docs(changelog): update release notes for version 2.2.10

This change implements the ability to specify multiple listen addresses.
This allows the application to listen on different interfaces or ports simultaneously,
or a combination of IP addresses and Unix sockets.

Closes #3343

.devcontainer/docker-compose.yml

@@ -1,7 +1,7 @@
 version: '3.8'
 services:
   app:
-    image: mcr.microsoft.com/devcontainers/go
+    image: mcr.microsoft.com/devcontainers/go:1.23
     volumes:
       - ..:/workspace:cached
     command: sleep infinity
@@ -24,7 +24,7 @@ services:
     ports:
       - 5432:5432
   apprise:
-    image: caronc/apprise:latest
+    image: caronc/apprise:1.0
     restart: unless-stopped
     hostname: apprise
 volumes:

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,10 +0,0 @@
----
-name: Bug report
-about: Create a bug report
-title: ''
-labels: bug, triage needed
-assignees: ''
-
----
-
-

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,105 @@
+name: "Bug Report"
+description: "Report a bug or unexpected behavior"
+title: "[Bug]: "
+type: "Bug"
+labels: ["triage needed"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug! Please provide detailed information to help us reproduce and fix the issue.
+
+  - type: input
+    id: summary
+    attributes:
+      label: "Bug Summary"
+      description: "Briefly describe the bug."
+      placeholder: "e.g., Error when saving a new entry"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Description"
+      description: "A clear and concise description of the bug."
+      placeholder: "e.g., When I click 'Save', I get a 500 error."
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps_to_reproduce
+    attributes:
+      label: "Steps to Reproduce"
+      description: "Steps to reproduce the behavior."
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_behavior
+    attributes:
+      label: "Expected Behavior"
+      description: "What should happen instead?"
+      placeholder: "e.g., The form should be saved successfully."
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual_behavior
+    attributes:
+      label: "Actual Behavior"
+      description: "What actually happens?"
+      placeholder: "e.g., A 500 error is returned with no useful error message."
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: "Version"
+      description: "Which version of Miniflux are you using?"
+      placeholder: "e.g., 2.2.6"
+    validations:
+      required: true
+
+  - type: input
+    id: browser
+    attributes:
+      label: "Browser"
+      description: "If applicable, which browser are you using? Please provide the version."
+      placeholder: "e.g., Chrome, Firefox, Safari"
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: "Relevant Logs or Error Output"
+      description: "Paste any relevant logs or error messages (if applicable)."
+      render: shell
+      placeholder: "e.g., Stack trace, log files, browser console logs, or console output"
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: "Additional Context"
+      description: "Add any other context about the problem here."
+      placeholder: "e.g., Screenshots, video recordings, or related issues"
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: agreement
+    attributes:
+      label: "Checklist"
+      description: "Please confirm the following:"
+      options:
+        - label: "I have searched existing issues to ensure this bug hasn't been reported before."
+          required: true

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,81 @@
+name: "Documentation Issue"
+description: "Report issues or suggest improvements for the documentation"
+title: "[Docs]: "
+type: "Documentation"
+labels: ["triage needed"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve the Miniflux documentation! Clear and accurate documentation helps everyone.
+
+  - type: dropdown
+    id: issue_type
+    attributes:
+      label: "Documentation Issue Type"
+      description: "What kind of documentation issue are you reporting?"
+      options:
+        - "Missing Information"
+        - "Incorrect Information"
+        - "Outdated Information"
+        - "Unclear Explanation"
+        - "Formatting/Structural Issue"
+        - "Typo/Grammar Error"
+        - "Documentation Request"
+        - "Other"
+    validations:
+      required: true
+
+  - type: input
+    id: summary
+    attributes:
+      label: "Summary"
+      description: "Briefly describe the documentation issue."
+      placeholder: "e.g., The API authentication section is outdated"
+    validations:
+      required: true
+
+  - type: input
+    id: location
+    attributes:
+      label: "Location"
+      description: "Where is the documentation you're referring to? Provide URLs, file paths, or section names."
+      placeholder: "e.g., README.md, docs/api.md, Installation section of the website"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: "Detailed Description"
+      description: "Provide a detailed description of the issue or improvement."
+      placeholder: "e.g., The API authentication section doesn't mention the new token-based authentication method introduced in version 2.0.5."
+    validations:
+      required: true
+
+  - type: textarea
+    id: current_content
+    attributes:
+      label: "Current Content (if applicable)"
+      description: "What does the current documentation say?"
+      placeholder: "Paste the current documentation text here."
+    validations:
+      required: false
+
+  - type: textarea
+    id: suggested_content
+    attributes:
+      label: "Suggested Changes"
+      description: "If you have specific suggestions for how to improve the documentation, please provide them here."
+      placeholder: "e.g., Add a new section about token-based authentication with these details..."
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: "Version"
+      description: "Which version of Miniflux does this documentation issue relate to?"
+      placeholder: "e.g., 2.2.6, or 'all versions'"
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,10 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: feature request
-assignees: ''
-
----
-
-- [ ] I have read this document: https://miniflux.app/opinionated.html#feature-request

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,67 @@
+name: "Feature Request"
+description: "Suggest an idea or improvement for the project"
+title: "[Feature]: "
+type: "Feature"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to suggest a feature! Please provide detailed information to help us understand and evaluate your idea.
+
+  - type: input
+    id: summary
+    attributes:
+      label: "Feature Summary"
+      description: "Briefly describe the feature or enhancement."
+      placeholder: "e.g., Add dark mode support"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: "What problem does this feature solve?"
+      description: "Explain the problem or limitation this feature would address."
+      placeholder: "e.g., It's difficult to use the app in low-light environments."
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: "Proposed Solution"
+      description: "Describe how you think this feature should work."
+      placeholder: "e.g., Add a toggle in settings to switch between light and dark mode."
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: "Alternatives Considered"
+      description: "Have you considered other solutions or workarounds?"
+      placeholder: "e.g., Using browser extensions to force dark mode."
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: "Additional Context"
+      description: "Add any other context, screenshots, or examples to explain your request."
+      placeholder: "e.g., A screenshot of a similar feature in another project."
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: agreement
+    attributes:
+      label: "Checklist"
+      description: "Please confirm the following:"
+      options:
+        - label: "I have searched existing issues to ensure this feature hasn't been requested before."
+          required: true
+        - label: "I understand that feature requests are not guaranteed to be implemented."
+          required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/ISSUE_TEMPLATE/feed-problems.md

@@ -1,10 +0,0 @@
----
-name: Feed Problems
-about: Problems with a feed or a website
-title: ''
-labels: feed problems, triage needed
-assignees: ''
-
----
-
-

.github/ISSUE_TEMPLATE/feed_issue.yml

@@ -0,0 +1,84 @@
+name: "Feed/Website Issue"
+description: "Report problems with a specific feed or website"
+title: "[Feed Issue]: "
+type: "Feed Issue"
+labels: ["triage needed"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting an issue with a feed or website! Please provide detailed information to help us diagnose and resolve the problem.
+
+  - type: input
+    id: feed_url
+    attributes:
+      label: "Feed URL"
+      description: "Provide the URL of the feed that is not working correctly."
+      placeholder: "e.g., https://example.com/feed.xml"
+    validations:
+      required: true
+
+  - type: input
+    id: website_url
+    attributes:
+      label: "Website URL"
+      description: "Provide the URL of the website."
+      placeholder: "e.g., https://example.com"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem_description
+    attributes:
+      label: "Problem Description"
+      description: "Describe the issue you are experiencing with this feed."
+      placeholder: |
+        e.g.,
+        - The feed URL returns a 403 error.
+        - The content is malformed.
+        - Images are not loading in the web ui.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_behavior
+    attributes:
+      label: "Expected Behavior"
+      description: "Describe what you expect to happen."
+      placeholder: "e.g., The feed should show the images correctly."
+    validations:
+      required: true
+
+  - type: textarea
+    id: error_logs
+    attributes:
+      label: "Relevant Logs or Error Output"
+      description: "Paste any relevant logs or error messages, if available."
+      render: shell
+      placeholder: "e.g., HTTP error codes, invalid XML warnings, etc."
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: "Additional Context"
+      description: "Add any other context, screenshots, or related information to help us troubleshoot."
+      placeholder: "e.g., Is this a recurring problem? Did the feed work before?"
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: troubleshooting
+    attributes:
+      label: "Troubleshooting Steps"
+      description: "Please confirm that you have tried the following:"
+      options:
+        - label: "I have checked if the feed URL is correct and accessible in a web browser."
+          required: true
+        - label: "I have checked if the feed URL is correct and accessible with `curl`."
+          required: true
+        - label: "I have verified that the feed is valid using an RSS/Atom validator."
+          required: false
+        - label: "I have searched for existing issues to avoid duplicates."
+          required: true

.github/ISSUE_TEMPLATE/improvement.md

@@ -1,10 +0,0 @@
----
-name: Improvement
-about: Do you have an idea to improve an existing feature?
-title: ''
-labels: improvements
-assignees: ''
-
----
-
-

.github/ISSUE_TEMPLATE/proposal.yml

@@ -0,0 +1,88 @@
+name: "Proposal / RFC"
+description: "Propose a significant change, or architectural decision"
+title: "[Proposal]: "
+type: "Proposal"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to submit a proposal! Please provide detailed information to ensure a productive discussion.
+
+  - type: input
+    id: summary
+    attributes:
+      label: "Proposal Summary"
+      description: "A brief summary of the proposed change or idea."
+      placeholder: "e.g., Refactor database schema for performance optimization"
+    validations:
+      required: true
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: "Motivation and Context"
+      description: "Explain the problem this proposal addresses. Why is it necessary? What are the current limitations or pain points?"
+      placeholder: |
+        e.g.,
+        - The current database schema causes performance bottlenecks when querying large datasets.
+        - Adding this feature will improve scalability and reliability for large-scale use cases.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed_solution
+    attributes:
+      label: "Proposed Solution"
+      description: "Describe the proposed solution or approach. Include technical details, diagrams, and examples where possible."
+      placeholder: |
+        e.g.,
+        - Redesign the schema to normalize tables and introduce indexing.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: "Alternatives Considered"
+      description: "List any alternative approaches that were considered and explain why they were rejected."
+      placeholder: |
+        e.g.,
+        - Use Redis for caching, but it adds operational complexity.
+        - Stick with the current schema and optimize queries, but this has limited impact on performance.
+    validations:
+      required: false
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: "Impact and Risks"
+      description: "Describe the potential impact of this change. Highlight possible risks and backward compatibility concerns."
+      placeholder: |
+        e.g.,
+        - May require data migration with downtime.
+        - Could introduce breaking changes in API responses.
+        - Affects core functionality, requiring extensive testing.
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: "Additional Context or References"
+      description: "Add any relevant context, links to related discussions, RFCs, or design documents."
+      placeholder: "e.g., Links to research, GitHub issues, or similar projects"
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: agreement
+    attributes:
+      label: "Checklist"
+      description: "Please confirm the following:"
+      options:
+        - label: "I have reviewed existing proposals to ensure this change hasn't been proposed before."
+          required: true
+        - label: "I agree to provide follow-up updates and maintain discussion on this proposal."
+          required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/dependabot.yml

@@ -4,52 +4,28 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"
 
   - package-ecosystem: "docker"
     directory: "/packaging/docker/alpine"
     schedule:
       interval: "weekly"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"
 
   - package-ecosystem: "docker"
     directory: "/packaging/docker/distroless"
     schedule:
       interval: "weekly"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"
 
   - package-ecosystem: "docker"
     directory: "packaging/debian"
     schedule:
       interval: "weekly"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"
 
   - package-ecosystem: "docker"
     directory: "packaging/rpm"
     schedule:
       interval: "weekly"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    reviewers:
-      - "fguillot"
-    assignees:
-      - "fguillot"

.github/pull_request_template.md

@@ -1,4 +1,7 @@
-Do you follow the guidelines?
+Have you followed these guidelines?
 
 - [ ] I have tested my changes
-- [ ] I read this document: https://miniflux.app/faq.html#pull-request
+- [ ] There are no breaking changes
+- [ ] I have thoroughly tested my changes and verified there are no regressions
+- [ ] My commit messages follow the [Conventional Commits specification](https://www.conventionalcommits.org/)
+- [ ] I have read and understood the [contribution guidelines](https://github.com/miniflux/v2/blob/main/CONTRIBUTING.md)

.github/workflows/build_binaries.yml

@@ -9,16 +9,19 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
       - name: Set up Golang
         uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
-      - name: Checkout
-        uses: actions/checkout@v4
+          go-version: "1.24.x"
+          check-latest: true
       - name: Compile binaries
+        env:
+          CGO_ENABLED: 0
         run: make build
       - name: Upload binaries
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: binaries
           path: miniflux-*

.github/workflows/codeql-analysis.yml

@@ -5,9 +5,17 @@ permissions: read-all
 on:
   push:
     branches: [ main ]
+    paths:
+      - '**.js'
+      - '**.go'
+      - '!**_test.go'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ main ]
+    paths:
+      - '**.js'
+      - '**.go'
+      - '!**_test.go'
   schedule:
     - cron: '45 22 * * 3'
 
@@ -22,18 +30,20 @@ jobs:
 
     strategy:
       fail-fast: false
-      matrix:
-        language: [ 'go', 'javascript' ]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
 
+    - uses: actions/setup-go@v5
+      with:
+        go-version: "1.24.x"
+
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/debian_packages.yml

@@ -1,14 +1,19 @@
 name: Debian Packages
 permissions: read-all
 on:
+  workflow_dispatch:
   push:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
+  schedule:
+    - cron: '0 0 * * 1,4' # Runs at 00:00 UTC on Monday and Thursday
   pull_request:
     branches: [ main ]
+    paths:
+      - 'packaging/debian/**' # Only run on changes to the debian packaging files
 jobs:
   test-packages:
-    if: github.event.pull_request
+    if: github.event_name == 'schedule' || github.event_name == 'pull_request'
     name: Test Packages
     runs-on: ubuntu-latest
     steps:
@@ -28,8 +33,34 @@ jobs:
       run: make debian-packages
     - name: List generated files
       run: ls -l *.deb
+  build-packages-manually:
+    if: github.event_name == 'workflow_dispatch'
+    name: Build Packages Manually
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+          fetch-depth: 0
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      id: buildx
+      with:
+          install: true
+    - name: Available Docker Platforms
+      run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Build Debian Packages
+      run: make debian-packages
+    - name: Upload package
+      uses: actions/upload-artifact@v4
+      with:
+        name: packages
+        path: "*.deb"
+        if-no-files-found: error
+        retention-days: 3
   publish-packages:
-    if: ${{ ! github.event.pull_request }}
+    if: github.event_name == 'push'
     name: Publish Packages
     runs-on: ubuntu-latest
     steps:

.github/workflows/docker.yml

@@ -7,36 +7,11 @@ on:
       - '[0-9]+.[0-9]+.[0-9]+'
   pull_request:
     branches: [ main ]
+    paths:
+      - 'packaging/docker/**'
 jobs:
-  test-docker-images:
-    if: github.event.pull_request
-    name: Test Images
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Build Alpine image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./packaging/docker/alpine/Dockerfile
-          push: false
-          tags: ${{ github.repository_owner }}/miniflux:alpine-dev
-      - name: Test Alpine Docker image
-        run: docker run --rm ${{ github.repository_owner }}/miniflux:alpine-dev miniflux -i
-      - name: Build Distroless image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./packaging/docker/distroless/Dockerfile
-          push: false
-          tags: ${{ github.repository_owner }}/miniflux:distroless-dev
-      - name: Test Distroless Docker image
-        run: docker run --rm ${{ github.repository_owner }}/miniflux:distroless-dev miniflux -i
-
-  publish-docker-images:
-    if: ${{ ! github.event.pull_request }}
-    name: Publish Images
+  docker-images:
+    name: Docker Images
     permissions:
       packages: write
     runs-on: ubuntu-latest
@@ -46,33 +21,33 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Generate Alpine Docker tag
-        id: docker_alpine_tag
-        run: |
-          DOCKER_IMAGE=${{ github.repository_owner }}/miniflux
-          DOCKER_VERSION=dev
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-          DOCKER_VERSION=nightly
-          TAGS="docker.io/${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION},quay.io/${DOCKER_IMAGE}:${DOCKER_VERSION}"
-          elif [[ $GITHUB_REF == refs/tags/* ]]; then
-          DOCKER_VERSION=${GITHUB_REF#refs/tags/}
-          TAGS="docker.io/${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION},quay.io/${DOCKER_IMAGE}:${DOCKER_VERSION},docker.io/${DOCKER_IMAGE}:latest,ghcr.io/${DOCKER_IMAGE}:latest,quay.io/${DOCKER_IMAGE}:latest"
-          fi
-          echo ::set-output name=tags::${TAGS}
+      - name: Generate Alpine Docker tags
+        id: docker_alpine_tags
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            docker.io/${{ github.repository_owner }}/miniflux
+            ghcr.io/${{ github.repository_owner }}/miniflux
+            quay.io/${{ github.repository_owner }}/miniflux
+          tags: |
+            type=ref,event=pr
+            type=schedule,pattern=nightly
+            type=semver,pattern={{raw}}
 
-      - name: Generate Distroless Docker tag
-        id: docker_distroless_tag
-        run: |
-          DOCKER_IMAGE=${{ github.repository_owner }}/miniflux
-          DOCKER_VERSION=dev-distroless
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-          DOCKER_VERSION=nightly-distroless
-          TAGS="docker.io/${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION},quay.io/${DOCKER_IMAGE}:${DOCKER_VERSION}"
-          elif [[ $GITHUB_REF == refs/tags/* ]]; then
-          DOCKER_VERSION=${GITHUB_REF#refs/tags/}-distroless
-          TAGS="docker.io/${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION},quay.io/${DOCKER_IMAGE}:${DOCKER_VERSION},docker.io/${DOCKER_IMAGE}:latest-distroless,ghcr.io/${DOCKER_IMAGE}:latest-distroless,quay.io/${DOCKER_IMAGE}:latest-distroless"
-          fi
-          echo ::set-output name=tags::${TAGS}
+      - name: Generate Distroless Docker tags
+        id: docker_distroless_tags
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            docker.io/${{ github.repository_owner }}/miniflux
+            ghcr.io/${{ github.repository_owner }}/miniflux
+            quay.io/${{ github.repository_owner }}/miniflux
+          tags: |
+            type=ref,event=pr
+            type=schedule,pattern=nightly
+            type=semver,pattern={{raw}}
+          flavor: |
+            suffix=-distroless,onlatest=true
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -81,12 +56,14 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
+        if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
+        if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -94,6 +71,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Quay Container Registry
+        if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: quay.io
@@ -101,19 +79,21 @@ jobs:
           password: ${{ secrets.QUAY_TOKEN }}
 
       - name: Build and Push Alpine images
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
+        if: ${{ vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         with:
           context: .
           file: ./packaging/docker/alpine/Dockerfile
           platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
-          push: true
-          tags: ${{ steps.docker_alpine_tag.outputs.tags }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_alpine_tags.outputs.tags }}
 
       - name: Build and Push Distroless images
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
+        if: ${{ vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         with:
           context: .
           file: ./packaging/docker/distroless/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.docker_distroless_tag.outputs.tags }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_distroless_tags.outputs.tags }}

.github/workflows/linters.yml

@@ -13,20 +13,42 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-    - name: Install jshint
+    - name: Install linters
       run: |
-        sudo npm install -g jshint@2.13.3
+        sudo npm install -g jshint@2.13.6 eslint@8.57.0
     - name: Run jshint
-      run: jshint ui/static/js/*.js
+      run: jshint internal/ui/static/js/*.js
+    - name: Run ESLint
+      run: eslint internal/ui/static/js/*.js
 
   golangci:
-    name: Golang Linter
+    name: Golang Linters
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
-      - uses: golangci/golangci-lint-action@v3
+          go-version: "1.24.x"
+      - uses: golangci/golangci-lint-action@v8
         with:
-          args: --timeout 10m --skip-dirs tests --disable errcheck --enable sqlclosecheck --enable misspell --enable gofmt --enable goimports --enable whitespace
+          args: >
+            --timeout 10m
+            --disable errcheck
+            --enable sqlclosecheck,misspell,whitespace,gocritic
+      - name: Run gofmt linter
+        run: gofmt -d -e .
+
+  commitlint:
+    if: github.event_name == 'pull_request'
+    name: Commit Linter
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Validate PR commits
+        run: python3 .github/workflows/scripts/commit-checker.py --base ${{ github.event.pull_request.base.sha }} --head ${{ github.event.pull_request.head.sha }}

.github/workflows/rpm_packages.yml

@@ -1,14 +1,19 @@
 name: RPM Packages
 permissions: read-all
 on:
+  workflow_dispatch:
   push:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
+  schedule:
+    - cron: '0 0 * * 1,4' # Runs at 00:00 UTC on Monday and Thursday
   pull_request:
     branches: [ main ]
+    paths:
+      - 'packaging/rpm/**' # Only run on changes to the rpm packaging files
 jobs:
   test-package:
-    if: github.event.pull_request
+    if: github.event_name == 'schedule' || github.event_name == 'pull_request'
     name: Test Packages
     runs-on: ubuntu-latest
     steps:
@@ -19,8 +24,25 @@ jobs:
       run: make rpm
     - name: List generated files
       run: ls -l *.rpm
+  build-package-manually:
+    if: github.event_name == 'workflow_dispatch'
+    name: Build Packages Manually
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+          fetch-depth: 0
+    - name: Build RPM Package
+      run: make rpm
+    - name: Upload package
+      uses: actions/upload-artifact@v4
+      with:
+        name: packages
+        path: "*.rpm"
+        if-no-files-found: error
+        retention-days: 3
   publish-package:
-    if: ${{ ! github.event.pull_request }}
+    if: github.event_name == 'push'
     name: Publish Packages
     runs-on: ubuntu-latest
     steps:

.github/workflows/scripts/commit-checker.py

@@ -0,0 +1,93 @@
+import subprocess
+import re
+import sys
+import argparse
+from typing import Match
+
+# Conventional commit pattern
+CONVENTIONAL_COMMIT_PATTERN: str = r"^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9-]+\))?!?: .{1,100}"
+
+
+def get_commit_message(commit_hash: str) -> str:
+    """Get the commit message for a given commit hash."""
+    try:
+        result: subprocess.CompletedProcess = subprocess.run(
+            ["git", "show", "-s", "--format=%B", commit_hash],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return result.stdout.strip()
+    except subprocess.CalledProcessError as e:
+        print(f"Error retrieving commit message: {e}")
+        sys.exit(1)
+
+
+def check_commit_message(
+    message: str, pattern: str = CONVENTIONAL_COMMIT_PATTERN
+) -> bool:
+    """Check if commit message follows conventional commit format."""
+    first_line: str = message.split("\n")[0]
+    match: Match[str] | None = re.match(pattern, first_line)
+    return bool(match)
+
+
+def check_commit_range(base_ref: str, head_ref: str) -> list[dict[str, str]]:
+    """Check all commits in a range for compliance."""
+    try:
+        result: subprocess.CompletedProcess = subprocess.run(
+            ["git", "log", "--format=%H", f"{base_ref}..{head_ref}"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        commit_hashes: list[str] = result.stdout.strip().split("\n")
+
+        # Filter out empty lines
+        commit_hashes = [hash for hash in commit_hashes if hash]
+
+        non_compliant: list[dict[str, str]] = []
+        for commit_hash in commit_hashes:
+            message: str = get_commit_message(commit_hash)
+            if not check_commit_message(message):
+                non_compliant.append(
+                    {"hash": commit_hash, "message": message.split("\n")[0]}
+                )
+
+        return non_compliant
+    except subprocess.CalledProcessError as e:
+        print(f"Error checking commit range: {e}")
+        sys.exit(1)
+
+
+def main() -> None:
+    parser: argparse.ArgumentParser = argparse.ArgumentParser(
+        description="Check conventional commit compliance"
+    )
+    parser.add_argument(
+        "--base", required=True, help="Base ref (starting commit, exclusive)"
+    )
+    parser.add_argument(
+        "--head", required=True, help="Head ref (ending commit, inclusive)"
+    )
+    args: argparse.Namespace = parser.parse_args()
+
+    non_compliant: list[dict[str, str]] = check_commit_range(args.base, args.head)
+
+    if non_compliant:
+        print("The following commits do not follow the conventional commit format:")
+        for commit in non_compliant:
+            print(f"- {commit['hash'][:8]}: {commit['message']}")
+        print("\nPlease ensure your commit messages follow the format:")
+        print("type(scope): subject")
+        print(
+            "\nWhere type is one of: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
+        )
+        sys.exit(1)
+    else:
+        print("All commits follow the conventional commit format!")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/tests.yml

@@ -15,16 +15,20 @@ jobs:
       max-parallel: 4
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
-        go-version: ["1.21"]
+        go-version: ["1.24.x"]
     steps:
+    - name: Checkout
+      uses: actions/checkout@v4
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
-    - name: Checkout
-      uses: actions/checkout@v4
-    - name: Run unit tests
+    - name: Run unit tests with coverage and race conditions checking
+      if: matrix.os == 'ubuntu-latest'
       run: make test
+    - name: Run unit tests without coverage and race conditions checking
+      if: matrix.os != 'ubuntu-latest'
+      run: go test ./...
 
   integration-tests:
     name: Integration Tests
@@ -40,12 +44,12 @@ jobs:
         - 5432:5432
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
     steps:
+    - name: Checkout
+      uses: actions/checkout@v4
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: "1.21"
-    - name: Checkout
-      uses: actions/checkout@v4
+        go-version: "1.24.x"
     - name: Install Postgres client
       run: sudo apt update && sudo apt install -y postgresql-client
     - name: Run integration tests

.gitignore

@@ -1,6 +1,7 @@
-miniflux-*
-./miniflux
-*.rpm
-*.deb
+./*.sha256
+/miniflux
 .idea
-.vscode
+.vscode
+*.deb
+*.rpm
+miniflux-*

