, @Otolock and newcomers @akine, @colons, @ethanstoner, @gigioneggiando, @Juice-de-Orange, @pavel-miniutka, @qwist1233-cpu, @Sharawey74, @shcheglovnd, @TapuGithub, @yuchenshi, @ZainnQureshii

Full changelog:

  • Deployment
    • Reword recommendations and explanations for edge (rolling release) vs. latest (versioned release) channels #9270
  • Security
    • Config + increase default values for search max length and depth #9280
    • Accept a trusted proxy address given without a subnet #9301
    • Warn during session regenerate fail #9311, #9376
    • CI/CD add zizmor workflow for action security checks #9228, #9331
    • Use PHP #[\SensitiveParameter] #9322
    • Reject token access (RSS/OPML export, feed refresh) for disabled accounts #9336
    • Require POST+CSRF for self-update mutations #9335
    • Make the login challenge nonce one-time #9334
    • Bound ZIP import against decompression bombs #9332
    • Rotate session ID on all authenticated transitions #9333
    • Minz: Remove vulnerable and unused code path for displaying errors #9395
    • Fix NAT64 feed fetching on IPv6-only hosts #9372
  • Bug fixes
    • Fix domain-wide Retry-After #9390
    • Fix muting of feeds gone with HTTP 410 #9391
    • Fix infinite redirect loop due to SCRIPT_NAME in PATH_INFO #9282, #9287
    • Restore the automatic reading view after marking articles as read, while preserving explicit filters #9288
    • Fix adaptive reading state after marking articles read #9290
    • Fix regression sharing links #9303
    • Don’t disable anonymous refresh when anonymous feed access is disabled #9354
    • Fix regression with HTTPS proxies due to wrong TLS SNI resolution #9341
    • Better enforce limits for feeds and categories #9357
    • Fix JavaScript error when opening a label menu in sidebar #9377
    • Fix custom favicon with GReader API #9409
  • CLI
    • Add optional feed argument to actualize-user.php #9319
  • UI
  • Extensions
    • Call check_url_before_add hook when previewing a feed #9343
  • I18n
  • Misc.

Thunderbird for iOS: A First Look at the Native iPhone Email App in Development

2 October 2026 at 01:14

The team has been working hard behind the scenes laying a strong foundation for the Thunderbird iOS app. Rather than leveraging existing code, we are building natively from scratch. This fresh start allows us to take everything we’ve learned from Thunderbird Desktop and Android to ensure a fast, reliable, and modern experience on your iPhone right from the start.

Our ultimate goal is seamless cross-device experience. Whether you’re sitting at your desktop computer, checking messages on the go, your workflow should feel effortless and unified.Β 

Right now, we are focused heavily on getting the core foundations right. We are excited about the momentum because having clean architecture today means we can layer on exciting new features much faster in the future.

Below we’ve captured some of our work in progress. Nothing is final, but we wanted to share what we are cooking up so far. If you have feedback, keep reading on. At the bottom of the post we haveΒ  a link to a user research study where we want to hear from you and what you want to see from Thunderbird for iOS.

Hassle-free setup

Adding account user flow with options for email services like Google and Microsoft

We know people are really busy, often doing more than one thing at a time. We’re making login fast, secure, and fully automatic, so whether you’re signing in with a single click or setting up multiple accounts, you can get to your inbox quickly.Β 

Solid reliable connections

Thunderbird inbox

An email app is only as good as its connection. Behind the scenes, we’re building a background sync that maintains a steady connection with your provider that keeps your inbox up to date while respecting your battery life.

Core daily tools

Formatting toolbar (highlighted to show the details)

Your daily email routine should feel effortless. We’re polishing the essentials: a clutter-free, easy-to-read inbox layout paired with a clean, modern editor that lets you format messages smoothly without getting in your way.

Designed for growth

Thunderbird has always belonged to its community. We’re structuring the app with clean code and an experimental feature flag system so it’s easy for community developers to contribute. This means power users will be able to test out new experimental features early, and external contributors can easily help us extend what the app can do.

When can you try it?

Our goal is to have a first version ready for community testing in the next few months.

Building with our community, not just for people, is core to what we are trying to do. To help us decide what to build next after our first release, we’d love your input. If you had to pick the top three things that matter most to your daily email routine, what would they be?

➑ Survey link
Update: the survey has now closed. Thanks to all that responded!

A note to the communityΒ 

Lastly, we know how long many of you have been asking for and waiting for Thunderbird on iOS. Whether you’ve dropped a comment on our forums, tagged us on social media, or simply kept an eye on our progress, thank you for your patience!

Bringing Thunderbird to iPhone and iPad isn’t just about building an app; it’s about doing it right so it serves you reliably for years to come. Today, we want to pop open the hood, share where we are, and work with everyone to design the best possible experience.

The post Thunderbird for iOS: A First Look at the Native iPhone Email App in Development appeared first on The Thunderbird Blog.

❌