LoginSign Up
← Back to all sparks
F

FreshRSS

COLLAB
Velocity5.0

Self-hosted RSS and Atom feed aggregator

freshrss.org ↗

FreshRSS ships two security releases in a day for PHP CVEs and moves Docker to Debian 13.

rss readerself-hostedsecuritydocker
◆Current state
FreshRSS has issued four 1.30.x security releases since the 1.30.0 change that blocked local network access by default. 1.30.3 and 1.30.4, both on Oct 21, patched severe PHP vulnerabilities in the official Docker images: Debian first, now on Debian 13 Trixie, then Alpine. The project points users who want faster patches to its rolling edge channel.
◆Where it's heading
The 1.30 line has become a security maintenance branch, and new features wait for the next major. The team is treating its Docker images as part of the product it must patch, not just the PHP code.
◆Prediction
More 1.30.x point releases are likely as upstream PHP and base-image fixes land; new features probably arrive with 1.31.

◆Recent moves

  1. 7d ago

    FreshRSS 1.30.4: Alpine image patched for PHP CVEs

    1.30.4 brings the PHP CVE fixes to the Alpine Docker image and turns off PHP upload progress tracking. It finishes what 1.30.3 started for the Debian image the same day.

    View source ↗
  2. 8d ago

    FreshRSS 1.30.3: PHP CVE fixes, Debian 13 Docker image

    1.30.3 moves the default Docker image to Debian 13 with a patched PHP 8.4 to fix two severe PHP CVEs, and adds an autofill hook for extensions on auth views. It is the third security release since 1.30.0.

    View source ↗
  3. 9d ago

    1.30.2 closes proxy DNS leak and blocks data: URIs

    The third 1.30.x release continues the hardening that 1.30.0 started: it blocks data: URIs outside images, closes a proxy DNS leak and stops logging Fever API keys. It also fixes PHP 8.5 SQLite deprecations and cuts export memory use, so self-hosters on new PHP versions are covered too.

    View source ↗
  4. 23d ago

    FreshRSS 1.30.1

    A security follow-up to 1.30.0 that patches more attack scenarios, applies Retry-After across a whole domain and correctly mutes feeds that return HTTP 410. It also adds an optional feed argument to actualize-user.php, so operators can refresh a single feed from the CLI.

    View source ↗
  5. 1mo ago

    FreshRSS 1.30.0

    ⚡ SPARK

    FreshRSS 1.30.0 ships a breaking security change — local network access blocked by default — repositioning the project's security posture after a series of CVE fixes in prior releases.

    View source ↗
  6. 5mo ago

    FreshRSS 1.29.1

    A bug-fix release that also accepts plain .txt lists of feed URLs for import, adds a CLI for periodic SQLite export with retention, and shows more feed metadata. It continues the steady growth of operator tooling.

    View source ↗