CONTRIBUTING.md

@@ -0,0 +1,178 @@
+# Contributing to Miniflux
+
+This document outlines how to contribute effectively to Miniflux.
+
+## Philosophy
+
+Miniflux follows a **minimalist philosophy**. The feature set is intentionally kept limited to avoid bloatware. Before contributing, please understand that:
+
+- **Improving existing features takes priority over adding new ones**
+- **Quality over quantity** - well-implemented, focused features are preferred
+- **Simplicity is key** - complex solutions are discouraged in favor of simple, maintainable code
+
+## Before You Start
+
+### Feature Requests
+
+Before implementing a new feature:
+
+- Check if it aligns with Miniflux's philosophy
+- Consider if the feature could be implemented differently to maintain simplicity
+- Remember that developing software takes significant time, and this is a volunteer-driven project
+- If you need a specific feature, the best approach is to contribute it yourself
+
+### Bug Reports
+
+When reporting bugs:
+
+- Search existing issues first to avoid duplicates
+- Provide clear reproduction steps
+- Include relevant system information (OS, browser, Miniflux version)
+- Include error messages, screenshots, and logs when applicable
+
+## Development Setup
+
+### Requirements
+
+- **Git**
+- **Go >= 1.24**
+- **PostgreSQL**
+
+### Getting Started
+
+1. **Fork the repository** on GitHub
+2. **Clone your fork locally:**
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/miniflux.git
+   cd miniflux
+   ```
+
+3. **Build the application binary:**
+   ```bash
+   make miniflux
+   ```
+
+4. **Run locally in debug mode:**
+   ```bash
+   make run
+   ```
+
+### Database Setup
+
+For development and testing, you can run a local PostgreSQL database with Docker:
+
+```bash
+# Start PostgreSQL container
+docker run --rm --name miniflux2-db -p 5432:5432 \
+  -e POSTGRES_DB=miniflux2 \
+  -e POSTGRES_USER=postgres \
+  -e POSTGRES_PASSWORD=postgres \
+  postgres
+```
+
+You can also use an existing PostgreSQL instance. Make sure to set the `DATABASE_URL` environment variable accordingly.
+
+## Development Workflow
+
+### Code Quality
+
+1. **Run the linter:**
+   ```bash
+   make lint
+   ```
+   Requires `staticcheck` and `golangci-lint` to be installed.
+
+2. **Run unit tests:**
+   ```bash
+   make test
+   ```
+
+3. **Run integration tests:**
+   ```bash
+   make integration-test
+   make clean-integration-test
+   ```
+
+### Building
+
+- **Current platform:** `make miniflux`
+- **All platforms:** `make build`
+- **Specific platforms:** `make linux-amd64`, `make darwin-arm64`, etc.
+- **Docker image:** `make docker-image`
+
+### Cross-Platform Support
+
+Miniflux supports multiple architectures. When making changes, ensure compatibility across:
+- Linux (amd64, arm64, armv7, armv6, armv5)
+- macOS (amd64, arm64)
+- FreeBSD, OpenBSD, Windows (amd64)
+
+## Pull Request Guidelines
+
+### What Is Preferred
+
+✅ **Good Pull Requests:**
+
+- Focus on a single issue or feature
+- Include tests for new functionality
+- Maintain or improve performance
+- Follow existing code style and patterns
+- The commit messages follow the [conventional commit format](https://www.conventionalcommits.org/) (e.g., `feat: add new feature`, `fix: resolve bug`)
+- Update documentation when necessary
+
+### What to Avoid
+
+❌ **Pull Requests That Cannot Be Accepted:**
+
+- **Too many changes** - makes review difficult
+- **Breaking changes** - disrupts existing functionality
+- **New bugs or regressions** - reduces software quality
+- **Unnecessary dependencies** - conflicts with minimalist approach
+- **Performance degradation** - slows down the software
+- **Poor-quality code** - hard to maintain
+- **Dependent PRs** - creates review complexity
+- **Radical UI changes** - disrupts user experience
+- **Conflicts with philosophy** - doesn't align with minimalist approach
+
+### Pull Request Template
+
+When creating a pull request, please include:
+
+- **Description:** What does this PR do?
+- **Motivation:** Why is this change needed?
+- **Testing:** How was this tested?
+- **Breaking Changes:** Are there any breaking changes?
+- **Related Issues:** Link to any related issues
+
+## Code Style
+
+- Follow Go conventions and best practices
+- Use `gofmt` to format your Go code, and `jshint` for JavaScript
+- Write clear, descriptive variable and function names
+- Include comments for complex logic
+- Keep functions small and focused
+
+## Testing
+
+### Unit Tests
+- Write unit tests for new functions and methods
+- Ensure tests are fast and don't require external dependencies
+- Aim for good test coverage
+
+### Integration Tests
+- Add integration tests for new API endpoints
+- Tests run against a real PostgreSQL database
+- Ensure tests clean up after themselves
+
+## Communication
+
+- **Discussions:** Use GitHub Discussions for general questions and community interaction
+- **Issues:** Use GitHub issues for bug reports and feature requests
+- **Pull Requests:** Use PR comments for code-specific discussions
+- **Philosophy Questions:** Refer to the FAQ for common questions about project direction
+
+## Questions?
+
+- Check the [FAQ](https://miniflux.app/faq.html) for common questions
+- Review the [development documentation](https://miniflux.app/docs/development.html) and [internationalization guide](https://miniflux.app/docs/i18n.html)
+- Look at existing issues and pull requests for examples

ChangeLog

@@ -1,3 +1,784 @@
+Version 2.2.10 (June 23, 2025)
+------------------------------
+
+* test(sanitizer): add unit test for 0x0 pixel tracker
+* test(sanitizer): add test case to cover Vimeo iframe rewrite without query string
+* refactor(youtube): Remove a regex and make use of `fetchWatchTime`
+* refactor(youtube): initialize two maps to the proper length
+* refactor(tests): use `b.Loop()` instead of for range `b.N`
+* refactor(server): avoid double call to `Sprintf`
+* refactor(sanitizer): use global variables to avoid recreating slices on every call
+* refactor(sanitizer): use a map for iframe allow list
+* refactor(sanitizer): remove two useless `www.` prefixes
+* refactor(sanitizer): make `isValidAttribute()` check O(1)
+* refactor(rewrite): rename `Rewriter` function to `ApplyContentRewriteRules`
+* refactor(processor): simplify Bilibili processing
+* refactor(processor): remove a useless type declaration
+* refactor(processor): remove a duplicated function call
+* refactor(processor): refactor common code into a `fetchWatchTime` function
+* refactor(processor): move filters to a `filter` package
+* refactor(processor): move `FilterEntryMaxAgeDays` filter to filter package
+* refactor(processor): move `RewriteEntryURL` function to `rewrite` package
+* refactor(processor): minor simplification of a loop
+* refactor(internal): add an `urllib.DomainWithoutWWW` function
+* refactor(http): rename package from `httpd` to `server` for consistency
+* refactor(http): Don't hardcode TLS configuration
+* refactor(filter): avoid code duplication between `IsBlockedEntry` and `IsAllowedEntry` functions
+* refactor(database): drop 3 columns in a single transaction
+* refactor(crypto): use `rand.Text()` instead of a custom implementation
+* refactor(config): remove deprecated config options
+* refactor(appjs): no need to check if always present elements are always present
+* perf(xml): optimized `NewXMLDecoder`
+* perf(xml): optimize XML filtering
+* perf(validator): slightly optimize a regex
+* perf(timezone): cache `getLocation`'s results
+* perf(storage): pre-allocate a slice in `RefreshFeedEntries`
+* perf(storage): optimize away two `Sprintf` calls
+* perf(sanitizer): use a switch-case instead of a map
+* perf(sanitizer): minor simplifications of the sanitizer
+* perf(sanitizer): extract a call to `url.Parse` and make intensive use of it
+* perf(rss): optimize a bit `BuildFeed`
+* perf(rss): early return when looking for an item's author
+* perf(rewrite): make `getPredefinedRewriteRules` O(1)
+* perf(reader): use a non-cryptographic hash when possible
+* perf(reader): optimize `RemoveTrackingParameters`
+* perf(readability): minor regex improvement
+* perf(media): minor regex simplification
+* perf(fetcher): pre-allocate the cipherSuites
+* perf(database): use `TRUNCATE` instead of `DELETE FROM` in migrations
+* perf(database): marginally speeds migrations up
+* perf(api): use `math/rand/v2` instead of `math/rand` for better performance
+* fix(readability): do not remove elements within code blocks
+* fix(karakeep): correct method name and improve error handling in `SaveURL`
+* fix(filter): skip invalid rules instead of exiting the loop
+* feat(ui): display external link in single entry view because the URL was not visible on mobile (no mouse over)
+* feat(ui): avoid showing an excessive number of tags
+* feat(ui): add user setting to control `target="_blank"` on links
+* feat(sanitizer): validate MathML XML namespace
+* feat(sanitizer): consider images of size 0x0 as pixel trackers
+* feat(sanitizer): add validation for empty `width` and `height` attributes in img tags
+* feat(sanitizer): add support for `fetchpriority` and `decoding` attributes in img tags
+* feat(rewrite): add support for YouTube Shorts video URL pattern
+* feat(rewrite): add `parkablogs.com` to the referer override list
+* feat(oidc): use `preferred_username` first instead of `email` claim
+* feat(locale): update Polish translations
+* feat(locale): update locales using machine translation
+* feat(locale): update Indonesian translations
+* feat(locale): update German translations
+* feat(locale): update Chinese translations
+* feat(integration)!: remove Pocket integration (Pocket will no longer be available after July 8, 2025)
+* feat(filter): add `EntryDate=max-age:duration` filter
+* feat(css): add margin-bottom to input for consistent spacing
+* feat(config)!: remove `SERVER_TIMING_HEADER` config option
+* feat: Allow multiple listen addresses
+* feat: adding support for saving entries to Karakeep
+* feat: add entry filters at the feed level
+* docs(readme): document a couple of nifty features
+* docs: add `CONTRIBUTING.md` file
+* chore(template): remove `X-UA-Compatible` meta tag specific to Internet Explorer
+* build(go): bump to go 1.24
+* build(deps): bump `library/alpine` in `/packaging/docker/alpine`
+* build(deps): bump `golang.org/x/net` from `0.40.0` to `0.41.0`
+* build(deps): bump `golang.org/x/image` from `0.27.0` to `0.28.0`
+* build(deps): bump `golang.org/x/crypto` from `0.38.0` to `0.39.0`
+
+Version 2.2.9 (May 26, 2025)
+----------------------------
+
+* refactor(googlereader): remove redundant log message
+* refactor(googlereader): move constants to separate files
+* fix(webauthn): correct argument in debug log
+* fix(sanitizer): MathML tags are not fully supported by `golang.org/x/net/html`
+* fix(migrations): prevent failure at version 45 with long entry URLs
+* fix(locale): localize Git commit label in about page
+* fix(googlereader): return a 400 instead of 500 for invalid edit requests
+* fix(googlereader): handle various item ID formats
+* fix(googlereader): avoid panic for inexisting feed or category
+* fix(googlereader): `/items/contents` should accept short form item IDs
+* feat(webauthn): prefer creation of a client-side discoverable credential
+* feat(urlcleaner): remove the `ref` parameter from url
+* feat(settings): replace `div.panel` with paragraph tags for OAuth2 links
+* feat(settings): add validation for entry order and categories sorting order
+* feat(settings): add option to always open articles externally
+* feat(server): add liveness and readiness probes
+* feat(sanitizer): add MathML tags to the sanitizer
+* feat(sanitized): allow Spotify iframes
+* feat(rssbridge): support authentication token for RSS-Bridge
+* feat(response): change error response content type to plain text and escape HTML
+* feat(reader): populate feed description automatically
+* feat(locale): update Russian translation
+* feat(locale): update Polish translation
+* feat(locale): update French translation
+* feat(googlereader): avoid SQL query to fetch username in streamItemContentsHandler
+* feat(googlereader): add `mark-all-as-read` endpoint
+* feat(api): add new endpoints to manage API keys
+* ci: remove deprecated `reviewers` field from `dependantbot.yml`
+* chore(gitignore): ignore miniflux binary in root directory
+* build(deps): bump `golangci/golangci-lint-action` from `7` to `8`
+* build(deps): bump `golang.org/x/oauth2` from `0.29.0` to `0.30.0`
+* build(deps): bump `golang.org/x/net` from `0.39.0` to `0.40.0`
+* build(deps): bump `golang.org/x/image` from `0.26.0` to `0.27.0`
+* build(deps): bump `golang.org/x/crypto` from `0.37.0` to `0.38.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.23.3` to `2.23.8`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.23.1` to `2.23.3`
+* build(deps): bump `github.com/go-webauthn/webauthn` from `0.12.3` to `0.13.0`
+
+Version 2.2.8 (April 22, 2025)
+------------------------------
+
+* refactor(js): replace `DomHelper` methods with standalone functions
+* refactor: avoid logging twice the feed errors in the background worker
+* fix(api): `hide_globally` categories field should be a boolean
+* fix(ui): add missing `await` when calling `navigator.share()` method
+* fix(ui): replace share link with a form button for better accessibility
+* feat(telegrambot): replace "Go to website" button with "Go to Miniflux"
+* feat(locale): update Polish translation
+* feat(locale): update German translation
+* feat(locale): update Chinese translation
+* feat(config): add `SCHEDULER_ROUND_ROBIN_MAX_INTERVAL` option
+* feat(cli): add `-reset-feed-next-check-at` argument
+* feat(api): add `update_content` query parameter to `/entries/{entryID}/fetch-content` endpoint
+* feat: use `Cache-Control` max-age and `Expires` headers to calculate next check
+* feat: implement proxy URL per feed
+* feat: add proxy rotation functionality
+* ci(linter): replace commitlint with a Python script
+* ci: add documentation issue template
+* build(deps): bump `golang.org/x/oauth2` from `0.28.0` to `0.29.0`
+* build(deps): bump `golang.org/x/net` from `0.38.0` to `0.39.0`
+* build(deps): bump `golang.org/x/image` from `0.25.0` to `0.26.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.22.4` to `2.23.1`
+* build(deps): bump `github.com/PuerkitoBio/goquery` from `1.10.2` to `1.10.3`
+* build(deps): bump `github.com/prometheus/client_golang`
+* build(deps): bump `github.com/mattn/go-sqlite3` from `1.14.24` to `1.14.28`
+* build(deps): bump `github.com/go-webauthn/webauthn` from `0.12.2` to `0.12.3`
+* build(deps): bump `github.com/coreos/go-oidc/v3` from `3.13.0` to `3.14.1`
+
+Version 2.2.7 (April 1, 2025)
+-----------------------------
+
+* test(api): update base URL after upgrading Hugo
+* refactor(rewrite): reorganize referer rules and remove obsolete mappings
+* refactor: combine feed icon handlers to use only `externalIconID`
+* fix(ui): update share feature to correctly select the title element and handle empty titles
+* fix(ui): update entry tags display logic to show links based on user authentication
+* fix(ui): remove touch-action style to prevent horizontal scrolling issues
+* fix(ui): log a warning for an empty client secret
+* fix(ui): change labels from "Read / Unread" to "Mark as Read"
+* fix(ui): avoid 500 errors and NaN when marking a deleted entry as read
+* fix(subscription): add `/rss/feed.xml` to the list of known feed URLs
+* fix(security): use a more restrictive CSP for untrusted content
+* fix(rewrite): remove obsolete rule for `webtoons.com`
+* fix(processor): add missing quotation marks to import comments
+* fix(googlereader): return enclosures in the `streamItemContentsHandler` response
+* fix: address minor issues detected by Go linters
+* feat(urlcleaner): add more Google Analytics parameters
+* feat(storage): reduce the number of SQL queries when fetching entry enclosures
+* feat(sanitizer): allow the `<u>` tag in feeds
+* feat(sanitizer): allow the `<b>` tag
+* feat(locale): update Polish translation
+* feat(locale): add Romanian translation
+* feat(integrations/ntfy): make ntfy topics configurable per feed
+* feat(googlereader): add a feed icon endpoint
+* feat: show database size on the about page
+* feat: add a `make add string` command to add new localized strings
+* docs: update README
+* docs: update client README to remove references to deprecated functions
+* ci: replace GitHub Issue Markdown templates with YAML forms
+* build(deps): bump `golangci/golangci-lint-action` from `6` to `7`
+* build(deps): bump `golang.org/x/term` from `0.29.0` to `0.30.0`
+* build(deps): bump `golang.org/x/oauth2` from `0.26.0` to` 0.28.0`
+* build(deps): bump `golang.org/x/net` from `0.35.0` to `0.38.0`
+* build(deps): bump `golang.org/x/image` from `0.24.0` to `0.25.0`
+* build(deps): bump `golang.org/x/crypto` from `0.33.0` to `0.36.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.21.3` to `2.22.4`
+* build(deps): bump `github.com/prometheus/client_golang`
+* build(deps): bump `github.com/golang-jwt/jwt/v5` from `5.2.1` to `5.2.2`
+* build(deps): bump `github.com/go-webauthn/webauthn` from `0.11.2` to `0.12.2`
+* build(deps): bump `github.com/go-jose/go-jose/v4` from `4.0.2` to `4.0.5`
+* build(deps): bump `github.com/coreos/go-oidc/v3` from `3.12.0` to `3.13.0`
+
+Version 2.2.6 (February 22, 2025)
+---------------------------------
+
+* test(encoding): add unit tests for `CharsetReader` function
+* refactor(xml): improve the performances of `NewXMLDecoder`
+* refactor(ui): remove superfluous cast
+* refactor(request): broaden an error condition when parsing cookies
+* refactor(processor): remove superfluous parenthesis
+* refactor(opml): don't define receivers on both values and pointer
+* refactor(model): simplify a condition
+* refactor(model): don't define methods both on instance and pointer
+* refactor(locale): sort JSON documents alphabetically by keys
+* refactor(locale): remove superfluous parenthesis
+* refactor(js): use proper types in `app.js`
+* refactor(js): replace the deprecated `window.pageYOffset` with `window.scollY`
+* refactor(js): remove a useless `return`
+* refactor(js): anchor `=` removal in `webauthn_handler.js` regex
+* refactor(js): add default value for parameter `fallbackSelf` in `goToPage` function
+* refactor(integration): don't use `defer` in a loop
+* refactor(icon): guard against a potential `null` dereference
+* refactor(date): use an else-if instead of two if statements
+* refactor(css): use shortcuts to declare padding
+* refactor(client): remove a useless cast
+* perf(sanitizer): remove two useless calls to `strings.ReplaceAll`
+* fix(ui): Redirect correctly post feed removal from category feeds list
+* fix(scraper): update TechCrunch scraper rule
+* fix(scraper): avoid encoding issue if charset meta tag is after 1024 bytes
+* fix(sanitizer): non-allowed attributes are not properly stripped
+* fix(sanitizer): correct HTML tag name from `tfooter` to `tfoot`
+* fix(rss): handle item title with `CDATA` content correctly
+* fix(locale): missing hyphen in `de_DE.json`
+* fix(css): avoid aside overflow on the pagination menu
+* fix(css): `--entry-content-aside-border-color` is missing from `system.css`
+* fix(api): return 500 response when JSON serialization fails
+* fix(api): JSON encoding is failing with dates at OAD and negative timezone offset
+* feat(urlcleaner): add trackers to the blocklist
+* feat(ui): open the `<details>` tag in edit feed page when the feature is enabled
+* feat(sanitizer): improve text truncation with better space handling
+* feat(sanitizer): allow `img` tags with only a `srcset` and no `src` attribute
+* feat(rss): add workaround for RSS item title with HTML content
+* feat(pushover): add integration with pushover.net
+* feat(processor): fetch YouTube watch time in bulk using the API
+* feat(locale): update Traditional Chinese translation
+* feat(locale): update Polish translation
+* feat(locale): update French translation
+* feat(locale): add Taiwanese POJ (nan-Latn-pehoeji)
+* feat(integration): update Linkace integration to support API v2
+* feat(integration): add webhook URL per feed
+* feat(integration): add Slack integration
+* feat(css): improve aside element position on smartphone
+* ci: update GitHub Actions workflows to use Go 1.24
+* ci: trigger packaging tests on pull requests
+* ci: add `commitlint` to validate PR commit messages
+* build(deps): bump `golang` in `/packaging/debian`
+* build(deps): bump `golang.org/x/term` from `0.28.0` to `0.29.0`
+* build(deps): bump `golang.org/x/oauth2` from `0.25.0` to `0.26.0`
+* build(deps): bump `golang.org/x/net` from `0.34.0` to `0.35.0`
+* build(deps): bump `golang.org/x/image` from `0.23.0` to `0.24.0`
+* build(deps): bump `golang.org/x/crypto` from `0.32.0` to `0.33.0`
+* build(deps): bump `github.com/PuerkitoBio/goquery` from `1.10.1` to `1.10.2`
+
+Version 2.2.5 (January 20, 2025)
+--------------------------------
+
+* test(js): improve `.jshintrc` (strict comparison, etc...)
+* test(sanitizer): add a fuzzer
+* refactor(rewriter): use custom title case converter implementation instead of `golang.org/x/text/cases.Title()`
+* refactor(readingtime): replace `whatlanggo` package with an ad-hoc implementation
+* refactor(oauth2): no need to use `io.WriteString` when sha256 provides a way to obtain a sum in a single call
+* refactor(js): simplify a bit `keyboard_handler.js`
+* refactor(js): remove an outdated check for `{passive: true}`
+* refactor(js): minor refactoring of `touch_handler.js`
+* refactor(js): minor improvements in `app.js`
+* refactor(database): add special handling for PostgreSQL-specific migrations
+* fix(ui): reading preferences are reset if the form values are incorrect
+* fix(sanitizer): allow `<hr>` tags
+* fix(finder): do not add redirections to the list of subscriptions to avoid confusion
+* fix: update Wallabag URL label to avoid confusion
+* fix: improve pagination when having identical publication date
+* fix: do not strip tags in Atom entry title
+* feat(ntfy): Add option to use internal links
+* feat(locale): update Polish translation
+* feat(locale): update German translation
+* feat(integration): add Discord integration
+* feat(database): add optional build support for SQLite
+* feat: validate usernames upon creation
+* feat: replace `%{?systemd_requires}` with `%{?systemd_ordering}`
+* feat: bump linter and minifier from ECMAScript 2017 to 2020 (ES11)
+* feat: add `fix_ghost_cards` rewrite rule
+* ci: tighten the CodeQL rules
+* ci: run Docker tests only when the Dockerfiles are modified
+* ci: run `-race -cover` only on Ubuntu jobs
+* ci: don't specify languages for CodeQL
+* ci: don't run `go vet ./...` as it's run as part of `golangci-lint`
+* ci: checkout before installing Go to improve cache efficiency
+* ci: avoid building Linux packages for each pull-request
+* build(deps): bump `golang.org/x/oauth2` from `0.24.0` to `0.25.0`
+* build(deps): bump `golang.org/x/net` from `0.33.0` to `0.34.0`
+* build(deps): bump `golang.org/x/crypto` from `0.31.0` to `0.32.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.21.2` to `2.21.3`
+* build(deps): bump `github.com/PuerkitoBio/goquery` from `1.10.0` to `1.10.1`
+* build(deps): bump `github.com/coreos/go-oidc/v3` from `3.11.0` to `3.12.0`
+
+Version 2.2.4 (December 20, 2024)
+---------------------------------
+
+* test(rewrite): add unit test for referer rewrite function
+* refactor(subscription): use `strings.HasSuffix` instead of a regex in `FindSubscriptionsFromYouTubePlaylistPage`
+* refactor(sanitizer): use `token.String()` instead of `html.EscapeString(token.Data)`
+* refactor(sanitizer): simplify `isValidTag`
+* refactor(sanitizer): simplify `hasRequiredAttributes`
+* refactor(sanitizer): remove condition because `config.Opts` is guaranteed to never be nil
+* refactor(sanitizer): remove a now-useless function after refactoring
+* refactor(sanitizer): refactor conditions to highlight their similitude, enabling further refactoring
+* refactor(sanitizer): optimize `strip_tags.go`
+* refactor(sanitizer): micro-optimizations of `srcset.go`
+* refactor(sanitizer): merge two conditions
+* refactor(sanitizer): inline a function in `sanitizeAttributes` and fix a bug in it
+* refactor(sanitizer): inline a condition in `sanitizeSrcsetAttr`
+* refactor(sanitizer): improve `rewriteIframeURL()`
+* refactor(sanitizer): Google+ isn't a thing anymore
+* refactor(sanitizer): change the scope of a variable
+* refactor(rewriter): replace regex with URL parsing for referrer override
+* refactor(rewriter): avoid the use of regex in `addDynamicImage`
+* refactor(rewrite): remove unused function arguments
+* refactor(readability): various improvements and optimizations
+* refactor(readability): simplify the regexes in `readability.go`
+* refactor(processor): use URL parsing instead of a regex
+* refactor(processor): improve the `rewrite` URL rule regex
+* refactor(locale): delay parsing of translations until they're used
+* refactor(js): factorise a line in `app.js`
+* refactor(handler): delay `store.UserByID()` as much as possible
+* refactor(css): replace `-ms-text-size-adjust` with `text-size-adjust`
+* refactor(css): remove `-webkit-clip-path`
+* refactor(css): factorise `.pagination-next` and `.pagination-last` together
+* refactor: use a better construct than `doc.Find(…).First()`
+* refactor: use `min/max` instead of `math.Min/math.Max`
+* refactor: refactor `internal/reader/readability/testdata`
+* refactor: optimize `sanitizeAttributes`
+* refactor: get rid of `numberOfPluralFormsPerLanguage` test-only variable
+* fix(storage): replace timezone function call with view
+* fix(consistency): align feed modification behavior between API and UI
+* fix(ci): fix grammar in pull-request template
+* fix: load icon from site URL instead of feed URL
+* fix: feed icon from xml ignored during force refresh
+* feat(rewrite)!: remove `parse_markdown` rewrite rule
+* feat(mediaproxy): update predefined referer spoofing rules for restricted media resources
+* feat(locale): update translations to clarify readeck URL instead of readeck API endpoint
+* feat(locale): update German translations
+* feat(locale): update Chinese translations
+* feat(apprise): update `SendNotification` to handle multiple entries and add logging
+* feat(apprise): add title in notification request body
+* feat: resize favicons before storing them in the database
+* feat: optionally fetch watch time from YouTube API instead of website
+* feat: only show the commit URL if it's not empty on `/about`
+* feat: add predefined scraper rules for `arstechnica.com`
+* feat: add date-based entry filtering rules
+* chore: remove `blog.laravel.com` rewrite rule
+* build(deps): bump `library/alpine` in `/packaging/docker/alpine` to `3.21`
+* build(deps): bump `golang.org/x/term` from `0.26.0` to `0.27.0`
+* build(deps): bump `golang.org/x/net` from `0.31.0` to `0.33.0`
+* build(deps): bump `golang.org/x/crypto` from `0.30.0` to `0.31.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.21.1` to `2.21.2`
+
+Version 2.2.3 (November 10, 2024)
+---------------------------------
+
+* fix: unable to change password due to a typo in SQL parameter
+* fix: show only one player when there are several audio/video enclosures
+* feat(mediaproxy): pass original filename in `Content-Disposition` header
+* feat(mediaproxy): implement referer spoofing for restricted media resources
+* feat(integration): update Shiori integration to use new API endpoints for login/bookmark
+* build(deps): bump `golang.org/x/text` from `0.19.0` to `0.20.0`
+* build(deps): bump `golang.org/x/term` from `0.25.0` to `0.26.0`
+* build(deps): bump `golang.org/x/oauth2` from `0.23.0` to `0.24.0`
+* build(deps): bump `golang.org/x/net` from `0.30.0` to `0.31.0`
+* build(deps): bump `golang.org/x/crypto` from `0.28.0` to `0.29.0`
+
+Version 2.2.2 (October 29, 2024)
+--------------------------------
+
+* fix(webauthn): add backup eligibility flag workaround to avoid a 401 response
+* fix: update `Last-Modified` if it changes in a 304 response
+* feat(webauthn): show help message regarding username and non-discoverable credentials
+* feat(rss): calculate hash based on item title/content for feeds without GUID and link
+* feat(locale): update Chinese translations
+* feat(locale): update Polish translations
+* feat(integration): add Cubox integration
+* feat(client): add `custom_js` field to Go API client
+* feat(api): add endpoint for user integration status
+* feat: update feed icon during force refresh
+* feat: take `Retry-After` header into consideration for rate limited feeds
+* feat: set entry URL to rewritten URL if a rewrite rule is defined
+* feat: replace `xurls` third-party module with an ad-hoc regexp
+* feat: add new settings option to allow external fonts
+* feat: add custom user JavaScript similar to custom CSS
+* chore: update test case comment
+* build(deps): bump `golang.org/x/net` from `0.29.0` to `0.30.0`
+* build(deps): bump `github.com/yuin/goldmark` from `1.7.4` to `1.7.8`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.20.37` to `2.21.1`
+* build(deps): bump `github.com/prometheus/client_golang`
+* build(deps): bump `github.com/andybalholm/brotli` from `1.1.0` to `1.1.1`
+
+Version 2.2.1 (September 28, 2024)
+----------------------------------
+
+* refactor: split processor package into smaller files
+* fix(mediaproxy): forward client user-agent to origin to bypass bot protection
+* fix: use root URL to generate absolute proxy URL
+* fix: remove progression save on shared entry
+* fix: add datasource variable and upgrade depecrated panels on the Grafana dashboard
+* feat(locale): update zh_CN translations
+* feat(locale): update Ukrainian translations
+* feat(locale): update Spanish translations
+* feat(locale): update Dutch translations
+* feat: use Bilibili API instead of web scraping to get videos watch time
+* feat: add pagination to shared entries listing
+* feat: add button to show only starred entries per category
+* build(deps): bump `golang.org/x/term` from `0.23.0` to `0.24.0`
+* build(deps): bump `golang.org/x/oauth2` from `0.22.0` to `0.23.0`
+* build(deps): bump `golang.org/x/net` from `0.28.0` to `0.29.0`
+* build(deps): bump `github.com/PuerkitoBio/goquery` from `1.9.2` to `1.10.0`
+* build(deps): bump `github.com/prometheus/client_golang` from `1.20.3` to `1.20.4`
+* build(deps): bump `github.com/go-webauthn/webauthn` from `0.10.2` to `0.11.2`
+* build: update go.mod to Go 1.23
+* build: bump devcontainer version to go 1.23
+
+Version 2.2.0 (August 18, 2024)
+-------------------------------
+
+* refactor: simplify Youtube feeds discovery
+* fix(integration): define content encoding explicitly when sending article body to Readeck
+* fix(fever): correct sorting direction when using `max_id` argument
+* fix(client): Return `nil` and error if endpoint is an empty string
+* fix: video poster image URL is encoded twice when using `MEDIA_PROXY_MODE=all`
+* fix: use `BASE_URL` instead of `r.Host` to generate absolute media proxy URL
+* fix: panic during YouTube channel feed discovery
+* fix: honor `hide_globally` when creating a new feed through the api
+* fix: align pagination correctly on small screens with non-English text
+* fix: `store.GetEnclosure()` should return `nil` if no rows are returned
+* feat(locale): update Turkish translations
+* feat(locale): update French translations
+* feat(locale): update Chinese` translations
+* feat(integration): add ntfy integration
+* feat(api): add API routes `/v1/enclosures/{enclosureID}`
+* feat: validate `OAUTH2_PROVIDER` config option value
+* feat: remove YouTube video page subscription finder because `meta[itemprop="channelId"]` no longer exists
+* feat: remove well-known URL parameter trackers
+* feat: mark media as read when playback reaches 90%
+* feat: change log level to info when running migrations
+* feat: allow customizing the display name of the OpenID Connect provider
+* feat: add support for `base` HTML element when discovering feeds
+* feat: add support for `aside` HTML element in entry content
+* feat: Add option to disable local auth form
+* feat: add license info to Javascript files for LibreJS compatibility
+* feat: add `FETCH_BILIBILI_WATCH_TIME` config option
+* docs: update links to filtering rules
+* chore: avoid using legacy key/value format in Dockerfile
+* build(deps): bump `golang.org/x/oauth2` from `0.21.0` to `0.22.0`
+* build(deps): bump `golang.org/x/net` from `0.27.0` to `0.28.0`
+* build(deps): bump `golang.org/x/crypto` from `0.25.0` to `0.26.0`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.20.36` to `2.20.37`
+* build(deps): bump `github.com/prometheus/client_golang`
+* build: update GitHub Actions to Go 1.23
+* build: publish OCI images only if `PUBLISH_DOCKER_IMAGES=true`
+* build: bump Alpine Linux build image to v3.20
+* build: add sha256 checksum file for published binaries
+
+Version 2.1.4 (July 9, 2024)
+----------------------------
+
+* test: add unit tests for `IsModified()` behaviour
+* refactor: improve YouTube page feed detection
+* fix(ui): settings form is not populated correctly after validation errors
+* fix(ui): playback speed indicator precision
+* fix(ui): playback speed indicator on shared entries
+* fix(integration): preserve existing Pinboard bookmarks
+* fix(googlereader): set `CrawlTimeMsec` to the correct precision
+* fix(build): failed to solve container image `arm64v8/golang:1.22-bookworm`
+* fix(build): add `distroless` suffix on `latest` tag in GitHub workflow
+* fix: use `ETag` as a stronger validator than `Last-Modified`
+* fix: update `theverge.com` rewrite rule to avoid duplicate image
+* fix: incorrect Go package comment `reader/readingtime`
+* fix: error out for improper rewrite regexp when processing feed entries
+* fix: ensures that session cookies are not expiring before the session is cleaned up from the database as per `CLEANUP_REMOVE_SESSIONS_DAYS`
+* fix: `<img>` aspect ratio with `height: auto`
+* feat(ui): add `viewport-fit=cover`
+* feat(sanitizer): add support for HTML hidden attribute
+* feat(locale): update French translations
+* feat(integration): add Raindrop integration
+* feat(integration): add feed name to Telegram message
+* feat(integration): add Betula integration
+* feat: use of insecure TLS ciphers when "Allow self-signed or invalid certificates" is enabled to workaround some broken websites
+* feat: discover feeds from a Youtube playlist pages
+* feat: add navigation to last/first page
+* feat: add global block and keep filters
+* feat: add description field to feed settings
+* feat: add `pitchfork.com` scraping rule
+* feat: add `FETCH_NEBULA_WATCH_TIME` config option
+* Bump `github.com/PuerkitoBio/goquery` from` 1.9.1` to` 1.9.2`
+* Bump `github.com/prometheus/client_golang` from `1.19.0` to `1.19.1`
+* build(deps): bump `library/alpine` in `/packaging/docker/alpine`
+* build(deps): bump `golangci/golangci-lint-action` from `4` to `6`
+* build(deps): bump `golang.org/x/term` from `0.19.0` to `0.22.0`
+* build(deps): bump `golang.org/x/oauth2` from `0.19.0` to `0.21.0`
+* build(deps): bump `golang.org/x/net` from `0.22.0` to `0.27.0`
+* build(deps): bump `golang.org/x/crypto` from `0.24.0` to `0.25.0`
+* build(deps): bump `github.com/yuin/goldmark` from `1.7.1` to `1.7.4`
+* build(deps): bump `github.com/tdewolff/minify/v2` from `2.20.20` to `2.20.36`
+* build(deps): bump `github.com/coreos/go-oidc/v3` from `3.10.0` to `3.11.0`
+* build(deps): bump `docker/build-push-action` from `5` to `6`
+
+Version 2.1.3 (April 27, 2024)
+------------------------------
+
+* `api`: `rand.Intn(math.MaxInt64)` causes tests to fail on 32-bit architectures (use `rand.Int()` instead)
+* `ci`: use `docker/metadata-action` instead of deprecated shell-scripts
+* `database`: remove `entries_feed_url_idx` index because entry URLs can exceeds btree index size limit
+* `finder`: find feeds from YouTube playlist
+* `http/response`: add brotli compression support
+* `integration/matrix`: fix function name in comment
+* `packaging`: specify container registry explicitly (e.g., Podman does not use `docker.io` by default)
+* `packaging`: use `make miniflux` instead of duplicating `go build` arguments (this leverages Go's PIE build mode)
+* `reader/fetcher`: add brotli content encoding support
+* `reader/processor`: minimize feed entries HTML content
+* `reader/rewrite`: add a rule for `oglaf.com`
+* `storage`: change `GetReadTime()` function to use `entries_feed_id_hash_key` index
+* `ui`: add seek and speed controls to media player
+* `ui`: add tag entries page
+* `ui`: fix JavaScript error when clicking on unread counter
+* `ui`: use `FORCE_REFRESH_INTERVAL` config for category refresh
+* Bump `github.com/tdewolff/minify/v2` from `2.20.19` to `2.20.20`
+* Bump `golang.org/x/net` from `0.22.0` to `0.24.0`
+* Bump `golang.org/x/term` from `0.18.0` to `0.19.0`
+* Bump `golang.org/x/oauth2` from `0.18.0` to `0.19.0`
+* Bump `github.com/yuin/goldmark` from `1.7.0` to `1.7.1`
+
+Version 2.1.2 (March 30, 2024)
+------------------------------
+
+* `api`: rewrite API integration tests without build tags
+* `ci`: add basic ESLinter checks
+* `ci`: enable go-critic linter and fix various issues detected
+* `ci`: fix JavaScript linter path in GitHub Actions
+* `cli`: avoid misleading error message when creating an admin user automatically
+* `config`: add `FILTER_ENTRY_MAX_AGE_DAYS` option
+* `config`: bump the number of simultaneous workers
+* `config`: rename `PROXY_*` options to `MEDIA_PROXY_*`
+* `config`: use `crypto.GenerateRandomBytes` instead of doing it by hand
+* `http/request`: refactor conditions to be more idiomatic
+* `http/response`: remove legacy `X-XSS-Protection` header
+* `integration/rssbrige`: fix rssbrige import
+* `integration/shaarli`: factorize the header+payload concatenation as data
+* `integration/shaarli`: no need to base64-encode then remove the padding when we can simply encode without padding
+* `integration/shaarli`: the JWT token was declared as using HS256 as algorithm, but was using HS512
+* `integration/webhook`: add category title to request body
+* `locale`: update Turkish translations
+* `man page`: sort config options in alphabetical order
+* `mediaproxy`: reduce the internal indentation of `ProxifiedUrl` by inverting some conditions
+* `mediaproxy`: simplify and refactor the package
+* `model`: replace` Optional{Int,Int64,Float64}` with a generic function `OptionalNumber()`
+* `model`: use struct embedding for `FeedCreationRequestFromSubscriptionDiscovery` to reduce code duplication
+* `reader/atom`: avoid debug message when the date is empty
+* `reader/atom`: change `if !a { a = } if !a {a = }` constructs into `if !a { a = ; if !a {a = }}` to reduce the number of comparisons and improve readability
+* `reader/atom`: Move the population of the feed's entries into a new function, to make BuildFeed easier to understand/separate concerns/implementation details
+* `reader/atom`: refactor Atom parser to use an adapter
+* `reader/atom`: use `sort+compact` instead of `compact+sort` to remove duplicates
+* `reader/atom`: when detecting the format, detect its version as well
+* `reader/encoding`: inline a one-liner function
+* `reader/handler`: fix force refresh feature
+* `reader/json`: refactor JSON Feed parser to use an adapter
+* `reader/media`: remove a superfluous error-check: `strconv.ParseInt` returns `0` when passed an empty string
+* `reader/media`: simplify switch-case by moving a common condition above it
+* `reader/processor`: compile block/keep regex only once per feed
+* `reader/rdf`: refactor RDF parser to use an adapter
+* `reader/rewrite`: inline some one-line functions
+* `reader/rewrite`: simplify `removeClickbait`
+* `reader/rewrite`: transform a free-standing function into a method
+* `reader/rewrite`: use a proper constant instead of a magic number in `applyFuncOnTextContent`
+* `reader/rss`: add support for `<media:category>` element
+* `reader/rss`: don't add empty tags to RSS items
+* `reader/rss`: refactor RSS parser to use a default namespace to avoid some limitations of the Go XML parser
+* `reader/rss`: refactor RSS Parser to use an adapter
+* `reader/rss`: remove some duplicated code in RSS parser
+* `reader`: ensure that enclosure URLs are always absolute
+* `reader`: move iTunes and GooglePlay XML definitions to their own packages
+* `reader`: parse podcast categories
+* `reader`: remove trailing space in `SiteURL` and `FeedURL`
+* `storage`: do not store empty tags
+* `storage`: simplify `removeDuplicates()` to use a `sort`+`compact` construct instead of doing it by hand with a hashmap
+* `storage`: Use plain strings concatenation instead of building an array and then joining it
+* `timezone`: make sure the tests pass when the timezone database is not installed on the host
+* `ui/css`: align `min-width` with the other `min-width` values
+* `ui/css`: fix regression: "Add to Home Screen" button is unreadable
+* `ui/js`: don't use lambdas to return a function, use directly the function instead
+* `ui/js`: enable trusted-types
+* `ui/js`: fix download button loading label
+* `ui/js`: fix JavaScript error on the login page when the user not authenticated
+* `ui/js`: inline one-line functions
+* `ui/js`: inline some `querySelectorAll` calls
+* `ui/js`: reduce the scope of some variables
+* `ui/js`: remove a hack for "Chrome 67 and earlier" since it was released in 2018
