Update ghcr.io/miniflux/miniflux Docker tag to v2.2.17 #651

2026-02-14T03:16:46Z

renovate commented

2026-02-14 03:16:46 +00:00

This PR contains the following updates:

Package	Update	Change
ghcr.io/miniflux/miniflux (source)	patch	`2.2.16` → `2.2.17`

Release Notes

miniflux/v2 (ghcr.io/miniflux/miniflux)

`v2.2.17`: Miniflux 2.2.17

Compare Source

Security

Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49).
Improve HTML sanitizer by switching from the tokenizer to the golang.org/x/net/html parser to better match browser behavior and reduce the risk of injection issues.
Enforce blocked resource checks on srcset URLs.
Improve blocked resource handling (including updates to blocked URL substrings).
Add validation for TRUSTED_REVERSE_PROXY_NETWORKS configuration to prevent silent misconfiguration.
Prevent possible deadlock when cleaning removed entries.
Ensure HTTP response bodies are always closed, even on client errors.

Improvements

Rewrite srcset parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly.
Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling).
Handle deeply nested HTML more robustly in the sanitizer.
Add scraper and rewrite rules for:
- bleepingcomputer.com
- vnexpress.net
Improve JSON Feed support:
- Support malformed feeds with author objects in the authors array.
- Avoid panic when parsing null feeds.
- Improve title fallback logic.
- Include external_url in JSON entry hash fallback.
Ignore WordPress wp-json API endpoint during JSON feed discovery.
Add unread status filter to search results.
Improve timezone handling internals and performance.
Improve API payload structures and Godoc comments.
Improve JavaScript code readability and keyboard shortcut handling.
Restore cmd/ctrl/shift-click behavior on main navigation.
Fix Safari PWA behavior for the v shortcut to open links in the main browser.

Bug Fixes

Do not keep old enclosures when an updated entry has none.
Handle sql.ErrNoRows properly in IconByFeedID.
Change FindRemoteIP to fall back to 127.0.0.1.

Configuration Changes

Removed FILTER_ENTRY_MAX_AGE_DAYS.
This option can be replaced with a filter rule such as max-age:<duration>.
Global environment variables should be reserved for process-level configuration.

Dependencies

Update github.com/lib/pq to 1.11.2.
Update:
- golang.org/x/net to 0.50.0
- golang.org/x/crypto to 0.48.0
- golang.org/x/image to 0.36.0
- golang.org/x/oauth2 to 0.35.0
- golang.org/x/term to 0.40.0
Update Debian packager Docker image to Trixie.

As always, thank you to all contributors who helped improve Miniflux in this release.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/miniflux/miniflux](https://miniflux.app) ([source](https://github.com/miniflux/v2)) | patch | `2.2.16` → `2.2.17` | --- ### Release Notes <details> <summary>miniflux/v2 (ghcr.io/miniflux/miniflux)</summary> ### [`v2.2.17`](https://github.com/miniflux/v2/releases/tag/2.2.17): Miniflux 2.2.17 [Compare Source](https://github.com/miniflux/v2/compare/2.2.16...2.2.17) ##### Security - Do not expose the Miniflux version on unauthenticated endpoints (deprecated since version 2.0.49). - Improve HTML sanitizer by switching from the tokenizer to the `golang.org/x/net/html` parser to better match browser behavior and reduce the risk of injection issues. - Enforce blocked resource checks on `srcset` URLs. - Improve blocked resource handling (including updates to blocked URL substrings). - Add validation for `TRUSTED_REVERSE_PROXY_NETWORKS` configuration to prevent silent misconfiguration. - Prevent possible deadlock when cleaning removed entries. - Ensure HTTP response bodies are always closed, even on client errors. ##### Improvements - Rewrite `srcset` parser to follow HTML specifications (WebKit-style parsing) and handle edge cases more correctly. - Improve sanitizer performance (various optimizations, including reduced allocations and better attribute handling). - Handle deeply nested HTML more robustly in the sanitizer. - Add scraper and rewrite rules for: - `bleepingcomputer.com` - `vnexpress.net` - Improve JSON Feed support: - Support malformed feeds with `author` objects in the `authors` array. - Avoid panic when parsing `null` feeds. - Improve title fallback logic. - Include `external_url` in JSON entry hash fallback. - Ignore WordPress `wp-json` API endpoint during JSON feed discovery. - Add unread status filter to search results. - Improve timezone handling internals and performance. - Improve API payload structures and Godoc comments. - Improve JavaScript code readability and keyboard shortcut handling. - Restore cmd/ctrl/shift-click behavior on main navigation. - Fix Safari PWA behavior for the `v` shortcut to open links in the main browser. ##### Bug Fixes - Do not keep old enclosures when an updated entry has none. - Handle `sql.ErrNoRows` properly in `IconByFeedID`. - Change `FindRemoteIP` to fall back to `127.0.0.1`. ##### Configuration Changes - Removed `FILTER_ENTRY_MAX_AGE_DAYS`. This option can be replaced with a filter rule such as `max-age:<duration>`. Global environment variables should be reserved for process-level configuration. ##### Dependencies - Update `github.com/lib/pq` to 1.11.2. - Update: - `golang.org/x/net` to 0.50.0 - `golang.org/x/crypto` to 0.48.0 - `golang.org/x/image` to 0.36.0 - `golang.org/x/oauth2` to 0.35.0 - `golang.org/x/term` to 0.40.0 - Update Debian packager Docker image to Trixie. *** As always, thank you to all contributors who helped improve Miniflux in this release. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-02-14 03:16:47 +00:00

Update ghcr.io/miniflux/miniflux Docker tag to v2.2.17 f026a1321b

AverageMarcus merged commit 8956c5140c into master

2026-02-15 09:18:45 +00:00

AverageMarcus deleted branch renovate/ghcr.io-miniflux-miniflux-2.x

2026-02-15 09:18:46 +00:00

AverageMarcus referenced this issue from a commit

2026-02-15 09:18:46 +00:00

Merge pull request 'Update ghcr.io/miniflux/miniflux Docker tag to v2.2.17' (#651) from renovate/ghcr.io-miniflux-miniflux-2.x into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#651