FriRSS 1.4.3

1.4.3 adds encrypted backup and restore, moves FreshRSS server management into Preferences, and clears ten advisories from the image.

Nothing to do on upgrade: no new environment variable, no manual migration.

Encrypted backup and restore

FriRSS can now hand you a single file that rebuilds the whole instance — accounts and their password hashes, the FreshRSS servers you configured, their tokens and the key that decrypts them, preferences, and instance settings. Your articles are not in it: they live in FreshRSS, and always did.

That file is enough to impersonate every account on the instance, so a passphrase is mandatory — 12 characters minimum, AES-256-GCM behind a scrypt key. Lose the passphrase and the file is permanently unusable. There is no recovery path, by design.

Restore it from Preferences → Administration, or from the first-run screen of a brand-new instance — which makes it a migration tool as much as a backup. Either way you see what the file holds before committing to anything, and restoring replaces the instance's contents entirely.

The README now has a Backups section covering this alongside the data directory and the snapshot script, and what distinguishes them.

FreshRSS servers, managed in Preferences

Adding, renaming, setting a default, deleting and switching servers now live on one screen in Preferences → Feeds, reachable in every configuration. The top bar stays a selector; its + and its right-click lead there.

This fixes a real hole: hiding the top bar made server management — and switching itself — unreachable, and renaming, setting a default and deleting simply did not exist in the iOS PWA, for want of a right-click.

The master token is now per server, configured and tested from that server's row without having to switch to it first.

Faster, clearer Preferences

The panel used to rebuild from scratch on every section change. Feeds and Administration paid a full network round trip — blank screen included — on every visit. They no longer do.

Administration's five unrelated groups are legible at a glance. Their headings were the smallest, palest text on the page; a heading quieter than its own content titles nothing.

Security

Alpine packages are now upgraded when the image is built. The base image is rebuilt on its own schedule, so it was shipping openssl 3.5.7-r0 with ten fixable advisories against it; the production stage pulls the patched 3.5.8-r0 from the branch the base already pins — patch level only, no distribution jump.

Fixes

Backup and restore

• Signing back in after a restore works the first time. The restore armed a 1.5 s deferred logout that no unmount cancelled. Since clearing the sessions returns you to the login screen well within that delay, a quick sign-in was destroyed by the stale timer — it took two or three attempts.
• Restoring onto an already-configured instance says exactly that, instead of "The operation failed. Try again." — advice that could not work.
• The restore form is readable on the login screen, where it had been borrowing the Administration panel's light palette: near-black text on near-black.
• The file picker is one control that carries its state, instead of an empty input with the chosen filename detached beside it.
• Checking a backup shows that it is working, and the preview that unfolds below announces itself instead of appearing unnoticed.
• The first-run screen puts the administrator note and the restore link on a readable surface, and states the note as a sentence.

Servers in Preferences

• Escape no longer closes the Preferences panel from under an open form, and focus returns to the button that opened it — without that, a second Escape did nothing.
• A refused rename keeps the form open along with what you typed.
• The server list tells its states apart: a pending load and a failed request were indistinguishable from a read-only legacy connection. The recovery action reads Retry, not Refresh — it reissues the request that failed.
• The active server's row expands when you click its body, and the rename form has a cancel button like the delete flow.

Elsewhere

• Login errors no longer lie. Every failure — rate limit, server error, dropped connection — announced "incorrect credentials", which sent you retyping a password that was right all along. Only an authentication refusal says so now.
• French and Italian use the typographic apostrophe instead of the straight one.
• 25 dead translation keys removed across the nine locales, and two counters given real plural forms — Polish and Ukrainian were receiving a French-shaped user(s) where their grammar asks for four.

Under the hood

docs/FEATURES.md now inventories everything FriRSS does, with a test that fails when a server route, an environment variable or a translation family is missing from it. The 232-settings guard introduced in 1.4.2 walks the panel recursively: it was not descending into nested settings, so it guarded less than it claimed. And a CHANGELOG.md tracks the release history, backfilled to 1.3.0.

---

Docker: ghcr.io/fripix/frirss:1.4.3 · docker.io/fripix/frirss:1.4.3 (amd64 + arm64)