+* `ui/js`: replace `DomHelper.findParent` with `.closest`
+* `ui/js`: replace `let` with `const`
+* `ui/js`: simplify `DomHelper.getVisibleElements` by using a `filter` instead of a loop with an index
+* `ui/js`: use a `Set` instead of an array in a `KeyboardHandler`'s member
+* `ui/js`: use some ternaries where it makes sense
+* `ui/static`: make use of `HashFromBytes` everywhere
+* `ui/static`: set minifier ECMAScript version
+* `ui`: add keyboard shortcuts for scrolling to top/bottom of the item list
+* `ui`: add media player control playback speed
+* `ui`: remove unused variables and improve JSON decoding in `saveEnclosureProgression()`
+* `validator`: display an error message on edit feed page when the feed URL is not unique
+* Bump `github.com/coreos/go-oidc/v3` from `3.9.0` to `3.10.0`
+* Bump `github.com/go-webauthn/webauthn` from `0.10.1` to `0.10.2`
+* Bump `github.com/tdewolff/minify/v2` from `2.20.18` to `2.20.19`
+* Bump `google.golang.org/protobuf` from `1.32.0` to `1.33.0`
+
+Version 2.1.1 (March 10, 2024)
+-----------------------------
+
+* Move search form to a dedicated page
+* Add Readeck integration
+* Add feed option to disable HTTP/2 to avoid fingerprinting
+* Add `Enter` key as a hotkey to open selected item
+* Proxify `video` element `poster` attribute
+* Add a couple of new possible locations for feeds
+    * Hugo likes to generate `index.xml`
+    * `feed.atom` and `feed.rss` are used by enterprise-scale/old-school gigantic CMS
+* Fix categories import from Thunderbird's OPML
+* Fix logo misalignment when using languages that are more verbose than English
+* Google Reader: Do not return a 500 error when no items is returned
+* Handle RDF feeds with duplicated `<title>` elements
+* Sort integrations alphabetically
+* Add more URL validation in media proxy
+* Add unit test to ensure each translation has the correct number of plurals
+* Add missing plurals for some languages
+* Makefile: quiet `git describe` and `rev-parse` stderr: When building from a tarball instead of a cloned git repo, there would be two `fatal: not a git repository` errors emitted even though the build succeeds. This is because of how `VERSION` and `COMMIT` are set in the Makefile. This PR suppresses the stderr for these variable assignments.
+* Makefile: do not force `CGO_ENABLED=0` for `miniflux` target
+* Add GitHub Action pipeline to build packages on-demand
+* Remove Golint (deprecated), use `staticcheck` and `golangci-lint` instead
+* Build amd64/arm64 Debian packages with CGO disabled
+* Update `go.mod` and add `.exe` suffix to Windows binary
+* Add a couple of fuzzers
+* Fix CodeQL workflow
+* Code and performance improvements:
+    * Use an `io.ReadSeeker` instead of an `io.Reader` to parse feeds
+    * Speed up the sanitizer:
+        - Allow Youtube URLs to start with `www`
+        - Use `strings.Builder` instead of a `bytes.Buffer`
+        - Use a `strings.NewReader` instead of a `bytes.NewBufferString`
+        - Sprinkles a couple of `continue` to make the code-flow more obvious
+        - Inline calls to `inList`, and put their parameters in the right order
+        - Simplify `isPixelTracker`
+        - Simplify `isValidIframeSource`, by extracting the hostname and comparing it directly, instead of using the full url and checking if it starts with multiple variations of the same one (`//`, `http:`, `https://` multiplied by `/www.`)
+        - Add a benchmark
+        - Instead of having to allocate a ~100 keys map containing possibly dynamic values (at least to the go compiler), allocate it once in a global variable. This significantly speeds things up, by reducing the garbage
+        - Use constant time access for maps instead of iterating on them
+        - Build a ~large whitelist map inline instead of constructing it item by item (and remove a duplicate key/value pair)
+        - Use `slices` instead of hand-rolled loops
+    collector/allocator involvements.
+    * Reuse a `Reader` instead of copying to a buffer when parsing an Atom feed
+    * Preallocate memory when exporting to OPML: This should marginally increase performance when exporting a large amount of feeds to OPML
+    * Delay call of `view.New` after logging the user in: There is no need to do extra work like creating a session and its associated view until the user has been properly identified and as many possibly-failing sql request have been successfully run
+    * Use constant-time comparison for anti-csrf tokens: This is probably completely overkill, but since anti-csrf tokens are secrets, they should be compared against untrusted inputs in constant time
+    * Simplify and optimize `genericProxyRewriter`
+        - Reduce the amount of nested loops: it's preferable to search the whole page once and filter on it (even with filters that should always be false), than searching it again for every element we're looking for.
+        - Factorize the proxying conditions into a `shouldProxy` function to reduce the copy-pasta.
+    * Speed up `removeUnlikelyCandidates`: `.Not` returns a brand new `Selection`, copied element by element
+    * Improve `EstimateReadingTime`'s speed by a factor 7
+        - Refactorise the tests and add some
+        - Use 250 signs instead of the whole text
+        - Only check for Korean, Chinese and Japanese script
+        - Add a benchmark
+        - Use a more idiomatic control flow
+    * Don't compute reading-time when unused: If the user doesn't display reading times, there is no need to compute them. This should speed things up a bit, since `whatlanggo.Detect` is abysmally slow.
+    * Simplify `username` generation for the integration tests: No need to generate random numbers 10 times, generate a single big-enough one. A single int64 should be more than enough
+    * Add missing regex anchor detected by CodeQL
+    * Don't mix up slices capacity and length
+    * Use prepared statements for intervals, `ArchiveEntries` and `updateEnclosures`
+    * Use modern for-loops introduced with Go 1.22
+    * Remove a superfluous condition: No need to check if the length of `line` is positive since we're checking afterwards that it contains the `=` sign
+    * Close resources as soon as possible, instead of using `defer()` in a loop
+    * Remove superfluous escaping in a regex
+    * Use `strings.ReplaceAll` instead of `strings.Replace(…, -1)`
+    * Use `strings.EqualFold` instead of `strings.ToLower(…) ==`
+    * Use `.WriteString(` instead of `.Write([]byte(…`
+    * Use `%q` instead of `"%s"`
+    * Make `internal/worker/worker.go` read-only
+    * Use a switch-case construct in `internal/locale/plural.go` instead of an avalanche of `if`
+    * Template functions: simplify `formatFileSize` and `duration` implementation
+    * Inline some templating functions
+    * Make use of `printer.Print` when possible
+    * Add a `printer.Print` to `internal/locale/printer.go`: No need to use variadic functions with string format interpolation to generate static strings
+    * Minor code simplification in `internal/ui/view/view.go`: No need to create the map item by item when we can create it in one go
+    * Build the map inline in `CountAllFeeds()`: No need to build an empty map to then add more fields in it one by one
+    * Miscellaneous improvements to `internal/reader/subscription/finder.go`:
+        - Surface `localizedError` in `FindSubscriptionsFromWellKnownURLs` via `slog`
+        - Use an inline declaration for new subscriptions, like done elsewhere in the
+        file, if only for consistency's sake
+        - Preallocate the `subscriptions` slice when using an RSS-bridge,
+    * Use an update-where for `MarkCategoryAsRead` instead of a subquery
+    * Simplify `CleanOldUserSessions`' query: No need for a subquery, filtering on `created_at` directly is enough
+    * Simplify `cleanupEntries`' query
+        - `NOT (hash=ANY(%4))` can be expressed as `hash NOT IN $4`
+        - There is no need for a subquery operating on the same table, moving the conditions out is equivalent.
+    * Reformat `ArchiveEntries`'s query for consistency's sake and replace the `=ANY` with an `IN`
+    * Reformat the query in `GetEntryIDs` and `GetReadTime`'s query for consistency's sake
+    * Simplify `WeeklyFeedEntryCount`: No need for a `BETWEEN`: we want to filter on entries published in the last week, no need to express is as "entries published between now and last week", "entries published after last week" is enough
+    * Add some tests for `add_image_title`
+    * Remove `github.com/google/uuid` dependencies: Replace it with a hand-rolled implementation. Heck, an UUID isn't even a requirement according to Omnivore API docs
+    * Simplify `internal/reader/icon/finder.go`:
+        - Use a simple regex to parse data uri instead of a hand-rolled parser, and document what fields are considered mandatory.
+        - Use case-insensitive matching to find (fav)icons, instead of doing the same query twice with different letter cases
+        - Add `apple-touch-icon-precomposed.png` as a fallback `favicon`
+        - Reorder the queries to have `icon` first, since it seems to be the most popular one. It used to be last, meaning that pages had to be parsed completely 4 times, instead of one now.
+        - Minor factorisation in `findIconURLsFromHTMLDocument`
+    * Small refactoring of `internal/reader/date/parser.go`:
+        - Split dates formats into those that require local times and those who don't, so that there is no need to have a switch-case in the for loop with around 250 iterations at most.
+        - Be more strict when it comes to timezones, previously invalid ones like -13 were accepted. Also add a test for this.
+        - Bail out early if the date is an empty string.
+    * Make use of Go ≥ 1.21 slices package instead of hand-rolled loops
+    * Reorder the fields of the `Entry` struct to save some memory
+* Dependencies update:
+    * Bump `golang.org/x/oauth2` from `0.17.0` to `0.18.0`
+    * Bump `github.com/prometheus/client_golang` from `1.18.0` to `1.19.0`
+    * Bump `github.com/tdewolff/minify/v2` from `2.20.16` to `2.20.18`
+    * Bump `github.com/PuerkitoBio/goquery` from `1.8.1` to `1.9.1`
+    * Bump `golang.org/x/crypto` from `0.19.0` to `0.20.0`
+    * Bump `github.com/go-jose/go-jose/v3` from `3.0.1` to `3.0.3`
+
+Version 2.1.0 (February 17, 2024)
+---------------------------------
+
+* Add Linkwarden integration
+* Add LinkAce integration
+* Add `FORCE_REFRESH_INTERVAL` config option
+* Add `item-meta-info-reading-time` CSS class
+* Add `add_dynamic_iframe` rewrite function
+* Add attribute `data-original-mos` to `add_dynamic_image` rewrite candidates
+* Update entry processor to allow blocking/keeping entries by tags and/or authors
+* Change default `Accept` header when fetching feeds
+* Rewrite relative RSS Bridge URL to absolute URL
+* Use numeric user ID in Alpine and distroless container image (avoid `securityContext` error in Kubernetes)
+* Always try to use HTTP/2 when fetching feeds if available
+* Add `type` attribute in OPML export as per OPML 2.0 specs
+* Fix missing translation argument for the key `error.unable_to_parse_feed`
+* Fix Debian package builder when using Go 1.22 and `armhf` architecture
+* Fix typo in log message
+* Fix incorrect label shown when saving an article
+* Fix incorrect condition in refresh feeds cli
+* Fix incorrect label `for` attribute
+* Add missing label ID for custom CSS field
+* Accessibility improvements:
+    * Add workaround for macOS VoiceOver that didn't announce `details` and `summary` when expanded
+    * Add `alert` role to alert message element
+    * Add a `h2` heading to the article element so that the screen reader users can navigate the article through the heading level
+    * Add an `aria-label` attribute for the article element for screen readers
+    * Remove the icon image `alt` attribute in feeds list to prevent screen reader to announce it before entry title
+    * Add `sr-only` CSS class for screen reader users (provides more context)
+    * Differentiate between buttons and links
+    * Change links that could perform actions to buttons
+    * Improve translation of hidden Aria elements
+    * Remove the redundant article role
+    * Add a search landmark for the search form so that the screen reader users can navigate to it
+    * Add skip to content link
+    * Add `nav` landmark to page header links
+* Limit feed/category entry pagination to unread entries when coming from unread entry list
+* Update German translation
+* Update GitHub Actions to Go 1.22
+* Bump `golang.org/x/term` from `0.16.0` to `0.17.0`
+* Bump `github.com/google/uuid` from `1.5.0` to `1.6.0`
+* Bump `github.com/yuin/goldmark` from `1.6.0` to `1.7.0`
+* Bump `golang.org/x/oauth2` from `0.15.0` to `0.17.0`
+* Bump `github.com/tdewolff/minify/v2` from `2.20.10` to `2.20.12`
+* Bump `golang.org/x/term` from `0.15.0` to `0.16.0`
+* Bump `github.com/prometheus/client_golang` from `1.17.0` to `1.18.0`
+* Bump `github.com/tdewolff/minify/v2` from `2.20.9` to `2.20.16`
+* Bump `golang.org/x/crypto` from `0.16.0` to `0.19.0`
+* Bump `github.com/go-webauthn/webauthn` from `0.9.4` to` 0.10.1`
+* Bump `golang.org/x/net` from `0.20.0` to `0.21.0`
+
 Version 2.0.51 (December 13, 2023)
 ----------------------------------
 
@@ -158,7 +939,7 @@ Version 2.0.47 (August 20, 2023)
 * Add new API endpoint: `/entries/{entryID}/save`
 * Trigger Docker and packages workflows only for semantic tags
     * Go module versioning expect Git tags to start with the letter v.
-    * The goal is to keep the existing naming convention for generated artifacts and 
+    * The goal is to keep the existing naming convention for generated artifacts and
     have proper versioning for the Go module.
 * Bump `golang.org/x/*` dependencies
 * Bump `github.com/yuin/goldmark`

Makefile

@@ -1,17 +1,18 @@
-APP          := miniflux
-DOCKER_IMAGE := miniflux/miniflux
-VERSION      := $(shell git describe --tags --abbrev=0)
-COMMIT       := $(shell git rev-parse --short HEAD)
-BUILD_DATE   := `date +%FT%T%z`
-LD_FLAGS     := "-s -w -X 'miniflux.app/v2/internal/version.Version=$(VERSION)' -X 'miniflux.app/v2/internal/version.Commit=$(COMMIT)' -X 'miniflux.app/v2/internal/version.BuildDate=$(BUILD_DATE)'"
-PKG_LIST     := $(shell go list ./... | grep -v /vendor/)
-DB_URL       := postgres://postgres:postgres@localhost/miniflux_test?sslmode=disable
-DEB_IMG_ARCH := amd64
+APP             := miniflux
+DOCKER_IMAGE    := miniflux/miniflux
+VERSION         := $(shell git describe --tags --abbrev=0 2>/dev/null)
+COMMIT          := $(shell git rev-parse --short HEAD 2>/dev/null)
+BUILD_DATE      := `date +%FT%T%z`
+LD_FLAGS        := "-s -w -X 'miniflux.app/v2/internal/version.Version=$(VERSION)' -X 'miniflux.app/v2/internal/version.Commit=$(COMMIT)' -X 'miniflux.app/v2/internal/version.BuildDate=$(BUILD_DATE)'"
+PKG_LIST        := $(shell go list ./... | grep -v /vendor/)
+DB_URL          := postgres://postgres:postgres@localhost/miniflux_test?sslmode=disable
+DOCKER_PLATFORM := amd64
 
 export PGPASSWORD := postgres
 
 .PHONY: \
 	miniflux \
+	miniflux-no-pie \
 	linux-amd64 \
 	linux-arm64 \
 	linux-armv7 \
@@ -43,37 +44,50 @@ export PGPASSWORD := postgres
 	debian-packages
 
 miniflux:
-	@ CGO_ENABLED=0 go build -buildmode=pie -ldflags=$(LD_FLAGS) -o $(APP) main.go
+	@ go build -buildmode=pie -ldflags=$(LD_FLAGS) -o $(APP) main.go
+
+miniflux-no-pie:
+	@ go build -ldflags=$(LD_FLAGS) -o $(APP) main.go
 
 linux-amd64:
 	@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-arm64:
 	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv7:
 	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv6:
 	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv5:
 	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 darwin-amd64:
 	@ GOOS=darwin GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 darwin-arm64:
 	@ GOOS=darwin GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 freebsd-amd64:
 	@ CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 openbsd-amd64:
 	@ GOOS=openbsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 windows-amd64:
-	@ GOOS=windows GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ GOOS=windows GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@.exe main.go
+	@ sha256sum $(APP)-$@.exe > $(APP)-$@.exe.sha256
 
 build: linux-amd64 linux-arm64 linux-armv7 linux-armv6 linux-armv5 darwin-amd64 darwin-arm64 freebsd-amd64 openbsd-amd64 windows-amd64
 
@@ -94,19 +108,31 @@ openbsd-x86:
 	@ GOOS=openbsd GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
 
 windows-x86:
-	@ GOOS=windows GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ GOOS=windows GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@.exe main.go
 
 run:
-	@ LOG_DATE_TIME=1 DEBUG=1 RUN_MIGRATIONS=1 CREATE_ADMIN=1 ADMIN_USERNAME=admin ADMIN_PASSWORD=test123 go run main.go
+	@ LOG_DATE_TIME=1 LOG_LEVEL=debug RUN_MIGRATIONS=1 CREATE_ADMIN=1 ADMIN_USERNAME=admin ADMIN_PASSWORD=test123 go run main.go
 
 clean:
-	@ rm -f $(APP)-* $(APP) $(APP)*.rpm $(APP)*.deb
+	@ rm -f $(APP)-* $(APP) $(APP)*.rpm $(APP)*.deb $(APP)*.exe $(APP)*.sha256
+
+.PHONY: add-string
+add-string:
+	cd internal/locale/translations && \
+	for file in *.json; do \
+		jq --indent 4 --arg key "$(KEY)" --arg val "$(VAL)" \
+		   '. + {($$key): $$val} | to_entries | sort_by(.key) | from_entries' "$$file" > tmp && \
+		mv tmp "$$file"; \
+	done
+
 
 test:
 	go test -cover -race -count=1 ./...
 
 lint:
-	golint -set_exit_status ${PKG_LIST}
+	go vet ./...
+	staticcheck ./...
+	golangci-lint run --disable errcheck --enable sqlclosecheck --enable misspell --enable gofmt --enable goimports --enable whitespace
 
 integration-test:
 	psql -U postgres -c 'drop database if exists miniflux_test;'
@@ -118,11 +144,15 @@ integration-test:
 	ADMIN_PASSWORD=test123 \
 	CREATE_ADMIN=1 \
 	RUN_MIGRATIONS=1 \
-	DEBUG=1 \
+	LOG_LEVEL=debug \
 	./miniflux-test >/tmp/miniflux.log 2>&1 & echo "$$!" > "/tmp/miniflux.pid"
-	
+
 	while ! nc -z localhost 8080; do sleep 1; done
-	go test -v -tags=integration -count=1 miniflux.app/v2/internal/tests
+
+	TEST_MINIFLUX_BASE_URL=http://127.0.0.1:8080 \
+	TEST_MINIFLUX_ADMIN_USERNAME=admin \
+	TEST_MINIFLUX_ADMIN_PASSWORD=test123 \
+	go test -v -count=1 ./internal/api
 
 clean-integration-test:
 	@ kill -9 `cat /tmp/miniflux.pid`
@@ -153,15 +183,15 @@ rpm: clean
 		rpmbuild -bb --define "_miniflux_version $(VERSION)" /root/rpmbuild/SPECS/miniflux.spec
 
 debian:
-	@ docker build --load \
-		--build-arg BASE_IMAGE_ARCH=$(DEB_IMG_ARCH) \
-		-t $(DEB_IMG_ARCH)/miniflux-deb-builder \
+	@ docker buildx build --load \
+		--platform linux/$(DOCKER_PLATFORM) \
+		-t miniflux-deb-builder \
 		-f packaging/debian/Dockerfile \
 		.
-	@ docker run --rm \
-		-v ${PWD}:/pkg $(DEB_IMG_ARCH)/miniflux-deb-builder
+	@ docker run --rm --platform linux/$(DOCKER_PLATFORM) \
+		-v ${PWD}:/pkg miniflux-deb-builder
 
 debian-packages: clean
-	$(MAKE) debian DEB_IMG_ARCH=amd64
-	$(MAKE) debian DEB_IMG_ARCH=arm64v8
-	$(MAKE) debian DEB_IMG_ARCH=arm32v7
+	$(MAKE) debian DOCKER_PLATFORM=amd64
+	$(MAKE) debian DOCKER_PLATFORM=arm64
+	$(MAKE) debian DOCKER_PLATFORM=arm/v7

README.md

@@ -1,20 +1,114 @@
 Miniflux 2
 ==========
 
-Miniflux is a minimalist and opinionated feed reader:
-
-- Written in Go (Golang)
-- Works only with Postgresql
-- Doesn't use any ORM
-- Doesn't use any complicated framework
-- Use only modern vanilla Javascript (ES6 and Fetch API)
-- Single binary compiled statically without dependency
-- The number of features is voluntarily limited
-
+Miniflux is a minimalist and opinionated feed reader.
 It's simple, fast, lightweight and super easy to install.
 
 Official website: <https://miniflux.app>
 
+Features
+--------
+
+### Feed Reader
+
+- Supported feed formats: Atom 0.3/1.0, RSS 1.0/2.0, and JSON Feed 1.0/1.1.
+- [OPML](https://en.wikipedia.org/wiki/OPML) file import/export and URL import.
+- Supports multiple attachments (podcasts, videos, music, and images enclosures).
+- Plays videos from YouTube directly inside Miniflux.
+- Organizes articles using categories and bookmarks.
+- Share individual articles publicly.
+- Fetches website icons (favicons).
+- Saves articles to third-party services.
+- Provides full-text search (powered by Postgres).
+- Available in 20 languages: Portuguese (Brazilian), Chinese (Simplified and Traditional), Dutch, English (US), Finnish, French, German, Greek, Hindi, Indonesian, Italian, Japanese, Polish, Romanian, Russian, Taiwanese POJ, Ukrainian, Spanish, and Turkish.
+
+### Privacy and Security
+
+- Removes pixel trackers.
+- Strips tracking parameters from URLs (e.g., `utm_source`, `utm_medium`, `utm_campaign`, `fbclid`, etc.).
+- Retrieves original links when feeds are sourced from FeedBurner.
+- Opens external links with attributes `rel="noopener noreferrer" referrerpolicy="no-referrer"` for improved security.
+- Implements the HTTP header `Referrer-Policy: no-referrer` to prevent referrer leakage.
+- Provides a media proxy to avoid tracking and resolve mixed content warnings when using HTTPS.
+- Plays YouTube videos via the privacy-focused domain `youtube-nocookie.com`.
+- Supports alternative YouTube video players such as [Invidious](https://invidio.us).
+- Blocks external JavaScript to prevent tracking and enhance security.
+- Sanitizes external content before rendering it.
+- Enforces a [Content Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and a [Trusted Types Policy](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) to only application JavaScript and blocks inline scripts and styles. 
+
+### Bot Protection Bypass Mechanisms
+
+- Optionally disable HTTP/2 to mitigate fingerprinting.
+- Allows configuration of a custom user agent.
+- Supports adding custom cookies for specific use cases.
+- Enables the use of proxies for enhanced privacy or bypassing restrictions.
+
+### Content Manipulation
+
+- Fetches the original article and extracts only the relevant content using a local Readability parser.
+- Allows custom scraper rules based on <abbr title="Cascading Style Sheets">CSS</abbr> selectors.
+- Supports custom rewriting rules for content manipulation.
+- Provides a regex filter to include or exclude articles based on specific patterns.
+- Optionally permits self-signed or invalid certificates (disabled by default).
+- Scrapes YouTube's website to retrieve video duration as read time or uses the YouTube API (disabled by default).
+
+### User Interface
+
+- Optimized stylesheet for readability.
+- Responsive design that adapts seamlessly to desktop, tablet, and mobile devices.
+- Minimalistic and distraction-free user interface.
+- No requirement to download an app from Apple App Store or Google Play Store.
+- Can be added directly to the home screen for quick access.
+- Supports a wide range of keyboard shortcuts for efficient navigation.
+- Optional touch gesture support for navigation on mobile devices.
+- Custom stylesheets and JavaScript to personalize the user interface to your preferences.
+- Themes:
+    - Light (Sans-Serif)
+    - Light (Serif)
+    - Dark (Sans-Serif)
+    - Dark (Serif)
+    - System (Sans-Serif) – Automatically switches between Dark and Light themes based on system preferences.
+    - System (Serif)
+
+### Integrations
+
+- 25+ integrations with third-party services: [Apprise](https://github.com/caronc/apprise), [Betula](https://sr.ht/~bouncepaw/betula/), [Cubox](https://cubox.cc/), [Discord](https://discord.com/), [Espial](https://github.com/jonschoning/espial), [Instapaper](https://www.instapaper.com/), [LinkAce](https://www.linkace.org/), [Linkding](https://github.com/sissbruecker/linkding), [LinkWarden](https://linkwarden.app/), [Matrix](https://matrix.org), [Notion](https://www.notion.com/), [Ntfy](https://ntfy.sh/), [Nunux Keeper](https://keeper.nunux.org/), [Pinboard](https://pinboard.in/), [Pushover](https://pushover.net), [RainDrop](https://raindrop.io/), [Readeck](https://readeck.org/en/), [Readwise Reader](https://readwise.io/read), [RssBridge](https://rss-bridge.org/), [Shaarli](https://github.com/shaarli/Shaarli), [Shiori](https://github.com/go-shiori/shiori), [Slack](https://slack.com/), [Telegram](https://telegram.org), [Wallabag](https://www.wallabag.org/), etc.
+- Bookmarklet for subscribing to websites directly from any web browser.
+- Webhooks for real-time notifications or custom integrations.
+- Compatibility with existing mobile applications using the Fever or Google Reader API.
+- REST API with client libraries available in [Go](https://github.com/miniflux/v2/tree/main/client) and [Python](https://github.com/miniflux/python-client).
+
+### Authentication
+
+- Local username and password.
+- Passkeys ([WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)).
+- Google (OAuth2).
+- Generic OpenID Connect.
+- Reverse-Proxy authentication.
+
+### Technical Stuff
+
+- Written in [Go (Golang)](https://golang.org/).
+- Single binary compiled statically without dependency.
+- Works only with [PostgreSQL](https://www.postgresql.org/).
+- Does not use any ORM or any complicated frameworks.
+- Uses modern vanilla JavaScript only when necessary.
+- All static files are bundled into the application binary using the Go `embed` package.
+- Supports the Systemd `sd_notify` protocol for process monitoring.
+- Configures HTTPS automatically with Let's Encrypt.
+- Allows the use of custom <abbr title="Secure Sockets Layer">SSL</abbr> certificates.
+- Supports [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) when TLS is enabled.
+- Updates feeds in the background using an internal scheduler or a traditional cron job.
+- Uses native lazy loading for images and iframes.
+- Compatible only with modern browsers.
+- Adheres to the [Twelve-Factor App](https://12factor.net/) methodology.
+- Provides official Debian/RPM packages and pre-built binaries.
+- Publishes a Docker image to Docker Hub, GitHub Registry, and Quay.io Registry, with ARM architecture support.
+- Uses a limited amount of third-party go dependencies
+- Has a comprehensive testsuite, with both unit tests and integration tests.
+- Only uses a couple of MB of memory and a negligible amount of CPU, even with several hundreds of feeds.
+- Respects/sends Last-Modified, If-Modified-Since, If-None-Match, Cache-Control, Expires and ETags headers, and has a default polling interval of 1h.
+
 Documentation
 -------------
 
@@ -29,7 +123,7 @@ The Miniflux documentation is available here: <https://miniflux.app/docs/> ([Man
 - [Command Line Usage](https://miniflux.app/docs/cli.html)
 - [User Interface Usage](https://miniflux.app/docs/ui.html)
 - [Keyboard Shortcuts](https://miniflux.app/docs/keyboard_shortcuts.html)
-- [Integration with External Services](https://miniflux.app/docs/services.html)
+- [Integration with External Services](https://miniflux.app/docs/#integrations)
 - [Rewrite and Scraper Rules](https://miniflux.app/docs/rules.html)
 - [API Reference](https://miniflux.app/docs/api.html)
 - [Development](https://miniflux.app/docs/development.html)

client/README.md

@@ -27,10 +27,10 @@ import (
 
 func main() {
     // Authentication with username/password:
-    client := miniflux.New("https://api.example.org", "admin", "secret")
+    client := miniflux.NewClient("https://api.example.org", "admin", "secret")
 
     // Authentication with an API Key:
-    client := miniflux.New("https://api.example.org", "my-secret-token")
+    client := miniflux.NewClient("https://api.example.org", "my-secret-token")
 
     // Fetch all feeds.
     feeds, err := client.Feeds()

client/client.go

@@ -18,16 +18,45 @@ type Client struct {
 }
 
 // New returns a new Miniflux client.
+//
+// Deprecated: use NewClient instead.
 func New(endpoint string, credentials ...string) *Client {
-	// Web gives "API Endpoint = https://miniflux.app/v1/", it doesn't work (/v1/v1/me)
+	return NewClient(endpoint, credentials...)
+}
+
+// NewClient returns a new Miniflux client.
+func NewClient(endpoint string, credentials ...string) *Client {
+	// Trim trailing slashes and /v1 from the endpoint.
 	endpoint = strings.TrimSuffix(endpoint, "/")
 	endpoint = strings.TrimSuffix(endpoint, "/v1")
-	// trim to https://miniflux.app
-
-	if len(credentials) == 2 {
+	switch len(credentials) {
+	case 2:
 		return &Client{request: &request{endpoint: endpoint, username: credentials[0], password: credentials[1]}}
+	case 1:
+		return &Client{request: &request{endpoint: endpoint, apiKey: credentials[0]}}
+	default:
+		return &Client{request: &request{endpoint: endpoint}}
 	}
-	return &Client{request: &request{endpoint: endpoint, apiKey: credentials[0]}}
+}
+
+// Healthcheck checks if the application is up and running.
+func (c *Client) Healthcheck() error {
+	body, err := c.request.Get("/healthcheck")
+	if err != nil {
+		return fmt.Errorf("miniflux: unable to perform healthcheck: %w", err)
+	}
+	defer body.Close()
+
+	responseBodyContent, err := io.ReadAll(body)
+	if err != nil {
+		return fmt.Errorf("miniflux: unable to read healthcheck response: %w", err)
+	}
+
+	if string(responseBodyContent) != "OK" {
+		return fmt.Errorf("miniflux: invalid healthcheck response: %q", responseBodyContent)
+	}
+
+	return nil
 }
 
 // Version returns the version of the Miniflux instance.
@@ -151,12 +180,70 @@ func (c *Client) DeleteUser(userID int64) error {
 	return c.request.Delete(fmt.Sprintf("/v1/users/%d", userID))
 }
 
+// APIKeys returns all API keys for the authenticated user.
+func (c *Client) APIKeys() (APIKeys, error) {
+	body, err := c.request.Get("/v1/api-keys")
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var apiKeys APIKeys
+	if err := json.NewDecoder(body).Decode(&apiKeys); err != nil {
+		return nil, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return apiKeys, nil
+}
+
+// CreateAPIKey creates a new API key for the authenticated user.
+func (c *Client) CreateAPIKey(description string) (*APIKey, error) {
+	body, err := c.request.Post("/v1/api-keys", &APIKeyCreationRequest{
+		Description: description,
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var apiKey *APIKey
+	if err := json.NewDecoder(body).Decode(&apiKey); err != nil {
+		return nil, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return apiKey, nil
+}
+
+// DeleteAPIKey removes an API key for the authenticated user.
+func (c *Client) DeleteAPIKey(apiKeyID int64) error {
+	return c.request.Delete(fmt.Sprintf("/v1/api-keys/%d", apiKeyID))
+}
+
 // MarkAllAsRead marks all unread entries as read for a given user.
 func (c *Client) MarkAllAsRead(userID int64) error {
 	_, err := c.request.Put(fmt.Sprintf("/v1/users/%d/mark-all-as-read", userID), nil)
 	return err
 }
 
+// IntegrationsStatus fetches the integrations status for the logged user.
+func (c *Client) IntegrationsStatus() (bool, error) {
+	body, err := c.request.Get("/v1/integrations/status")
+	if err != nil {
+		return false, err
+	}
+	defer body.Close()
+
+	var response struct {
+		HasIntegrations bool `json:"has_integrations"`
+	}
+
+	if err := json.NewDecoder(body).Decode(&response); err != nil {
+		return false, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return response.HasIntegrations, nil
+}
+
 // Discover try to find subscriptions from a website.
 func (c *Client) Discover(url string) (Subscriptions, error) {
 	body, err := c.request.Post("/v1/discover", map[string]string{"url": url})
@@ -191,8 +278,8 @@ func (c *Client) Categories() (Categories, error) {
 
 // CreateCategory creates a new category.
 func (c *Client) CreateCategory(title string) (*Category, error) {
-	body, err := c.request.Post("/v1/categories", map[string]interface{}{
-		"title": title,
+	body, err := c.request.Post("/v1/categories", &CategoryCreationRequest{
+		Title: title,
 	})
 	if err != nil {
 		return nil, err
@@ -207,10 +294,25 @@ func (c *Client) CreateCategory(title string) (*Category, error) {
 	return category, nil
 }
 
+// CreateCategoryWithOptions creates a new category with options.
+func (c *Client) CreateCategoryWithOptions(createRequest *CategoryCreationRequest) (*Category, error) {
+	body, err := c.request.Post("/v1/categories", createRequest)
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var category *Category
+	if err := json.NewDecoder(body).Decode(&category); err != nil {
+		return nil, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+	return category, nil
+}
+
 // UpdateCategory updates a category.
 func (c *Client) UpdateCategory(categoryID int64, title string) (*Category, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/categories/%d", categoryID), map[string]interface{}{
-		"title": title,
+	body, err := c.request.Put(fmt.Sprintf("/v1/categories/%d", categoryID), &CategoryModificationRequest{
+		Title: SetOptionalField(title),
 	})
 	if err != nil {
 		return nil, err
@@ -225,6 +327,22 @@ func (c *Client) UpdateCategory(categoryID int64, title string) (*Category, erro
 	return category, nil
 }
 
+// UpdateCategoryWithOptions updates a category with options.
+func (c *Client) UpdateCategoryWithOptions(categoryID int64, categoryChanges *CategoryModificationRequest) (*Category, error) {
+	body, err := c.request.Put(fmt.Sprintf("/v1/categories/%d", categoryID), categoryChanges)
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var category *Category
+	if err := json.NewDecoder(body).Decode(&category); err != nil {
+		return nil, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return category, nil
+}
+
 // MarkCategoryAsRead marks all unread entries in a category as read.
 func (c *Client) MarkCategoryAsRead(categoryID int64) error {
 	_, err := c.request.Put(fmt.Sprintf("/v1/categories/%d/mark-all-as-read", categoryID), nil)
@@ -528,6 +646,25 @@ func (c *Client) SaveEntry(entryID int64) error {
 	return err
 }
 
+// FetchEntryOriginalContent fetches the original content of an entry using the scraper.
+func (c *Client) FetchEntryOriginalContent(entryID int64) (string, error) {
+	body, err := c.request.Get(fmt.Sprintf("/v1/entries/%d/fetch-content", entryID))
+	if err != nil {
+		return "", err
+	}
+	defer body.Close()
+
+	var response struct {
+		Content string `json:"content"`
+	}
+
+	if err := json.NewDecoder(body).Decode(&response); err != nil {
+		return "", fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return response.Content, nil
+}
+
 // FetchCounters fetches feed counters.
 func (c *Client) FetchCounters() (*FeedCounters, error) {
 	body, err := c.request.Get("/v1/feeds/counters")
@@ -566,6 +703,28 @@ func (c *Client) Icon(iconID int64) (*FeedIcon, error) {
 	return feedIcon, nil
 }
 
+// Enclosure fetches a specific enclosure.
+func (c *Client) Enclosure(enclosureID int64) (*Enclosure, error) {
+	body, err := c.request.Get(fmt.Sprintf("/v1/enclosures/%d", enclosureID))
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var enclosure *Enclosure
+	if err := json.NewDecoder(body).Decode(&enclosure); err != nil {
+		return nil, fmt.Errorf("miniflux: response error(%v)", err)
+	}
+
+	return enclosure, nil
+}
+
+// UpdateEnclosure updates an enclosure.
+func (c *Client) UpdateEnclosure(enclosureID int64, enclosureUpdate *EnclosureUpdateRequest) error {
+	_, err := c.request.Put(fmt.Sprintf("/v1/enclosures/%d", enclosureID), enclosureUpdate)
+	return err
+}
+
 func buildFilterQueryString(path string, filter *Filter) string {
 	if filter != nil {
 		values := url.Values{}
@@ -638,6 +797,10 @@ func buildFilterQueryString(path string, filter *Filter) string {
 			values.Set("feed_id", strconv.FormatInt(filter.FeedID, 10))
 		}
 
+		if filter.GloballyVisible {
+			values.Set("globally_visible", "true")
+		}
+
 		for _, status := range filter.Statuses {
 			values.Add("status", status)
 		}

client/doc.go

@@ -12,7 +12,7 @@ This code snippet fetch the list of users:
 		miniflux "miniflux.app/v2/client"
 	)
 
-	client := miniflux.New("https://api.example.org", "admin", "secret")
+	client := miniflux.NewClient("https://api.example.org", "admin", "secret")
 	users, err := client.Users()
 	if err != nil {
 		fmt.Println(err)

client/model.go

@@ -17,30 +17,37 @@ const (
 
 // User represents a user in the system.
 type User struct {
-	ID                     int64      `json:"id"`
-	Username               string     `json:"username"`
-	Password               string     `json:"password,omitempty"`
-	IsAdmin                bool       `json:"is_admin"`
-	Theme                  string     `json:"theme"`
-	Language               string     `json:"language"`
-	Timezone               string     `json:"timezone"`
-	EntryDirection         string     `json:"entry_sorting_direction"`
-	EntryOrder             string     `json:"entry_sorting_order"`
-	Stylesheet             string     `json:"stylesheet"`
-	GoogleID               string     `json:"google_id"`
-	OpenIDConnectID        string     `json:"openid_connect_id"`
-	EntriesPerPage         int        `json:"entries_per_page"`
-	KeyboardShortcuts      bool       `json:"keyboard_shortcuts"`
-	ShowReadingTime        bool       `json:"show_reading_time"`
-	EntrySwipe             bool       `json:"entry_swipe"`
-	GestureNav             string     `json:"gesture_nav"`
-	LastLoginAt            *time.Time `json:"last_login_at"`
-	DisplayMode            string     `json:"display_mode"`
-	DefaultReadingSpeed    int        `json:"default_reading_speed"`
-	CJKReadingSpeed        int        `json:"cjk_reading_speed"`
-	DefaultHomePage        string     `json:"default_home_page"`
-	CategoriesSortingOrder string     `json:"categories_sorting_order"`
-	MarkReadOnView         bool       `json:"mark_read_on_view"`
+	ID                        int64      `json:"id"`
+	Username                  string     `json:"username"`
+	Password                  string     `json:"password,omitempty"`
+	IsAdmin                   bool       `json:"is_admin"`
+	Theme                     string     `json:"theme"`
+	Language                  string     `json:"language"`
+	Timezone                  string     `json:"timezone"`
+	EntryDirection            string     `json:"entry_sorting_direction"`
+	EntryOrder                string     `json:"entry_sorting_order"`
+	Stylesheet                string     `json:"stylesheet"`
+	CustomJS                  string     `json:"custom_js"`
+	GoogleID                  string     `json:"google_id"`
+	OpenIDConnectID           string     `json:"openid_connect_id"`
+	EntriesPerPage            int        `json:"entries_per_page"`
+	KeyboardShortcuts         bool       `json:"keyboard_shortcuts"`
+	ShowReadingTime           bool       `json:"show_reading_time"`
+	EntrySwipe                bool       `json:"entry_swipe"`
+	GestureNav                string     `json:"gesture_nav"`
+	LastLoginAt               *time.Time `json:"last_login_at"`
+	DisplayMode               string     `json:"display_mode"`
+	DefaultReadingSpeed       int        `json:"default_reading_speed"`
+	CJKReadingSpeed           int        `json:"cjk_reading_speed"`
+	DefaultHomePage           string     `json:"default_home_page"`
+	CategoriesSortingOrder    string     `json:"categories_sorting_order"`
+	MarkReadOnView            bool       `json:"mark_read_on_view"`
+	MediaPlaybackRate         float64    `json:"media_playback_rate"`
+	BlockFilterEntryRules     string     `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules      string     `json:"keep_filter_entry_rules"`
+	ExternalFontHosts         string     `json:"external_font_hosts"`
+	AlwaysOpenExternalLinks   bool       `json:"always_open_external_links"`
+	OpenExternalLinksInNewTab bool       `json:"open_external_links_in_new_tab"`
 }
 
 func (u User) String() string {
@@ -58,28 +65,35 @@ type UserCreationRequest struct {
 
 // UserModificationRequest represents the request to update a user.
 type UserModificationRequest struct {
-	Username               *string `json:"username"`
-	Password               *string `json:"password"`
-	IsAdmin                *bool   `json:"is_admin"`
-	Theme                  *string `json:"theme"`
-	Language               *string `json:"language"`
-	Timezone               *string `json:"timezone"`
-	EntryDirection         *string `json:"entry_sorting_direction"`
-	EntryOrder             *string `json:"entry_sorting_order"`
-	Stylesheet             *string `json:"stylesheet"`
-	GoogleID               *string `json:"google_id"`
-	OpenIDConnectID        *string `json:"openid_connect_id"`
-	EntriesPerPage         *int    `json:"entries_per_page"`
-	KeyboardShortcuts      *bool   `json:"keyboard_shortcuts"`
-	ShowReadingTime        *bool   `json:"show_reading_time"`
-	EntrySwipe             *bool   `json:"entry_swipe"`
-	GestureNav             *string `json:"gesture_nav"`
-	DisplayMode            *string `json:"display_mode"`
-	DefaultReadingSpeed    *int    `json:"default_reading_speed"`
-	CJKReadingSpeed        *int    `json:"cjk_reading_speed"`
-	DefaultHomePage        *string `json:"default_home_page"`
-	CategoriesSortingOrder *string `json:"categories_sorting_order"`
-	MarkReadOnView         *bool   `json:"mark_read_on_view"`
+	Username                  *string  `json:"username"`
+	Password                  *string  `json:"password"`
+	IsAdmin                   *bool    `json:"is_admin"`
+	Theme                     *string  `json:"theme"`
+	Language                  *string  `json:"language"`
+	Timezone                  *string  `json:"timezone"`
+	EntryDirection            *string  `json:"entry_sorting_direction"`
