Skip to content

v0.4.4

Choose a tag to compare

View all tags
@justin-stanley justin-stanley released this 05 Oct 03:40
· 19 commits to main since this release
v0.4.4
54373cc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FeatherReader 0.4.4 moves the feed parser to feed-rs 3.0. Entry ids and permalinks stay exactly as they were, RSS bylines now show real names, and a parser crash is contained as a parse failure. It also closes the reserved address ranges the SSRF guard missed.

Full engineering detail is in CHANGELOG.md.

Upgrade notes

  • No schema change and no new settings. Upgrading from 0.4.3 is a deploy, and rolling back to 0.4.3 is a redeploy. Both were rehearsed on a fork of a production volume: 0.4.4 booted with db: ok, and 0.4.3 then booted on the result, also with db: ok.
  • Bylines change on each feed's next poll. RSS items that showed "author", and Atom authors that showed "unknown", get the real name, or no byline when the feed gives only an email address. Entry ids, titles, links, dates and content do not change. A side-by-side run of 2.4 and 3.0 over 27 live feeds (774 entries) found no difference in any of them.
  • A feed whose author field crashes feed-rs 3.0 now fails as a parse error and backs off, until the offending item leaves the feed. The trigger is a multi-byte character directly next to an email address. 2.4 parsed these feeds, and none of the 27 sampled feeds has one.

Changed

  • feed-rs 2.4 → 3.0 (#249):
    • Same ids and links: comments links are no longer picked as an entry's link or used for its id, and generated ids match 2.4's.
    • No more repeats: an item with no guid and no link now gets a stable id, instead of a random one that made it reappear on every poll.
    • Pinned dedup hashes: they use SipHash-1-3 explicitly, so a Rust toolchain upgrade can't change them, and the values already stored are unchanged.
    • More dates parsed: some formats 2.4 rejected are now read. The two-day future bound still applies.
    • Known regression in 3.0 itself, invalid feeds only: unescaped markup inside a title or description keeps only the text before the first tag.

Security

  • The SSRF guard refuses the ranges it missed (#254): 240.0.0.0/4, the IPv4 documentation ranges, fec0::/10, 100::/64 and 2001:db8::/32. It refuses them inside every IPv6 form it already unwraps too.
  • A local docker build no longer sends the app's OAuth signing key or .claude/ to the Docker daemon (#252). Shipped images were never affected.

Dependencies

tokio-rustls 0.26.6 (#248); the sidecar's npm group, including @atproto/api 0.22 (#250); CI action pins (#251).

Assets 2
Loading