CommaFeed 7.3.2

• Prevent users from starring/tagging entries that are not theirs and subsequently reading them (GHSA-prfv-88mm-5gpg)

CommaFeed 7.3.1

• Prevent Host header injection attacks on the password recovery endpoint. A new setting
  commafeed.password-recovery-public-base-url has been added to specify the base URL to use in password recovery
  emails (GHSA-hp8h-jqfm-v7x5). This setting is only required when the password recovery feature is enabled, which is not the default.

CommaFeed 7.3.0

• Add support for the Google Reader API for native mobile apps that don't support the Fever API
• The profile menu now works again on mobile when action buttons are at the bottom of the screen
• More SSRF protection regarding IPv6 (GHSA-q5qw-345w-55xg)
• Changed the default value of blockLocalAddresses to make CommaFeed more secure out-of-the-box. See the "Access to
  local address blocked" section of the README if you subscribe to feeds that are only available on your local network.

CommaFeed 7.2.1

• correctly handle favicons hosted at the root of the domain for feeds with non-default ports
• prevent XXS injections in third party apps. The CommaFeed React client was already stripping malicious "javascript:" URLs, they are now filtered during feed parsing and no longer stored in the database/served through the REST API (GHSA-44pq-9929-f8mq)

CommaFeed 7.2.0

• Add support for icons declared in feeds. This is useful for feeds exposed by RSS bridges (#2048)
• Search now also works for starred entries (#2217)
• The error message when subscribing to a feed is now properly displayed again
• Small performance improvements to the feed refresh engine
• Removed the Pocket sharing feature because the Pocket service has been discontinued
• Prevent the image proxy feature to access any URL to avoid SSRF attacks
• Strengthened the SSRF protection by also blocking ULA and CGNAT ranges (GHSA-hgrr-mjfp-gmr6)
• Prevent DDOS attacks by filtering OPML files during imports (GHSA-83jp-rww3-57rr)

CommaFeed 7.1.0

• Display the unread count in the header on mobile, since the tree is hidden by default and the unread count is not visible otherwise (#2055)
• The feed refresh engine is now a little bit more performant (#2089)
• On shutdown, give the feed refresh engine some time to finish refreshing feeds before killing it. This is controlled by the new commafeed.shutdown-timeout setting, which defaults to 2 seconds

CommaFeed 7.0.0

• Replaced the JEXL filter expression for marking feed entries as read automatically with a user-friendly visual query builder. Expressions are now evaluated with Common Expression Language, which is safer than JEXL and sanboxed by default.
• Added a per-feed setting for sending push notifications to ntfy, Gotify or Pushover when new feed entries are discovered (#1610)
• Added a per-feed setting for marking entries as read after a number of days (#2041)
• The default value of commafeed.http-client.block-local-addresses is now false, allowing users to subscribe to feeds only available on their local network. This may be a security risk (SSRF) if your instance is accessible by untrusted users, so you may want to set it to true if you host a public instance of CommaFeed with user registeration enabled.
• When commafeed.http-client.block-local-addresses is enabled, SSRF is now also mitigated by blocking public websites redirecting to local ones.

CommaFeed 6.2.0

• Starred entries are no longer deleted after a certain amount of time, they are now kept indefinitely. The new commafeed.database.cleanup.keep-starred-entries setting can be disabled to restore the previous behavior if you want to keep deleting starred entries during normal entries cleanup (#1581)

CommaFeed 6.1.1

• Fix old starred entries not loading if they were marked as read (#2031)

CommaFeed 6.1.0

• When clicking on the password reset link, a random password is no longer generated automatically. The user is now redirected to a page where they can set their own password (#2023)
• Use browser preferred language instead of English when using CommaFeed for the first time (#2018)
• The profile menu is now closed when scrolling the page (#2019)
• The "disable pull to refresh" feature is now disabled by default (#2030)