+	EntryOrder                *string  `json:"entry_sorting_order"`
+	Stylesheet                *string  `json:"stylesheet"`
+	CustomJS                  *string  `json:"custom_js"`
+	GoogleID                  *string  `json:"google_id"`
+	OpenIDConnectID           *string  `json:"openid_connect_id"`
+	EntriesPerPage            *int     `json:"entries_per_page"`
+	KeyboardShortcuts         *bool    `json:"keyboard_shortcuts"`
+	ShowReadingTime           *bool    `json:"show_reading_time"`
+	EntrySwipe                *bool    `json:"entry_swipe"`
+	GestureNav                *string  `json:"gesture_nav"`
+	DisplayMode               *string  `json:"display_mode"`
+	DefaultReadingSpeed       *int     `json:"default_reading_speed"`
+	CJKReadingSpeed           *int     `json:"cjk_reading_speed"`
+	DefaultHomePage           *string  `json:"default_home_page"`
+	CategoriesSortingOrder    *string  `json:"categories_sorting_order"`
+	MarkReadOnView            *bool    `json:"mark_read_on_view"`
+	MediaPlaybackRate         *float64 `json:"media_playback_rate"`
+	BlockFilterEntryRules     *string  `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules      *string  `json:"keep_filter_entry_rules"`
+	ExternalFontHosts         *string  `json:"external_font_hosts"`
+	AlwaysOpenExternalLinks   *bool    `json:"always_open_external_links"`
+	OpenExternalLinksInNewTab *bool    `json:"open_external_links_in_new_tab"`
 }
 
 // Users represents a list of users.
@@ -87,9 +101,12 @@ type Users []User
 
 // Category represents a feed category.
 type Category struct {
-	ID     int64  `json:"id,omitempty"`
-	Title  string `json:"title,omitempty"`
-	UserID int64  `json:"user_id,omitempty"`
+	ID           int64  `json:"id"`
+	Title        string `json:"title"`
+	UserID       int64  `json:"user_id,omitempty"`
+	HideGlobally bool   `json:"hide_globally,omitempty"`
+	FeedCount    *int   `json:"feed_count,omitempty"`
+	TotalUnread  *int   `json:"total_unread,omitempty"`
 }
 
 func (c Category) String() string {
@@ -99,6 +116,18 @@ func (c Category) String() string {
 // Categories represents a list of categories.
 type Categories []*Category
 
+// CategoryCreationRequest represents the request to create a category.
+type CategoryCreationRequest struct {
+	Title        string `json:"title"`
+	HideGlobally bool   `json:"hide_globally"`
+}
+
+// CategoryModificationRequest represents the request to update a category.
+type CategoryModificationRequest struct {
+	Title        *string `json:"title"`
+	HideGlobally *bool   `json:"hide_globally"`
+}
+
 // Subscription represents a feed subscription.
 type Subscription struct {
 	Title string `json:"title"`
@@ -107,7 +136,7 @@ type Subscription struct {
 }
 
 func (s Subscription) String() string {
-	return fmt.Sprintf(`Title="%s", URL="%s", Type="%s"`, s.Title, s.URL, s.Type)
+	return fmt.Sprintf(`Title=%q, URL=%q, Type=%q`, s.Title, s.URL, s.Type)
 }
 
 // Subscriptions represents a list of subscriptions.
@@ -131,8 +160,11 @@ type Feed struct {
 	FetchViaProxy               bool      `json:"fetch_via_proxy"`
 	ScraperRules                string    `json:"scraper_rules"`
 	RewriteRules                string    `json:"rewrite_rules"`
+	UrlRewriteRules             string    `json:"urlrewrite_rules"`
 	BlocklistRules              string    `json:"blocklist_rules"`
 	KeeplistRules               string    `json:"keeplist_rules"`
+	BlockFilterEntryRules       string    `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        string    `json:"keep_filter_entry_rules"`
 	Crawler                     bool      `json:"crawler"`
 	UserAgent                   string    `json:"user_agent"`
 	Cookie                      string    `json:"cookie"`
@@ -140,6 +172,8 @@ type Feed struct {
 	Password                    string    `json:"password"`
 	Category                    *Category `json:"category,omitempty"`
 	HideGlobally                bool      `json:"hide_globally"`
+	DisableHTTP2                bool      `json:"disable_http2"`
+	ProxyURL                    string    `json:"proxy_url"`
 }
 
 // FeedCreationRequest represents the request to create a feed.
@@ -157,9 +191,14 @@ type FeedCreationRequest struct {
 	FetchViaProxy               bool   `json:"fetch_via_proxy"`
 	ScraperRules                string `json:"scraper_rules"`
 	RewriteRules                string `json:"rewrite_rules"`
+	UrlRewriteRules             string `json:"urlrewrite_rules"`
 	BlocklistRules              string `json:"blocklist_rules"`
 	KeeplistRules               string `json:"keeplist_rules"`
+	BlockFilterEntryRules       string `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        string `json:"keep_filter_entry_rules"`
 	HideGlobally                bool   `json:"hide_globally"`
+	DisableHTTP2                bool   `json:"disable_http2"`
+	ProxyURL                    string `json:"proxy_url"`
 }
 
 // FeedModificationRequest represents the request to update a feed.
@@ -169,8 +208,11 @@ type FeedModificationRequest struct {
 	Title                       *string `json:"title"`
 	ScraperRules                *string `json:"scraper_rules"`
 	RewriteRules                *string `json:"rewrite_rules"`
+	UrlRewriteRules             *string `json:"urlrewrite_rules"`
 	BlocklistRules              *string `json:"blocklist_rules"`
 	KeeplistRules               *string `json:"keeplist_rules"`
+	BlockFilterEntryRules       *string `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        *string `json:"keep_filter_entry_rules"`
 	Crawler                     *bool   `json:"crawler"`
 	UserAgent                   *string `json:"user_agent"`
 	Cookie                      *string `json:"cookie"`
@@ -182,6 +224,8 @@ type FeedModificationRequest struct {
 	AllowSelfSignedCertificates *bool   `json:"allow_self_signed_certificates"`
 	FetchViaProxy               *bool   `json:"fetch_via_proxy"`
 	HideGlobally                *bool   `json:"hide_globally"`
+	DisableHTTP2                *bool   `json:"disable_http2"`
+	ProxyURL                    *string `json:"proxy_url"`
 }
 
 // FeedIcon represents the feed icon.
@@ -202,24 +246,24 @@ type Feeds []*Feed
 // Entry represents a subscription item in the system.
 type Entry struct {
 	ID          int64      `json:"id"`
-	UserID      int64      `json:"user_id"`
-	FeedID      int64      `json:"feed_id"`
-	Status      string     `json:"status"`
+	Date        time.Time  `json:"published_at"`
+	ChangedAt   time.Time  `json:"changed_at"`
+	CreatedAt   time.Time  `json:"created_at"`
+	Feed        *Feed      `json:"feed,omitempty"`
 	Hash        string     `json:"hash"`
-	Title       string     `json:"title"`
 	URL         string     `json:"url"`
 	CommentsURL string     `json:"comments_url"`
-	Date        time.Time  `json:"published_at"`
-	CreatedAt   time.Time  `json:"created_at"`
-	ChangedAt   time.Time  `json:"changed_at"`
+	Title       string     `json:"title"`
+	Status      string     `json:"status"`
 	Content     string     `json:"content"`
 	Author      string     `json:"author"`
 	ShareCode   string     `json:"share_code"`
-	Starred     bool       `json:"starred"`
-	ReadingTime int        `json:"reading_time"`
 	Enclosures  Enclosures `json:"enclosures,omitempty"`
-	Feed        *Feed      `json:"feed,omitempty"`
 	Tags        []string   `json:"tags"`
+	ReadingTime int        `json:"reading_time"`
+	UserID      int64      `json:"user_id"`
+	FeedID      int64      `json:"feed_id"`
+	Starred     bool       `json:"starred"`
 }
 
 // EntryModificationRequest represents a request to modify an entry.
@@ -233,12 +277,17 @@ type Entries []*Entry
 
 // Enclosure represents an attachment.
 type Enclosure struct {
-	ID       int64  `json:"id"`
-	UserID   int64  `json:"user_id"`
-	EntryID  int64  `json:"entry_id"`
-	URL      string `json:"url"`
-	MimeType string `json:"mime_type"`
-	Size     int    `json:"size"`
+	ID               int64  `json:"id"`
+	UserID           int64  `json:"user_id"`
+	EntryID          int64  `json:"entry_id"`
+	URL              string `json:"url"`
+	MimeType         string `json:"mime_type"`
+	Size             int    `json:"size"`
+	MediaProgression int64  `json:"media_progression"`
+}
+
+type EnclosureUpdateRequest struct {
+	MediaProgression int64 `json:"media_progression"`
 }
 
 // Enclosures represents a list of attachments.
@@ -269,6 +318,7 @@ type Filter struct {
 	CategoryID      int64
 	FeedID          int64
 	Statuses        []string
+	GloballyVisible bool
 }
 
 // EntryResultSet represents the response when fetching entries.
@@ -287,3 +337,25 @@ type VersionResponse struct {
 	Arch      string `json:"arch"`
 	OS        string `json:"os"`
 }
+
+// APIKey represents an application API key.
+type APIKey struct {
+	ID          int64      `json:"id"`
+	UserID      int64      `json:"user_id"`
+	Token       string     `json:"token"`
+	Description string     `json:"description"`
+	LastUsedAt  *time.Time `json:"last_used_at"`
+	CreatedAt   time.Time  `json:"created_at"`
+}
+
+// APIKeys represents a collection of API keys.
+type APIKeys []*APIKey
+
+// APIKeyCreationRequest represents the request to create an API key.
+type APIKeyCreationRequest struct {
+	Description string `json:"description"`
+}
+
+func SetOptionalField[T any](value T) *T {
+	return &value
+}

client/request.go

@@ -26,6 +26,8 @@ var (
 	ErrForbidden     = errors.New("miniflux: access forbidden")
 	ErrServerError   = errors.New("miniflux: internal server error")
 	ErrNotFound      = errors.New("miniflux: resource not found")
+	ErrBadRequest    = errors.New("miniflux: bad request")
+	ErrEmptyEndpoint = errors.New("miniflux: empty endpoint provided")
 )
 
 type errorResponse struct {
@@ -61,6 +63,9 @@ func (r *request) Delete(path string) error {
 }
 
 func (r *request) execute(method, path string, data interface{}) (io.ReadCloser, error) {
+	if r.endpoint == "" {
+		return nil, ErrEmptyEndpoint
+	}
 	if r.endpoint[len(r.endpoint)-1:] == "/" {
 		r.endpoint = r.endpoint[:len(r.endpoint)-1]
 	}
@@ -124,10 +129,10 @@ func (r *request) execute(method, path string, data interface{}) (io.ReadCloser,
 		var resp errorResponse
 		decoder := json.NewDecoder(response.Body)
 		if err := decoder.Decode(&resp); err != nil {
-			return nil, fmt.Errorf("miniflux: bad request error (%v)", err)
+			return nil, fmt.Errorf("%w (%v)", ErrBadRequest, err)
 		}
 
-		return nil, fmt.Errorf("miniflux: bad request (%s)", resp.ErrorMessage)
+		return nil, fmt.Errorf("%w (%s)", ErrBadRequest, resp.ErrorMessage)
 	}
 
 	if response.StatusCode > 400 {
@@ -140,7 +145,7 @@ func (r *request) execute(method, path string, data interface{}) (io.ReadCloser,
 
 func (r *request) buildClient() http.Client {
 	return http.Client{
-		Timeout: time.Duration(defaultTimeout * time.Second),
+		Timeout: defaultTimeout * time.Second,
 	}
 }
 

contrib/docker-compose/basic.yml

@@ -24,6 +24,7 @@ services:
     environment:
       - POSTGRES_USER=miniflux
       - POSTGRES_PASSWORD=secret
+      - POSTGRES_DB=miniflux
     volumes:
       - miniflux-db:/var/lib/postgresql/data
     healthcheck:

go.mod

@@ -1,49 +1,49 @@
 module miniflux.app/v2
 
-// +heroku goVersion go1.21
+// +heroku goVersion go1.24
 
 require (
-	github.com/PuerkitoBio/goquery v1.8.1
-	github.com/abadojack/whatlanggo v1.0.1
-	github.com/coreos/go-oidc/v3 v3.9.0
-	github.com/go-webauthn/webauthn v0.9.4
-	github.com/google/uuid v1.5.0
+	github.com/PuerkitoBio/goquery v1.10.3
+	github.com/andybalholm/brotli v1.1.1
+	github.com/coreos/go-oidc/v3 v3.14.1
+	github.com/go-webauthn/webauthn v0.13.0
 	github.com/gorilla/mux v1.8.1
 	github.com/lib/pq v1.10.9
-	github.com/prometheus/client_golang v1.17.0
-	github.com/tdewolff/minify/v2 v2.20.9
-	github.com/yuin/goldmark v1.6.0
-	golang.org/x/crypto v0.16.0
-	golang.org/x/net v0.19.0
-	golang.org/x/oauth2 v0.15.0
-	golang.org/x/term v0.15.0
-	mvdan.cc/xurls/v2 v2.5.0
+	github.com/mattn/go-sqlite3 v1.14.28
+	github.com/prometheus/client_golang v1.22.0
+	github.com/tdewolff/minify/v2 v2.23.8
+	golang.org/x/crypto v0.39.0
+	golang.org/x/image v0.28.0
+	golang.org/x/net v0.41.0
+	golang.org/x/oauth2 v0.30.0
+	golang.org/x/term v0.32.0
 )
 
 require (
-	github.com/go-webauthn/x v0.1.5 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
-	github.com/google/go-tpm v0.9.0 // indirect
+	github.com/go-webauthn/x v0.1.21 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/google/go-tpm v0.9.5 // indirect
 )
 
 require (
-	github.com/andybalholm/cascadia v1.3.2 // indirect
+	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.5.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
-	github.com/tdewolff/parse/v2 v2.7.6 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/tdewolff/parse/v2 v2.8.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 )
 
-go 1.21
+go 1.24.0
+
+toolchain go1.24.1

go.sum

@@ -1,139 +1,149 @@
-github.com/PuerkitoBio/goquery v1.8.1 h1:uQxhNlArOIdbrH1tr0UXwdVFgDcZDrZVdcpygAcwmWM=
-github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ=
-github.com/abadojack/whatlanggo v1.0.1 h1:19N6YogDnf71CTHm3Mp2qhYfkRdyvbgwWdd2EPxJRG4=
-github.com/abadojack/whatlanggo v1.0.1/go.mod h1:66WiQbSbJBIlOZMsvbKe5m6pzQovxCH9B/K8tQB2uoc=
-github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA=
-github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
-github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
+github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
+github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
+github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
-github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.5.0 h1:oHsG0V/Q6E/wqTS2O1Cozzsy69nqCiguo5Q1a1ADivE=
-github.com/fxamacker/cbor/v2 v2.5.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-webauthn/webauthn v0.9.4 h1:YxvHSqgUyc5AK2pZbqkWWR55qKeDPhP8zLDr6lpIc2g=
-github.com/go-webauthn/webauthn v0.9.4/go.mod h1:LqupCtzSef38FcxzaklmOn7AykGKhAhr9xlRbdbgnTw=
-github.com/go-webauthn/x v0.1.5 h1:V2TCzDU2TGLd0kSZOXdrqDVV5JB9ILnKxA9S53CSBw0=
-github.com/go-webauthn/x v0.1.5/go.mod h1:qbzWwcFcv4rTwtCLOZd+icnr6B7oSsAGZJqlt8cukqY=
-github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
-github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
-github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
-github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
-github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-webauthn/webauthn v0.13.0 h1:cJIL1/1l+22UekVhipziAaSgESJxokYkowUqAIsWs0Y=
+github.com/go-webauthn/webauthn v0.13.0/go.mod h1:Oy9o2o79dbLKRPZWWgRIOdtBGAhKnDIaBp2PFkICRHs=
+github.com/go-webauthn/x v0.1.21 h1:nFbckQxudvHEJn2uy1VEi713MeSpApoAv9eRqsb9AdQ=
+github.com/go-webauthn/x v0.1.21/go.mod h1:sEYohtg1zL4An1TXIUIQ5csdmoO+WO0R4R2pGKaHYKA=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.5 h1:ocUmnDebX54dnW+MQWGQRbdaAcJELsa6PqZhJ48KwVU=
+github.com/google/go-tpm v0.9.5/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
-github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
-github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
-github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
-github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI=
-github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/tdewolff/minify/v2 v2.20.9 h1:0RGsL+jBpm77obkuNCjNZ2eiN81CZzTnjeVmTqxCmYk=
-github.com/tdewolff/minify/v2 v2.20.9/go.mod h1:hZnNtFqXVQ5QIAR05tdgvS7h6E80jyRwHSGVmM4jbzQ=
-github.com/tdewolff/parse/v2 v2.7.6 h1:PGZH2b/itDSye9RatReRn4GBhsT+KFEMtAMjHRuY1h8=
-github.com/tdewolff/parse/v2 v2.7.6/go.mod h1:3FbJWZp3XT9OWVN3Hmfp0p/a08v4h8J9W1aghka0soA=
-github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52 h1:gAQliwn+zJrkjAHVcBEYW/RFvd2St4yYimisvozAYlA=
-github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tdewolff/minify/v2 v2.23.8 h1:tvjHzRer46kwOfpdCBCWsDblCw3QtnLJRd61pTVkyZ8=
+github.com/tdewolff/minify/v2 v2.23.8/go.mod h1:VW3ISUd3gDOZuQ/jwZr4sCzsuX+Qvsx87FDMjk6Rvno=
+github.com/tdewolff/parse/v2 v2.8.1 h1:J5GSHru6o3jF1uLlEKVXkDxxcVx6yzOlIVIotK4w2po=
+github.com/tdewolff/parse/v2 v2.8.1/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
+github.com/tdewolff/test v1.0.11 h1:FdLbwQVHxqG16SlkGveC0JVyrJN62COWTRyUFzfbtBE=
+github.com/tdewolff/test v1.0.11/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.6.0 h1:boZcn2GTjpsynOsC0iJHnBWa4Bi0qzfJjthwauItG68=
-github.com/yuin/goldmark v1.6.0/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
-golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/image v0.28.0 h1:gdem5JW1OLS4FbkWgLO+7ZeFzYtL3xClb97GaUzYMFE=
+golang.org/x/image v0.28.0/go.mod h1:GUJYXtnGKEUgggyzh+Vxt+AviiCcyiwpsl8iQ8MvwGY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210916014120-12bc252f5db8/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
-golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
-golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/xurls/v2 v2.5.0 h1:lyBNOm8Wo71UknhUs4QTFUNNMyxy2JEIaKKo0RWOh+8=
-mvdan.cc/xurls/v2 v2.5.0/go.mod h1:yQgaGQ1rFtJUzkmKiHYSSfuQxqfYmd//X6PxvholpeE=

internal/api/api.go

@@ -72,7 +72,13 @@ func Serve(router *mux.Router, store *storage.Storage, pool *worker.Pool) {
 	sr.HandleFunc("/entries/{entryID}/fetch-content", handler.fetchContent).Methods(http.MethodGet)
 	sr.HandleFunc("/flush-history", handler.flushHistory).Methods(http.MethodPut, http.MethodDelete)
 	sr.HandleFunc("/icons/{iconID}", handler.getIconByIconID).Methods(http.MethodGet)
+	sr.HandleFunc("/enclosures/{enclosureID}", handler.getEnclosureByID).Methods(http.MethodGet)
+	sr.HandleFunc("/enclosures/{enclosureID}", handler.updateEnclosureByID).Methods(http.MethodPut)
+	sr.HandleFunc("/integrations/status", handler.getIntegrationsStatus).Methods(http.MethodGet)
 	sr.HandleFunc("/version", handler.versionHandler).Methods(http.MethodGet)
+	sr.HandleFunc("/api-keys", handler.createAPIKey).Methods(http.MethodPost)
+	sr.HandleFunc("/api-keys", handler.getAPIKeys).Methods(http.MethodGet)
+	sr.HandleFunc("/api-keys/{apiKeyID}", handler.deleteAPIKey).Methods(http.MethodDelete)
 }
 
 func (h *handler) versionHandler(w http.ResponseWriter, r *http.Request) {

internal/api/api_key.go

@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package api // import "miniflux.app/v2/internal/api"
+
+import (
+	json_parser "encoding/json"
+	"errors"
+	"net/http"
+
+	"miniflux.app/v2/internal/http/request"
+	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/storage"
+	"miniflux.app/v2/internal/validator"
+)
+
+func (h *handler) createAPIKey(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+
+	var apiKeyCreationRequest model.APIKeyCreationRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&apiKeyCreationRequest); err != nil {
+		json.BadRequest(w, r, err)
+		return
+	}
+
+	if validationErr := validator.ValidateAPIKeyCreation(h.store, userID, &apiKeyCreationRequest); validationErr != nil {
+		json.BadRequest(w, r, validationErr.Error())
+		return
+	}
+
+	apiKey, err := h.store.CreateAPIKey(userID, apiKeyCreationRequest.Description)
+	if err != nil {
+		json.ServerError(w, r, err)
+		return
+	}
+
+	json.Created(w, r, apiKey)
+}
+
+func (h *handler) getAPIKeys(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+	apiKeys, err := h.store.APIKeys(userID)
+	if err != nil {
+		json.ServerError(w, r, err)
+		return
+	}
+	json.OK(w, r, apiKeys)
+}
+
+func (h *handler) deleteAPIKey(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+	apiKeyID := request.RouteInt64Param(r, "apiKeyID")
+
+	if err := h.store.DeleteAPIKey(userID, apiKeyID); err != nil {
+		if errors.Is(err, storage.ErrAPIKeyNotFound) {
+			json.NotFound(w, r)
+			return
+		}
+		json.ServerError(w, r, err)
+		return
+	}
+	json.NoContent(w, r)
+}

internal/api/category.go

@@ -19,18 +19,18 @@ import (
 func (h *handler) createCategory(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
-	var categoryRequest model.CategoryRequest
-	if err := json_parser.NewDecoder(r.Body).Decode(&categoryRequest); err != nil {
+	var categoryCreationRequest model.CategoryCreationRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&categoryCreationRequest); err != nil {
 		json.BadRequest(w, r, err)
 		return
 	}
 
-	if validationErr := validator.ValidateCategoryCreation(h.store, userID, &categoryRequest); validationErr != nil {
+	if validationErr := validator.ValidateCategoryCreation(h.store, userID, &categoryCreationRequest); validationErr != nil {
 		json.BadRequest(w, r, validationErr.Error())
 		return
 	}
 
-	category, err := h.store.CreateCategory(userID, &categoryRequest)
+	category, err := h.store.CreateCategory(userID, &categoryCreationRequest)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -54,20 +54,20 @@ func (h *handler) updateCategory(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var categoryRequest model.CategoryRequest
-	if err := json_parser.NewDecoder(r.Body).Decode(&categoryRequest); err != nil {
+	var categoryModificationRequest model.CategoryModificationRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&categoryModificationRequest); err != nil {
 		json.BadRequest(w, r, err)
 		return
 	}
 
-	if validationErr := validator.ValidateCategoryModification(h.store, userID, category.ID, &categoryRequest); validationErr != nil {
+	if validationErr := validator.ValidateCategoryModification(h.store, userID, category.ID, &categoryModificationRequest); validationErr != nil {
 		json.BadRequest(w, r, validationErr.Error())
 		return
 	}
 
-	categoryRequest.Patch(category)
-	err = h.store.UpdateCategory(category)
-	if err != nil {
+	categoryModificationRequest.Patch(category)
+
+	if err := h.store.UpdateCategory(category); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}

internal/api/enclosure.go

@@ -0,0 +1,79 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package api // import "miniflux.app/v2/internal/api"
+
+import (
+	json_parser "encoding/json"
+	"net/http"
+
+	"miniflux.app/v2/internal/http/request"
+	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/validator"
+)
+
+func (h *handler) getEnclosureByID(w http.ResponseWriter, r *http.Request) {
+	enclosureID := request.RouteInt64Param(r, "enclosureID")
+
+	enclosure, err := h.store.GetEnclosure(enclosureID)
+	if err != nil {
+		json.ServerError(w, r, err)
+		return
+	}
+
+	if enclosure == nil {
+		json.NotFound(w, r)
+		return
+	}
+
+	userID := request.UserID(r)
+	if enclosure.UserID != userID {
+		json.NotFound(w, r)
+		return
+	}
+
+	enclosure.ProxifyEnclosureURL(h.router)
+
+	json.OK(w, r, enclosure)
+}
+
+func (h *handler) updateEnclosureByID(w http.ResponseWriter, r *http.Request) {
+	enclosureID := request.RouteInt64Param(r, "enclosureID")
+
+	var enclosureUpdateRequest model.EnclosureUpdateRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&enclosureUpdateRequest); err != nil {
+		json.BadRequest(w, r, err)
+		return
+	}
+
+	if err := validator.ValidateEnclosureUpdateRequest(&enclosureUpdateRequest); err != nil {
+		json.BadRequest(w, r, err)
+		return
+	}
+
+	enclosure, err := h.store.GetEnclosure(enclosureID)
+	if err != nil {
+		json.ServerError(w, r, err)
+		return
+	}
+
+	if enclosure == nil {
+		json.NotFound(w, r)
+		return
+	}
+
+	userID := request.UserID(r)
+	if enclosure.UserID != userID {
+		json.NotFound(w, r)
+		return
+	}
+
+	enclosure.MediaProgression = enclosureUpdateRequest.MediaProgression
+	if err := h.store.UpdateEnclosure(enclosure); err != nil {
+		json.ServerError(w, r, err)
+		return
+	}
+
+	json.NoContent(w, r)
+}

internal/api/entry.go

@@ -8,19 +8,16 @@ import (
 	"errors"
 	"net/http"
 	"strconv"
-	"strings"
 	"time"
 
-	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/request"
 	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/integration"
+	"miniflux.app/v2/internal/mediaproxy"
 	"miniflux.app/v2/internal/model"
-	"miniflux.app/v2/internal/proxy"
 	"miniflux.app/v2/internal/reader/processor"
 	"miniflux.app/v2/internal/reader/readingtime"
 	"miniflux.app/v2/internal/storage"
-	"miniflux.app/v2/internal/urllib"
 	"miniflux.app/v2/internal/validator"
 )
 
@@ -36,19 +33,9 @@ func (h *handler) getEntryFromBuilder(w http.ResponseWriter, r *http.Request, b
 		return
 	}
 
-	entry.Content = proxy.AbsoluteProxyRewriter(h.router, r.Host, entry.Content)
-	proxyOption := config.Opts.ProxyOption()
+	entry.Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entry.Content)
 
-	for i := range entry.Enclosures {
-		if proxyOption == "all" || proxyOption != "none" && !urllib.IsHTTPS(entry.Enclosures[i].URL) {
-			for _, mediaType := range config.Opts.ProxyMediaTypes() {
-				if strings.HasPrefix(entry.Enclosures[i].MimeType, mediaType+"/") {
-					entry.Enclosures[i].URL = proxy.AbsoluteProxifyURL(h.router, r.Host, entry.Enclosures[i].URL)
-					break
-				}
-			}
-		}
-	}
+	entry.Enclosures.ProxifyEnclosureURL(h.router)
 
 	json.OK(w, r, entry)
 }
@@ -149,6 +136,15 @@ func (h *handler) findEntries(w http.ResponseWriter, r *http.Request, feedID int
 	builder.WithLimit(limit)
 	builder.WithTags(tags)
 	builder.WithEnclosures()
+
+	if request.HasQueryParam(r, "globally_visible") {
+		globallyVisible := request.QueryBoolParam(r, "globally_visible", true)
+
+		if globallyVisible {
+			builder.WithGloballyVisible()
+		}
+	}
+
 	configureFilters(builder, r)
 
 	entries, err := builder.GetEntries()
@@ -164,7 +160,7 @@ func (h *handler) findEntries(w http.ResponseWriter, r *http.Request, feedID int
 	}
 
 	for i := range entries {
-		entries[i].Content = proxy.AbsoluteProxyRewriter(h.router, r.Host, entries[i].Content)
+		entries[i].Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entries[i].Content)
 	}
 
 	json.OK(w, r, &entriesResponse{Total: count, Entries: entries})
@@ -275,7 +271,9 @@ func (h *handler) updateEntry(w http.ResponseWriter, r *http.Request) {
 	}
 
 	entryUpdateRequest.Patch(entry)
-	entry.ReadingTime = readingtime.EstimateReadingTime(entry.Content, user.DefaultReadingSpeed, user.CJKReadingSpeed)
+	if user.ShowReadingTime {
+		entry.ReadingTime = readingtime.EstimateReadingTime(entry.Content, user.DefaultReadingSpeed, user.CJKReadingSpeed)
+	}
 
 	if err := h.store.UpdateEntryTitleAndContent(entry); err != nil {
 		json.ServerError(w, r, err)
@@ -333,6 +331,18 @@ func (h *handler) fetchContent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	shouldUpdateContent := request.QueryBoolParam(r, "update_content", false)
+	if shouldUpdateContent {
+		if err := h.store.UpdateEntryTitleAndContent(entry); err != nil {
+			json.ServerError(w, r, err)
+			return
+		}
+
+		json.OK(w, r, map[string]interface{}{"content": mediaproxy.RewriteDocumentWithRelativeProxyURL(h.router, entry.Content), "reading_time": entry.ReadingTime})
+
+		return
+	}
+
 	json.OK(w, r, map[string]string{"content": entry.Content})
 }
 

internal/api/feed.go

@@ -115,12 +115,13 @@ func (h *handler) updateFeed(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if validationErr := validator.ValidateFeedModification(h.store, userID, &feedModificationRequest); validationErr != nil {
+	if validationErr := validator.ValidateFeedModification(h.store, userID, originalFeed.ID, &feedModificationRequest); validationErr != nil {
 		json.BadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	feedModificationRequest.Patch(originalFeed)
+	originalFeed.ResetErrorCounter()
 	if err := h.store.UpdateFeed(originalFeed); err != nil {
 		json.ServerError(w, r, err)
 		return

internal/api/icon.go

@@ -13,7 +13,7 @@ import (
 func (h *handler) getIconByFeedID(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 
-	if !h.store.HasIcon(feedID) {
+	if !h.store.HasFeedIcon(feedID) {
 		json.NotFound(w, r)
 		return
 	}

internal/api/subscription.go

@@ -11,6 +11,7 @@ import (
 	"miniflux.app/v2/internal/http/request"
 	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/proxyrotator"
 	"miniflux.app/v2/internal/reader/fetcher"
 	"miniflux.app/v2/internal/reader/subscription"
 	"miniflux.app/v2/internal/validator"
@@ -29,23 +30,29 @@ func (h *handler) discoverSubscriptions(w http.ResponseWriter, r *http.Request)
 	}
 
 	var rssbridgeURL string
+	var rssbridgeToken string
 	intg, err := h.store.Integration(request.UserID(r))
 	if err == nil && intg != nil && intg.RSSBridgeEnabled {
 		rssbridgeURL = intg.RSSBridgeURL
+		rssbridgeToken = intg.RSSBridgeToken
 	}
 
 	requestBuilder := fetcher.NewRequestBuilder()
 	requestBuilder.WithTimeout(config.Opts.HTTPClientTimeout())
-	requestBuilder.WithProxy(config.Opts.HTTPClientProxy())
+	requestBuilder.WithProxyRotator(proxyrotator.ProxyRotatorInstance)
+	requestBuilder.WithCustomFeedProxyURL(subscriptionDiscoveryRequest.ProxyURL)
+	requestBuilder.WithCustomApplicationProxyURL(config.Opts.HTTPClientProxyURL())
+	requestBuilder.UseCustomApplicationProxyURL(subscriptionDiscoveryRequest.FetchViaProxy)
 	requestBuilder.WithUserAgent(subscriptionDiscoveryRequest.UserAgent, config.Opts.HTTPClientUserAgent())
 	requestBuilder.WithCookie(subscriptionDiscoveryRequest.Cookie)
 	requestBuilder.WithUsernameAndPassword(subscriptionDiscoveryRequest.Username, subscriptionDiscoveryRequest.Password)
-	requestBuilder.UseProxy(subscriptionDiscoveryRequest.FetchViaProxy)
 	requestBuilder.IgnoreTLSErrors(subscriptionDiscoveryRequest.AllowSelfSignedCertificates)
+	requestBuilder.DisableHTTP2(subscriptionDiscoveryRequest.DisableHTTP2)
 
 	subscriptions, localizedError := subscription.NewSubscriptionFinder(requestBuilder).FindSubscriptions(
 		subscriptionDiscoveryRequest.URL,
 		rssbridgeURL,
+		rssbridgeToken,
 	)
 
 	if localizedError != nil {

internal/api/user.go

@@ -7,6 +7,8 @@ import (
 	json_parser "encoding/json"
 	"errors"
 	"net/http"
+	"regexp"
+	"strings"
 
 	"miniflux.app/v2/internal/http/request"
 	"miniflux.app/v2/internal/http/response/json"
@@ -77,11 +79,23 @@ func (h *handler) updateUser(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if userModificationRequest.IsAdmin != nil && *userModificationRequest.IsAdmin {
-			json.BadRequest(w, r, errors.New("Only administrators can change permissions of standard users"))
+			json.BadRequest(w, r, errors.New("only administrators can change permissions of standard users"))
 			return
 		}
 	}
 
+	cleanEnd := regexp.MustCompile(`(?m)\r\n\s*$`)
+	if userModificationRequest.BlockFilterEntryRules != nil {
+		*userModificationRequest.BlockFilterEntryRules = cleanEnd.ReplaceAllLiteralString(*userModificationRequest.BlockFilterEntryRules, "")
+		// Clean carriage returns for Windows environments
+		*userModificationRequest.BlockFilterEntryRules = strings.ReplaceAll(*userModificationRequest.BlockFilterEntryRules, "\r\n", "\n")
+	}
+	if userModificationRequest.KeepFilterEntryRules != nil {
+		*userModificationRequest.KeepFilterEntryRules = cleanEnd.ReplaceAllLiteralString(*userModificationRequest.KeepFilterEntryRules, "")
+		// Clean carriage returns for Windows environments
+		*userModificationRequest.KeepFilterEntryRules = strings.ReplaceAll(*userModificationRequest.KeepFilterEntryRules, "\r\n", "\n")
+	}
+
 	if validationErr := validator.ValidateUserModification(h.store, originalUser.ID, &userModificationRequest); validationErr != nil {
 		json.BadRequest(w, r, validationErr.Error())
 		return
@@ -116,6 +130,25 @@ func (h *handler) markUserAsRead(w http.ResponseWriter, r *http.Request) {
 	json.NoContent(w, r)
 }
 
+func (h *handler) getIntegrationsStatus(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+
+	if _, err := h.store.UserByID(userID); err != nil {
+		json.NotFound(w, r)
+		return
+	}
+
+	hasIntegrations := h.store.HasSaveEntry(userID)
+
+	response := struct {
+		HasIntegrations bool `json:"has_integrations"`
+	}{
+		HasIntegrations: hasIntegrations,
+	}
+
+	json.OK(w, r, response)
+}
+
 func (h *handler) users(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
@@ -141,7 +174,7 @@ func (h *handler) userByID(w http.ResponseWriter, r *http.Request) {
 	userID := request.RouteInt64Param(r, "userID")
 	user, err := h.store.UserByID(userID)
 	if err != nil {
-		json.BadRequest(w, r, errors.New("Unable to fetch this user from the database"))
+		json.BadRequest(w, r, errors.New("unable to fetch this user from the database"))
 		return
 	}
 
@@ -163,7 +196,7 @@ func (h *handler) userByUsername(w http.ResponseWriter, r *http.Request) {
 	username := request.RouteStringParam(r, "username")
 	user, err := h.store.UserByUsername(username)
 	if err != nil {
-		json.BadRequest(w, r, errors.New("Unable to fetch this user from the database"))
+		json.BadRequest(w, r, errors.New("unable to fetch this user from the database"))
 		return
 	}
 
@@ -194,7 +227,7 @@ func (h *handler) removeUser(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if user.ID == request.UserID(r) {
-		json.BadRequest(w, r, errors.New("You cannot remove yourself"))
+		json.BadRequest(w, r, errors.New("you cannot remove yourself"))
 		return
 	}
 

internal/cli/ask_credentials.go

@@ -16,7 +16,7 @@ func askCredentials() (string, string) {
 	fd := int(os.Stdin.Fd())
 
 	if !term.IsTerminal(fd) {
-		printErrorAndExit(fmt.Errorf("this is not a terminal, exiting"))
+		printErrorAndExit(fmt.Errorf("this is not an interactive terminal, exiting"))
 	}
 
 	fmt.Print("Enter Username: ")

internal/cli/cli.go

@@ -4,6 +4,7 @@
 package cli // import "miniflux.app/v2/internal/cli"
 
 import (
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -12,47 +13,49 @@ import (
 
 	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/database"
-	"miniflux.app/v2/internal/locale"
+	"miniflux.app/v2/internal/proxyrotator"
 	"miniflux.app/v2/internal/storage"
 	"miniflux.app/v2/internal/ui/static"
 	"miniflux.app/v2/internal/version"
 )
 
 const (
-	flagInfoHelp            = "Show build information"
-	flagVersionHelp         = "Show application version"
-	flagMigrateHelp         = "Run SQL migrations"
-	flagFlushSessionsHelp   = "Flush all sessions (disconnect users)"
-	flagCreateAdminHelp     = "Create admin user"
-	flagResetPasswordHelp   = "Reset user password"
-	flagResetFeedErrorsHelp = "Clear all feed errors for all users"
-	flagDebugModeHelp       = "Show debug logs"
-	flagConfigFileHelp      = "Load configuration file"
-	flagConfigDumpHelp      = "Print parsed configuration values"
-	flagHealthCheckHelp     = `Perform a health check on the given endpoint (the value "auto" try to guess the health check endpoint).`
-	flagRefreshFeedsHelp    = "Refresh a batch of feeds and exit"
-	flagRunCleanupTasksHelp = "Run cleanup tasks (delete old sessions and archives old entries)"
-	flagExportUserFeedsHelp = "Export user feeds (provide the username as argument)"
+	flagInfoHelp             = "Show build information"
+	flagVersionHelp          = "Show application version"
+	flagMigrateHelp          = "Run SQL migrations"
+	flagFlushSessionsHelp    = "Flush all sessions (disconnect users)"
+	flagCreateAdminHelp      = "Create an admin user from an interactive terminal"
+	flagResetPasswordHelp    = "Reset user password"
+	flagResetFeedErrorsHelp  = "Clear all feed errors for all users"
+	flagDebugModeHelp        = "Show debug logs"
+	flagConfigFileHelp       = "Load configuration file"
+	flagConfigDumpHelp       = "Print parsed configuration values"
+	flagHealthCheckHelp      = `Perform a health check on the given endpoint (the value "auto" try to guess the health check endpoint).`
+	flagRefreshFeedsHelp     = "Refresh a batch of feeds and exit"
+	flagRunCleanupTasksHelp  = "Run cleanup tasks (delete old sessions and archives old entries)"
+	flagExportUserFeedsHelp  = "Export user feeds (provide the username as argument)"
+	flagResetNextCheckAtHelp = "Reset the next check time for all feeds"
 )
 
 // Parse parses command line arguments.
 func Parse() {
 	var (
-		err                 error
-		flagInfo            bool
-		flagVersion         bool
-		flagMigrate         bool
-		flagFlushSessions   bool
-		flagCreateAdmin     bool
-		flagResetPassword   bool
-		flagResetFeedErrors bool
-		flagDebugMode       bool
-		flagConfigFile      string
-		flagConfigDump      bool
-		flagHealthCheck     string
-		flagRefreshFeeds    bool
-		flagRunCleanupTasks bool
-		flagExportUserFeeds string
+		err                      error
+		flagInfo                 bool
+		flagVersion              bool
+		flagMigrate              bool
+		flagFlushSessions        bool
+		flagCreateAdmin          bool
+		flagResetPassword        bool
+		flagResetFeedErrors      bool
+		flagResetFeedNextCheckAt bool
+		flagDebugMode            bool
+		flagConfigFile           string
+		flagConfigDump           bool
+		flagHealthCheck          string
+		flagRefreshFeeds         bool
+		flagRunCleanupTasks      bool
+		flagExportUserFeeds      string
 	)
 
 	flag.BoolVar(&flagInfo, "info", false, flagInfoHelp)
@@ -64,6 +67,7 @@ func Parse() {
 	flag.BoolVar(&flagCreateAdmin, "create-admin", false, flagCreateAdminHelp)
 	flag.BoolVar(&flagResetPassword, "reset-password", false, flagResetPasswordHelp)
 	flag.BoolVar(&flagResetFeedErrors, "reset-feed-errors", false, flagResetFeedErrorsHelp)
+	flag.BoolVar(&flagResetFeedNextCheckAt, "reset-feed-next-check-at", false, flagResetNextCheckAtHelp)
 	flag.BoolVar(&flagDebugMode, "debug", false, flagDebugModeHelp)
 	flag.StringVar(&flagConfigFile, "config-file", "", flagConfigFileHelp)
 	flag.StringVar(&flagConfigFile, "c", "", flagConfigFileHelp)
@@ -88,6 +92,23 @@ func Parse() {
 		printErrorAndExit(err)
 	}
 
+	if oauth2Provider := config.Opts.OAuth2Provider(); oauth2Provider != "" {
+		if oauth2Provider != "oidc" && oauth2Provider != "google" {
+			printErrorAndExit(fmt.Errorf(`unsupported OAuth2 provider: %q (Possible values are "google" or "oidc")`, oauth2Provider))
+		}
+	}
+
+	if config.Opts.DisableLocalAuth() {
+		switch {
+		case config.Opts.OAuth2Provider() == "" && config.Opts.AuthProxyHeader() == "":
+			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled but neither OAUTH2_PROVIDER nor AUTH_PROXY_HEADER is not set. Please enable at least one authentication source"))
+		case config.Opts.OAuth2Provider() != "" && !config.Opts.IsOAuth2UserCreationAllowed():
+			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled and an OAUTH2_PROVIDER is configured, but OAUTH2_USER_CREATION is not enabled"))
+		case config.Opts.AuthProxyHeader() != "" && !config.Opts.IsAuthProxyUserCreationAllowed():
+			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled and an AUTH_PROXY_HEADER is configured, but AUTH_PROXY_USER_CREATION is not enabled"))
+		}
+	}
+
 	if flagConfigDump {
 		fmt.Print(config.Opts)
 		return
@@ -135,10 +156,6 @@ func Parse() {
 		slog.Info("The default value for DATABASE_URL is used")
 	}
 
-	if err := locale.LoadCatalogMessages(); err != nil {
-		printErrorAndExit(fmt.Errorf("unable to load translations: %v", err))
-	}
-
 	if err := static.CalculateBinaryFileChecksums(); err != nil {
 		printErrorAndExit(fmt.Errorf("unable to calculate binary file checksums: %v", err))
 	}
@@ -176,7 +193,16 @@ func Parse() {
 	}
 
 	if flagResetFeedErrors {
-		store.ResetFeedErrors()
+		if err := store.ResetFeedErrors(); err != nil {
+			printErrorAndExit(err)
+		}
+		return
+	}
+
+	if flagResetFeedNextCheckAt {
+		if err := store.ResetNextCheckAt(); err != nil {
+			printErrorAndExit(err)
+		}
 		return
 	}
 
@@ -191,7 +217,7 @@ func Parse() {
 	}
 
 	if flagCreateAdmin {
-		createAdmin(store)
+		createAdminUserFromInteractiveTerminal(store)
 		return
 	}
 
@@ -211,9 +237,16 @@ func Parse() {
 		printErrorAndExit(err)
 	}
 
-	// Create admin user and start the daemon.
 	if config.Opts.CreateAdmin() {
-		createAdmin(store)
+		createAdminUserFromEnvironmentVariables(store)
+	}
+
+	if config.Opts.HasHTTPClientProxiesConfigured() {
+		slog.Info("Initializing proxy rotation", slog.Int("proxies_count", len(config.Opts.HTTPClientProxies())))
+		proxyrotator.ProxyRotatorInstance, err = proxyrotator.NewProxyRotator(config.Opts.HTTPClientProxies())
+		if err != nil {
+			printErrorAndExit(fmt.Errorf("unable to initialize proxy rotator: %v", err))
+		}
 	}
 
 	if flagRefreshFeeds {

internal/cli/create_admin.go

@@ -12,15 +12,20 @@ import (
 	"miniflux.app/v2/internal/validator"
 )
 
-func createAdmin(store *storage.Storage) {
-	userCreationRequest := &model.UserCreationRequest{
-		Username: config.Opts.AdminUsername(),
-		Password: config.Opts.AdminPassword(),
-		IsAdmin:  true,
-	}
+func createAdminUserFromEnvironmentVariables(store *storage.Storage) {
+	createAdminUser(store, config.Opts.AdminUsername(), config.Opts.AdminPassword())
+}
 
-	if userCreationRequest.Username == "" || userCreationRequest.Password == "" {
-		userCreationRequest.Username, userCreationRequest.Password = askCredentials()
+func createAdminUserFromInteractiveTerminal(store *storage.Storage) {
+	username, password := askCredentials()
+	createAdminUser(store, username, password)
+}
+
+func createAdminUser(store *storage.Storage, username, password string) {
+	userCreationRequest := &model.UserCreationRequest{
+		Username: username,
+		Password: password,
+		IsAdmin:  true,
 	}
 
 	if store.UserExists(userCreationRequest.Username) {
@@ -34,7 +39,12 @@ func createAdmin(store *storage.Storage) {
 		printErrorAndExit(validationErr.Error())
 	}
 
-	if _, err := store.CreateUser(userCreationRequest); err != nil {
+	if user, err := store.CreateUser(userCreationRequest); err != nil {
 		printErrorAndExit(err)
+	} else {
+		slog.Info("Created new admin user",
+			slog.String("username", user.Username),
+			slog.Int64("user_id", user.ID),
+		)
 	}
 }

internal/cli/daemon.go

@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"miniflux.app/v2/internal/config"
-	httpd "miniflux.app/v2/internal/http/server"
+	"miniflux.app/v2/internal/http/server"
