v1.7.0

AI summaries and translations arrive in FriRSS — optional, off until an administrator turns them on, with your own providers (Claude, OpenAI, a local Ollama…). Plus a round of reading, keyboard, accessibility and security fixes. Nothing to do when upgrading.

✨ AI summaries and translations (#22)

• Summaries in a panel above the article: one click, the s key, the palette, or automatically when an article opens. Length adjustable; Summarise with… picks another provider; Regenerate asks again.
• Translations of the whole article — title and body, in batches, into any of 28 languages — and of its summary. Show original switches back without a new request; Translate into… and Translate with… choose the language and the provider; the t key translates.
• Your providers: Anthropic (Claude) or any OpenAI-compatible endpoint — OpenAI, Ollama, LM Studio, OpenRouter. List models fills in the model name. Keys are encrypted at rest and never reach the browser.
• Admin controls: which keys are shared with users, whether users may bring their own keys, and a daily cap per user. Changing a provider's address or type erases its stored keys, so a key never goes to another host.
• Fallback: if a provider is down, the next one in the list takes over and the panel says so; an unusable answer offers Retry with… instead of switching silently to a possibly paid provider.
• Per feed and per category: summarise on open, translate on open, translate the summary, keep the panel shown, and which AI to use — one row per category and per feed, each switch off, on or inherited, one click to the next state.
• Cached and shared: reopening an article on any device costs nothing; two tabs asking for the same summary make one request; a request made while the full article is still loading waits for it instead of summarising the teaser.

🐛 Fixes

• Links in an article open in a new tab. In the installed app, a link used to replace FriRSS with no way back. (#24)
• ISO-8859-1 pages no longer turn into "�" in Full article: the charset is read from the header, then the page.
• Code blocks and pictures were broken since 1.4.0 by the per-block text direction; it is now applied on the sanitised tree.
• Shortcuts no longer steal browser keys (⌘R / Ctrl+R reloads again), stay quiet behind a dialog, inside a menu or a focused list, and the shortcut editor refuses reserved and already-used keys.
• New default shortcuts never take a key you already use: if s or t was assigned elsewhere, Summarise or Translate arrives with no key, to set.
• Automatic full-text extraction no longer skips an article when you move on while one is loading, and coming back shows its extract again.
• A failed sign-in no longer overwrites your synced preferences with the browser's defaults.
• The feed drawer stays closed on load on phones and tablets, and closing it no longer hides the desktop sidebar when you come back to a large screen.
• AI stays available when its configuration could not be loaded at startup: it is fetched again when the network or the app comes back.
• Admin editor: a double click on Save no longer creates two providers, a slow save keeps your edits, a pasted key is trimmed, and the daily cap is kept when you close Preferences with Escape.
• Screen readers read the unread counts with their meaning ("3,673 unread", "12 articles") instead of a number glued to the name.
• Spanish now uses one form of address throughout.

🔒 Security

• A crafted request could block the server for about 17 seconds: tag stripping used a quadratic pattern on input made of many <. It is linear now, on the server and in the browser.
• Dependencies: DOMPurify 3.4.17, follow-redirects 1.16.1. The image's Alpine packages are refreshed at least daily, so nginx is 1.30.6.
• Missing files answer 404 (/.env, /.git/HEAD, *.map) instead of the app with a 200; /api errors are JSON.

🧹 Under the hood

• index.html is served no-cache, so a new deployment is picked up on the next load.
• The container's nginx allows 120 s on /api/ for long AI requests.
• A translation batch whose answer was lost (proxy cut, phone in the background) is first asked again whole — free, the server kept working — before being split in two.
• Struck-through text travels to the model as <del>: </s> ends generation for Llama and Qwen.
• Development tooling updated (vitest 4).

⬆️ Upgrading

• Nothing required. AI is off until you turn it on in Preferences → AI.
• If you use AI translation behind a reverse proxy, allow at least 120 s on FriRSS (two lines in the README); with a local Ollama, start it with OLLAMA_CONTEXT_LENGTH=16384.
• Redis is strongly recommended: lists, extracts and AI results are cached once for the whole instance. Without it everything works, but the AI cache lives in SQLite, capped at 10,000 entries.

Full details in the CHANGELOG. Image: ghcr.io/fripix/frirss:1.7.0 (also :latest, and on Docker Hub).