• Milestone

This is a security-focussed release for FreshRSS 1.26.x, addressing several CVEs (thanks @Inverle) 🛡

A few highlights ✨:

• Implement JSON string concatenation with & operator
• Support multiple JSON fragments in HTML+XPath+JSON mode (e.g. JSON-LD)
• Multiple security fixes with CVEs
• Bug fixes

Notes ℹ:

• Favicons will be reconstructed automatically when feeds gets refreshed. After that, you may need to refresh your Web browser as well.

This release has been made by @Alkarex, @Frenzie, @hkcomori, @loviuz, @math-GH
and newcomers @dezponia, @glyn, @Inverle, @Machou, @mikropsoft

Full changelog:

• Features
  • Implement JSON string concatenation with & operator #7414
  • Support multiple JSON fragments in HTML+XPath+JSON mode #7369
• Bug fixing
  • Fix escaping of tag search #7468
  • Fix CLI parsing of Boolean flags #7430
  • Fix API for labels with slash #7437
• SimplePie
  • Fix support for feeds with XML preamble + DTD #7515, simplepie#914
  • Merged upstream #7434
    • Upstream fix simplepie#912
• Security
  • Disallow <iframe srcdoc=""> #7494, CVE-2025-32015
  • Disallow <button formaction=""> #7506
  • Improve favicons hash to avoid favicon pollution #7505, CVE-2025-46339
  • Add Content-Security-Policy HTTP headers to favicons #7471, CVE-2025-31136
  • Web scraping forbid security HTTP headers in cURL #7496, CVE-2025-46341
  • Add some HTTP headers Referrer-Policy: same-origin #6303, #7478
  • Use HTTP POST for logout #7489, CVE-2025-31482
  • Make update URL read-only #7477
  • Fix for extensions: Restrict valid paths in ext.php #7479, CVE-2025-31134
  • Fix for extensions: Secure serving of user files #7495
• Extensions
  • Fix file serving for symlinked extensions #7545
  • Catch extension exceptions in override #7475
  • JavaScript: new event to detect context loaded #7452
• Deployment
  • Apache: add check for mod_filter to ensure that AddOutputFilterByType works #7419
• UI
  • Accessibility: Add :focus style to some dropdown menus #7491
  • New size option for the Mark as read button #7314
  • Update bcrypt.js from 2.4.4 to 3.0.2 #7449
  • Various UI and style improvements: #7168, #7526
• I18n
  • Rework credits #7426
  • Improve French #7432
  • Improve Italian #7540
  • Improve Polish #7508
  • Improve Turkish #7442
• Misc.
  • Improve PHP code #7431, #7488, #7534
  • Update dev dependencies #7480, #7482, #7483,
    #7484, #7485, #7486,
    #7487, #7533, #7535,
    #7536, #7537, #7538

QuickBooks Online vs Solopreneur isn’t a close call. Here’s my expert take on the better fit for your business.

Learn how to build a Shopify store from scratch with this beginner-friendly guide covering themes, payments, product listings, and launch tips.

Cover ChatGPT, automation, generative AI, and more with 150+ hours of instruction for just $29.99.

The FrontierMath benchmark from Epoch AI tests generative models on difficult math problems. Find out how OpenAI’s o3 and other AI models performed.

Robust data handling measures can help organizations prevent breaches and protect sensitive information from unauthorized access.

If you don’t use the voice assistant on a macOS, ChromeOS, or Microsoft Windows, you may choose to turn it off following these simple steps from the system settings.

The release later this year is the latest maneuver between China and the U.S. as they try to control the flow of powerful AI chips.

Inference, training, and everyday operations all contribute to the considerable water and power consumption required to run generative AI.

These free LinkedIn Learning courses help professionals upskill for the future. Topics include personal branding, networking, and career growth.

Find the best accounting software for property management to track rent, expenses, and financials. Compare top options for landlords and property managers.

In this comparison between Bitwarden and LastPass, we explore their features, security, ease of use and pricing. Find out which password manager is best for you.

Google and Kairos Power are collaborating to build small modular reactors to provide nuclear power to data centers to give them abundant, clean, and reliable energy.

Learn about how Copilot Studio’s computer use agents bring the system new functionality and more benefits to users.

NVIDIA’s ties to DeepSeek are also being called into question by some US government officials.

US President Donald Trump's tariffs, including a 145% levy on Chinese tech, will disrupt supply chains and raise prices on products like smartphones, computers, and gaming consoles.

“Data centers are today’s gold rush,” Kevin O’Leary stated during his keynote at Data Center World 2025.

The FTC wants Meta to divest Instagram and WhatsApp to create a more level playing field in the social app market.

Microsoft’s model BitNet b1.58 2B4T is available on Hugging Face but doesn’t run on GPU and requires a proprietary framework.