 	"miniflux.app/v2/internal/metric"
 	"miniflux.app/v2/internal/storage"
 	"miniflux.app/v2/internal/systemd"
@@ -33,9 +33,9 @@ func startDaemon(store *storage.Storage) {
 		runScheduler(store, pool)
 	}
 
-	var httpServer *http.Server
+	var httpServers []*http.Server
 	if config.Opts.HasHTTPService() {
-		httpServer = httpd.StartWebServer(store, pool)
+		httpServers = server.StartWebServer(store, pool)
 	}
 
 	if config.Opts.HasMetricsCollector() {
@@ -78,8 +78,18 @@ func startDaemon(store *storage.Storage) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	if httpServer != nil {
-		httpServer.Shutdown(ctx)
+	if len(httpServers) > 0 {
+		slog.Debug("Shutting down HTTP servers...")
+		for _, server := range httpServers {
+			if server != nil {
+				if err := server.Shutdown(ctx); err != nil {
+					slog.Error("HTTP server shutdown error", slog.Any("error", err), slog.String("addr", server.Addr))
+				}
+			}
+		}
+		slog.Debug("All HTTP servers shut down.")
+	} else {
+		slog.Debug("No HTTP servers to shut down.")
 	}
 
 	slog.Debug("Process gracefully stopped")

internal/cli/health_check.go

@@ -14,7 +14,7 @@ import (
 
 func doHealthCheck(healthCheckEndpoint string) {
 	if healthCheckEndpoint == "auto" {
-		healthCheckEndpoint = "http://" + config.Opts.ListenAddr() + config.Opts.BasePath() + "/healthcheck"
+		healthCheckEndpoint = "http://" + config.Opts.ListenAddr()[0] + config.Opts.BasePath() + "/healthcheck"
 	}
 
 	slog.Debug("Executing health check request", slog.String("endpoint", healthCheckEndpoint))

internal/cli/refresh_feeds.go

@@ -45,7 +45,7 @@ func refreshFeeds(store *storage.Storage) {
 		slog.Int("nb_workers", config.Opts.WorkerPoolSize()),
 	)
 
-	for i := 0; i < config.Opts.WorkerPoolSize(); i++ {
+	for i := range config.Opts.WorkerPoolSize() {
 		wg.Add(1)
 		go func(workerID int) {
 			defer wg.Done()
@@ -56,7 +56,7 @@ func refreshFeeds(store *storage.Storage) {
 					slog.Int("worker_id", workerID),
 				)
 
-				if localizedError := feedHandler.RefreshFeed(store, job.UserID, job.FeedID, false); err != nil {
+				if localizedError := feedHandler.RefreshFeed(store, job.UserID, job.FeedID, false); localizedError != nil {
 					slog.Warn("Unable to refresh feed",
 						slog.Int64("feed_id", job.FeedID),
 						slog.Int64("user_id", job.UserID),

internal/config/config_test.go

@@ -4,7 +4,9 @@
 package config // import "miniflux.app/v2/internal/config"
 
 import (
+	"bytes"
 	"os"
+	"reflect"
 	"testing"
 )
 
@@ -183,35 +185,6 @@ func TestLogFormatWithInvalidValue(t *testing.T) {
 	}
 }
 
-func TestDebugModeOn(t *testing.T) {
-	os.Clearenv()
-	os.Setenv("DEBUG", "1")
-
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
-	if err != nil {
-		t.Fatalf(`Parsing failure: %v`, err)
-	}
-
-	if opts.LogLevel() != "debug" {
-		t.Fatalf(`Unexpected debug mode value, got %q`, opts.LogLevel())
-	}
-}
-
-func TestDebugModeOff(t *testing.T) {
-	os.Clearenv()
-
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
-	if err != nil {
-		t.Fatalf(`Parsing failure: %v`, err)
-	}
-
-	if opts.LogLevel() != "info" {
-		t.Fatalf(`Unexpected debug mode value, got %q`, opts.LogLevel())
-	}
-}
-
 func TestCustomBaseURL(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("BASE_URL", "http://example.org")
@@ -258,6 +231,29 @@ func TestCustomBaseURLWithTrailingSlash(t *testing.T) {
 	}
 }
 
+func TestCustomBaseURLWithCustomPort(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("BASE_URL", "http://example.org:88/folder/")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	if opts.BaseURL() != "http://example.org:88/folder" {
+		t.Fatalf(`Unexpected base URL, got "%s"`, opts.BaseURL())
+	}
+
+	if opts.RootURL() != "http://example.org:88" {
+		t.Fatalf(`Unexpected root URL, got "%s"`, opts.RootURL())
+	}
+
+	if opts.BasePath() != "/folder" {
+		t.Fatalf(`Unexpected base path, got "%s"`, opts.BasePath())
+	}
+}
+
 func TestBaseURLWithoutScheme(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("BASE_URL", "example.org/folder/")
@@ -433,18 +429,18 @@ func TestListenAddr(t *testing.T) {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
 
-	expected := "foobar"
+	expected := []string{"foobar"}
 	result := opts.ListenAddr()
 
-	if result != expected {
-		t.Fatalf(`Unexpected LISTEN_ADDR value, got %q instead of %q`, result, expected)
+	if !reflect.DeepEqual(result, expected) {
+		t.Fatalf(`Unexpected LISTEN_ADDR value, got %v instead of %v`, result, expected)
 	}
 }
 
 func TestListenAddrWithPortDefined(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("PORT", "3000")
-	os.Setenv("LISTEN_ADDR", "foobar")
+	os.Setenv("LISTEN_ADDR", "foobar") // This should be overridden by PORT
 
 	parser := NewParser()
 	opts, err := parser.ParseEnvironmentVariables()
@@ -452,11 +448,11 @@ func TestListenAddrWithPortDefined(t *testing.T) {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
 
-	expected := ":3000"
+	expected := []string{":3000"}
 	result := opts.ListenAddr()
 
-	if result != expected {
-		t.Fatalf(`Unexpected LISTEN_ADDR value, got %q instead of %q`, result, expected)
+	if !reflect.DeepEqual(result, expected) {
+		t.Fatalf(`Unexpected LISTEN_ADDR value when PORT is set, got %v instead of %v`, result, expected)
 	}
 }
 
@@ -469,11 +465,11 @@ func TestDefaultListenAddrValue(t *testing.T) {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
 
-	expected := defaultListenAddr
+	expected := []string{defaultListenAddr}
 	result := opts.ListenAddr()
 
-	if result != expected {
-		t.Fatalf(`Unexpected LISTEN_ADDR value, got %q instead of %q`, result, expected)
+	if !reflect.DeepEqual(result, expected) {
+		t.Fatalf(`Unexpected default LISTEN_ADDR value, got %v instead of %v`, result, expected)
 	}
 }
 
@@ -759,6 +755,41 @@ func TestPollingFrequency(t *testing.T) {
 	}
 }
 
+func TestDefautForceRefreshInterval(t *testing.T) {
+	os.Clearenv()
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := defaultForceRefreshInterval
+	result := opts.ForceRefreshInterval()
+
+	if result != expected {
+		t.Fatalf(`Unexpected FORCE_REFRESH_INTERVAL value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestForceRefreshInterval(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("FORCE_REFRESH_INTERVAL", "42")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := 42
+	result := opts.ForceRefreshInterval()
+
+	if result != expected {
+		t.Fatalf(`Unexpected FORCE_REFRESH_INTERVAL value, got %v instead of %v`, result, expected)
+	}
+}
+
 func TestDefaultBatchSizeValue(t *testing.T) {
 	os.Clearenv()
 
@@ -969,6 +1000,41 @@ func TestSchedulerRoundRobin(t *testing.T) {
 	}
 }
 
+func TestDefaultSchedulerRoundRobinMaxIntervalValue(t *testing.T) {
+	os.Clearenv()
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := defaultSchedulerRoundRobinMaxInterval
+	result := opts.SchedulerRoundRobinMaxInterval()
+
+	if result != expected {
+		t.Fatalf(`Unexpected SCHEDULER_ROUND_ROBIN_MAX_INTERVAL value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestSchedulerRoundRobinMaxInterval(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("SCHEDULER_ROUND_ROBIN_MAX_INTERVAL", "150")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := 150
+	result := opts.SchedulerRoundRobinMaxInterval()
+
+	if result != expected {
+		t.Fatalf(`Unexpected SCHEDULER_ROUND_ROBIN_MAX_INTERVAL value, got %v instead of %v`, result, expected)
+	}
+}
+
 func TestPollingParsingErrorLimit(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("POLLING_PARSING_ERROR_LIMIT", "100")
@@ -1372,44 +1438,9 @@ func TestCreateAdmin(t *testing.T) {
 	}
 }
 
-func TestPocketConsumerKeyFromEnvVariable(t *testing.T) {
+func TestMediaProxyMode(t *testing.T) {
 	os.Clearenv()
-	os.Setenv("POCKET_CONSUMER_KEY", "something")
-
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
-	if err != nil {
-		t.Fatalf(`Parsing failure: %v`, err)
-	}
-
-	expected := "something"
-	result := opts.PocketConsumerKey("default")
-
-	if result != expected {
-		t.Fatalf(`Unexpected POCKET_CONSUMER_KEY value, got %q instead of %q`, result, expected)
-	}
-}
-
-func TestPocketConsumerKeyFromUserPrefs(t *testing.T) {
-	os.Clearenv()
-
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
-	if err != nil {
-		t.Fatalf(`Parsing failure: %v`, err)
-	}
-
-	expected := "default"
-	result := opts.PocketConsumerKey("default")
-
-	if result != expected {
-		t.Fatalf(`Unexpected POCKET_CONSUMER_KEY value, got %q instead of %q`, result, expected)
-	}
-}
-
-func TestProxyOption(t *testing.T) {
-	os.Clearenv()
-	os.Setenv("PROXY_OPTION", "all")
+	os.Setenv("MEDIA_PROXY_MODE", "all")
 
 	parser := NewParser()
 	opts, err := parser.ParseEnvironmentVariables()
@@ -1418,14 +1449,14 @@ func TestProxyOption(t *testing.T) {
 	}
 
 	expected := "all"
-	result := opts.ProxyOption()
+	result := opts.MediaProxyMode()
 
 	if result != expected {
-		t.Fatalf(`Unexpected PROXY_OPTION value, got %q instead of %q`, result, expected)
+		t.Fatalf(`Unexpected MEDIA_PROXY_MODE value, got %q instead of %q`, result, expected)
 	}
 }
 
-func TestDefaultProxyOptionValue(t *testing.T) {
+func TestDefaultMediaProxyModeValue(t *testing.T) {
 	os.Clearenv()
 
 	parser := NewParser()
@@ -1434,17 +1465,17 @@ func TestDefaultProxyOptionValue(t *testing.T) {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
 
-	expected := defaultProxyOption
-	result := opts.ProxyOption()
+	expected := defaultMediaProxyMode
+	result := opts.MediaProxyMode()
 
 	if result != expected {
-		t.Fatalf(`Unexpected PROXY_OPTION value, got %q instead of %q`, result, expected)
+		t.Fatalf(`Unexpected MEDIA_PROXY_MODE value, got %q instead of %q`, result, expected)
 	}
 }
 
-func TestProxyMediaTypes(t *testing.T) {
+func TestMediaProxyResourceTypes(t *testing.T) {
 	os.Clearenv()
-	os.Setenv("PROXY_MEDIA_TYPES", "image,audio")
+	os.Setenv("MEDIA_PROXY_RESOURCE_TYPES", "image,audio")
 
 	parser := NewParser()
 	opts, err := parser.ParseEnvironmentVariables()
@@ -1454,25 +1485,25 @@ func TestProxyMediaTypes(t *testing.T) {
 
 	expected := []string{"audio", "image"}
 
-	if len(expected) != len(opts.ProxyMediaTypes()) {
-		t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+	if len(expected) != len(opts.MediaProxyResourceTypes()) {
+		t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 	}
 
 	resultMap := make(map[string]bool)
-	for _, mediaType := range opts.ProxyMediaTypes() {
+	for _, mediaType := range opts.MediaProxyResourceTypes() {
 		resultMap[mediaType] = true
 	}
 
 	for _, mediaType := range expected {
 		if !resultMap[mediaType] {
-			t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+			t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 		}
 	}
 }
 
-func TestProxyMediaTypesWithDuplicatedValues(t *testing.T) {
+func TestMediaProxyResourceTypesWithDuplicatedValues(t *testing.T) {
 	os.Clearenv()
-	os.Setenv("PROXY_MEDIA_TYPES", "image,audio, image")
+	os.Setenv("MEDIA_PROXY_RESOURCE_TYPES", "image,audio, image")
 
 	parser := NewParser()
 	opts, err := parser.ParseEnvironmentVariables()
@@ -1481,56 +1512,23 @@ func TestProxyMediaTypesWithDuplicatedValues(t *testing.T) {
 	}
 
 	expected := []string{"audio", "image"}
-	if len(expected) != len(opts.ProxyMediaTypes()) {
-		t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+	if len(expected) != len(opts.MediaProxyResourceTypes()) {
+		t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 	}
 
 	resultMap := make(map[string]bool)
-	for _, mediaType := range opts.ProxyMediaTypes() {
+	for _, mediaType := range opts.MediaProxyResourceTypes() {
 		resultMap[mediaType] = true
 	}
 
 	for _, mediaType := range expected {
 		if !resultMap[mediaType] {
-			t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+			t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 		}
 	}
 }
 
-func TestProxyImagesOptionBackwardCompatibility(t *testing.T) {
-	os.Clearenv()
-	os.Setenv("PROXY_IMAGES", "all")
-
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
-	if err != nil {
-		t.Fatalf(`Parsing failure: %v`, err)
-	}
-
-	expected := []string{"image"}
-	if len(expected) != len(opts.ProxyMediaTypes()) {
-		t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
-	}
-
-	resultMap := make(map[string]bool)
-	for _, mediaType := range opts.ProxyMediaTypes() {
-		resultMap[mediaType] = true
-	}
-
-	for _, mediaType := range expected {
-		if !resultMap[mediaType] {
-			t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
-		}
-	}
-
-	expectedProxyOption := "all"
-	result := opts.ProxyOption()
-	if result != expectedProxyOption {
-		t.Fatalf(`Unexpected PROXY_OPTION value, got %q instead of %q`, result, expectedProxyOption)
-	}
-}
-
-func TestDefaultProxyMediaTypes(t *testing.T) {
+func TestDefaultMediaProxyResourceTypes(t *testing.T) {
 	os.Clearenv()
 
 	parser := NewParser()
@@ -1541,25 +1539,25 @@ func TestDefaultProxyMediaTypes(t *testing.T) {
 
 	expected := []string{"image"}
 
-	if len(expected) != len(opts.ProxyMediaTypes()) {
-		t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+	if len(expected) != len(opts.MediaProxyResourceTypes()) {
+		t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 	}
 
 	resultMap := make(map[string]bool)
-	for _, mediaType := range opts.ProxyMediaTypes() {
+	for _, mediaType := range opts.MediaProxyResourceTypes() {
 		resultMap[mediaType] = true
 	}
 
 	for _, mediaType := range expected {
 		if !resultMap[mediaType] {
-			t.Fatalf(`Unexpected PROXY_MEDIA_TYPES value, got %v instead of %v`, opts.ProxyMediaTypes(), expected)
+			t.Fatalf(`Unexpected MEDIA_PROXY_RESOURCE_TYPES value, got %v instead of %v`, opts.MediaProxyResourceTypes(), expected)
 		}
 	}
 }
 
-func TestProxyHTTPClientTimeout(t *testing.T) {
+func TestMediaProxyHTTPClientTimeout(t *testing.T) {
 	os.Clearenv()
-	os.Setenv("PROXY_HTTP_CLIENT_TIMEOUT", "24")
+	os.Setenv("MEDIA_PROXY_HTTP_CLIENT_TIMEOUT", "24")
 
 	parser := NewParser()
 	opts, err := parser.ParseEnvironmentVariables()
@@ -1568,14 +1566,14 @@ func TestProxyHTTPClientTimeout(t *testing.T) {
 	}
 
 	expected := 24
-	result := opts.ProxyHTTPClientTimeout()
+	result := opts.MediaProxyHTTPClientTimeout()
 
 	if result != expected {
-		t.Fatalf(`Unexpected PROXY_HTTP_CLIENT_TIMEOUT value, got %d instead of %d`, result, expected)
+		t.Fatalf(`Unexpected MEDIA_PROXY_HTTP_CLIENT_TIMEOUT value, got %d instead of %d`, result, expected)
 	}
 }
 
-func TestDefaultProxyHTTPClientTimeoutValue(t *testing.T) {
+func TestDefaultMediaProxyHTTPClientTimeoutValue(t *testing.T) {
 	os.Clearenv()
 
 	parser := NewParser()
@@ -1584,11 +1582,45 @@ func TestDefaultProxyHTTPClientTimeoutValue(t *testing.T) {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
 
-	expected := defaultProxyHTTPClientTimeout
-	result := opts.ProxyHTTPClientTimeout()
+	expected := defaultMediaProxyHTTPClientTimeout
+	result := opts.MediaProxyHTTPClientTimeout()
 
 	if result != expected {
-		t.Fatalf(`Unexpected PROXY_HTTP_CLIENT_TIMEOUT value, got %d instead of %d`, result, expected)
+		t.Fatalf(`Unexpected MEDIA_PROXY_HTTP_CLIENT_TIMEOUT value, got %d instead of %d`, result, expected)
+	}
+}
+
+func TestMediaProxyCustomURL(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("MEDIA_PROXY_CUSTOM_URL", "http://example.org/proxy")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+	expected := "http://example.org/proxy"
+	result := opts.MediaCustomProxyURL()
+	if result != expected {
+		t.Fatalf(`Unexpected MEDIA_PROXY_CUSTOM_URL value, got %q instead of %q`, result, expected)
+	}
+}
+
+func TestMediaProxyPrivateKey(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("MEDIA_PROXY_PRIVATE_KEY", "foobar")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := []byte("foobar")
+	result := opts.MediaProxyPrivateKey()
+
+	if !bytes.Equal(result, expected) {
+		t.Fatalf(`Unexpected MEDIA_PROXY_PRIVATE_KEY value, got %q instead of %q`, result, expected)
 	}
 }
 
@@ -1730,9 +1762,7 @@ func TestParseConfigFile(t *testing.T) {
 	content := []byte(`
  # This is a comment
 
-DEBUG = yes
-
- POCKET_CONSUMER_KEY= >#1234
+LOG_LEVEL = debug
 
 Invalid text
 `)
@@ -1755,13 +1785,7 @@ Invalid text
 	}
 
 	if opts.LogLevel() != "debug" {
-		t.Errorf(`Unexpected debug mode value, got %q`, opts.LogLevel())
-	}
-
-	expected := ">#1234"
-	result := opts.PocketConsumerKey("default")
-	if result != expected {
-		t.Errorf(`Unexpected POCKET_CONSUMER_KEY value, got %q instead of %q`, result, expected)
+		t.Errorf(`Unexpected log level value, got %q`, opts.LogLevel())
 	}
 
 	if err := tmpfile.Close(); err != nil {
@@ -1843,6 +1867,42 @@ func TestAuthProxyUserCreationAdmin(t *testing.T) {
 	}
 }
 
+func TestFetchBilibiliWatchTime(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("FETCH_BILIBILI_WATCH_TIME", "1")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := true
+	result := opts.FetchBilibiliWatchTime()
+
+	if result != expected {
+		t.Fatalf(`Unexpected FETCH_BILIBILI_WATCH_TIME value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestFetchNebulaWatchTime(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("FETCH_NEBULA_WATCH_TIME", "1")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := true
+	result := opts.FetchNebulaWatchTime()
+
+	if result != expected {
+		t.Fatalf(`Unexpected FETCH_NEBULA_WATCH_TIME value, got %v instead of %v`, result, expected)
+	}
+}
+
 func TestFetchOdyseeWatchTime(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("FETCH_ODYSEE_WATCH_TIME", "1")
@@ -1879,12 +1939,51 @@ func TestFetchYouTubeWatchTime(t *testing.T) {
 	}
 }
 
+func TestYouTubeApiKey(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("YOUTUBE_API_KEY", "AAAAAAAAAAAAAaaaaaaaaaaaaa0000000000000")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := "AAAAAAAAAAAAAaaaaaaaaaaaaa0000000000000"
+	result := opts.YouTubeApiKey()
+
+	if result != expected {
+		t.Fatalf(`Unexpected YOUTUBE_API_KEY value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestDefaultYouTubeEmbedUrl(t *testing.T) {
+	os.Clearenv()
+
+	opts, err := NewParser().ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := "https://www.youtube-nocookie.com/embed/"
+	result := opts.YouTubeEmbedUrlOverride()
+
+	if result != expected {
+		t.Fatalf(`Unexpected default value, got %v instead of %v`, result, expected)
+	}
+
+	expected = "www.youtube-nocookie.com"
+	result = opts.YouTubeEmbedDomain()
+	if result != expected {
+		t.Fatalf(`Unexpected YouTube embed domain, got %v instead of %v`, result, expected)
+	}
+}
+
 func TestYouTubeEmbedUrlOverride(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("YOUTUBE_EMBED_URL_OVERRIDE", "https://invidious.custom/embed/")
 
-	parser := NewParser()
-	opts, err := parser.ParseEnvironmentVariables()
+	opts, err := NewParser().ParseEnvironmentVariables()
 	if err != nil {
 		t.Fatalf(`Parsing failure: %v`, err)
 	}
@@ -1895,6 +1994,12 @@ func TestYouTubeEmbedUrlOverride(t *testing.T) {
 	if result != expected {
 		t.Fatalf(`Unexpected YOUTUBE_EMBED_URL_OVERRIDE value, got %v instead of %v`, result, expected)
 	}
+
+	expected = "invidious.custom"
+	result = opts.YouTubeEmbedDomain()
+	if result != expected {
+		t.Fatalf(`Unexpected YouTube embed domain, got %v instead of %v`, result, expected)
+	}
 }
 
 func TestParseConfigDumpOutput(t *testing.T) {
@@ -1909,7 +2014,7 @@ func TestParseConfigDumpOutput(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, err := tmpfile.Write([]byte(serialized)); err != nil {
+	if _, err := tmpfile.WriteString(serialized); err != nil {
 		t.Fatal(err)
 	}
 
@@ -1931,3 +2036,71 @@ func TestParseConfigDumpOutput(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestHTTPClientProxies(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("HTTP_CLIENT_PROXIES", "http://proxy1.example.com,http://proxy2.example.com")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := []string{"http://proxy1.example.com", "http://proxy2.example.com"}
+	result := opts.HTTPClientProxies()
+
+	if len(expected) != len(result) {
+		t.Fatalf(`Unexpected HTTP_CLIENT_PROXIES value, got %v instead of %v`, result, expected)
+	}
+
+	for i, proxy := range expected {
+		if result[i] != proxy {
+			t.Fatalf(`Unexpected HTTP_CLIENT_PROXIES value at index %d, got %q instead of %q`, i, result[i], proxy)
+		}
+	}
+}
+
+func TestDefaultHTTPClientProxiesValue(t *testing.T) {
+	os.Clearenv()
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := []string{}
+	result := opts.HTTPClientProxies()
+
+	if len(expected) != len(result) {
+		t.Fatalf(`Unexpected default HTTP_CLIENT_PROXIES value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestHTTPClientProxy(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("HTTP_CLIENT_PROXY", "http://proxy.example.com")
+
+	parser := NewParser()
+	opts, err := parser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf(`Parsing failure: %v`, err)
+	}
+
+	expected := "http://proxy.example.com"
+	if opts.HTTPClientProxyURL() == nil || opts.HTTPClientProxyURL().String() != expected {
+		t.Fatalf(`Unexpected HTTP_CLIENT_PROXY value, got %v instead of %v`, opts.HTTPClientProxyURL(), expected)
+	}
+}
+
+func TestInvalidHTTPClientProxy(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("HTTP_CLIENT_PROXY", "sche|me://invalid-proxy-url")
+
+	parser := NewParser()
+	_, err := parser.ParseEnvironmentVariables()
+	if err == nil {
+		t.Fatalf(`Expected error for invalid HTTP_CLIENT_PROXY value, but got none`)
+	}
+}

internal/config/options.go

@@ -4,12 +4,13 @@
 package config // import "miniflux.app/v2/internal/config"
 
 import (
-	"crypto/rand"
 	"fmt"
+	"net/url"
 	"sort"
 	"strings"
 	"time"
 
+	"miniflux.app/v2/internal/crypto"
 	"miniflux.app/v2/internal/version"
 )
 
@@ -27,14 +28,16 @@ const (
 	defaultBaseURL                            = "http://localhost"
 	defaultRootURL                            = "http://localhost"
 	defaultBasePath                           = ""
-	defaultWorkerPoolSize                     = 5
+	defaultWorkerPoolSize                     = 16
 	defaultPollingFrequency                   = 60
+	defaultForceRefreshInterval               = 30
 	defaultBatchSize                          = 100
 	defaultPollingScheduler                   = "round_robin"
 	defaultSchedulerEntryFrequencyMinInterval = 5
 	defaultSchedulerEntryFrequencyMaxInterval = 24 * 60
 	defaultSchedulerEntryFrequencyFactor      = 1
 	defaultSchedulerRoundRobinMinInterval     = 60
+	defaultSchedulerRoundRobinMaxInterval     = 1440
 	defaultPollingParsingErrorLimit           = 3
 	defaultRunMigrations                      = false
 	defaultDatabaseURL                        = "user=postgres password=postgres dbname=miniflux2 sslmode=disable"
@@ -50,12 +53,16 @@ const (
 	defaultCleanupArchiveUnreadDays           = 180
 	defaultCleanupArchiveBatchSize            = 10000
 	defaultCleanupRemoveSessionsDays          = 30
-	defaultProxyHTTPClientTimeout             = 120
-	defaultProxyOption                        = "http-only"
-	defaultProxyMediaTypes                    = "image"
-	defaultProxyUrl                           = ""
+	defaultMediaProxyHTTPClientTimeout        = 120
+	defaultMediaProxyMode                     = "http-only"
+	defaultMediaResourceTypes                 = "image"
+	defaultMediaProxyURL                      = ""
+	defaultFilterEntryMaxAgeDays              = 0
+	defaultFetchBilibiliWatchTime             = false
+	defaultFetchNebulaWatchTime               = false
 	defaultFetchOdyseeWatchTime               = false
 	defaultFetchYouTubeWatchTime              = false
+	defaultYouTubeApiKey                      = ""
 	defaultYouTubeEmbedUrlOverride            = "https://www.youtube-nocookie.com/embed/"
 	defaultCreateAdmin                        = false
 	defaultAdminUsername                      = ""
@@ -65,8 +72,9 @@ const (
 	defaultOAuth2ClientSecret                 = ""
 	defaultOAuth2RedirectURL                  = ""
 	defaultOAuth2OidcDiscoveryEndpoint        = ""
+	defaultOauth2OidcProviderName             = "OpenID Connect"
 	defaultOAuth2Provider                     = ""
-	defaultPocketConsumerKey                  = ""
+	defaultDisableLocalAuth                   = false
 	defaultHTTPClientTimeout                  = 20
 	defaultHTTPClientMaxBodySize              = 15
 	defaultHTTPClientProxy                    = ""
@@ -103,7 +111,6 @@ type Options struct {
 	hsts                               bool
 	httpService                        bool
 	schedulerService                   bool
-	serverTimingHeader                 bool
 	baseURL                            string
 	rootURL                            string
 	basePath                           string
@@ -112,7 +119,7 @@ type Options struct {
 	databaseMinConns                   int
 	databaseConnectionLifetime         int
 	runMigrations                      bool
-	listenAddr                         string
+	listenAddr                         []string
 	certFile                           string
 	certDomain                         string
 	certKeyFile                        string
@@ -122,34 +129,43 @@ type Options struct {
 	cleanupArchiveBatchSize            int
 	cleanupRemoveSessionsDays          int
 	pollingFrequency                   int
+	forceRefreshInterval               int
 	batchSize                          int
 	pollingScheduler                   string
 	schedulerEntryFrequencyMinInterval int
 	schedulerEntryFrequencyMaxInterval int
 	schedulerEntryFrequencyFactor      int
 	schedulerRoundRobinMinInterval     int
+	schedulerRoundRobinMaxInterval     int
 	pollingParsingErrorLimit           int
 	workerPoolSize                     int
 	createAdmin                        bool
 	adminUsername                      string
 	adminPassword                      string
-	proxyHTTPClientTimeout             int
-	proxyOption                        string
-	proxyMediaTypes                    []string
-	proxyUrl                           string
+	mediaProxyHTTPClientTimeout        int
+	mediaProxyMode                     string
+	mediaProxyResourceTypes            []string
+	mediaProxyCustomURL                string
+	fetchBilibiliWatchTime             bool
+	fetchNebulaWatchTime               bool
 	fetchOdyseeWatchTime               bool
 	fetchYouTubeWatchTime              bool
+	filterEntryMaxAgeDays              int
+	youTubeApiKey                      string
 	youTubeEmbedUrlOverride            string
+	youTubeEmbedDomain                 string
 	oauth2UserCreationAllowed          bool
 	oauth2ClientID                     string
 	oauth2ClientSecret                 string
 	oauth2RedirectURL                  string
 	oidcDiscoveryEndpoint              string
+	oidcProviderName                   string
 	oauth2Provider                     string
-	pocketConsumerKey                  string
+	disableLocalAuth                   bool
 	httpClientTimeout                  int
 	httpClientMaxBodySize              int64
-	httpClientProxy                    string
+	httpClientProxyURL                 *url.URL
+	httpClientProxies                  []string
 	httpClientUserAgent                string
 	httpServerTimeout                  int
 	authProxyHeader                    string
@@ -163,15 +179,12 @@ type Options struct {
 	metricsPassword                    string
 	watchdog                           bool
 	invidiousInstance                  string
-	proxyPrivateKey                    []byte
+	mediaProxyPrivateKey               []byte
 	webAuthn                           bool
 }
 
 // NewOptions returns Options with default values.
 func NewOptions() *Options {
-	randomKey := make([]byte, 16)
-	rand.Read(randomKey)
-
 	return &Options{
 		HTTPS:                              defaultHTTPS,
 		logFile:                            defaultLogFile,
@@ -181,7 +194,6 @@ func NewOptions() *Options {
 		hsts:                               defaultHSTS,
 		httpService:                        defaultHTTPService,
 		schedulerService:                   defaultSchedulerService,
-		serverTimingHeader:                 defaultTiming,
 		baseURL:                            defaultBaseURL,
 		rootURL:                            defaultRootURL,
 		basePath:                           defaultBasePath,
@@ -190,7 +202,7 @@ func NewOptions() *Options {
 		databaseMinConns:                   defaultDatabaseMinConns,
 		databaseConnectionLifetime:         defaultDatabaseConnectionLifetime,
 		runMigrations:                      defaultRunMigrations,
-		listenAddr:                         defaultListenAddr,
+		listenAddr:                         []string{defaultListenAddr},
 		certFile:                           defaultCertFile,
 		certDomain:                         defaultCertDomain,
 		certKeyFile:                        defaultKeyFile,
@@ -200,32 +212,40 @@ func NewOptions() *Options {
 		cleanupArchiveBatchSize:            defaultCleanupArchiveBatchSize,
 		cleanupRemoveSessionsDays:          defaultCleanupRemoveSessionsDays,
 		pollingFrequency:                   defaultPollingFrequency,
+		forceRefreshInterval:               defaultForceRefreshInterval,
 		batchSize:                          defaultBatchSize,
 		pollingScheduler:                   defaultPollingScheduler,
 		schedulerEntryFrequencyMinInterval: defaultSchedulerEntryFrequencyMinInterval,
 		schedulerEntryFrequencyMaxInterval: defaultSchedulerEntryFrequencyMaxInterval,
 		schedulerEntryFrequencyFactor:      defaultSchedulerEntryFrequencyFactor,
 		schedulerRoundRobinMinInterval:     defaultSchedulerRoundRobinMinInterval,
+		schedulerRoundRobinMaxInterval:     defaultSchedulerRoundRobinMaxInterval,
 		pollingParsingErrorLimit:           defaultPollingParsingErrorLimit,
 		workerPoolSize:                     defaultWorkerPoolSize,
 		createAdmin:                        defaultCreateAdmin,
-		proxyHTTPClientTimeout:             defaultProxyHTTPClientTimeout,
-		proxyOption:                        defaultProxyOption,
-		proxyMediaTypes:                    []string{defaultProxyMediaTypes},
-		proxyUrl:                           defaultProxyUrl,
+		mediaProxyHTTPClientTimeout:        defaultMediaProxyHTTPClientTimeout,
+		mediaProxyMode:                     defaultMediaProxyMode,
+		mediaProxyResourceTypes:            []string{defaultMediaResourceTypes},
+		mediaProxyCustomURL:                defaultMediaProxyURL,
+		filterEntryMaxAgeDays:              defaultFilterEntryMaxAgeDays,
+		fetchBilibiliWatchTime:             defaultFetchBilibiliWatchTime,
+		fetchNebulaWatchTime:               defaultFetchNebulaWatchTime,
 		fetchOdyseeWatchTime:               defaultFetchOdyseeWatchTime,
 		fetchYouTubeWatchTime:              defaultFetchYouTubeWatchTime,
+		youTubeApiKey:                      defaultYouTubeApiKey,
 		youTubeEmbedUrlOverride:            defaultYouTubeEmbedUrlOverride,
 		oauth2UserCreationAllowed:          defaultOAuth2UserCreation,
 		oauth2ClientID:                     defaultOAuth2ClientID,
 		oauth2ClientSecret:                 defaultOAuth2ClientSecret,
 		oauth2RedirectURL:                  defaultOAuth2RedirectURL,
 		oidcDiscoveryEndpoint:              defaultOAuth2OidcDiscoveryEndpoint,
+		oidcProviderName:                   defaultOauth2OidcProviderName,
 		oauth2Provider:                     defaultOAuth2Provider,
-		pocketConsumerKey:                  defaultPocketConsumerKey,
+		disableLocalAuth:                   defaultDisableLocalAuth,
 		httpClientTimeout:                  defaultHTTPClientTimeout,
 		httpClientMaxBodySize:              defaultHTTPClientMaxBodySize * 1024 * 1024,
-		httpClientProxy:                    defaultHTTPClientProxy,
+		httpClientProxyURL:                 nil,
+		httpClientProxies:                  []string{},
 		httpClientUserAgent:                defaultHTTPClientUserAgent,
 		httpServerTimeout:                  defaultHTTPServerTimeout,
 		authProxyHeader:                    defaultAuthProxyHeader,
@@ -239,7 +259,7 @@ func NewOptions() *Options {
 		metricsPassword:                    defaultMetricsPassword,
 		watchdog:                           defaultWatchdog,
 		invidiousInstance:                  defaultInvidiousInstance,
-		proxyPrivateKey:                    randomKey,
+		mediaProxyPrivateKey:               crypto.GenerateRandomBytes(16),
 		webAuthn:                           defaultWebAuthn,
 	}
 }
@@ -278,11 +298,6 @@ func (o *Options) MaintenanceMessage() string {
 	return o.maintenanceMessage
 }
 
-// HasServerTimingHeader returns true if server-timing headers enabled.
-func (o *Options) HasServerTimingHeader() bool {
-	return o.serverTimingHeader
-}
-
 // BaseURL returns the application base URL with path.
 func (o *Options) BaseURL() string {
 	return o.baseURL
@@ -324,7 +339,7 @@ func (o *Options) DatabaseConnectionLifetime() time.Duration {
 }
 
 // ListenAddr returns the listen address for the HTTP server.
-func (o *Options) ListenAddr() string {
+func (o *Options) ListenAddr() []string {
 	return o.listenAddr
 }
 
@@ -378,6 +393,11 @@ func (o *Options) PollingFrequency() int {
 	return o.pollingFrequency
 }
 
+// ForceRefreshInterval returns the force refresh interval
+func (o *Options) ForceRefreshInterval() int {
+	return o.forceRefreshInterval
+}
+
 // BatchSize returns the number of feeds to send for background processing.
 func (o *Options) BatchSize() int {
 	return o.batchSize
@@ -407,6 +427,10 @@ func (o *Options) SchedulerRoundRobinMinInterval() int {
 	return o.schedulerRoundRobinMinInterval
 }
 
+func (o *Options) SchedulerRoundRobinMaxInterval() int {
+	return o.schedulerRoundRobinMaxInterval
+}
+
 // PollingParsingErrorLimit returns the limit of errors when to stop polling.
 func (o *Options) PollingParsingErrorLimit() int {
 	return o.pollingParsingErrorLimit
@@ -437,11 +461,21 @@ func (o *Options) OIDCDiscoveryEndpoint() string {
 	return o.oidcDiscoveryEndpoint
 }
 
+// OIDCProviderName returns the OAuth2 OIDC provider's display name
+func (o *Options) OIDCProviderName() string {
+	return o.oidcProviderName
+}
+
 // OAuth2Provider returns the name of the OAuth2 provider configured.
 func (o *Options) OAuth2Provider() string {
 	return o.oauth2Provider
 }
 
+// DisableLocalAUth returns true if the local user database should not be used to authenticate users
+func (o *Options) DisableLocalAuth() bool {
+	return o.disableLocalAuth
+}
+
 // HasHSTS returns true if HTTP Strict Transport Security is enabled.
 func (o *Options) HasHSTS() bool {
 	return o.hsts
@@ -473,35 +507,65 @@ func (o *Options) FetchYouTubeWatchTime() bool {
 	return o.fetchYouTubeWatchTime
 }
 
-// YouTubeEmbedUrlOverride returns YouTube URL which will be used for embeds
+// YouTubeApiKey returns the YouTube API key if defined.
+func (o *Options) YouTubeApiKey() string {
+	return o.youTubeApiKey
+}
+
+// YouTubeEmbedUrlOverride returns the YouTube embed URL override if defined.
 func (o *Options) YouTubeEmbedUrlOverride() string {
 	return o.youTubeEmbedUrlOverride
 }
 
+// YouTubeEmbedDomain returns the domain used for YouTube embeds.
+func (o *Options) YouTubeEmbedDomain() string {
+	if o.youTubeEmbedDomain != "" {
+		return o.youTubeEmbedDomain
+	}
+	return "www.youtube-nocookie.com"
+}
+
+// FetchNebulaWatchTime returns true if the Nebula video duration
+// should be fetched and used as a reading time.
+func (o *Options) FetchNebulaWatchTime() bool {
+	return o.fetchNebulaWatchTime
+}
+
 // FetchOdyseeWatchTime returns true if the Odysee video duration
 // should be fetched and used as a reading time.
 func (o *Options) FetchOdyseeWatchTime() bool {
 	return o.fetchOdyseeWatchTime
 }
 
-// ProxyOption returns "none" to never proxy, "http-only" to proxy non-HTTPS, "all" to always proxy.
-func (o *Options) ProxyOption() string {
-	return o.proxyOption
+// FetchBilibiliWatchTime returns true if the Bilibili video duration
+// should be fetched and used as a reading time.
+func (o *Options) FetchBilibiliWatchTime() bool {
+	return o.fetchBilibiliWatchTime
 }
 
-// ProxyMediaTypes returns a slice of media types to proxy.
-func (o *Options) ProxyMediaTypes() []string {
-	return o.proxyMediaTypes
+// MediaProxyMode returns "none" to never proxy, "http-only" to proxy non-HTTPS, "all" to always proxy.
+func (o *Options) MediaProxyMode() string {
+	return o.mediaProxyMode
 }
 
-// ProxyUrl returns a string of a URL to use to proxy image requests
-func (o *Options) ProxyUrl() string {
-	return o.proxyUrl
+// MediaProxyResourceTypes returns a slice of resource types to proxy.
+func (o *Options) MediaProxyResourceTypes() []string {
+	return o.mediaProxyResourceTypes
 }
 
-// ProxyHTTPClientTimeout returns the time limit in seconds before the proxy HTTP client cancel the request.
-func (o *Options) ProxyHTTPClientTimeout() int {
-	return o.proxyHTTPClientTimeout
+// MediaCustomProxyURL returns the custom proxy URL for medias.
+func (o *Options) MediaCustomProxyURL() string {
+	return o.mediaProxyCustomURL
+}
+
+// MediaProxyHTTPClientTimeout returns the time limit in seconds before the proxy HTTP client cancel the request.
+func (o *Options) MediaProxyHTTPClientTimeout() int {
+	return o.mediaProxyHTTPClientTimeout
+}
+
+// MediaProxyPrivateKey returns the private key used by the media proxy.
+func (o *Options) MediaProxyPrivateKey() []byte {
+	return o.mediaProxyPrivateKey
 }
 
 // HasHTTPService returns true if the HTTP service is enabled.
@@ -514,14 +578,6 @@ func (o *Options) HasSchedulerService() bool {
 	return o.schedulerService
 }
 
-// PocketConsumerKey returns the Pocket Consumer Key if configured.
-func (o *Options) PocketConsumerKey(defaultValue string) string {
-	if o.pocketConsumerKey != "" {
-		return o.pocketConsumerKey
-	}
-	return defaultValue
-}
-
 // HTTPClientTimeout returns the time limit in seconds before the HTTP client cancel the request.
 func (o *Options) HTTPClientTimeout() int {
 	return o.httpClientTimeout
@@ -532,9 +588,24 @@ func (o *Options) HTTPClientMaxBodySize() int64 {
 	return o.httpClientMaxBodySize
 }
 
-// HTTPClientProxy returns the proxy URL for HTTP client.
-func (o *Options) HTTPClientProxy() string {
-	return o.httpClientProxy
+// HTTPClientProxyURL returns the client HTTP proxy URL if configured.
+func (o *Options) HTTPClientProxyURL() *url.URL {
+	return o.httpClientProxyURL
+}
+
+// HasHTTPClientProxyURLConfigured returns true if the client HTTP proxy URL if configured.
+func (o *Options) HasHTTPClientProxyURLConfigured() bool {
+	return o.httpClientProxyURL != nil
+}
+
+// HTTPClientProxies returns the list of proxies.
+func (o *Options) HTTPClientProxies() []string {
+	return o.httpClientProxies
+}
+
+// HTTPClientProxiesString returns true if the list of rotating proxies are configured.
+func (o *Options) HasHTTPClientProxiesConfigured() bool {
+	return len(o.httpClientProxies) > 0
 }
 
 // HTTPServerTimeout returns the time limit in seconds before the HTTP server cancel the request.
@@ -542,11 +613,6 @@ func (o *Options) HTTPServerTimeout() int {
 	return o.httpServerTimeout
 }
 
-// HasHTTPClientProxyConfigured returns true if the HTTP proxy is configured.
-func (o *Options) HasHTTPClientProxyConfigured() bool {
-	return o.httpClientProxy != ""
-}
-
 // AuthProxyHeader returns an HTTP header name that contains username for
 // authentication using auth proxy.
 func (o *Options) AuthProxyHeader() string {
@@ -597,18 +663,45 @@ func (o *Options) InvidiousInstance() string {
 	return o.invidiousInstance
 }
 
-// ProxyPrivateKey returns the private key used by the media proxy
-func (o *Options) ProxyPrivateKey() []byte {
-	return o.proxyPrivateKey
-}
-
 // WebAuthn returns true if WebAuthn logins are supported
 func (o *Options) WebAuthn() bool {
 	return o.webAuthn
 }
 
+// FilterEntryMaxAgeDays returns the number of days after which entries should be retained.
+func (o *Options) FilterEntryMaxAgeDays() int {
+	return o.filterEntryMaxAgeDays
+}
+
 // SortedOptions returns options as a list of key value pairs, sorted by keys.
 func (o *Options) SortedOptions(redactSecret bool) []*Option {
+	var clientProxyURLRedacted string
+	if o.httpClientProxyURL != nil {
+		if redactSecret {
+			clientProxyURLRedacted = o.httpClientProxyURL.Redacted()
+		} else {
+			clientProxyURLRedacted = o.httpClientProxyURL.String()
+		}
+	}
+
+	var clientProxyURLsRedacted string
+	if len(o.httpClientProxies) > 0 {
+		if redactSecret {
+			var proxyURLs []string
+			for range o.httpClientProxies {
+				proxyURLs = append(proxyURLs, "<redacted>")
+			}
+			clientProxyURLsRedacted = strings.Join(proxyURLs, ",")
+		} else {
+			clientProxyURLsRedacted = strings.Join(o.httpClientProxies, ",")
+		}
+	}
+
+	var mediaProxyPrivateKeyValue string
+	if len(o.mediaProxyPrivateKey) > 0 {
+		mediaProxyPrivateKeyValue = "<binary-data>"
+	}
+
 	var keyValues = map[string]interface{}{
 		"ADMIN_PASSWORD":                         redactSecretValue(o.adminPassword, redactSecret),
 		"ADMIN_USERNAME":                         o.adminUsername,
@@ -632,18 +725,22 @@ func (o *Options) SortedOptions(redactSecret bool) []*Option {
 		"DISABLE_HSTS":                           !o.hsts,
 		"DISABLE_HTTP_SERVICE":                   !o.httpService,
 		"DISABLE_SCHEDULER_SERVICE":              !o.schedulerService,
+		"FILTER_ENTRY_MAX_AGE_DAYS":              o.filterEntryMaxAgeDays,
 		"FETCH_YOUTUBE_WATCH_TIME":               o.fetchYouTubeWatchTime,
+		"FETCH_NEBULA_WATCH_TIME":                o.fetchNebulaWatchTime,
 		"FETCH_ODYSEE_WATCH_TIME":                o.fetchOdyseeWatchTime,
+		"FETCH_BILIBILI_WATCH_TIME":              o.fetchBilibiliWatchTime,
 		"HTTPS":                                  o.HTTPS,
 		"HTTP_CLIENT_MAX_BODY_SIZE":              o.httpClientMaxBodySize,
