This repository has been archived by the owner on Oct 24, 2023. It is now read-only.
fix(container): update image ghcr.io/miniflux/miniflux to v2.0.43 #1330
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.0.42
->2.0.43
⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
Release Notes
miniflux/v2
v2.0.43
Compare Source
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592)
Creating an RSS feed item with the inline description containing an
<img>
tagwith a
srcset
attribute pointing to an invalid URL likehttp:a<script>alert(1)</script>
, we can coerce the proxy handler into an errorcondition where the invalid URL is returned unescaped and in full.
This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image.
Use
r.RemoteAddr
to check/metrics
endpoint network access (CVE-2023-27591)HTTP headers like
X-Forwarded-For
orX-Real-Ip
can be easily spoofed. Assuch, it cannot be used to test if the client IP is allowed.
The recommendation is to use HTTP Basic authentication to protect the
metrics endpoint, or run Miniflux behind a trusted reverse-proxy.
Add HTTP Basic authentication for
/metrics
endpointAdd proxy support for several media types
Parse feed categories from RSS, Atom and JSON feeds
Ignore empty link when discovering feeds
Disable CGO explicitly to make sure the binary is statically linked
Add CSS classes to differentiate between category/feed/entry view and icons
Add rewrite and scraper rules for
blog.cloudflare.com
Add
color-scheme
to themesAdd new keyboard shortcut to toggle open/close entry attachments section
Sanitizer: allow
id
attribute in<sup>
elementAdd Indonesian Language
Update translations
Update Docker Compose examples:
depends_on
version
elementUpdate scraping rules for
ilpost.it
Bump
github.com/PuerkitoBio/goquery
from1.8.0
to1.8.1
Bump
github.com/tdewolff/minify/v2
from2.12.4
to2.12.5
Bump
github.com/yuin/goldmark
from1.5.3
to1.5.4
Bump
golang.org/x/*
dependenciesConfiguration
📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.