2026.10.13

What's Changed

• Security fix (GHSA-6g83-8v98-rq5v): Removed the unauthenticated public route /rss/import_opml/, which let anonymous users import OPML and make the server fetch arbitrary URLs (SSRF). OPML import is now only available through the authenticated admin interface. All self-hosted instances should upgrade.
  • Added regression tests to ensure anonymous OPML import is rejected.

Full Changelog: 2026.9.16...2026.10.13