-		"HTTP_CLIENT_PROXY":                      o.httpClientProxy,
+		"HTTP_CLIENT_PROXIES":                    clientProxyURLsRedacted,
+		"HTTP_CLIENT_PROXY":                      clientProxyURLRedacted,
 		"HTTP_CLIENT_TIMEOUT":                    o.httpClientTimeout,
 		"HTTP_CLIENT_USER_AGENT":                 o.httpClientUserAgent,
 		"HTTP_SERVER_TIMEOUT":                    o.httpServerTimeout,
 		"HTTP_SERVICE":                           o.httpService,
 		"INVIDIOUS_INSTANCE":                     o.invidiousInstance,
 		"KEY_FILE":                               o.certKeyFile,
-		"LISTEN_ADDR":                            o.listenAddr,
+		"LISTEN_ADDR":                            strings.Join(o.listenAddr, ","),
 		"LOG_FILE":                               o.logFile,
 		"LOG_DATE_TIME":                          o.logDateTime,
 		"LOG_FORMAT":                             o.logFormat,
@@ -658,28 +755,31 @@ func (o *Options) SortedOptions(redactSecret bool) []*Option {
 		"OAUTH2_CLIENT_ID":                       o.oauth2ClientID,
 		"OAUTH2_CLIENT_SECRET":                   redactSecretValue(o.oauth2ClientSecret, redactSecret),
 		"OAUTH2_OIDC_DISCOVERY_ENDPOINT":         o.oidcDiscoveryEndpoint,
+		"OAUTH2_OIDC_PROVIDER_NAME":              o.oidcProviderName,
 		"OAUTH2_PROVIDER":                        o.oauth2Provider,
 		"OAUTH2_REDIRECT_URL":                    o.oauth2RedirectURL,
 		"OAUTH2_USER_CREATION":                   o.oauth2UserCreationAllowed,
-		"POCKET_CONSUMER_KEY":                    redactSecretValue(o.pocketConsumerKey, redactSecret),
+		"DISABLE_LOCAL_AUTH":                     o.disableLocalAuth,
 		"POLLING_FREQUENCY":                      o.pollingFrequency,
+		"FORCE_REFRESH_INTERVAL":                 o.forceRefreshInterval,
 		"POLLING_PARSING_ERROR_LIMIT":            o.pollingParsingErrorLimit,
 		"POLLING_SCHEDULER":                      o.pollingScheduler,
-		"PROXY_HTTP_CLIENT_TIMEOUT":              o.proxyHTTPClientTimeout,
-		"PROXY_MEDIA_TYPES":                      o.proxyMediaTypes,
-		"PROXY_OPTION":                           o.proxyOption,
-		"PROXY_PRIVATE_KEY":                      redactSecretValue(string(o.proxyPrivateKey), redactSecret),
-		"PROXY_URL":                              o.proxyUrl,
+		"MEDIA_PROXY_HTTP_CLIENT_TIMEOUT":        o.mediaProxyHTTPClientTimeout,
+		"MEDIA_PROXY_RESOURCE_TYPES":             o.mediaProxyResourceTypes,
+		"MEDIA_PROXY_MODE":                       o.mediaProxyMode,
+		"MEDIA_PROXY_PRIVATE_KEY":                mediaProxyPrivateKeyValue,
+		"MEDIA_PROXY_CUSTOM_URL":                 o.mediaProxyCustomURL,
 		"ROOT_URL":                               o.rootURL,
 		"RUN_MIGRATIONS":                         o.runMigrations,
 		"SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL": o.schedulerEntryFrequencyMaxInterval,
 		"SCHEDULER_ENTRY_FREQUENCY_MIN_INTERVAL": o.schedulerEntryFrequencyMinInterval,
 		"SCHEDULER_ENTRY_FREQUENCY_FACTOR":       o.schedulerEntryFrequencyFactor,
 		"SCHEDULER_ROUND_ROBIN_MIN_INTERVAL":     o.schedulerRoundRobinMinInterval,
+		"SCHEDULER_ROUND_ROBIN_MAX_INTERVAL":     o.schedulerRoundRobinMaxInterval,
 		"SCHEDULER_SERVICE":                      o.schedulerService,
-		"SERVER_TIMING_HEADER":                   o.serverTimingHeader,
 		"WATCHDOG":                               o.watchdog,
 		"WORKER_POOL_SIZE":                       o.workerPoolSize,
+		"YOUTUBE_API_KEY":                        redactSecretValue(o.youTubeApiKey, redactSecret),
 		"YOUTUBE_EMBED_URL_OVERRIDE":             o.youTubeEmbedUrlOverride,
 		"WEBAUTHN":                               o.webAuthn,
 	}

internal/config/parser.go

@@ -56,7 +56,7 @@ func (p *Parser) parseFileContent(r io.Reader) (lines []string) {
 	scanner := bufio.NewScanner(r)
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
-		if len(line) > 0 && !strings.HasPrefix(line, "#") && strings.Index(line, "=") > 0 {
+		if !strings.HasPrefix(line, "#") && strings.Index(line, "=") > 0 {
 			lines = append(lines, line)
 		}
 	}
@@ -86,13 +86,6 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			if parsedValue == "json" || parsedValue == "text" {
 				p.opts.logFormat = parsedValue
 			}
-		case "DEBUG":
-			parsedValue := parseBool(value, defaultDebug)
-			if parsedValue {
-				p.opts.logLevel = "debug"
-			}
-		case "SERVER_TIMING_HEADER":
-			p.opts.serverTimingHeader = parseBool(value, defaultTiming)
 		case "BASE_URL":
 			p.opts.baseURL, p.opts.rootURL, p.opts.basePath, err = parseBaseURL(value)
 			if err != nil {
@@ -101,7 +94,7 @@ func (p *Parser) parseLines(lines []string) (err error) {
 		case "PORT":
 			port = value
 		case "LISTEN_ADDR":
-			p.opts.listenAddr = parseString(value, defaultListenAddr)
+			p.opts.listenAddr = parseStringList(value, []string{defaultListenAddr})
 		case "DATABASE_URL":
 			p.opts.databaseURL = parseString(value, defaultDatabaseURL)
 		case "DATABASE_URL_FILE":
@@ -112,6 +105,8 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.databaseMinConns = parseInt(value, defaultDatabaseMinConns)
 		case "DATABASE_CONNECTION_LIFETIME":
 			p.opts.databaseConnectionLifetime = parseInt(value, defaultDatabaseConnectionLifetime)
+		case "FILTER_ENTRY_MAX_AGE_DAYS":
+			p.opts.filterEntryMaxAgeDays = parseInt(value, defaultFilterEntryMaxAgeDays)
 		case "RUN_MIGRATIONS":
 			p.opts.runMigrations = parseBool(value, defaultRunMigrations)
 		case "DISABLE_HSTS":
@@ -142,6 +137,8 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.workerPoolSize = parseInt(value, defaultWorkerPoolSize)
 		case "POLLING_FREQUENCY":
 			p.opts.pollingFrequency = parseInt(value, defaultPollingFrequency)
+		case "FORCE_REFRESH_INTERVAL":
+			p.opts.forceRefreshInterval = parseInt(value, defaultForceRefreshInterval)
 		case "BATCH_SIZE":
 			p.opts.batchSize = parseInt(value, defaultBatchSize)
 		case "POLLING_SCHEDULER":
@@ -154,22 +151,24 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.schedulerEntryFrequencyFactor = parseInt(value, defaultSchedulerEntryFrequencyFactor)
 		case "SCHEDULER_ROUND_ROBIN_MIN_INTERVAL":
 			p.opts.schedulerRoundRobinMinInterval = parseInt(value, defaultSchedulerRoundRobinMinInterval)
+		case "SCHEDULER_ROUND_ROBIN_MAX_INTERVAL":
+			p.opts.schedulerRoundRobinMaxInterval = parseInt(value, defaultSchedulerRoundRobinMaxInterval)
 		case "POLLING_PARSING_ERROR_LIMIT":
 			p.opts.pollingParsingErrorLimit = parseInt(value, defaultPollingParsingErrorLimit)
-		// kept for compatibility purpose
-		case "PROXY_IMAGES":
-			p.opts.proxyOption = parseString(value, defaultProxyOption)
-		case "PROXY_HTTP_CLIENT_TIMEOUT":
-			p.opts.proxyHTTPClientTimeout = parseInt(value, defaultProxyHTTPClientTimeout)
-		case "PROXY_OPTION":
-			p.opts.proxyOption = parseString(value, defaultProxyOption)
-		case "PROXY_MEDIA_TYPES":
-			p.opts.proxyMediaTypes = parseStringList(value, []string{defaultProxyMediaTypes})
-		// kept for compatibility purpose
-		case "PROXY_IMAGE_URL":
-			p.opts.proxyUrl = parseString(value, defaultProxyUrl)
-		case "PROXY_URL":
-			p.opts.proxyUrl = parseString(value, defaultProxyUrl)
+		case "MEDIA_PROXY_HTTP_CLIENT_TIMEOUT":
+			p.opts.mediaProxyHTTPClientTimeout = parseInt(value, defaultMediaProxyHTTPClientTimeout)
+		case "MEDIA_PROXY_MODE":
+			p.opts.mediaProxyMode = parseString(value, defaultMediaProxyMode)
+		case "MEDIA_PROXY_RESOURCE_TYPES":
+			p.opts.mediaProxyResourceTypes = parseStringList(value, []string{defaultMediaResourceTypes})
+		case "MEDIA_PROXY_PRIVATE_KEY":
+			randomKey := make([]byte, 16)
+			if _, err := rand.Read(randomKey); err != nil {
+				return fmt.Errorf("config: unable to generate random key: %w", err)
+			}
+			p.opts.mediaProxyPrivateKey = parseBytes(value, randomKey)
+		case "MEDIA_PROXY_CUSTOM_URL":
+			p.opts.mediaProxyCustomURL = parseString(value, defaultMediaProxyURL)
 		case "CREATE_ADMIN":
 			p.opts.createAdmin = parseBool(value, defaultCreateAdmin)
 		case "ADMIN_USERNAME":
@@ -180,10 +179,6 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.adminPassword = parseString(value, defaultAdminPassword)
 		case "ADMIN_PASSWORD_FILE":
 			p.opts.adminPassword = readSecretFile(value, defaultAdminPassword)
-		case "POCKET_CONSUMER_KEY":
-			p.opts.pocketConsumerKey = parseString(value, defaultPocketConsumerKey)
-		case "POCKET_CONSUMER_KEY_FILE":
-			p.opts.pocketConsumerKey = readSecretFile(value, defaultPocketConsumerKey)
 		case "OAUTH2_USER_CREATION":
 			p.opts.oauth2UserCreationAllowed = parseBool(value, defaultOAuth2UserCreation)
 		case "OAUTH2_CLIENT_ID":
@@ -198,14 +193,23 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.oauth2RedirectURL = parseString(value, defaultOAuth2RedirectURL)
 		case "OAUTH2_OIDC_DISCOVERY_ENDPOINT":
 			p.opts.oidcDiscoveryEndpoint = parseString(value, defaultOAuth2OidcDiscoveryEndpoint)
+		case "OAUTH2_OIDC_PROVIDER_NAME":
+			p.opts.oidcProviderName = parseString(value, defaultOauth2OidcProviderName)
 		case "OAUTH2_PROVIDER":
 			p.opts.oauth2Provider = parseString(value, defaultOAuth2Provider)
+		case "DISABLE_LOCAL_AUTH":
+			p.opts.disableLocalAuth = parseBool(value, defaultDisableLocalAuth)
 		case "HTTP_CLIENT_TIMEOUT":
 			p.opts.httpClientTimeout = parseInt(value, defaultHTTPClientTimeout)
 		case "HTTP_CLIENT_MAX_BODY_SIZE":
 			p.opts.httpClientMaxBodySize = int64(parseInt(value, defaultHTTPClientMaxBodySize) * 1024 * 1024)
 		case "HTTP_CLIENT_PROXY":
-			p.opts.httpClientProxy = parseString(value, defaultHTTPClientProxy)
+			p.opts.httpClientProxyURL, err = url.Parse(parseString(value, defaultHTTPClientProxy))
+			if err != nil {
+				return fmt.Errorf("config: invalid HTTP_CLIENT_PROXY value: %w", err)
+			}
+		case "HTTP_CLIENT_PROXIES":
+			p.opts.httpClientProxies = parseStringList(value, []string{})
 		case "HTTP_CLIENT_USER_AGENT":
 			p.opts.httpClientUserAgent = parseString(value, defaultHTTPClientUserAgent)
 		case "HTTP_SERVER_TIMEOUT":
@@ -232,28 +236,37 @@ func (p *Parser) parseLines(lines []string) (err error) {
 			p.opts.metricsPassword = parseString(value, defaultMetricsPassword)
 		case "METRICS_PASSWORD_FILE":
 			p.opts.metricsPassword = readSecretFile(value, defaultMetricsPassword)
+		case "FETCH_BILIBILI_WATCH_TIME":
+			p.opts.fetchBilibiliWatchTime = parseBool(value, defaultFetchBilibiliWatchTime)
+		case "FETCH_NEBULA_WATCH_TIME":
+			p.opts.fetchNebulaWatchTime = parseBool(value, defaultFetchNebulaWatchTime)
 		case "FETCH_ODYSEE_WATCH_TIME":
 			p.opts.fetchOdyseeWatchTime = parseBool(value, defaultFetchOdyseeWatchTime)
 		case "FETCH_YOUTUBE_WATCH_TIME":
 			p.opts.fetchYouTubeWatchTime = parseBool(value, defaultFetchYouTubeWatchTime)
+		case "YOUTUBE_API_KEY":
+			p.opts.youTubeApiKey = parseString(value, defaultYouTubeApiKey)
 		case "YOUTUBE_EMBED_URL_OVERRIDE":
 			p.opts.youTubeEmbedUrlOverride = parseString(value, defaultYouTubeEmbedUrlOverride)
 		case "WATCHDOG":
 			p.opts.watchdog = parseBool(value, defaultWatchdog)
 		case "INVIDIOUS_INSTANCE":
 			p.opts.invidiousInstance = parseString(value, defaultInvidiousInstance)
-		case "PROXY_PRIVATE_KEY":
-			randomKey := make([]byte, 16)
-			rand.Read(randomKey)
-			p.opts.proxyPrivateKey = parseBytes(value, randomKey)
 		case "WEBAUTHN":
 			p.opts.webAuthn = parseBool(value, defaultWebAuthn)
 		}
 	}
 
 	if port != "" {
-		p.opts.listenAddr = ":" + port
+		p.opts.listenAddr = []string{":" + port}
 	}
+
+	youtubeEmbedURL, err := url.Parse(p.opts.youTubeEmbedUrlOverride)
+	if err != nil {
+		return fmt.Errorf("config: invalid YOUTUBE_EMBED_URL_OVERRIDE value: %w", err)
+	}
+	p.opts.youTubeEmbedDomain = youtubeEmbedURL.Hostname()
+
 	return nil
 }
 
@@ -326,6 +339,10 @@ func parseStringList(value string, fallback []string) []string {
 	for _, item := range items {
 		itemValue := strings.TrimSpace(item)
 
+		if itemValue == "" {
+			continue
+		}
+
 		if _, found := strMap[itemValue]; !found {
 			strMap[itemValue] = true
 			strList = append(strList, itemValue)

internal/config/parser_test.go

@@ -4,6 +4,7 @@
 package config // import "miniflux.app/v2/internal/config"
 
 import (
+	"reflect"
 	"testing"
 )
 
@@ -58,3 +59,108 @@ func TestParseIntValue(t *testing.T) {
 		t.Errorf(`Defined variables should returns the specified value`)
 	}
 }
+
+func TestParseListenAddr(t *testing.T) {
+	defaultExpected := []string{defaultListenAddr}
+
+	tests := []struct {
+		name           string
+		listenAddr     string
+		port           string
+		expected       []string
+		lines          []string // Used for direct lines parsing instead of individual env vars
+		isLineOriented bool     // Flag to indicate if we use lines
+	}{
+		{
+			name:       "Single LISTEN_ADDR",
+			listenAddr: "127.0.0.1:8080",
+			expected:   []string{"127.0.0.1:8080"},
+		},
+		{
+			name:       "Multiple LISTEN_ADDR comma-separated",
+			listenAddr: "127.0.0.1:8080,:8081,/tmp/miniflux.sock",
+			expected:   []string{"127.0.0.1:8080", ":8081", "/tmp/miniflux.sock"},
+		},
+		{
+			name:       "Multiple LISTEN_ADDR with spaces around commas",
+			listenAddr: "127.0.0.1:8080 , :8081",
+			expected:   []string{"127.0.0.1:8080", ":8081"},
+		},
+		{
+			name:       "Empty LISTEN_ADDR",
+			listenAddr: "",
+			expected:   defaultExpected,
+		},
+		{
+			name:       "PORT overrides LISTEN_ADDR",
+			listenAddr: "127.0.0.1:8000",
+			port:       "8082",
+			expected:   []string{":8082"},
+		},
+		{
+			name:       "PORT overrides empty LISTEN_ADDR",
+			listenAddr: "",
+			port:       "8083",
+			expected:   []string{":8083"},
+		},
+		{
+			name:       "LISTEN_ADDR with empty segment (comma)",
+			listenAddr: "127.0.0.1:8080,,:8081",
+			expected:   []string{"127.0.0.1:8080", ":8081"},
+		},
+		{
+			name:           "PORT override with lines parsing",
+			isLineOriented: true,
+			lines:          []string{"LISTEN_ADDR=127.0.0.1:8000", "PORT=8082"},
+			expected:       []string{":8082"},
+		},
+		{
+			name:           "LISTEN_ADDR only with lines parsing (comma)",
+			isLineOriented: true,
+			lines:          []string{"LISTEN_ADDR=10.0.0.1:9090,10.0.0.2:9091"},
+			expected:       []string{"10.0.0.1:9090", "10.0.0.2:9091"},
+		},
+		{
+			name:           "Empty LISTEN_ADDR with lines parsing (default)",
+			isLineOriented: true,
+			lines:          []string{"LISTEN_ADDR="},
+			expected:       defaultExpected,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			parser := NewParser()
+			var err error
+
+			if tt.isLineOriented {
+				err = parser.parseLines(tt.lines)
+			} else {
+				// Simulate os.Environ() behaviour for individual var testing
+				var envLines []string
+				if tt.listenAddr != "" {
+					envLines = append(envLines, "LISTEN_ADDR="+tt.listenAddr)
+				}
+				if tt.port != "" {
+					envLines = append(envLines, "PORT="+tt.port)
+				}
+				// Add a dummy var if both are empty to avoid empty lines slice if not intended
+				if tt.listenAddr == "" && tt.port == "" && tt.name == "Empty LISTEN_ADDR" {
+					// This case specifically tests empty LISTEN_ADDR resulting in default
+					// So, we pass LISTEN_ADDR=
+					envLines = append(envLines, "LISTEN_ADDR=")
+				}
+				err = parser.parseLines(envLines)
+			}
+
+			if err != nil {
+				t.Fatalf("parseLines() error = %v", err)
+			}
+
+			opts := parser.opts
+			if !reflect.DeepEqual(opts.ListenAddr(), tt.expected) {
+				t.Errorf("ListenAddr() got = %v, want %v", opts.ListenAddr(), tt.expected)
+			}
+		})
+	}
+}

internal/crypto/crypto.go

@@ -7,39 +7,34 @@ import (
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
-	"encoding/base64"
+	"crypto/subtle"
 	"encoding/hex"
 	"fmt"
+	"hash/fnv"
 
 	"golang.org/x/crypto/bcrypt"
 )
 
-// HashFromBytes returns a SHA-256 checksum of the input.
+// HashFromBytes returns a non-cryptographic checksum of the input.
 func HashFromBytes(value []byte) string {
-	sum := sha256.Sum256(value)
-	return fmt.Sprintf("%x", sum)
+	h := fnv.New128a()
+	h.Write(value)
+	return hex.EncodeToString(h.Sum(nil))
 }
 
-// Hash returns a SHA-256 checksum of a string.
-func Hash(value string) string {
-	return HashFromBytes([]byte(value))
+// SHA256 returns a SHA-256 checksum of a string.
+func SHA256(value string) string {
+	h := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(h[:])
 }
 
 // GenerateRandomBytes returns random bytes.
 func GenerateRandomBytes(size int) []byte {
 	b := make([]byte, size)
-	if _, err := rand.Read(b); err != nil {
-		panic(err)
-	}
-
+	rand.Read(b)
 	return b
 }
 
-// GenerateRandomString returns a random string.
-func GenerateRandomString(size int) string {
-	return base64.URLEncoding.EncodeToString(GenerateRandomBytes(size))
-}
-
 // GenerateRandomStringHex returns a random hexadecimal string.
 func GenerateRandomStringHex(size int) string {
 	return hex.EncodeToString(GenerateRandomBytes(size))
@@ -55,3 +50,12 @@ func GenerateSHA256Hmac(secret string, data []byte) string {
 	h.Write(data)
 	return hex.EncodeToString(h.Sum(nil))
 }
+
+func GenerateUUID() string {
+	b := GenerateRandomBytes(16)
+	return fmt.Sprintf("%X-%X-%X-%X-%X", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
+}
+
+func ConstantTimeCmp(a, b string) bool {
+	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
+}

internal/database/database.go

@@ -7,34 +7,18 @@ import (
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"time"
-
-	// Postgresql driver import
-	_ "github.com/lib/pq"
 )
 
-// NewConnectionPool configures the database connection pool.
-func NewConnectionPool(dsn string, minConnections, maxConnections int, connectionLifetime time.Duration) (*sql.DB, error) {
-	db, err := sql.Open("postgres", dsn)
-	if err != nil {
-		return nil, err
-	}
-
-	db.SetMaxOpenConns(maxConnections)
-	db.SetMaxIdleConns(minConnections)
-	db.SetConnMaxLifetime(connectionLifetime)
-
-	return db, nil
-}
-
 // Migrate executes database migrations.
 func Migrate(db *sql.DB) error {
 	var currentVersion int
 	db.QueryRow(`SELECT version FROM schema_version`).Scan(&currentVersion)
 
-	slog.Debug("Running database migrations",
+	driver := getDriverStr()
+	slog.Info("Running database migrations",
 		slog.Int("current_version", currentVersion),
 		slog.Int("latest_version", schemaVersion),
+		slog.String("driver", driver),
 	)
 
 	for version := currentVersion; version < schemaVersion; version++ {
@@ -45,12 +29,12 @@ func Migrate(db *sql.DB) error {
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}
 
-		if err := migrations[version](tx); err != nil {
+		if err := migrations[version](tx, driver); err != nil {
 			tx.Rollback()
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}
 
-		if _, err := tx.Exec(`DELETE FROM schema_version`); err != nil {
+		if _, err := tx.Exec(`TRUNCATE schema_version`); err != nil {
 			tx.Rollback()
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}

internal/database/postgresql.go

@@ -0,0 +1,31 @@
+//go:build !sqlite
+
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package database // import "miniflux.app/v2/internal/database"
+
+import (
+	"database/sql"
+	"time"
+
+	_ "github.com/lib/pq"
+)
+
+// NewConnectionPool configures the database connection pool.
+func NewConnectionPool(dsn string, minConnections, maxConnections int, connectionLifetime time.Duration) (*sql.DB, error) {
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		return nil, err
+	}
+
+	db.SetMaxOpenConns(maxConnections)
+	db.SetMaxIdleConns(minConnections)
+	db.SetConnMaxLifetime(connectionLifetime)
+
+	return db, nil
+}
+
+func getDriverStr() string {
+	return "postgresql"
+}

internal/database/sqlite.go

@@ -0,0 +1,26 @@
+//go:build sqlite
+
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package database // import "miniflux.app/v2/internal/database"
+
+import (
+	"database/sql"
+	"time"
+
+	_ "github.com/mattn/go-sqlite3"
+)
+
+// NewConnectionPool configures the database connection pool.
+func NewConnectionPool(dsn string, _, _ int, _ time.Duration) (*sql.DB, error) {
+	db, err := sql.Open("sqlite3", dsn)
+	if err != nil {
+		return nil, err
+	}
+	return db, nil
+}
+
+func getDriverStr() string {
+	return "sqlite3"
+}

internal/fever/handler.go

@@ -13,8 +13,8 @@ import (
 	"miniflux.app/v2/internal/http/request"
 	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/integration"
+	"miniflux.app/v2/internal/mediaproxy"
 	"miniflux.app/v2/internal/model"
-	"miniflux.app/v2/internal/proxy"
 	"miniflux.app/v2/internal/storage"
 
 	"github.com/gorilla/mux"
@@ -247,7 +247,6 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 	builder := h.store.NewEntryQueryBuilder(userID)
 	builder.WithoutStatus(model.EntryStatusRemoved)
 	builder.WithLimit(50)
-	builder.WithSorting("id", model.DefaultSortingDirection)
 
 	switch {
 	case request.HasQueryParam(r, "since_id"):
@@ -258,6 +257,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 				slog.Int64("since_id", sinceID),
 			)
 			builder.AfterEntryID(sinceID)
+			builder.WithSorting("id", "ASC")
 		}
 	case request.HasQueryParam(r, "max_id"):
 		maxID := request.QueryInt64Param(r, "max_id", 0)
@@ -324,7 +324,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 			FeedID:    entry.FeedID,
 			Title:     entry.Title,
 			Author:    entry.Author,
-			HTML:      proxy.AbsoluteProxyRewriter(h.router, r.Host, entry.Content),
+			HTML:      mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entry.Content),
 			URL:       entry.URL,
 			IsSaved:   isSaved,
 			IsRead:    isRead,

internal/googlereader/handler.go

@@ -9,7 +9,6 @@ import (
 	"log/slog"
 	"net/http"
 	"strconv"
-	"strings"
 	"time"
 
 	"miniflux.app/v2/internal/config"
@@ -18,13 +17,13 @@ import (
 	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/http/route"
 	"miniflux.app/v2/internal/integration"
+	"miniflux.app/v2/internal/mediaproxy"
 	"miniflux.app/v2/internal/model"
-	"miniflux.app/v2/internal/proxy"
+	"miniflux.app/v2/internal/proxyrotator"
 	"miniflux.app/v2/internal/reader/fetcher"
 	mff "miniflux.app/v2/internal/reader/handler"
 	mfs "miniflux.app/v2/internal/reader/subscription"
 	"miniflux.app/v2/internal/storage"
-	"miniflux.app/v2/internal/urllib"
 	"miniflux.app/v2/internal/validator"
 
 	"github.com/gorilla/mux"
@@ -35,178 +34,12 @@ type handler struct {
 	router *mux.Router
 }
 
-const (
-	// StreamPrefix is the prefix for astreams (read/starred/reading list and so on)
-	StreamPrefix = "user/-/state/com.google/"
-	// UserStreamPrefix is the user specific prefix for streams (read/starred/reading list and so on)
-	UserStreamPrefix = "user/%d/state/com.google/"
-	// LabelPrefix is the prefix for a label stream
-	LabelPrefix = "user/-/label/"
-	// UserLabelPrefix is the user specific prefix prefix for a label stream
-	UserLabelPrefix = "user/%d/label/"
-	// FeedPrefix is the prefix for a feed stream
-	FeedPrefix = "feed/"
-	// Read is the suffix for read stream
-	Read = "read"
-	// Starred is the suffix for starred stream
-	Starred = "starred"
-	// ReadingList is the suffix for reading list stream
-	ReadingList = "reading-list"
-	// KeptUnread is the suffix for kept unread stream
-	KeptUnread = "kept-unread"
-	// Broadcast is the suffix for broadcast stream
-	Broadcast = "broadcast"
-	// BroadcastFriends is the suffix for broadcast friends stream
-	BroadcastFriends = "broadcast-friends"
-	// Like is the suffix for like stream
-	Like = "like"
-	// EntryIDLong is the long entry id representation
-	EntryIDLong = "tag:google.com,2005:reader/item/%016x"
+var (
+	errEmptyFeedTitle   = errors.New("googlereader: empty feed title")
+	errFeedNotFound     = errors.New("googlereader: feed not found")
+	errCategoryNotFound = errors.New("googlereader: category not found")
 )
 
-const (
-	// ParamItemIDs - name of the parameter with the item ids
-	ParamItemIDs = "i"
-	// ParamStreamID - name of the parameter containing the stream to be included
-	ParamStreamID = "s"
-	// ParamStreamExcludes - name of the parameter containing streams to be excluded
-	ParamStreamExcludes = "xt"
-	// ParamStreamFilters - name of the parameter containing streams to be included
-	ParamStreamFilters = "it"
-	// ParamStreamMaxItems - name of the parameter containing number of items per page/max items returned
-	ParamStreamMaxItems = "n"
-	// ParamStreamOrder - name of the parameter containing the sort criteria
-	ParamStreamOrder = "r"
-	// ParamStreamStartTime - name of the parameter containing epoch timestamp, filtering items older than
-	ParamStreamStartTime = "ot"
-	// ParamStreamStopTime - name of the parameter containing epoch timestamp, filtering items newer than
-	ParamStreamStopTime = "nt"
-	// ParamTagsRemove - name of the parameter containing tags (streams) to be removed
-	ParamTagsRemove = "r"
-	// ParamTagsAdd - name of the parameter containing tags (streams) to be added
-	ParamTagsAdd = "a"
-	// ParamSubscribeAction - name of the parameter indicating the action to take for subscription/edit
-	ParamSubscribeAction = "ac"
-	// ParamTitle - name of the parameter for the title of the subscription
-	ParamTitle = "t"
-	// ParamQuickAdd - name of the parameter for a URL being quick subscribed to
-	ParamQuickAdd = "quickadd"
-	// ParamDestination - name of the parameter for the new name of a tag
-	ParamDestination = "dest"
-	// ParamContinuation -  name of the parameter for callers to pass to receive the next page of results
-	ParamContinuation = "c"
-)
-
-// StreamType represents the possible stream types
-type StreamType int
-
-const (
-	// NoStream - no stream type
-	NoStream StreamType = iota
-	// ReadStream - read stream type
-	ReadStream
-	// StarredStream - starred stream type
-	StarredStream
-	// ReadingListStream - reading list stream type
-	ReadingListStream
-	// KeptUnreadStream - kept unread stream type
-	KeptUnreadStream
-	// BroadcastStream - broadcast stream type
-	BroadcastStream
-	// BroadcastFriendsStream - broadcast friends stream type
-	BroadcastFriendsStream
-	// LabelStream - label stream type
-	LabelStream
-	// FeedStream - feed stream type
-	FeedStream
-	// LikeStream - like stream type
-	LikeStream
-)
-
-// Stream defines a stream type and its ID.
-type Stream struct {
-	Type StreamType
-	ID   string
-}
-
-func (s Stream) String() string {
-	return fmt.Sprintf("%v - '%s'", s.Type, s.ID)
-}
-
-func (st StreamType) String() string {
-	switch st {
-	case NoStream:
-		return "NoStream"
-	case ReadStream:
-		return "ReadStream"
-	case StarredStream:
-		return "StarredStream"
-	case ReadingListStream:
-		return "ReadingListStream"
-	case KeptUnreadStream:
-		return "KeptUnreadStream"
-	case BroadcastStream:
-		return "BroadcastStream"
-	case BroadcastFriendsStream:
-		return "BroadcastFriendsStream"
-	case LabelStream:
-		return "LabelStream"
-	case FeedStream:
-		return "FeedStream"
-	case LikeStream:
-		return "LikeStream"
-	default:
-		return st.String()
-	}
-}
-
-// RequestModifiers are the parsed request parameters.
-type RequestModifiers struct {
-	ExcludeTargets    []Stream
-	FilterTargets     []Stream
-	Streams           []Stream
-	Count             int
-	Offset            int
-	SortDirection     string
-	StartTime         int64
-	StopTime          int64
-	ContinuationToken string
-	UserID            int64
-}
-
-func (r RequestModifiers) String() string {
-	var results []string
-
-	results = append(results, fmt.Sprintf("UserID: %d", r.UserID))
-
-	var streamStr []string
-	for _, s := range r.Streams {
-		streamStr = append(streamStr, s.String())
-	}
-	results = append(results, fmt.Sprintf("Streams: [%s]", strings.Join(streamStr, ", ")))
-
-	var exclusions []string
-	for _, s := range r.ExcludeTargets {
-		exclusions = append(exclusions, s.String())
-	}
-	results = append(results, fmt.Sprintf("Exclusions: [%s]", strings.Join(exclusions, ", ")))
-
-	var filters []string
-	for _, s := range r.FilterTargets {
-		filters = append(filters, s.String())
-	}
-	results = append(results, fmt.Sprintf("Filters: [%s]", strings.Join(filters, ", ")))
-
-	results = append(results, fmt.Sprintf("Count: %d", r.Count))
-	results = append(results, fmt.Sprintf("Offset: %d", r.Offset))
-	results = append(results, fmt.Sprintf("Sort Direction: %s", r.SortDirection))
-	results = append(results, fmt.Sprintf("Continuation Token: %s", r.ContinuationToken))
-	results = append(results, fmt.Sprintf("Start Time: %d", r.StartTime))
-	results = append(results, fmt.Sprintf("Stop Time: %d", r.StopTime))
-
-	return strings.Join(results, "; ")
-}
-
 // Serve handles Google Reader API calls.
 func Serve(router *mux.Router, store *storage.Storage) {
 	handler := &handler{store, router}
@@ -228,101 +61,22 @@ func Serve(router *mux.Router, store *storage.Storage) {
 	sr.HandleFunc("/subscription/quickadd", handler.quickAddHandler).Methods(http.MethodPost).Name("QuickAdd")
 	sr.HandleFunc("/stream/items/ids", handler.streamItemIDsHandler).Methods(http.MethodGet).Name("StreamItemIDs")
 	sr.HandleFunc("/stream/items/contents", handler.streamItemContentsHandler).Methods(http.MethodPost).Name("StreamItemsContents")
+	sr.HandleFunc("/mark-all-as-read", handler.markAllAsReadHandler).Methods(http.MethodPost).Name("MarkAllAsRead")
 	sr.PathPrefix("/").HandlerFunc(handler.serveHandler).Methods(http.MethodPost, http.MethodGet).Name("GoogleReaderApiEndpoint")
 }
 
-func getStreamFilterModifiers(r *http.Request) (RequestModifiers, error) {
-	userID := request.UserID(r)
-
-	result := RequestModifiers{
-		SortDirection: "desc",
-		UserID:        userID,
-	}
-	streamOrder := request.QueryStringParam(r, ParamStreamOrder, "d")
-	if streamOrder == "o" {
-		result.SortDirection = "asc"
-	}
-	var err error
-	result.Streams, err = getStreams(request.QueryStringParamList(r, ParamStreamID), userID)
-	if err != nil {
-		return RequestModifiers{}, err
-	}
-	result.ExcludeTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamExcludes), userID)
-	if err != nil {
-		return RequestModifiers{}, err
-	}
-
-	result.FilterTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamFilters), userID)
-	if err != nil {
-		return RequestModifiers{}, err
-	}
-
-	result.Count = request.QueryIntParam(r, ParamStreamMaxItems, 0)
-	result.Offset = request.QueryIntParam(r, ParamContinuation, 0)
-	result.StartTime = request.QueryInt64Param(r, ParamStreamStartTime, int64(0))
-	result.StopTime = request.QueryInt64Param(r, ParamStreamStopTime, int64(0))
-	return result, nil
-}
-
-func getStream(streamID string, userID int64) (Stream, error) {
-	if strings.HasPrefix(streamID, FeedPrefix) {
-		return Stream{Type: FeedStream, ID: strings.TrimPrefix(streamID, FeedPrefix)}, nil
-	} else if strings.HasPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID)) || strings.HasPrefix(streamID, StreamPrefix) {
-		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID))
-		id = strings.TrimPrefix(id, StreamPrefix)
-		switch id {
-		case Read:
-			return Stream{ReadStream, ""}, nil
-		case Starred:
-			return Stream{StarredStream, ""}, nil
-		case ReadingList:
-			return Stream{ReadingListStream, ""}, nil
-		case KeptUnread:
-			return Stream{KeptUnreadStream, ""}, nil
-		case Broadcast:
-			return Stream{BroadcastStream, ""}, nil
-		case BroadcastFriends:
-			return Stream{BroadcastFriendsStream, ""}, nil
-		case Like:
-			return Stream{LikeStream, ""}, nil
-		default:
-			return Stream{NoStream, ""}, fmt.Errorf("googlereader: unknown stream with id: %s", id)
-		}
-	} else if strings.HasPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID)) || strings.HasPrefix(streamID, LabelPrefix) {
-		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID))
-		id = strings.TrimPrefix(id, LabelPrefix)
-		return Stream{LabelStream, id}, nil
-	} else if streamID == "" {
-		return Stream{NoStream, ""}, nil
-	}
-
-	return Stream{NoStream, ""}, fmt.Errorf("googlereader: unknown stream type: %s", streamID)
-}
-
-func getStreams(streamIDs []string, userID int64) ([]Stream, error) {
-	streams := make([]Stream, 0)
-	for _, streamID := range streamIDs {
-		stream, err := getStream(streamID, userID)
-		if err != nil {
-			return []Stream{}, err
-		}
-		streams = append(streams, stream)
-	}
-	return streams, nil
-}
-
 func checkAndSimplifyTags(addTags []Stream, removeTags []Stream) (map[StreamType]bool, error) {
 	tags := make(map[StreamType]bool)
 	for _, s := range addTags {
 		switch s.Type {
 		case ReadStream:
 			if _, ok := tags[KeptUnreadStream]; ok {
-				return nil, fmt.Errorf("googlereader: %s ad %s should not be supplied simultaneously", KeptUnread, Read)
+				return nil, fmt.Errorf("googlereader: %s and %s should not be supplied simultaneously", KeptUnread, Read)
 			}
 			tags[ReadStream] = true
 		case KeptUnreadStream:
 			if _, ok := tags[ReadStream]; ok {
-				return nil, fmt.Errorf("googlereader: %s ad %s should not be supplied simultaneously", KeptUnread, Read)
+				return nil, fmt.Errorf("googlereader: %s and %s should not be supplied simultaneously", KeptUnread, Read)
 			}
 			tags[ReadStream] = false
 		case StarredStream:
@@ -337,12 +91,12 @@ func checkAndSimplifyTags(addTags []Stream, removeTags []Stream) (map[StreamType
 		switch s.Type {
 		case ReadStream:
 			if _, ok := tags[ReadStream]; ok {
-				return nil, fmt.Errorf("googlereader: %s ad %s should not be supplied simultaneously", KeptUnread, Read)
+				return nil, fmt.Errorf("googlereader: %s and %s should not be supplied simultaneously", KeptUnread, Read)
 			}
 			tags[ReadStream] = false
 		case KeptUnreadStream:
 			if _, ok := tags[ReadStream]; ok {
-				return nil, fmt.Errorf("googlereader: %s ad %s should not be supplied simultaneously", KeptUnread, Read)
+				return nil, fmt.Errorf("googlereader: %s and %s should not be supplied simultaneously", KeptUnread, Read)
 			}
 			tags[ReadStream] = true
 		case StarredStream:
@@ -360,29 +114,7 @@ func checkAndSimplifyTags(addTags []Stream, removeTags []Stream) (map[StreamType
 	return tags, nil
 }
 
-func getItemIDs(r *http.Request) ([]int64, error) {
-	items := r.Form[ParamItemIDs]
-	if len(items) == 0 {
-		return nil, fmt.Errorf("googlereader: no items requested")
-	}
-
-	itemIDs := make([]int64, len(items))
-
-	for i, item := range items {
-		var itemID int64
-		_, err := fmt.Sscanf(item, EntryIDLong, &itemID)
-		if err != nil {
-			itemID, err = strconv.ParseInt(item, 16, 64)
-			if err != nil {
-				return nil, fmt.Errorf("googlereader: could not parse item: %v", item)
-			}
-		}
-		itemIDs[i] = itemID
-	}
-	return itemIDs, nil
-}
-
-func checkOutputFormat(w http.ResponseWriter, r *http.Request) error {
+func checkOutputFormat(r *http.Request) error {
 	var output string
 	if r.Method == http.MethodPost {
 		err := r.ParseForm()
@@ -558,9 +290,9 @@ func (h *handler) editTagHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	itemIDs, err := getItemIDs(r)
+	itemIDs, err := parseItemIDsFromRequest(r)
 	if err != nil {
-		json.ServerError(w, r, err)
+		json.BadRequest(w, r, err)
 		return
 	}
 
@@ -683,14 +415,16 @@ func (h *handler) quickAddHandler(w http.ResponseWriter, r *http.Request) {
 
 	requestBuilder := fetcher.NewRequestBuilder()
 	requestBuilder.WithTimeout(config.Opts.HTTPClientTimeout())
-	requestBuilder.WithProxy(config.Opts.HTTPClientProxy())
+	requestBuilder.WithProxyRotator(proxyrotator.ProxyRotatorInstance)
 
 	var rssBridgeURL string
+	var rssBridgeToken string
 	if intg, err := h.store.Integration(userID); err == nil && intg != nil && intg.RSSBridgeEnabled {
 		rssBridgeURL = intg.RSSBridgeURL
+		rssBridgeToken = intg.RSSBridgeToken
 	}
 
-	subscriptions, localizedError := mfs.NewSubscriptionFinder(requestBuilder).FindSubscriptions(feedURL, rssBridgeURL)
+	subscriptions, localizedError := mfs.NewSubscriptionFinder(requestBuilder).FindSubscriptions(feedURL, rssBridgeURL, rssBridgeToken)
 	if localizedError != nil {
 		json.ServerError(w, r, localizedError.Error())
 		return
@@ -735,16 +469,16 @@ func getFeed(stream Stream, store *storage.Storage, userID int64) (*model.Feed,
 	return store.FeedByID(userID, feedID)
 }
 
-func getOrCreateCategory(category Stream, store *storage.Storage, userID int64) (*model.Category, error) {
-	if category.ID == "" {
+func getOrCreateCategory(streamCategory Stream, store *storage.Storage, userID int64) (*model.Category, error) {
+	switch {
+	case streamCategory.ID == "":
 		return store.FirstCategory(userID)
-	} else if store.CategoryTitleExists(userID, category.ID) {
-		return store.CategoryByTitle(userID, category.ID)
-	} else {
-		catRequest := model.CategoryRequest{
-			Title: category.ID,
-		}
-		return store.CreateCategory(userID, &catRequest)
+	case store.CategoryTitleExists(userID, streamCategory.ID):
+		return store.CategoryByTitle(userID, streamCategory.ID)
+	default:
+		return store.CreateCategory(userID, &model.CategoryCreationRequest{
+			Title: streamCategory.ID,
+		})
 	}
 }
 
@@ -764,7 +498,7 @@ func subscribe(newFeed Stream, category Stream, title string, store *storage.Sto
 	}
 
 	created, localizedError := mff.CreateFeed(store, userID, &feedRequest)
-	if err != nil {
+	if localizedError != nil {
 		return nil, localizedError.Error()
 	}
 
@@ -795,14 +529,25 @@ func unsubscribe(streams []Stream, store *storage.Storage, userID int64) error {
 	return nil
 }
 
-func rename(stream Stream, title string, store *storage.Storage, userID int64) error {
+func rename(feedStream Stream, title string, store *storage.Storage, userID int64) error {
+	slog.Debug("[GoogleReader] Renaming feed",
+		slog.Int64("user_id", userID),
+		slog.Any("feed_stream", feedStream),
+		slog.String("new_title", title),
+	)
+
 	if title == "" {
-		return errors.New("empty title")
+		return errEmptyFeedTitle
 	}
-	feed, err := getFeed(stream, store, userID)
+
+	feed, err := getFeed(feedStream, store, userID)
 	if err != nil {
 		return err
 	}
+	if feed == nil {
+		return errFeedNotFound
+	}
+
 	feedModification := model.FeedModificationRequest{
 		Title: &title,
 	}
@@ -810,15 +555,29 @@ func rename(stream Stream, title string, store *storage.Storage, userID int64) e
 	return store.UpdateFeed(feed)
 }
 
-func move(stream Stream, destination Stream, store *storage.Storage, userID int64) error {
-	feed, err := getFeed(stream, store, userID)
+func move(feedStream Stream, labelStream Stream, store *storage.Storage, userID int64) error {
+	slog.Debug("[GoogleReader] Moving feed",
+		slog.Int64("user_id", userID),
+		slog.Any("feed_stream", feedStream),
+		slog.Any("label_stream", labelStream),
+	)
+
+	feed, err := getFeed(feedStream, store, userID)
 	if err != nil {
 		return err
 	}
-	category, err := getOrCreateCategory(destination, store, userID)
+	if feed == nil {
+		return errFeedNotFound
+	}
+
+	category, err := getOrCreateCategory(labelStream, store, userID)
 	if err != nil {
 		return err
 	}
+	if category == nil {
+		return errCategoryNotFound
+	}
+
 	feedModification := model.FeedModificationRequest{
 		CategoryID: &category.ID,
 	}
@@ -826,6 +585,14 @@ func move(stream Stream, destination Stream, store *storage.Storage, userID int6
 	return store.UpdateFeed(feed)
 }
 
+func (h *handler) feedIconURL(f *model.Feed) string {
+	if f.Icon != nil && f.Icon.ExternalIconID != "" {
+		return config.Opts.RootURL() + route.Path(h.router, "feedIcon", "externalIconID", f.Icon.ExternalIconID)
+	} else {
+		return ""
+	}
+}
+
 func (h *handler) editSubscriptionHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	clientIP := request.ClientIP(r)
@@ -873,7 +640,11 @@ func (h *handler) editSubscriptionHandler(w http.ResponseWriter, r *http.Request
 	case "edit":
 		if title != "" {
 			if err := rename(streamIds[0], title, h.store, userID); err != nil {
-				json.ServerError(w, r, err)
+				if errors.Is(err, errFeedNotFound) || errors.Is(err, errEmptyFeedTitle) {
+					json.BadRequest(w, r, err)
+				} else {
+					json.ServerError(w, r, err)
+				}
 				return
 			}
 		}
@@ -885,12 +656,16 @@ func (h *handler) editSubscriptionHandler(w http.ResponseWriter, r *http.Request
 			}
 
 			if err := move(streamIds[0], newLabel, h.store, userID); err != nil {
-				json.ServerError(w, r, err)
+				if errors.Is(err, errFeedNotFound) || errors.Is(err, errCategoryNotFound) {
+					json.BadRequest(w, r, err)
+				} else {
+					json.ServerError(w, r, err)
+				}
 				return
 			}
 		}
 	default:
-		json.ServerError(w, r, fmt.Errorf("googlereader: unrecognized action %s", action))
+		json.BadRequest(w, r, fmt.Errorf("googlereader: unrecognized action %s", action))
 		return
 	}
 
@@ -899,6 +674,7 @@ func (h *handler) editSubscriptionHandler(w http.ResponseWriter, r *http.Request
 
 func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+	userName := request.UserName(r)
 	clientIP := request.ClientIP(r)
 
 	slog.Debug("[GoogleReader] Handle /stream/items/contents",
@@ -908,8 +684,8 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 		slog.Int64("user_id", userID),
 	)
 
-	if err := checkOutputFormat(w, r); err != nil {
-		json.ServerError(w, r, err)
+	if err := checkOutputFormat(r); err != nil {
+		json.BadRequest(w, r, err)
 		return
 	}
 
@@ -918,13 +694,8 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 		json.ServerError(w, r, err)
 		return
 	}
-	var user *model.User
-	if user, err = h.store.UserByID(userID); err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
 
-	requestModifiers, err := getStreamFilterModifiers(r)
+	requestModifiers, err := parseStreamFilterFromRequest(r)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -934,9 +705,9 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 	userRead := fmt.Sprintf(UserStreamPrefix, userID) + Read
 	userStarred := fmt.Sprintf(UserStreamPrefix, userID) + Starred
 
-	itemIDs, err := getItemIDs(r)
+	itemIDs, err := parseItemIDsFromRequest(r)
 	if err != nil {
