LoginSign Up
← Back to all sparks
F

FreshRSS

COLLAB
Velocity0.0

Self-hosted RSS and Atom feed aggregator

freshrss.org ↗

FreshRSS keeps turning a reader into a queryable archive — and hardening the parts that touch the web.

rss-readerself-hostedsearchcli-automationsecurityapi
◆Current state
Two major releases and their bug-fix follow-ups define this window. 1.28.0 added sorting and filtering by user-modified date with a matching search operator, sorting by article length, an advanced search form, an overview of dates with the most unread articles, and API-level sharing of feed visibility. 1.29.0 layered on sort-order preferences at global, category and feed level, feed-provided icons, and a purge CLI. Security work runs alongside throughout — cURL restricted to HTTP and HTTPS, reauthentication in sudo mode, Content-Security-Policy frame-ancestors, and compliance with HTTP 429 and 503 including Retry-After.
◆Where it's heading
The feature line is consistently about retrieval rather than reading: search operators, sort dimensions, date overviews and per-level preferences all treat the archive as a queryable dataset instead of an inbox to clear. In parallel, the CLI surface keeps growing — purge policies, SQLite export with retention — which points at self-hosters automating maintenance rather than clicking through settings. Security fixes are steady and specific to the fact that a feed reader fetches arbitrary remote content, which is what makes the cURL protocol restriction and CSP work necessary rather than optional. Releases pair a feature drop with a fast bug-fix follow-up every time.
◆Prediction
Given the pattern of a major release followed within weeks by a patch, and the steady expansion of CLI commands, expect the next major to continue extending search and automation surfaces rather than reworking the reading experience.

◆Recent moves

  1. 2mo ago

    1.29.1: plain-text feed import and scheduled SQLite export

    Nominally a bug-fix release for 1.29.0, but it carries the automation thread forward with a CLI for periodic SQLite export with retention, plus plain .txt lists as an import format alongside OPML. Exposing last-received and publication dates continues the shift toward treating feeds as inspectable data.

    View source ↗
  2. 2mo ago

    1.29.0 adds per-level sort preferences and a purge CLI

    Sort order becomes configurable at global, category and feed level rather than one setting for everything — the sorting work from 1.28.0 turned into a preference hierarchy. The purge CLI extends the automation surface, and limiting cURL to HTTP and HTTPS closes off a class of request the fetcher had no reason to make.

    View source ↗
  3. 6mo ago

    1.28.1 fixes regressions from 1.28.0

    The standard fast follow-up after a major release, mostly cleaning up regressions. Logging usernames in Apache access logs for the GReader API and Basic Auth is a small operational win for self-hosters behind a reverse proxy.

    View source ↗
  4. 7mo ago

    1.28.0: userdate search operator, advanced search form, sort by length

    The clearest expression of the archive-as-dataset direction — a search operator for user-modified time, sorting by article length, an advanced search form and an overview of the dates with the most unread articles. Sharing feed visibility through the API also lets third-party clients like Capy Reader expose server-side organisation.

    View source ↗
  5. 10mo ago

    1.27.1: security fixes, CSP frame-ancestors and Docker healthcheck

    Security and reliability work aimed squarely at self-hosted deployments — a CSP frame-ancestors option, a Docker healthcheck, and automatic database recovery that skips broken entries during CLI export and import. The recovery behaviour matters most to the same users relying on the growing CLI surface.

    View source ↗
  6. 11mo ago

    1.27.0 obeys Retry-After and adds sudo-mode reauthentication

    Handling HTTP 429 and 503 with Retry-After makes FreshRSS a better-behaved client against publishers that rate-limit, which protects self-hosters from being blocked outright. The category search operator continues the query work, and sudo-mode reauthentication plus enforced CSP extend the security thread running through this whole window.

    View source ↗