-		json.ServerError(w, r, err)
+		json.BadRequest(w, r, err)
 		return
 	}
 
@@ -949,6 +720,7 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 	)
 
 	builder := h.store.NewEntryQueryBuilder(userID)
+	builder.WithEnclosures()
 	builder.WithoutStatus(model.EntryStatusRemoved)
 	builder.WithEntryIDs(itemIDs)
 	builder.WithSorting(model.DefaultSortingOrder, requestModifiers.SortDirection)
@@ -959,32 +731,21 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	if len(entries) == 0 {
-		json.ServerError(w, r, fmt.Errorf("googlereader: no items returned from the database"))
-		return
-	}
-
 	result := streamContentItems{
 		Direction: "ltr",
-		ID:        fmt.Sprintf("feed/%d", entries[0].FeedID),
-		Title:     entries[0].Feed.Title,
-		Alternate: []contentHREFType{
-			{
-				HREF: entries[0].Feed.SiteURL,
-				Type: "text/html",
-			},
-		},
-		Updated: time.Now().Unix(),
+		ID:        "user/-/state/com.google/reading-list",
+		Title:     "Reading List",
+		Updated:   time.Now().Unix(),
 		Self: []contentHREF{
 			{
 				HREF: config.Opts.RootURL() + route.Path(h.router, "StreamItemsContents"),
 			},
 		},
-		Author: user.Username,
+		Author: userName,
 	}
 	contentItems := make([]contentItem, len(entries))
 	for i, entry := range entries {
-		enclosures := make([]contentItemEnclosure, len(entry.Enclosures))
+		enclosures := make([]contentItemEnclosure, 0, len(entry.Enclosures))
 		for _, enclosure := range entry.Enclosures {
 			enclosures = append(enclosures, contentItemEnclosure{URL: enclosure.URL, Type: enclosure.MimeType})
 		}
@@ -1001,28 +762,18 @@ func (h *handler) streamItemContentsHandler(w http.ResponseWriter, r *http.Reque
 			categories = append(categories, userStarred)
 		}
 
-		entry.Content = proxy.AbsoluteProxyRewriter(h.router, r.Host, entry.Content)
-		proxyOption := config.Opts.ProxyOption()
+		entry.Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entry.Content)
 
-		for i := range entry.Enclosures {
-			if proxyOption == "all" || proxyOption != "none" && !urllib.IsHTTPS(entry.Enclosures[i].URL) {
-				for _, mediaType := range config.Opts.ProxyMediaTypes() {
-					if strings.HasPrefix(entry.Enclosures[i].MimeType, mediaType+"/") {
-						entry.Enclosures[i].URL = proxy.AbsoluteProxifyURL(h.router, r.Host, entry.Enclosures[i].URL)
-						break
-					}
-				}
-			}
-		}
+		entry.Enclosures.ProxifyEnclosureURL(h.router)
 
 		contentItems[i] = contentItem{
-			ID:            fmt.Sprintf(EntryIDLong, entry.ID),
+			ID:            convertEntryIDToLongFormItemID(entry.ID),
 			Title:         entry.Title,
 			Author:        entry.Author,
-			TimestampUsec: fmt.Sprintf("%d", entry.Date.UnixNano()/(int64(time.Microsecond)/int64(time.Nanosecond))),
-			CrawlTimeMsec: fmt.Sprintf("%d", entry.Date.UnixNano()/(int64(time.Microsecond)/int64(time.Nanosecond))),
+			TimestampUsec: fmt.Sprintf("%d", entry.Date.UnixMicro()),
+			CrawlTimeMsec: fmt.Sprintf("%d", entry.CreatedAt.UnixMilli()),
 			Published:     entry.Date.Unix(),
-			Updated:       entry.Date.Unix(),
+			Updated:       entry.ChangedAt.Unix(),
 			Categories:    categories,
 			Canonical: []contentHREF{
 				{
@@ -1143,20 +894,23 @@ func (h *handler) renameTagHandler(w http.ResponseWriter, r *http.Request) {
 		json.NotFound(w, r)
 		return
 	}
-	categoryRequest := model.CategoryRequest{
-		Title: destination.ID,
+
+	categoryModificationRequest := model.CategoryModificationRequest{
+		Title: model.SetOptionalField(destination.ID),
 	}
-	verr := validator.ValidateCategoryModification(h.store, userID, category.ID, &categoryRequest)
-	if verr != nil {
-		json.BadRequest(w, r, verr.Error())
+
+	if validationError := validator.ValidateCategoryModification(h.store, userID, category.ID, &categoryModificationRequest); validationError != nil {
+		json.BadRequest(w, r, validationError.Error())
 		return
 	}
-	categoryRequest.Patch(category)
-	err = h.store.UpdateCategory(category)
-	if err != nil {
+
+	categoryModificationRequest.Patch(category)
+
+	if err := h.store.UpdateCategory(category); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
+
 	OK(w, r)
 }
 
@@ -1170,7 +924,7 @@ func (h *handler) tagListHandler(w http.ResponseWriter, r *http.Request) {
 		slog.String("user_agent", r.UserAgent()),
 	)
 
-	if err := checkOutputFormat(w, r); err != nil {
+	if err := checkOutputFormat(r); err != nil {
 		json.BadRequest(w, r, err)
 		return
 	}
@@ -1205,8 +959,8 @@ func (h *handler) subscriptionListHandler(w http.ResponseWriter, r *http.Request
 		slog.String("user_agent", r.UserAgent()),
 	)
 
-	if err := checkOutputFormat(w, r); err != nil {
-		json.ServerError(w, r, err)
+	if err := checkOutputFormat(r); err != nil {
+		json.BadRequest(w, r, err)
 		return
 	}
 
@@ -1216,6 +970,7 @@ func (h *handler) subscriptionListHandler(w http.ResponseWriter, r *http.Request
 		json.ServerError(w, r, err)
 		return
 	}
+
 	result.Subscriptions = make([]subscription, 0)
 	for _, feed := range feeds {
 		result.Subscriptions = append(result.Subscriptions, subscription{
@@ -1224,7 +979,7 @@ func (h *handler) subscriptionListHandler(w http.ResponseWriter, r *http.Request
 			URL:        feed.FeedURL,
 			Categories: []subscriptionCategory{{fmt.Sprintf(UserLabelPrefix, userID) + feed.Category.Title, feed.Category.Title, "folder"}},
 			HTMLURL:    feed.SiteURL,
-			IconURL:    "", //TODO Icons are only base64 encode in DB yet
+			IconURL:    h.feedIconURL(feed),
 		})
 	}
 	json.OK(w, r, result)
@@ -1251,8 +1006,8 @@ func (h *handler) userInfoHandler(w http.ResponseWriter, r *http.Request) {
 		slog.String("user_agent", r.UserAgent()),
 	)
 
-	if err := checkOutputFormat(w, r); err != nil {
-		json.ServerError(w, r, err)
+	if err := checkOutputFormat(r); err != nil {
+		json.BadRequest(w, r, err)
 		return
 	}
 
@@ -1276,12 +1031,12 @@ func (h *handler) streamItemIDsHandler(w http.ResponseWriter, r *http.Request) {
 		slog.Int64("user_id", userID),
 	)
 
-	if err := checkOutputFormat(w, r); err != nil {
-		json.ServerError(w, r, fmt.Errorf("googlereader: output only as json supported"))
+	if err := checkOutputFormat(r); err != nil {
+		json.BadRequest(w, r, err)
 		return
 	}
 
-	rm, err := getStreamFilterModifiers(r)
+	rm, err := parseStreamFilterFromRequest(r)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -1477,8 +1232,7 @@ func (h *handler) handleFeedStreamHandler(w http.ResponseWriter, r *http.Request
 
 	if len(rm.ExcludeTargets) > 0 {
 		for _, s := range rm.ExcludeTargets {
-			switch s.Type {
-			case ReadStream:
+			if s.Type == ReadStream {
 				builder.WithoutStatus(model.EntryStatusRead)
 			}
 		}
@@ -1509,3 +1263,82 @@ func (h *handler) handleFeedStreamHandler(w http.ResponseWriter, r *http.Request
 
 	json.OK(w, r, streamIDResponse{itemRefs, continuation})
 }
+
+func (h *handler) markAllAsReadHandler(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+	clientIP := request.ClientIP(r)
+
+	slog.Debug("[GoogleReader] Handle /mark-all-as-read",
+		slog.String("handler", "markAllAsReadHandler"),
+		slog.String("client_ip", clientIP),
+		slog.String("user_agent", r.UserAgent()),
+	)
+
+	if err := r.ParseForm(); err != nil {
+		json.BadRequest(w, r, err)
+		return
+	}
+
+	stream, err := getStream(r.Form.Get(ParamStreamID), userID)
+	if err != nil {
+		json.BadRequest(w, r, err)
+		return
+	}
+
+	var before time.Time
+	if timestampParamValue := r.Form.Get(ParamTimestamp); timestampParamValue != "" {
+		timestampParsedValue, err := strconv.ParseInt(timestampParamValue, 10, 64)
+		if err != nil {
+			json.BadRequest(w, r, err)
+			return
+		}
+
+		if timestampParsedValue > 0 {
+			// It's unclear if the timestamp is in seconds or microseconds, so we try both using a naive approach.
+			if len(timestampParamValue) >= 16 {
+				before = time.UnixMicro(timestampParsedValue)
+			} else {
+				before = time.Unix(timestampParsedValue, 0)
+			}
+		}
+	}
+
+	if before.IsZero() {
+		before = time.Now()
+	}
+
+	switch stream.Type {
+	case FeedStream:
+		feedID, err := strconv.ParseInt(stream.ID, 10, 64)
+		if err != nil {
+			json.BadRequest(w, r, err)
+			return
+		}
+		err = h.store.MarkFeedAsRead(userID, feedID, before)
+		if err != nil {
+			json.ServerError(w, r, err)
+			return
+		}
+	case LabelStream:
+		category, err := h.store.CategoryByTitle(userID, stream.ID)
+		if err != nil {
+			json.ServerError(w, r, err)
+			return
+		}
+		if category == nil {
+			json.NotFound(w, r)
+			return
+		}
+		if err := h.store.MarkCategoryAsRead(userID, category.ID, before); err != nil {
+			json.ServerError(w, r, err)
+			return
+		}
+	case ReadingListStream:
+		if err = h.store.MarkAllAsReadBeforeDate(userID, before); err != nil {
+			json.ServerError(w, r, err)
+			return
+		}
+	}
+
+	OK(w, r)
+}

internal/googlereader/item.go

@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+const (
+	ItemIDPrefix = "tag:google.com,2005:reader/item/"
+	ItemIDFormat = "tag:google.com,2005:reader/item/%016x"
+)
+
+func convertEntryIDToLongFormItemID(entryID int64) string {
+	// The entry ID is a 64-bit integer, so we need to format it as a 16-character hexadecimal string.
+	return fmt.Sprintf(ItemIDFormat, entryID)
+}
+
+// Expected format: "tag:google.com,2005:reader/item/00000000148b9369" (hexadecimal string with prefix and padding)
+// NetNewsWire uses this format: "tag:google.com,2005:reader/item/2f2" (hexadecimal string with prefix and no padding)
+// Reeder uses this format: "000000000000048c" (hexadecimal string without prefix and padding)
+// Liferea uses this format: "12345" (decimal string)
+// It returns the parsed ID as a int64 and an error if parsing fails.
+func parseItemID(itemIDValue string) (int64, error) {
+	var itemID int64
+	if strings.HasPrefix(itemIDValue, ItemIDPrefix) {
+		n, err := fmt.Sscanf(itemIDValue, ItemIDFormat, &itemID)
+		if err != nil {
+			return 0, fmt.Errorf("failed to parse hexadecimal item ID %s: %w", itemIDValue, err)
+		}
+		if n != 1 {
+			return 0, fmt.Errorf("failed to parse hexadecimal item ID %s: expected 1 value, got %d", itemIDValue, n)
+		}
+		if itemID == 0 {
+			return 0, fmt.Errorf("failed to parse hexadecimal item ID %s: item ID is zero", itemIDValue)
+		}
+		return itemID, nil
+	}
+
+	if len(itemIDValue) == 16 {
+		if n, err := fmt.Sscanf(itemIDValue, "%016x", &itemID); err == nil && n == 1 {
+			return itemID, nil
+		}
+	}
+
+	itemID, err := strconv.ParseInt(itemIDValue, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse decimal item ID %s: %w", itemIDValue, err)
+	}
+
+	return itemID, nil
+}
+
+func parseItemIDsFromRequest(r *http.Request) ([]int64, error) {
+	items := r.Form[ParamItemIDs]
+	if len(items) == 0 {
+		return nil, fmt.Errorf("googlereader: no items requested")
+	}
+
+	itemIDs := make([]int64, len(items))
+	for i, item := range items {
+		itemID, err := parseItemID(item)
+		if err != nil {
+			return nil, fmt.Errorf("googlereader: failed to parse item ID %s: %w", item, err)
+		}
+		itemIDs[i] = itemID
+	}
+
+	return itemIDs, nil
+}

internal/googlereader/item_test.go

@@ -0,0 +1,104 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+import (
+	"net/http"
+	"net/url"
+	"reflect"
+	"testing"
+)
+
+func TestConvertEntryIDToLongFormItemID(t *testing.T) {
+	entryID := int64(344691561)
+	expected := "tag:google.com,2005:reader/item/00000000148b9369"
+	result := convertEntryIDToLongFormItemID(entryID)
+
+	if result != expected {
+		t.Errorf("expected %s, got %s", expected, result)
+	}
+}
+
+func TestParseItemIDsFromRequest(t *testing.T) {
+	formValues := url.Values{}
+	formValues.Add("i", "12345")
+	formValues.Add("i", "tag:google.com,2005:reader/item/00000000148b9369")
+	formValues.Add("i", "tag:google.com,2005:reader/item/2f2")
+	formValues.Add("i", "000000000000046f")
+	formValues.Add("i", "tag:google.com,2005:reader/item/272")
+
+	request := &http.Request{
+		Form: formValues,
+	}
+
+	result, err := parseItemIDsFromRequest(request)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var expected = []int64{12345, 344691561, 754, 1135, 626}
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("expected %v, got %v", expected, result)
+	}
+
+	// Test with no item IDs
+	formValues = url.Values{}
+	request = &http.Request{
+		Form: formValues,
+	}
+	_, err = parseItemIDsFromRequest(request)
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+}
+
+func TestParseItemID(t *testing.T) {
+	// Test with long form ID and hex ID
+	result, err := parseItemID("tag:google.com,2005:reader/item/0000000000000001")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expected := int64(1)
+	if result != expected {
+		t.Errorf("expected %d, got %d", expected, result)
+	}
+
+	// Test with hexadecimal long form ID
+	result, err = parseItemID("0000000000000468")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expected = int64(1128)
+	if result != expected {
+		t.Errorf("expected %d, got %d", expected, result)
+	}
+
+	// Test with short form ID
+	result, err = parseItemID("12345")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expected = int64(12345)
+	if result != expected {
+		t.Errorf("expected %d, got %d", expected, result)
+	}
+
+	// Test with invalid long form ID
+	_, err = parseItemID("tag:google.com,2005:reader/item/000000000000000g")
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+
+	// Test with invalid short form ID
+	_, err = parseItemID("invalid_id")
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+
+	// Test with empty ID
+	_, err = parseItemID("")
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+}

internal/googlereader/middleware.go

@@ -173,18 +173,11 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 			return
 		}
 
-		slog.Info("[GoogleReader] User authenticated successfully",
-			slog.Bool("authentication_successful", true),
-			slog.String("client_ip", clientIP),
-			slog.String("user_agent", r.UserAgent()),
-			slog.Int64("user_id", user.ID),
-			slog.String("username", user.Username),
-		)
-
 		m.store.SetLastLogin(integration.UserID)
 
 		ctx := r.Context()
 		ctx = context.WithValue(ctx, request.UserIDContextKey, user.ID)
+		ctx = context.WithValue(ctx, request.UserNameContextKey, user.Username)
 		ctx = context.WithValue(ctx, request.UserTimezoneContextKey, user.Timezone)
 		ctx = context.WithValue(ctx, request.IsAdminUserContextKey, user.IsAdmin)
 		ctx = context.WithValue(ctx, request.IsAuthenticatedContextKey, true)

internal/googlereader/parameters.go

@@ -0,0 +1,39 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+const (
+	// ParamItemIDs - name of the parameter with the item ids
+	ParamItemIDs = "i"
+	// ParamStreamID - name of the parameter containing the stream to be included
+	ParamStreamID = "s"
+	// ParamStreamExcludes - name of the parameter containing streams to be excluded
+	ParamStreamExcludes = "xt"
+	// ParamStreamFilters - name of the parameter containing streams to be included
+	ParamStreamFilters = "it"
+	// ParamStreamMaxItems - name of the parameter containing number of items per page/max items returned
+	ParamStreamMaxItems = "n"
+	// ParamStreamOrder - name of the parameter containing the sort criteria
+	ParamStreamOrder = "r"
+	// ParamStreamStartTime - name of the parameter containing epoch timestamp, filtering items older than
+	ParamStreamStartTime = "ot"
+	// ParamStreamStopTime - name of the parameter containing epoch timestamp, filtering items newer than
+	ParamStreamStopTime = "nt"
+	// ParamTagsRemove - name of the parameter containing tags (streams) to be removed
+	ParamTagsRemove = "r"
+	// ParamTagsAdd - name of the parameter containing tags (streams) to be added
+	ParamTagsAdd = "a"
+	// ParamSubscribeAction - name of the parameter indicating the action to take for subscription/edit
+	ParamSubscribeAction = "ac"
+	// ParamTitle - name of the parameter for the title of the subscription
+	ParamTitle = "t"
+	// ParamQuickAdd - name of the parameter for a URL being quick subscribed to
+	ParamQuickAdd = "quickadd"
+	// ParamDestination - name of the parameter for the new name of a tag
+	ParamDestination = "dest"
+	// ParamContinuation -  name of the parameter for callers to pass to receive the next page of results
+	ParamContinuation = "c"
+	// ParamStreamType - name of the parameter for unix timestamp
+	ParamTimestamp = "ts"
+)

internal/googlereader/prefix_suffix.go

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+const (
+	// StreamPrefix is the prefix for astreams (read/starred/reading list and so on)
+	StreamPrefix = "user/-/state/com.google/"
+	// UserStreamPrefix is the user specific prefix for streams (read/starred/reading list and so on)
+	UserStreamPrefix = "user/%d/state/com.google/"
+	// LabelPrefix is the prefix for a label stream
+	LabelPrefix = "user/-/label/"
+	// UserLabelPrefix is the user specific prefix prefix for a label stream
+	UserLabelPrefix = "user/%d/label/"
+	// FeedPrefix is the prefix for a feed stream
+	FeedPrefix = "feed/"
+	// Read is the suffix for read stream
+	Read = "read"
+	// Starred is the suffix for starred stream
+	Starred = "starred"
+	// ReadingList is the suffix for reading list stream
+	ReadingList = "reading-list"
+	// KeptUnread is the suffix for kept unread stream
+	KeptUnread = "kept-unread"
+	// Broadcast is the suffix for broadcast stream
+	Broadcast = "broadcast"
+	// BroadcastFriends is the suffix for broadcast friends stream
+	BroadcastFriends = "broadcast-friends"
+	// Like is the suffix for like stream
+	Like = "like"
+)

internal/googlereader/request_modifier.go

@@ -0,0 +1,91 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"miniflux.app/v2/internal/http/request"
+)
+
+type RequestModifiers struct {
+	ExcludeTargets    []Stream
+	FilterTargets     []Stream
+	Streams           []Stream
+	Count             int
+	Offset            int
+	SortDirection     string
+	StartTime         int64
+	StopTime          int64
+	ContinuationToken string
+	UserID            int64
+}
+
+func (r RequestModifiers) String() string {
+	var results []string
+
+	results = append(results, fmt.Sprintf("UserID: %d", r.UserID))
+
+	var streamStr []string
+	for _, s := range r.Streams {
+		streamStr = append(streamStr, s.String())
+	}
+	results = append(results, fmt.Sprintf("Streams: [%s]", strings.Join(streamStr, ", ")))
+
+	var exclusions []string
+	for _, s := range r.ExcludeTargets {
+		exclusions = append(exclusions, s.String())
+	}
+	results = append(results, fmt.Sprintf("Exclusions: [%s]", strings.Join(exclusions, ", ")))
+
+	var filters []string
+	for _, s := range r.FilterTargets {
+		filters = append(filters, s.String())
+	}
+	results = append(results, fmt.Sprintf("Filters: [%s]", strings.Join(filters, ", ")))
+
+	results = append(results, fmt.Sprintf("Count: %d", r.Count))
+	results = append(results, fmt.Sprintf("Offset: %d", r.Offset))
+	results = append(results, fmt.Sprintf("Sort Direction: %s", r.SortDirection))
+	results = append(results, fmt.Sprintf("Continuation Token: %s", r.ContinuationToken))
+	results = append(results, fmt.Sprintf("Start Time: %d", r.StartTime))
+	results = append(results, fmt.Sprintf("Stop Time: %d", r.StopTime))
+
+	return strings.Join(results, "; ")
+}
+
+func parseStreamFilterFromRequest(r *http.Request) (RequestModifiers, error) {
+	userID := request.UserID(r)
+	result := RequestModifiers{
+		SortDirection: "desc",
+		UserID:        userID,
+	}
+
+	streamOrder := request.QueryStringParam(r, ParamStreamOrder, "d")
+	if streamOrder == "o" {
+		result.SortDirection = "asc"
+	}
+	var err error
+	result.Streams, err = getStreams(request.QueryStringParamList(r, ParamStreamID), userID)
+	if err != nil {
+		return RequestModifiers{}, err
+	}
+	result.ExcludeTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamExcludes), userID)
+	if err != nil {
+		return RequestModifiers{}, err
+	}
+
+	result.FilterTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamFilters), userID)
+	if err != nil {
+		return RequestModifiers{}, err
+	}
+
+	result.Count = request.QueryIntParam(r, ParamStreamMaxItems, 0)
+	result.Offset = request.QueryIntParam(r, ParamContinuation, 0)
+	result.StartTime = request.QueryInt64Param(r, ParamStreamStartTime, int64(0))
+	result.StopTime = request.QueryInt64Param(r, ParamStreamStopTime, int64(0))
+	return result, nil
+}

internal/googlereader/response.go

@@ -68,14 +68,13 @@ type tagsResponse struct {
 }
 
 type streamContentItems struct {
-	Direction string            `json:"direction"`
-	ID        string            `json:"id"`
-	Title     string            `json:"title"`
-	Self      []contentHREF     `json:"self"`
-	Alternate []contentHREFType `json:"alternate"`
-	Updated   int64             `json:"updated"`
-	Items     []contentItem     `json:"items"`
-	Author    string            `json:"author"`
+	Direction string        `json:"direction"`
+	ID        string        `json:"id"`
+	Title     string        `json:"title"`
+	Self      []contentHREF `json:"self"`
+	Updated   int64         `json:"updated"`
+	Items     []contentItem `json:"items"`
+	Author    string        `json:"author"`
 }
 
 type contentItem struct {

internal/googlereader/stream.go

@@ -0,0 +1,119 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package googlereader // import "miniflux.app/v2/internal/googlereader"
+
+import (
+	"fmt"
+	"strings"
+)
+
+type StreamType int
+
+const (
+	// NoStream - no stream type
+	NoStream StreamType = iota
+	// ReadStream - read stream type
+	ReadStream
+	// StarredStream - starred stream type
+	StarredStream
+	// ReadingListStream - reading list stream type
+	ReadingListStream
+	// KeptUnreadStream - kept unread stream type
+	KeptUnreadStream
+	// BroadcastStream - broadcast stream type
+	BroadcastStream
+	// BroadcastFriendsStream - broadcast friends stream type
+	BroadcastFriendsStream
+	// LabelStream - label stream type
+	LabelStream
+	// FeedStream - feed stream type
+	FeedStream
+	// LikeStream - like stream type
+	LikeStream
+)
+
+// Stream defines a stream type and its ID.
+type Stream struct {
+	Type StreamType
+	ID   string
+}
+
+func (s Stream) String() string {
+	return fmt.Sprintf("%v - '%s'", s.Type, s.ID)
+}
+
+func (st StreamType) String() string {
+	switch st {
+	case NoStream:
+		return "NoStream"
+	case ReadStream:
+		return "ReadStream"
+	case StarredStream:
+		return "StarredStream"
+	case ReadingListStream:
+		return "ReadingListStream"
+	case KeptUnreadStream:
+		return "KeptUnreadStream"
+	case BroadcastStream:
+		return "BroadcastStream"
+	case BroadcastFriendsStream:
+		return "BroadcastFriendsStream"
+	case LabelStream:
+		return "LabelStream"
+	case FeedStream:
+		return "FeedStream"
+	case LikeStream:
+		return "LikeStream"
+	default:
+		return st.String()
+	}
+}
+
+func getStream(streamID string, userID int64) (Stream, error) {
+	switch {
+	case strings.HasPrefix(streamID, FeedPrefix):
+		return Stream{Type: FeedStream, ID: strings.TrimPrefix(streamID, FeedPrefix)}, nil
+	case strings.HasPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID)) || strings.HasPrefix(streamID, StreamPrefix):
+		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID))
+		id = strings.TrimPrefix(id, StreamPrefix)
+		switch id {
+		case Read:
+			return Stream{ReadStream, ""}, nil
+		case Starred:
+			return Stream{StarredStream, ""}, nil
+		case ReadingList:
+			return Stream{ReadingListStream, ""}, nil
+		case KeptUnread:
+			return Stream{KeptUnreadStream, ""}, nil
+		case Broadcast:
+			return Stream{BroadcastStream, ""}, nil
+		case BroadcastFriends:
+			return Stream{BroadcastFriendsStream, ""}, nil
+		case Like:
+			return Stream{LikeStream, ""}, nil
+		default:
+			return Stream{NoStream, ""}, fmt.Errorf("googlereader: unknown stream with id: %s", id)
+		}
+	case strings.HasPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID)) || strings.HasPrefix(streamID, LabelPrefix):
+		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID))
+		id = strings.TrimPrefix(id, LabelPrefix)
+		return Stream{LabelStream, id}, nil
+	case streamID == "":
+		return Stream{NoStream, ""}, nil
+	default:
+		return Stream{NoStream, ""}, fmt.Errorf("googlereader: unknown stream type: %s", streamID)
+	}
+}
+
+func getStreams(streamIDs []string, userID int64) ([]Stream, error) {
+	streams := make([]Stream, 0)
+	for _, streamID := range streamIDs {
+		stream, err := getStream(streamID, userID)
+		if err != nil {
+			return []Stream{}, err
+		}
+		streams = append(streams, stream)
+	}
+	return streams, nil
+}

internal/http/cookie/cookie.go

@@ -6,15 +6,14 @@ package cookie // import "miniflux.app/v2/internal/http/cookie"
 import (
 	"net/http"
 	"time"
+
+	"miniflux.app/v2/internal/config"
 )
 
 // Cookie names.
 const (
 	CookieAppSessionID  = "MinifluxAppSessionID"
 	CookieUserSessionID = "MinifluxUserSessionID"
-
-	// Cookie duration in days.
-	cookieDuration = 30
 )
 
 // New creates a new cookie.
@@ -25,7 +24,7 @@ func New(name, value string, isHTTPS bool, path string) *http.Cookie {
 		Path:     basePath(path),
 		Secure:   isHTTPS,
 		HttpOnly: true,
-		Expires:  time.Now().Add(cookieDuration * 24 * time.Hour),
+		Expires:  time.Now().Add(time.Duration(config.Opts.CleanupRemoveSessionsDays()) * 24 * time.Hour),
 		SameSite: http.SameSiteLaxMode,
 	}
 }

internal/http/request/context.go

@@ -16,6 +16,7 @@ type ContextKey int
 // List of context keys.
 const (
 	UserIDContextKey ContextKey = iota
+	UserNameContextKey
 	UserTimezoneContextKey
 	IsAdminUserContextKey
 	IsAuthenticatedContextKey
@@ -28,7 +29,6 @@ const (
 	OAuth2CodeVerifierContextKey
 	FlashMessageContextKey
 	FlashErrorMessageContextKey
-	PocketRequestTokenContextKey
 	LastForceRefreshContextKey
 	ClientIPContextKey
 	GoogleReaderToken
@@ -37,14 +37,10 @@ const (
 
 func WebAuthnSessionData(r *http.Request) *model.WebAuthnSession {
 	if v := r.Context().Value(WebAuthnDataContextKey); v != nil {
-		value, valid := v.(model.WebAuthnSession)
-		if !valid {
-			return nil
+		if value, valid := v.(model.WebAuthnSession); valid {
+			return &value
 		}
-
-		return &value
 	}
-
 	return nil
 }
 
@@ -68,6 +64,15 @@ func UserID(r *http.Request) int64 {
 	return getContextInt64Value(r, UserIDContextKey)
 }
 
+// UserName returns the username of the logged user.
+func UserName(r *http.Request) string {
+	value := getContextStringValue(r, UserNameContextKey)
+	if value == "" {
+		value = "unknown"
+	}
+	return value
+}
+
 // UserTimezone returns the timezone used by the logged user.
 func UserTimezone(r *http.Request) string {
 	value := getContextStringValue(r, UserTimezoneContextKey)
@@ -129,11 +134,6 @@ func FlashErrorMessage(r *http.Request) string {
 	return getContextStringValue(r, FlashErrorMessageContextKey)
 }
 
-// PocketRequestToken returns the Pocket Request Token if any.
-func PocketRequestToken(r *http.Request) string {
-	return getContextStringValue(r, PocketRequestTokenContextKey)
-}
-
 // LastForceRefresh returns the last force refresh timestamp.
 func LastForceRefresh(r *http.Request) int64 {
 	jsonStringValue := getContextStringValue(r, LastForceRefreshContextKey)
@@ -151,39 +151,27 @@ func ClientIP(r *http.Request) string {
 
 func getContextStringValue(r *http.Request, key ContextKey) string {
 	if v := r.Context().Value(key); v != nil {
-		value, valid := v.(string)
-		if !valid {
-			return ""
+		if value, valid := v.(string); valid {
+			return value
 		}
-
-		return value
 	}
-
 	return ""
 }
 
 func getContextBoolValue(r *http.Request, key ContextKey) bool {
 	if v := r.Context().Value(key); v != nil {
-		value, valid := v.(bool)
-		if !valid {
-			return false
+		if value, valid := v.(bool); valid {
+			return value
 		}
-
-		return value
 	}
-
 	return false
 }
 
 func getContextInt64Value(r *http.Request, key ContextKey) int64 {
 	if v := r.Context().Value(key); v != nil {
-		value, valid := v.(int64)
-		if !valid {
-			return 0
+		if value, valid := v.(int64); valid {
+			return value
 		}
-
-		return value
 	}
-
 	return 0
 }

internal/http/request/context_test.go

@@ -390,28 +390,6 @@ func TestFlashErrorMessage(t *testing.T) {
 	}
 }
 
-func TestPocketRequestToken(t *testing.T) {
-	r, _ := http.NewRequest("GET", "http://example.org", nil)
-
-	result := PocketRequestToken(r)
-	expected := ""
-
-	if result != expected {
-		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
-	}
-
-	ctx := r.Context()
-	ctx = context.WithValue(ctx, PocketRequestTokenContextKey, "request token")
-	r = r.WithContext(ctx)
-
-	result = PocketRequestToken(r)
-	expected = "request token"
-
-	if result != expected {
-		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
-	}
-}
-
 func TestClientIP(t *testing.T) {
 	r, _ := http.NewRequest("GET", "http://example.org", nil)
 

internal/http/request/cookie.go

@@ -8,7 +8,7 @@ import "net/http"
 // CookieValue returns the cookie value.
 func CookieValue(r *http.Request, name string) string {
 	cookie, err := r.Cookie(name)
-	if err == http.ErrNoCookie {
+	if err != nil {
 		return ""
 	}
 

internal/http/response/builder.go

@@ -12,6 +12,8 @@ import (
 	"net/http"
 	"strings"
 	"time"
+
+	"github.com/andybalholm/brotli"
 )
 
 const compressionThreshold = 1024
@@ -23,7 +25,7 @@ type Builder struct {
 	statusCode        int
 	headers           map[string]string
 	enableCompression bool
-	body              interface{}
+	body              any
 }
 
 // WithStatus uses the given status code to build the response.
@@ -39,7 +41,7 @@ func (b *Builder) WithHeader(key, value string) *Builder {
 }
 
 // WithBody uses the given body to build the response.
-func (b *Builder) WithBody(body interface{}) *Builder {
+func (b *Builder) WithBody(body any) *Builder {
 	b.body = body
 	return b
 }
@@ -96,7 +98,6 @@ func (b *Builder) Write() {
 }
 
 func (b *Builder) writeHeaders() {
-	b.headers["X-XSS-Protection"] = "1; mode=block"
 	b.headers["X-Content-Type-Options"] = "nosniff"
 	b.headers["X-Frame-Options"] = "DENY"
 	b.headers["Referrer-Policy"] = "no-referrer"
@@ -111,8 +112,15 @@ func (b *Builder) writeHeaders() {
 func (b *Builder) compress(data []byte) {
 	if b.enableCompression && len(data) > compressionThreshold {
 		acceptEncoding := b.r.Header.Get("Accept-Encoding")
-
 		switch {
+		case strings.Contains(acceptEncoding, "br"):
+			b.headers["Content-Encoding"] = "br"
+			b.writeHeaders()
+
+			brotliWriter := brotli.NewWriterV2(b.w, brotli.DefaultCompression)
+			defer brotliWriter.Close()
+			brotliWriter.Write(data)
+			return
 		case strings.Contains(acceptEncoding, "gzip"):
 			b.headers["Content-Encoding"] = "gzip"
 			b.writeHeaders()

internal/http/response/builder_test.go

@@ -28,7 +28,6 @@ func TestResponseHasCommonHeaders(t *testing.T) {
 	resp := w.Result()
 
 	headers := map[string]string{
-		"X-XSS-Protection":       "1; mode=block",
 		"X-Content-Type-Options": "nosniff",
 		"X-Frame-Options":        "DENY",
 	}
@@ -229,7 +228,7 @@ func TestBuildResponseWithCachingAndEtag(t *testing.T) {
 	}
 }
 
-func TestBuildResponseWithGzipCompression(t *testing.T) {
+func TestBuildResponseWithBrotliCompression(t *testing.T) {
 	body := strings.Repeat("a", compressionThreshold+1)
 	r, err := http.NewRequest("GET", "/", nil)
 	r.Header.Set("Accept-Encoding", "gzip, deflate, br")
@@ -246,6 +245,30 @@ func TestBuildResponseWithGzipCompression(t *testing.T) {
 	handler.ServeHTTP(w, r)
 	resp := w.Result()
 
+	expected := "br"
+	actual := resp.Header.Get("Content-Encoding")
+	if actual != expected {
+		t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
+	}
+}
+
+func TestBuildResponseWithGzipCompression(t *testing.T) {
+	body := strings.Repeat("a", compressionThreshold+1)
+	r, err := http.NewRequest("GET", "/", nil)
+	r.Header.Set("Accept-Encoding", "gzip, deflate")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		New(w, r).WithBody(body).Write()
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
 	expected := "gzip"
 	actual := resp.Header.Get("Content-Encoding")
 	if actual != expected {

internal/http/response/html/html.go

@@ -4,6 +4,7 @@
 package html // import "miniflux.app/v2/internal/http/response/html"
 
 import (
+	"html"
 	"log/slog"
 	"net/http"
 
@@ -37,10 +38,10 @@ func ServerError(w http.ResponseWriter, r *http.Request, err error) {
 
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusInternalServerError)
-	builder.WithHeader("Content-Security-Policy", `default-src 'self'`)
-	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
+	builder.WithHeader("Content-Security-Policy", response.ContentSecurityPolicyForUntrustedContent)
+	builder.WithHeader("Content-Type", "text/plain; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody(err)
+	builder.WithBody(html.EscapeString(err.Error()))
 	builder.Write()
 }
 
@@ -61,10 +62,10 @@ func BadRequest(w http.ResponseWriter, r *http.Request, err error) {
 
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusBadRequest)
-	builder.WithHeader("Content-Security-Policy", `default-src 'self'`)
-	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
+	builder.WithHeader("Content-Security-Policy", response.ContentSecurityPolicyForUntrustedContent)
+	builder.WithHeader("Content-Type", "text/plain; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody(err)
+	builder.WithBody(html.EscapeString(err.Error()))
 	builder.Write()
 }
 

internal/http/response/html/html_test.go

@@ -58,7 +58,7 @@ func TestServerErrorResponse(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ServerError(w, r, errors.New("Some error"))
+		ServerError(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
 	})
 
 	handler.ServeHTTP(w, r)
@@ -69,13 +69,13 @@ func TestServerErrorResponse(t *testing.T) {
 		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
 	}
 
-	expectedBody := `Some error`
+	expectedBody := `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`
 	actualBody := w.Body.String()
 	if actualBody != expectedBody {
 		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
 	}
 
-	expectedContentType := "text/html; charset=utf-8"
+	expectedContentType := "text/plain; charset=utf-8"
 	actualContentType := resp.Header.Get("Content-Type")
 	if actualContentType != expectedContentType {
 		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
@@ -91,7 +91,7 @@ func TestBadRequestResponse(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		BadRequest(w, r, errors.New("Some error"))
+		BadRequest(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
 	})
 
 	handler.ServeHTTP(w, r)
@@ -102,13 +102,13 @@ func TestBadRequestResponse(t *testing.T) {
 		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
 	}
 
-	expectedBody := `Some error`
+	expectedBody := `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`
 	actualBody := w.Body.String()
 	if actualBody != expectedBody {
 		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
 	}
 
-	expectedContentType := "text/html; charset=utf-8"
+	expectedContentType := "text/plain; charset=utf-8"
 	actualContentType := resp.Header.Get("Content-Type")
 	if actualContentType != expectedContentType {
 		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)

internal/http/response/json/json.go

@@ -16,19 +16,31 @@ import (
 const contentTypeHeader = `application/json`
 
 // OK creates a new JSON response with a 200 status code.
-func OK(w http.ResponseWriter, r *http.Request, body interface{}) {
+func OK(w http.ResponseWriter, r *http.Request, body any) {
+	responseBody, err := json.Marshal(body)
+	if err != nil {
+		ServerError(w, r, err)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSON(body))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
 // Created sends a created response to the client.
-func Created(w http.ResponseWriter, r *http.Request, body interface{}) {
+func Created(w http.ResponseWriter, r *http.Request, body any) {
+	responseBody, err := json.Marshal(body)
+	if err != nil {
+		ServerError(w, r, err)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusCreated)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSON(body))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
@@ -62,10 +74,17 @@ func ServerError(w http.ResponseWriter, r *http.Request, err error) {
 		),
 	)
 
+	responseBody, jsonErr := generateJSONError(err)
+	if jsonErr != nil {
+		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusInternalServerError)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSONError(err))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
@@ -84,10 +103,17 @@ func BadRequest(w http.ResponseWriter, r *http.Request, err error) {
 		),
 	)
 
+	responseBody, jsonErr := generateJSONError(err)
+	if jsonErr != nil {
+		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusBadRequest)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSONError(err))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
@@ -105,10 +131,17 @@ func Unauthorized(w http.ResponseWriter, r *http.Request) {
 		),
 	)
 
+	responseBody, jsonErr := generateJSONError(errors.New("access unauthorized"))
+	if jsonErr != nil {
+		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusUnauthorized)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSONError(errors.New("access unauthorized")))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
@@ -126,10 +159,17 @@ func Forbidden(w http.ResponseWriter, r *http.Request) {
 		),
 	)
 
+	responseBody, jsonErr := generateJSONError(errors.New("access forbidden"))
+	if jsonErr != nil {
+		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusForbidden)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSONError(errors.New("access forbidden")))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
@@ -147,27 +187,29 @@ func NotFound(w http.ResponseWriter, r *http.Request) {
 		),
 	)
 
+	responseBody, jsonErr := generateJSONError(errors.New("resource not found"))
+	if jsonErr != nil {
+		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return
+	}
+
 	builder := response.New(w, r)
 	builder.WithStatus(http.StatusNotFound)
 	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(toJSONError(errors.New("resource not found")))
+	builder.WithBody(responseBody)
 	builder.Write()
 }
 
-func toJSONError(err error) []byte {
+func generateJSONError(err error) ([]byte, error) {
 	type errorMsg struct {
 		ErrorMessage string `json:"error_message"`
 	}
 
-	return toJSON(errorMsg{ErrorMessage: err.Error()})
-}
-
-func toJSON(v interface{}) []byte {
-	b, err := json.Marshal(v)
+	encodedBody, err := json.Marshal(errorMsg{ErrorMessage: err.Error()})
 	if err != nil {
-		slog.Error("Unable to marshal JSON response", slog.Any("error", err))
-		return []byte("")
+		return nil, err
 	}
 
-	return b
+	return encodedBody, nil
 }

internal/http/response/json/json_test.go

@@ -293,12 +293,12 @@ func TestBuildInvalidJSONResponse(t *testing.T) {
 	handler.ServeHTTP(w, r)
 	resp := w.Result()
 
-	expectedStatusCode := http.StatusOK
+	expectedStatusCode := http.StatusInternalServerError
 	if resp.StatusCode != expectedStatusCode {
 		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
 	}
 
-	expectedBody := ``
+	expectedBody := `{"error_message":"json: unsupported type: chan int"}`
 	actualBody := w.Body.String()
 	if actualBody != expectedBody {
 		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)

internal/http/response/response.go

@@ -0,0 +1,14 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package response // import "miniflux.app/v2/internal/http/response"
+
+// ContentSecurityPolicyForUntrustedContent is the default CSP for untrusted content.
+// default-src 'none' disables all content sources
+// form-action 'none' disables all form submissions
+// sandbox enables a sandbox for the requested resource
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
+const ContentSecurityPolicyForUntrustedContent = `default-src 'none'; form-action 'none'; sandbox;`

internal/http/server/httpd.go

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-package httpd // import "miniflux.app/v2/internal/http/server"
+package server // import "miniflux.app/v2/internal/http/server"
 
 import (
 	"crypto/tls"
@@ -30,36 +30,84 @@ import (
 	"golang.org/x/crypto/acme/autocert"
 )
 
-func StartWebServer(store *storage.Storage, pool *worker.Pool) *http.Server {
+func StartWebServer(store *storage.Storage, pool *worker.Pool) []*http.Server {
+	listenAddresses := config.Opts.ListenAddr()
+	var httpServers []*http.Server
+
 	certFile := config.Opts.CertFile()
 	keyFile := config.Opts.CertKeyFile()
 	certDomain := config.Opts.CertDomain()
-	listenAddr := config.Opts.ListenAddr()
-	server := &http.Server{
-		ReadTimeout:  time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
-		WriteTimeout: time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
-		IdleTimeout:  time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
-		Handler:      setupHandler(store, pool),
+	var sharedAutocertTLSConfig *tls.Config
+
+	if certDomain != "" {
+		slog.Debug("Configuring autocert manager and shared TLS config", slog.String("domain", certDomain))
+		certManager := autocert.Manager{
+			Cache:      storage.NewCertificateCache(store),
+			Prompt:     autocert.AcceptTOS,
+			HostPolicy: autocert.HostWhitelist(certDomain),
+		}
+
+		sharedAutocertTLSConfig = &tls.Config{}
+		sharedAutocertTLSConfig.GetCertificate = certManager.GetCertificate
+		sharedAutocertTLSConfig.NextProtos = []string{"h2", "http/1.1", acme.ALPNProto}
+
+		challengeServer := &http.Server{
+			Handler: certManager.HTTPHandler(nil),
+			Addr:    ":http",
+		}
+		slog.Info("Starting ACME HTTP challenge server for autocert", slog.String("address", challengeServer.Addr))
+		go func() {
+			if err := challengeServer.ListenAndServe(); err != http.ErrServerClosed {
+				slog.Error("ACME HTTP challenge server failed", slog.Any("error", err))
+			}
+		}()
+		config.Opts.HTTPS = true
+		httpServers = append(httpServers, challengeServer)
 	}
 
-	switch {
-	case os.Getenv("LISTEN_PID") == strconv.Itoa(os.Getpid()):
-		startSystemdSocketServer(server)
-	case strings.HasPrefix(listenAddr, "/"):
-		startUnixSocketServer(server, listenAddr)
-	case certDomain != "":
-		config.Opts.HTTPS = true
-		startAutoCertTLSServer(server, certDomain, store)
-	case certFile != "" && keyFile != "":
-		config.Opts.HTTPS = true
-		server.Addr = listenAddr
-		startTLSServer(server, certFile, keyFile)
-	default:
-		server.Addr = listenAddr
-		startHTTPServer(server)
+	for i, listenAddr := range listenAddresses {
+		server := &http.Server{
+			ReadTimeout:  time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
+			WriteTimeout: time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
+			IdleTimeout:  time.Duration(config.Opts.HTTPServerTimeout()) * time.Second,
+			Handler:      setupHandler(store, pool),
+		}
+
+		if !strings.HasPrefix(listenAddr, "/") && os.Getenv("LISTEN_PID") != strconv.Itoa(os.Getpid()) {
+			server.Addr = listenAddr
+		}
+
+		shouldAddServer := true
+
+		switch {
+		case os.Getenv("LISTEN_PID") == strconv.Itoa(os.Getpid()):
+			if i == 0 {
+				slog.Info("Starting server using systemd socket for the first listen address", slog.String("address_info", listenAddr))
+				startSystemdSocketServer(server)
+			} else {
+				slog.Warn("Systemd socket activation: Only the first listen address is used by systemd. Other addresses ignored.", slog.String("skipped_address", listenAddr))
+				shouldAddServer = false
+			}
+		case strings.HasPrefix(listenAddr, "/"): // Unix socket
+			startUnixSocketServer(server, listenAddr)
+		case certDomain != "" && (listenAddr == ":https" || (i == 0 && strings.Contains(listenAddr, ":"))):
+			server.Addr = listenAddr
+			startAutoCertTLSServer(server, sharedAutocertTLSConfig)
+		case certFile != "" && keyFile != "":
+			server.Addr = listenAddr
+			startTLSServer(server, certFile, keyFile)
+			config.Opts.HTTPS = true
+		default:
+			server.Addr = listenAddr
+			startHTTPServer(server)
+		}
+
+		if shouldAddServer {
+			httpServers = append(httpServers, server)
+		}
 	}
 
-	return server
+	return httpServers
 }
 
 func startSystemdSocketServer(server *http.Server) {
@@ -72,83 +120,47 @@ func startSystemdSocketServer(server *http.Server) {
 
 		slog.Info(`Starting server using systemd socket`)
 		if err := server.Serve(listener); err != http.ErrServerClosed {
-			printErrorAndExit(`Server failed to start: %v`, err)
+			printErrorAndExit(`Systemd socket server failed to start: %v`, err)
 		}
 	}()
 }
 
 func startUnixSocketServer(server *http.Server, socketFile string) {
-	os.Remove(socketFile)
+	if err := os.Remove(socketFile); err != nil && !os.IsNotExist(err) {
+		printErrorAndExit("Unable to remove existing Unix socket %s: %v", socketFile, err)
+	}
+	listener, err := net.Listen("unix", socketFile)
+	if err != nil {
+		printErrorAndExit(`Server failed to listen on Unix socket %s: %v`, socketFile, err)
+	}
 
-	go func(sock string) {
-		listener, err := net.Listen("unix", sock)
-		if err != nil {
-			printErrorAndExit(`Server failed to start: %v`, err)
-		}
-		defer listener.Close()
+	if err := os.Chmod(socketFile, 0666); err != nil {
+		printErrorAndExit(`Unable to change socket permission for %s: %v`, socketFile, err)
+	}
 
-		if err := os.Chmod(sock, 0666); err != nil {
-			printErrorAndExit(`Unable to change socket permission: %v`, err)
-		}
-
-		slog.Info("Starting server using a Unix socket", slog.String("socket", sock))
+	go func() {
+		slog.Info("Starting server using a Unix socket", slog.String("socket", socketFile))
 		if err := server.Serve(listener); err != http.ErrServerClosed {
-			printErrorAndExit(`Server failed to start: %v`, err)
+			printErrorAndExit("Unix socket server failed to start on %s: %v", socketFile, err)
 		}
-	}(socketFile)
+	}()
 }
 
-func tlsConfig() *tls.Config {
-	// See https://blog.cloudflare.com/exposing-go-on-the-internet/
-	// And https://wiki.mozilla.org/Security/Server_Side_TLS
-	return &tls.Config{
-		MinVersion: tls.VersionTLS12,
-		CurvePreferences: []tls.CurveID{
-			tls.CurveP256,
-			tls.X25519,
-		},
-		CipherSuites: []uint16{
-			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-		},
-	}
-}
-
-func startAutoCertTLSServer(server *http.Server, certDomain string, store *storage.Storage) {
-	server.Addr = ":https"
-	certManager := autocert.Manager{
-		Cache:      storage.NewCertificateCache(store),
-		Prompt:     autocert.AcceptTOS,
-		HostPolicy: autocert.HostWhitelist(certDomain),
-	}
-	server.TLSConfig = tlsConfig()
-	server.TLSConfig.GetCertificate = certManager.GetCertificate
-	server.TLSConfig.NextProtos = []string{"h2", "http/1.1", acme.ALPNProto}
-
-	// Handle http-01 challenge.
-	s := &http.Server{
-		Handler: certManager.HTTPHandler(nil),
-		Addr:    ":http",
-	}
-	go s.ListenAndServe()
+func startAutoCertTLSServer(server *http.Server, autoTLSConfig *tls.Config) {
+	server.TLSConfig.GetCertificate = autoTLSConfig.GetCertificate
+	server.TLSConfig.NextProtos = autoTLSConfig.NextProtos
 
 	go func() {
 		slog.Info("Starting TLS server using automatic certificate management",
 			slog.String("listen_address", server.Addr),
-			slog.String("domain", certDomain),
 		)
 		if err := server.ListenAndServeTLS("", ""); err != http.ErrServerClosed {
-			printErrorAndExit(`Server failed to start: %v`, err)
+			printErrorAndExit("Autocert server failed to start on %s: %v", server.Addr, err)
 		}
 	}()
 }
 
 func startTLSServer(server *http.Server, certFile, keyFile string) {
-	server.TLSConfig = tlsConfig()
 	go func() {
 		slog.Info("Starting TLS server using a certificate",
 			slog.String("listen_address", server.Addr),
@@ -156,7 +168,7 @@ func startTLSServer(server *http.Server, certFile, keyFile string) {
 			slog.String("key_file", keyFile),
 		)
 		if err := server.ListenAndServeTLS(certFile, keyFile); err != http.ErrServerClosed {
-			printErrorAndExit(`Server failed to start: %v`, err)
+			printErrorAndExit("TLS server failed to start on %s: %v", server.Addr, err)
 		}
 	}()
 }
@@ -167,49 +179,64 @@ func startHTTPServer(server *http.Server) {
 			slog.String("listen_address", server.Addr),
 		)
 		if err := server.ListenAndServe(); err != http.ErrServerClosed {
-			printErrorAndExit(`Server failed to start: %v`, err)
+			printErrorAndExit("HTTP server failed to start on %s: %v", server.Addr, err)
 		}
 	}()
 }
 
 func setupHandler(store *storage.Storage, pool *worker.Pool) *mux.Router {
+	livenessProbe := func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("OK"))
+	}
+	readinessProbe := func(w http.ResponseWriter, r *http.Request) {
+		if err := store.Ping(); err != nil {
+			http.Error(w, fmt.Sprintf("Database Connection Error: %q", err), http.StatusServiceUnavailable)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("OK"))
+	}
+
 	router := mux.NewRouter()
 
+	// These routes do not take the base path into consideration and are always available at the root of the server.
+	router.HandleFunc("/liveness", livenessProbe).Name("liveness")
+	router.HandleFunc("/healthz", livenessProbe).Name("healthz")
+	router.HandleFunc("/readiness", readinessProbe).Name("readiness")
+	router.HandleFunc("/readyz", readinessProbe).Name("readyz")
+
+	var subrouter *mux.Router
 	if config.Opts.BasePath() != "" {
-		router = router.PathPrefix(config.Opts.BasePath()).Subrouter()
+		subrouter = router.PathPrefix(config.Opts.BasePath()).Subrouter()
+	} else {
+		subrouter = router.NewRoute().Subrouter()
 	}
 
 	if config.Opts.HasMaintenanceMode() {
-		router.Use(func(next http.Handler) http.Handler {
+		subrouter.Use(func(next http.Handler) http.Handler {
 			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				w.Write([]byte(config.Opts.MaintenanceMessage()))
 			})
 		})
 	}
 
-	router.Use(middleware)
+	subrouter.Use(middleware)
 
-	fever.Serve(router, store)
-	googlereader.Serve(router, store)
-	api.Serve(router, store, pool)
-	ui.Serve(router, store, pool)
+	fever.Serve(subrouter, store)
+	googlereader.Serve(subrouter, store)
+	api.Serve(subrouter, store, pool)
+	ui.Serve(subrouter, store, pool)
 
-	router.HandleFunc("/healthcheck", func(w http.ResponseWriter, r *http.Request) {
-		if err := store.Ping(); err != nil {
-			http.Error(w, "Database Connection Error", http.StatusInternalServerError)
-			return
-		}
+	subrouter.HandleFunc("/healthcheck", readinessProbe).Name("healthcheck")
 
-		w.Write([]byte("OK"))
-	}).Name("healthcheck")
-
-	router.HandleFunc("/version", func(w http.ResponseWriter, r *http.Request) {
+	subrouter.HandleFunc("/version", func(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte(version.Version))
 	}).Name("version")
 
 	if config.Opts.HasMetricsCollector() {
-		router.Handle("/metrics", promhttp.Handler()).Name("metrics")
-		router.Use(func(next http.Handler) http.Handler {
+		subrouter.Handle("/metrics", promhttp.Handler()).Name("metrics")
+		subrouter.Use(func(next http.Handler) http.Handler {
 			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				route := mux.CurrentRoute(r)
 

internal/http/server/middleware.go

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-package httpd // import "miniflux.app/v2/internal/http/server"
+package server // import "miniflux.app/v2/internal/http/server"
 
 import (
 	"context"

internal/integration/apprise/apprise.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"time"
 
@@ -26,42 +27,53 @@ func NewClient(serviceURL, baseURL string) *Client {
 	return &Client{serviceURL, baseURL}
 }
 
-func (c *Client) SendNotification(entry *model.Entry) error {
+func (c *Client) SendNotification(feed *model.Feed, entries model.Entries) error {
 	if c.baseURL == "" || c.servicesURL == "" {
 		return fmt.Errorf("apprise: missing base URL or services URL")
 	}
 
-	message := "[" + entry.Title + "]" + "(" + entry.URL + ")" + "\n\n"
-	apiEndpoint, err := urllib.JoinBaseURLAndPath(c.baseURL, "/notify")
-	if err != nil {
-		return fmt.Errorf(`apprise: invalid API endpoint: %v`, err)
-	}
+	for _, entry := range entries {
+		message := "[" + entry.Title + "]" + "(" + entry.URL + ")" + "\n\n"
+		apiEndpoint, err := urllib.JoinBaseURLAndPath(c.baseURL, "/notify")
+		if err != nil {
+			return fmt.Errorf(`apprise: invalid API endpoint: %v`, err)
+		}
 
-	requestBody, err := json.Marshal(map[string]any{
-		"urls": c.servicesURL,
-		"body": message,
-	})
-	if err != nil {
-		return fmt.Errorf("apprise: unable to encode request body: %v", err)
-	}
+		requestBody, err := json.Marshal(map[string]any{
+			"urls":  c.servicesURL,
+			"body":  message,
+			"title": feed.Title,
+		})
+		if err != nil {
+			return fmt.Errorf("apprise: unable to encode request body: %v", err)
+		}
 
-	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
-	if err != nil {
-		return fmt.Errorf("apprise: unable to create request: %v", err)
-	}
+		request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
+		if err != nil {
+			return fmt.Errorf("apprise: unable to create request: %v", err)
+		}
 
-	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("User-Agent", "Miniflux/"+version.Version)
 
-	httpClient := &http.Client{Timeout: defaultClientTimeout}
-	response, err := httpClient.Do(request)
-	if err != nil {
-		return fmt.Errorf("apprise: unable to send request: %v", err)
-	}
-	defer response.Body.Close()
+		slog.Debug("Sending Apprise notification",
+			slog.String("apprise_url", c.baseURL),
+			slog.String("services_url", c.servicesURL),
+			slog.String("title", feed.Title),
+			slog.String("body", message),
+			slog.String("entry_url", entry.URL),
+		)
 
-	if response.StatusCode >= 400 {
-		return fmt.Errorf("apprise: unable to send a notification: url=%s status=%d", apiEndpoint, response.StatusCode)
+		httpClient := &http.Client{Timeout: defaultClientTimeout}
+		response, err := httpClient.Do(request)
+		if err != nil {
+			return fmt.Errorf("apprise: unable to send request: %v", err)
+		}
+		response.Body.Close()
+
+		if response.StatusCode >= 400 {
+			return fmt.Errorf("apprise: unable to send a notification: url=%s status=%d", apiEndpoint, response.StatusCode)
+		}
 	}
 
 	return nil

internal/integration/betula/betula.go

@@ -0,0 +1,57 @@
+package betula
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"miniflux.app/v2/internal/urllib"
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	url   string
+	token string
+}
+
+func NewClient(url, token string) *Client {
+	return &Client{url: url, token: token}
+}
+
+func (c *Client) CreateBookmark(entryURL, entryTitle string, tags []string) error {
+	apiEndpoint, err := urllib.JoinBaseURLAndPath(c.url, "/save-link")
+	if err != nil {
+		return fmt.Errorf("betula: unable to generate save-link endpoint: %v", err)
+	}
+
+	values := url.Values{}
+	values.Add("url", entryURL)
+	values.Add("title", entryTitle)
+	values.Add("tags", strings.Join(tags, ","))
+
+	request, err := http.NewRequest(http.MethodPost, apiEndpoint+"?"+values.Encode(), nil)
+	if err != nil {
+		return fmt.Errorf("betula: unable to create request: %v", err)
+	}
+
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+	request.AddCookie(&http.Cookie{Name: "betula-token", Value: c.token})
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("betula: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("betula: unable to create bookmark: url=%s status=%d", apiEndpoint, response.StatusCode)
+	}
+
+	return nil
+}

internal/integration/cubox/cubox.go

@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Cubox API documentation: https://help.cubox.cc/save/api/
+
+package cubox // import "miniflux.app/v2/internal/integration/cubox"
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	apiLink string
+}
+
+func NewClient(apiLink string) *Client {
+	return &Client{apiLink: apiLink}
+}
+
+func (c *Client) SaveLink(entryURL string) error {
+	if c.apiLink == "" {
+		return errors.New("cubox: missing API link")
+	}
+
+	requestBody, err := json.Marshal(&card{
+		Type:    "url",
+		Content: entryURL,
+	})
+	if err != nil {
+		return fmt.Errorf("cubox: unable to encode request body: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), defaultClientTimeout)
+	defer cancel()
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, c.apiLink, bytes.NewReader(requestBody))
+	if err != nil {
+		return fmt.Errorf("cubox: unable to create request: %w", err)
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("cubox: unable to send request: %w", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode != 200 {
+		return fmt.Errorf("cubox: unable to save link: status=%d", response.StatusCode)
+	}
+
+	return nil
+}
+
+type card struct {
+	Type    string `json:"type"`
+	Content string `json:"content"`
+}

internal/integration/discord/discord.go

@@ -0,0 +1,109 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Discord Webhooks documentation: https://discord.com/developers/docs/resources/webhook
+
+package discord // import "miniflux.app/v2/internal/integration/discord"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/urllib"
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+const discordMsgColor = 5793266
+
+type Client struct {
+	webhookURL string
+}
+
+func NewClient(webhookURL string) *Client {
+	return &Client{webhookURL: webhookURL}
+}
+
+func (c *Client) SendDiscordMsg(feed *model.Feed, entries model.Entries) error {
+	for _, entry := range entries {
+		requestBody, err := json.Marshal(&discordMessage{
+			Embeds: []discordEmbed{
+				{
+					Title: "RSS feed update from Miniflux",
+					Color: discordMsgColor,
+					Fields: []discordFields{
+						{
+							Name:  "Updated feed",
+							Value: feed.Title,
+						},
+						{
+							Name:  "Article link",
+							Value: "[" + entry.Title + "]" + "(" + entry.URL + ")",
+						},
+						{
+							Name:   "Author",
+							Value:  entry.Author,
+							Inline: true,
+						},
+						{
+							Name:   "Source website",
+							Value:  urllib.RootURL(feed.SiteURL),
+							Inline: true,
+						},
+					},
+				},
+			},
+		})
+		if err != nil {
+			return fmt.Errorf("discord: unable to encode request body: %v", err)
+		}
+
+		request, err := http.NewRequest(http.MethodPost, c.webhookURL, bytes.NewReader(requestBody))
+		if err != nil {
+			return fmt.Errorf("discord: unable to create request: %v", err)
+		}
+
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+		slog.Debug("Sending Discord notification",
+			slog.String("webhookURL", c.webhookURL),
+			slog.String("title", feed.Title),
+			slog.String("entry_url", entry.URL),
+		)
+
+		httpClient := &http.Client{Timeout: defaultClientTimeout}
+		response, err := httpClient.Do(request)
+		if err != nil {
+			return fmt.Errorf("discord: unable to send request: %v", err)
+		}
+		response.Body.Close()
+
+		if response.StatusCode >= 400 {
+			return fmt.Errorf("discord: unable to send a notification: url=%s status=%d", c.webhookURL, response.StatusCode)
+		}
+	}
+
+	return nil
+}
+
+type discordFields struct {
+	Name   string `json:"name"`
+	Value  string `json:"value"`
+	Inline bool   `json:"inline,omitempty"`
+}
+
+type discordEmbed struct {
+	Title  string          `json:"title"`
+	Color  int             `json:"color"`
+	Fields []discordFields `json:"fields"`
+}
+
+type discordMessage struct {
+	Embeds []discordEmbed `json:"embeds"`
+}

internal/integration/integration.go

@@ -6,20 +6,29 @@ package integration // import "miniflux.app/v2/internal/integration"
 import (
 	"log/slog"
 
-	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/integration/apprise"
+	"miniflux.app/v2/internal/integration/betula"
+	"miniflux.app/v2/internal/integration/cubox"
+	"miniflux.app/v2/internal/integration/discord"
 	"miniflux.app/v2/internal/integration/espial"
 	"miniflux.app/v2/internal/integration/instapaper"
+	"miniflux.app/v2/internal/integration/karakeep"
+	"miniflux.app/v2/internal/integration/linkace"
 	"miniflux.app/v2/internal/integration/linkding"
+	"miniflux.app/v2/internal/integration/linkwarden"
 	"miniflux.app/v2/internal/integration/matrixbot"
 	"miniflux.app/v2/internal/integration/notion"
+	"miniflux.app/v2/internal/integration/ntfy"
 	"miniflux.app/v2/internal/integration/nunuxkeeper"
 	"miniflux.app/v2/internal/integration/omnivore"
 	"miniflux.app/v2/internal/integration/pinboard"
-	"miniflux.app/v2/internal/integration/pocket"
+	"miniflux.app/v2/internal/integration/pushover"
+	"miniflux.app/v2/internal/integration/raindrop"
+	"miniflux.app/v2/internal/integration/readeck"
 	"miniflux.app/v2/internal/integration/readwise"
 	"miniflux.app/v2/internal/integration/shaarli"
 	"miniflux.app/v2/internal/integration/shiori"
+	"miniflux.app/v2/internal/integration/slack"
 	"miniflux.app/v2/internal/integration/telegrambot"
 	"miniflux.app/v2/internal/integration/wallabag"
 	"miniflux.app/v2/internal/integration/webhook"
@@ -28,6 +37,30 @@ import (
 
 // SendEntry sends the entry to third-party providers when the user click on "Save".
 func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
+	if userIntegrations.BetulaEnabled {
+		slog.Debug("Sending entry to Betula",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := betula.NewClient(userIntegrations.BetulaURL, userIntegrations.BetulaToken)
+		err := client.CreateBookmark(
+			entry.URL,
+			entry.Title,
+			entry.Tags,
+		)
+
+		if err != nil {
+			slog.Error("Unable to send entry to Betula",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
+
 	if userIntegrations.PinboardEnabled {
 		slog.Debug("Sending entry to Pinboard",
 			slog.Int64("user_id", userIntegrations.UserID),
@@ -162,16 +195,22 @@ func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
 		}
 	}
 
-	if userIntegrations.PocketEnabled {
-		slog.Debug("Sending entry to Pocket",
+	if userIntegrations.LinkAceEnabled {
+		slog.Debug("Sending entry to LinkAce",
 			slog.Int64("user_id", userIntegrations.UserID),
 			slog.Int64("entry_id", entry.ID),
 			slog.String("entry_url", entry.URL),
 		)
 
-		client := pocket.NewClient(config.Opts.PocketConsumerKey(userIntegrations.PocketConsumerKey), userIntegrations.PocketAccessToken)
+		client := linkace.NewClient(
+			userIntegrations.LinkAceURL,
+			userIntegrations.LinkAceAPIKey,
+			userIntegrations.LinkAceTags,
+			userIntegrations.LinkAcePrivate,
+			userIntegrations.LinkAceCheckDisabled,
+		)
 		if err := client.AddURL(entry.URL, entry.Title); err != nil {
-			slog.Error("Unable to send entry to Pocket",
+			slog.Error("Unable to send entry to LinkAce",
 				slog.Int64("user_id", userIntegrations.UserID),
 				slog.Int64("entry_id", entry.ID),
 				slog.String("entry_url", entry.URL),
@@ -203,6 +242,50 @@ func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
 		}
 	}
 
+	if userIntegrations.LinkwardenEnabled {
+		slog.Debug("Sending entry to linkwarden",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := linkwarden.NewClient(
+			userIntegrations.LinkwardenURL,
+			userIntegrations.LinkwardenAPIKey,
+		)
+		if err := client.CreateBookmark(entry.URL, entry.Title); err != nil {
+			slog.Error("Unable to send entry to Linkwarden",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
+
+	if userIntegrations.ReadeckEnabled {
+		slog.Debug("Sending entry to Readeck",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := readeck.NewClient(
+			userIntegrations.ReadeckURL,
+			userIntegrations.ReadeckAPIKey,
+			userIntegrations.ReadeckLabels,
+			userIntegrations.ReadeckOnlyURL,
+		)
+		if err := client.CreateBookmark(entry.URL, entry.Title, entry.Content); err != nil {
+			slog.Error("Unable to send entry to Readeck",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
+
 	if userIntegrations.ReadwiseEnabled {
 		slog.Debug("Sending entry to Readwise",
 			slog.Int64("user_id", userIntegrations.UserID),
@@ -224,6 +307,25 @@ func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
 		}
 	}
 
+	if userIntegrations.CuboxEnabled {
+		slog.Debug("Sending entry to Cubox",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := cubox.NewClient(userIntegrations.CuboxAPILink)
+
+		if err := client.SaveLink(entry.URL); err != nil {
+			slog.Error("Unable to send entry to Cubox",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
+
 	if userIntegrations.ShioriEnabled {
 		slog.Debug("Sending entry to Shiori",
 			slog.Int64("user_id", userIntegrations.UserID),
@@ -288,6 +390,7 @@ func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
 			)
 		}
 	}
+
 	if userIntegrations.OmnivoreEnabled {
 		slog.Debug("Sending entry to Omnivore",
 			slog.Int64("user_id", userIntegrations.UserID),
@@ -305,6 +408,42 @@ func SendEntry(entry *model.Entry, userIntegrations *model.Integration) {
 			)
 		}
 	}
+
+	if userIntegrations.KarakeepEnabled {
+		slog.Debug("Sending entry to Karakeep",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := karakeep.NewClient(userIntegrations.KarakeepAPIKey, userIntegrations.KarakeepURL)
+		if err := client.SaveURL(entry.URL); err != nil {
+			slog.Error("Unable to send entry to Karakeep",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
+
+	if userIntegrations.RaindropEnabled {
+		slog.Debug("Sending entry to Raindrop",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int64("entry_id", entry.ID),
+			slog.String("entry_url", entry.URL),
+		)
+
+		client := raindrop.NewClient(userIntegrations.RaindropToken, userIntegrations.RaindropCollectionID, userIntegrations.RaindropTags)
+		if err := client.CreateRaindrop(entry.URL, entry.Title); err != nil {
+			slog.Error("Unable to send entry to Raindrop",
+				slog.Int64("user_id", userIntegrations.UserID),
+				slog.Int64("entry_id", entry.ID),
+				slog.String("entry_url", entry.URL),
+				slog.Any("error", err),
+			)
+		}
+	}
 }
 
 // PushEntries pushes a list of entries to activated third-party providers during feed refreshes.
@@ -335,27 +474,136 @@ func PushEntries(feed *model.Feed, entries model.Entries, userIntegrations *mode
 	}
 
 	if userIntegrations.WebhookEnabled {
+		var webhookURL string
+		if feed.WebhookURL != "" {
+			webhookURL = feed.WebhookURL
+		} else {
+			webhookURL = userIntegrations.WebhookURL
+		}
+
 		slog.Debug("Sending new entries to Webhook",
 			slog.Int64("user_id", userIntegrations.UserID),
 			slog.Int("nb_entries", len(entries)),
 			slog.Int64("feed_id", feed.ID),
-			slog.String("webhook_url", userIntegrations.WebhookURL),
+			slog.String("webhook_url", webhookURL),
 		)
 
-		webhookClient := webhook.NewClient(userIntegrations.WebhookURL, userIntegrations.WebhookSecret)
+		webhookClient := webhook.NewClient(webhookURL, userIntegrations.WebhookSecret)
 		if err := webhookClient.SendNewEntriesWebhookEvent(feed, entries); err != nil {
 			slog.Debug("Unable to send new entries to Webhook",
 				slog.Int64("user_id", userIntegrations.UserID),
 				slog.Int("nb_entries", len(entries)),
 				slog.Int64("feed_id", feed.ID),
-				slog.String("webhook_url", userIntegrations.WebhookURL),
+				slog.String("webhook_url", webhookURL),
 				slog.Any("error", err),
 			)
 		}
 	}
 
+	if userIntegrations.NtfyEnabled && feed.NtfyEnabled {
+		ntfyTopic := feed.NtfyTopic
+		if ntfyTopic == "" {
+			ntfyTopic = userIntegrations.NtfyTopic
+		}
+		slog.Debug("Sending new entries to Ntfy",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int("nb_entries", len(entries)),
+			slog.Int64("feed_id", feed.ID),
+			slog.String("topic", ntfyTopic),
+		)
+
+		client := ntfy.NewClient(
+			userIntegrations.NtfyURL,
+			ntfyTopic,
+			userIntegrations.NtfyAPIToken,
+			userIntegrations.NtfyUsername,
+			userIntegrations.NtfyPassword,
+			userIntegrations.NtfyIconURL,
+			userIntegrations.NtfyInternalLinks,
+			feed.NtfyPriority,
+		)
+
+		if err := client.SendMessages(feed, entries); err != nil {
+			slog.Warn("Unable to send new entries to Ntfy", slog.Any("error", err))
+		}
+	}
+
+	if userIntegrations.AppriseEnabled {
+		slog.Debug("Sending new entries to Apprise",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int("nb_entries", len(entries)),
+			slog.Int64("feed_id", feed.ID),
+		)
+
+		appriseServiceURLs := userIntegrations.AppriseServicesURL
+		if feed.AppriseServiceURLs != "" {
+			appriseServiceURLs = feed.AppriseServiceURLs
+		}
+
+		client := apprise.NewClient(
+			appriseServiceURLs,
+			userIntegrations.AppriseURL,
+		)
+
+		if err := client.SendNotification(feed, entries); err != nil {
+			slog.Warn("Unable to send new entries to Apprise", slog.Any("error", err))
+		}
+	}
+
+	if userIntegrations.DiscordEnabled {
+		slog.Debug("Sending new entries to Discord",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int("nb_entries", len(entries)),
+			slog.Int64("feed_id", feed.ID),
+		)
+
+		client := discord.NewClient(
+			userIntegrations.DiscordWebhookLink,
+		)
+
+		if err := client.SendDiscordMsg(feed, entries); err != nil {
+			slog.Warn("Unable to send new entries to Discord", slog.Any("error", err))
+		}
+	}
+
+	if userIntegrations.SlackEnabled {
+		slog.Debug("Sending new entries to Slack",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int("nb_entries", len(entries)),
+			slog.Int64("feed_id", feed.ID),
+		)
+
+		client := slack.NewClient(
+			userIntegrations.SlackWebhookLink,
+		)
+
+		if err := client.SendSlackMsg(feed, entries); err != nil {
+			slog.Warn("Unable to send new entries to Slack", slog.Any("error", err))
+		}
+	}
+
+	if userIntegrations.PushoverEnabled && feed.PushoverEnabled {
+		slog.Debug("Sending new entries to Pushover",
+			slog.Int64("user_id", userIntegrations.UserID),
+			slog.Int("nb_entries", len(entries)),
+			slog.Int64("feed_id", feed.ID),
+		)
+
+		client := pushover.New(
+			userIntegrations.PushoverUser,
+			userIntegrations.PushoverToken,
+			feed.PushoverPriority,
+			userIntegrations.PushoverDevice,
+			userIntegrations.PushoverPrefix,
+		)
+
+		if err := client.SendMessages(feed, entries); err != nil {
+			slog.Warn("Unable to send new entries to Pushover", slog.Any("error", err))
+		}
+	}
+
 	// Integrations that only support sending individual entries
-	if userIntegrations.TelegramBotEnabled || userIntegrations.AppriseEnabled {
+	if userIntegrations.TelegramBotEnabled {
 		for _, entry := range entries {
 			if userIntegrations.TelegramBotEnabled {
 				slog.Debug("Sending a new entry to Telegram",
@@ -382,35 +630,6 @@ func PushEntries(feed *model.Feed, entries model.Entries, userIntegrations *mode
 					)
 				}
 			}
-
-			if userIntegrations.AppriseEnabled {
-				slog.Debug("Sending a new entry to Apprise",
-					slog.Int64("user_id", userIntegrations.UserID),
-					slog.Int64("entry_id", entry.ID),
-					slog.String("entry_url", entry.URL),
-					slog.String("apprise_url", userIntegrations.AppriseURL),
-				)
-
-				appriseServiceURLs := userIntegrations.AppriseServicesURL
-				if feed.AppriseServiceURLs != "" {
-					appriseServiceURLs = feed.AppriseServiceURLs
-				}
-
-				client := apprise.NewClient(
-					appriseServiceURLs,
-					userIntegrations.AppriseURL,
-				)
-
-				if err := client.SendNotification(entry); err != nil {
-					slog.Error("Unable to send entry to Apprise",
-						slog.Int64("user_id", userIntegrations.UserID),
-						slog.Int64("entry_id", entry.ID),
-						slog.String("entry_url", entry.URL),
-						slog.String("apprise_url", userIntegrations.AppriseURL),
-						slog.Any("error", err),
-					)
-				}
-			}
 		}
 	}
 }

internal/integration/karakeep/karakeep.go

@@ -0,0 +1,81 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package karakeep // import "miniflux.app/v2/internal/integration/karakeep"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type errorResponse struct {
+	Code  string `json:"code"`
+	Error string `json:"error"`
+}
+
+type saveURLPayload struct {
+	Type string `json:"type"`
+	URL  string `json:"url"`
+}
+
+type Client struct {
+	wrapped     *http.Client
+	apiEndpoint string
+	apiToken    string
+}
+
+func NewClient(apiToken string, apiEndpoint string) *Client {
+	return &Client{wrapped: &http.Client{Timeout: defaultClientTimeout}, apiEndpoint: apiEndpoint, apiToken: apiToken}
+}
+
+func (c *Client) SaveURL(entryURL string) error {
+	requestBody, err := json.Marshal(&saveURLPayload{
+		Type: "link",
+		URL:  entryURL,
+	})
+	if err != nil {
+		return fmt.Errorf("karakeep: unable to encode request body: %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, c.apiEndpoint, bytes.NewReader(requestBody))
+	if err != nil {
+		return fmt.Errorf("karakeep: unable to create request: %v", err)
+	}
+
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.apiToken))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+	resp, err := c.wrapped.Do(req)
+	if err != nil {
+		return fmt.Errorf("karakeep: unable to send request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	responseBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("karakeep: failed to parse response: %s", err)
+	}
+
+	if resp.Header.Get("Content-Type") != "application/json" {
+		return fmt.Errorf("karakeep: unexpected content type response: %s", resp.Header.Get("Content-Type"))
+	}
+
+	if resp.StatusCode != http.StatusCreated {
+		var errResponse errorResponse
+		if err := json.Unmarshal(responseBody, &errResponse); err != nil {
+			return fmt.Errorf("karakeep: unable to parse error response: status=%d body=%s", resp.StatusCode, string(responseBody))
+		}
+		return fmt.Errorf("karakeep: failed to save URL: status=%d errorcode=%s %s", resp.StatusCode, errResponse.Code, errResponse.Error)
+	}
+
+	return nil
+}

internal/integration/linkace/linkace.go

@@ -0,0 +1,83 @@
+package linkace
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"miniflux.app/v2/internal/urllib"
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	baseURL       string
+	apiKey        string
+	tags          string
+	private       bool
+	checkDisabled bool
+}
+
+func NewClient(baseURL, apiKey, tags string, private bool, checkDisabled bool) *Client {
+	return &Client{baseURL: baseURL, apiKey: apiKey, tags: tags, private: private, checkDisabled: checkDisabled}
+}
+
+func (c *Client) AddURL(entryURL, entryTitle string) error {
+	if c.baseURL == "" || c.apiKey == "" {
+		return fmt.Errorf("linkace: missing base URL or API key")
+	}
+
+	tagsSplitFn := func(c rune) bool {
+		return c == ',' || c == ' '
+	}
+
+	apiEndpoint, err := urllib.JoinBaseURLAndPath(c.baseURL, "/api/v2/links")
+	if err != nil {
+		return fmt.Errorf("linkace: invalid API endpoint: %v", err)
+	}
+	requestBody, err := json.Marshal(&createItemRequest{
+		Url:           entryURL,
+		Title:         entryTitle,
+		Tags:          strings.FieldsFunc(c.tags, tagsSplitFn),
+		Private:       c.private,
+		CheckDisabled: c.checkDisabled,
+	})
+	if err != nil {
+		return fmt.Errorf("linkace: unable to encode request body: %v", err)
+	}
+
+	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
+	if err != nil {
+		return fmt.Errorf("linkace: unable to create request: %v", err)
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Accept", "application/json")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+	request.Header.Set("Authorization", "Bearer "+c.apiKey)
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("linkace: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("linkace: unable to create item: url=%s status=%d", apiEndpoint, response.StatusCode)
+	}
+
+	return nil
+}
+
+type createItemRequest struct {
+	Title         string   `json:"title,omitempty"`
+	Url           string   `json:"url"`
+	Tags          []string `json:"tags,omitempty"`
+	Private       bool     `json:"is_private,omitempty"`
+	CheckDisabled bool     `json:"check_disabled,omitempty"`
+}

internal/integration/linkwarden/linkwarden.go

@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package linkwarden // import "miniflux.app/v2/internal/integration/linkwarden"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"miniflux.app/v2/internal/urllib"
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	baseURL string
+	apiKey  string
+}
+
+func NewClient(baseURL, apiKey string) *Client {
+	return &Client{baseURL: baseURL, apiKey: apiKey}
+}
+
+func (c *Client) CreateBookmark(entryURL, entryTitle string) error {
+	if c.baseURL == "" || c.apiKey == "" {
+		return fmt.Errorf("linkwarden: missing base URL or API key")
+	}
+
+	apiEndpoint, err := urllib.JoinBaseURLAndPath(c.baseURL, "/api/v1/links")
+	if err != nil {
+		return fmt.Errorf(`linkwarden: invalid API endpoint: %v`, err)
+	}
+
+	requestBody, err := json.Marshal(&linkwardenBookmark{
+		Url:         entryURL,
+		Name:        "",
+		Description: "",
+		Tags:        []string{},
+		Collection:  map[string]interface{}{},
+	})
+
+	if err != nil {
+		return fmt.Errorf("linkwarden: unable to encode request body: %v", err)
+	}
+
+	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
+	if err != nil {
+		return fmt.Errorf("linkwarden: unable to create request: %v", err)
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+	request.AddCookie(&http.Cookie{Name: "__Secure-next-auth.session-token", Value: c.apiKey})
+	request.AddCookie(&http.Cookie{Name: "next-auth.session-token", Value: c.apiKey})
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("linkwarden: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("linkwarden: unable to create link: url=%s status=%d", apiEndpoint, response.StatusCode)
+	}
+
+	return nil
+}
+
+type linkwardenBookmark struct {
+	Url         string                 `json:"url"`
+	Name        string                 `json:"name"`
+	Description string                 `json:"description"`
+	Tags        []string               `json:"tags"`
+	Collection  map[string]interface{} `json:"collection"`
+}

internal/integration/matrixbot/matrixbot.go

@@ -10,7 +10,7 @@ import (
 	"miniflux.app/v2/internal/model"
 )
 
-// PushEntry pushes entries to matrix chat using integration settings provided
+// PushEntries pushes entries to matrix chat using integration settings provided
 func PushEntries(feed *model.Feed, entries model.Entries, matrixBaseURL, matrixUsername, matrixPassword, matrixRoomID string) error {
 	client := NewClient(matrixBaseURL)
 	discovery, err := client.DiscoverEndpoints()
@@ -28,7 +28,7 @@ func PushEntries(feed *model.Feed, entries model.Entries, matrixBaseURL, matrixU
 
 	for _, entry := range entries {
 		textMessages = append(textMessages, fmt.Sprintf(`[%s] %s - %s`, feed.Title, entry.Title, entry.URL))
-		formattedTextMessages = append(formattedTextMessages, fmt.Sprintf(`<li><strong>%s</strong>: <a href="%s">%s</a></li>`, feed.Title, entry.URL, entry.Title))
+		formattedTextMessages = append(formattedTextMessages, fmt.Sprintf(`<li><strong>%s</strong>: <a href=%q>%s</a></li>`, feed.Title, entry.URL, entry.Title))
 	}
 
 	_, err = client.SendFormattedTextMessage(

internal/integration/ntfy/ntfy.go

@@ -0,0 +1,132 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package ntfy // import "miniflux.app/v2/internal/integration/ntfy"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"time"
+
+	"miniflux.app/v2/internal/config"
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/version"
+)
+
+const (
+	defaultClientTimeout = 10 * time.Second
+	defaultNtfyURL       = "https://ntfy.sh"
+)
+
+type Client struct {
+	ntfyURL, ntfyTopic, ntfyApiToken, ntfyUsername, ntfyPassword, ntfyIconURL string
+	ntfyInternalLinks                                                         bool
+	ntfyPriority                                                              int
+}
+
+func NewClient(ntfyURL, ntfyTopic, ntfyApiToken, ntfyUsername, ntfyPassword, ntfyIconURL string, ntfyInternalLinks bool, ntfyPriority int) *Client {
+	if ntfyURL == "" {
+		ntfyURL = defaultNtfyURL
+	}
+	return &Client{ntfyURL, ntfyTopic, ntfyApiToken, ntfyUsername, ntfyPassword, ntfyIconURL, ntfyInternalLinks, ntfyPriority}
+}
+
+func (c *Client) SendMessages(feed *model.Feed, entries model.Entries) error {
+	for _, entry := range entries {
+		ntfyMessage := &ntfyMessage{
+			Topic:    c.ntfyTopic,
+			Message:  entry.Title,
+			Title:    feed.Title,
+			Priority: c.ntfyPriority,
+			Click:    entry.URL,
+		}
+
+		if c.ntfyIconURL != "" {
+			ntfyMessage.Icon = c.ntfyIconURL
+		}
+
+		if c.ntfyInternalLinks {
+			url, err := url.Parse(config.Opts.BaseURL())
+			if err != nil {
+				slog.Error("Unable to parse base URL", slog.Any("error", err))
+			} else {
+				ntfyMessage.Click = fmt.Sprintf("%s%s%d", url, "/unread/entry/", entry.ID)
+			}
+		}
+
+		slog.Debug("Sending Ntfy message",
+			slog.String("url", c.ntfyURL),
+			slog.String("topic", c.ntfyTopic),
+			slog.Int("priority", ntfyMessage.Priority),
+			slog.String("message", ntfyMessage.Message),
+			slog.String("entry_url", ntfyMessage.Click),
+		)
+
+		if err := c.makeRequest(ntfyMessage); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (c *Client) makeRequest(payload any) error {
+	requestBody, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("ntfy: unable to encode request body: %v", err)
+	}
+
+	request, err := http.NewRequest(http.MethodPost, c.ntfyURL, bytes.NewReader(requestBody))
+	if err != nil {
+		return fmt.Errorf("ntfy: unable to create request: %v", err)
+	}
+
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+	// See https://docs.ntfy.sh/publish/#access-tokens
+	if c.ntfyApiToken != "" {
+		request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.ntfyApiToken))
+	}
+
+	// See https://docs.ntfy.sh/publish/#username-password
+	if c.ntfyUsername != "" && c.ntfyPassword != "" {
+		request.SetBasicAuth(c.ntfyUsername, c.ntfyPassword)
+	}
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("ntfy: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("ntfy: incorrect response status code %d for url %s", response.StatusCode, c.ntfyURL)
+	}
+
+	return nil
+}
+
+// See https://docs.ntfy.sh/publish/#publish-as-json
+type ntfyMessage struct {
+	Topic    string       `json:"topic"`
+	Message  string       `json:"message"`
+	Title    string       `json:"title"`
+	Tags     []string     `json:"tags,omitempty"`
+	Priority int          `json:"priority,omitempty"`
+	Icon     string       `json:"icon,omitempty"` // https://docs.ntfy.sh/publish/#icons
+	Click    string       `json:"click,omitempty"`
+	Actions  []ntfyAction `json:"actions,omitempty"`
+}
+
+// See https://docs.ntfy.sh/publish/#action-buttons
+type ntfyAction struct {
+	Action string `json:"action"`
+	Label  string `json:"label"`
+	URL    string `json:"url"`
+}

internal/integration/omnivore/omnivore.go

@@ -11,8 +11,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/google/uuid"
-
+	"miniflux.app/v2/internal/crypto"
 	"miniflux.app/v2/internal/version"
 )
 
@@ -79,7 +78,7 @@ func (c *client) SaveUrl(url string) error {
 		"query": mutation,
 		"variables": map[string]interface{}{
 			"input": map[string]interface{}{
-				"clientRequestId": uuid.New().String(),
+				"clientRequestId": crypto.GenerateUUID(),
 				"source":          "api",
 				"url":             url,
 			},

internal/integration/pinboard/pinboard.go

@@ -4,6 +4,8 @@
 package pinboard // import "miniflux.app/v2/internal/integration/pinboard"
 
 import (
+	"encoding/xml"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -12,6 +14,9 @@ import (
 	"miniflux.app/v2/internal/version"
 )
 
+var errPostNotFound = fmt.Errorf("pinboard: post not found")
+var errMissingCredentials = fmt.Errorf("pinboard: missing auth token")
+
 const defaultClientTimeout = 10 * time.Second
 
 type Client struct {
@@ -24,20 +29,27 @@ func NewClient(authToken string) *Client {
 
 func (c *Client) CreateBookmark(entryURL, entryTitle, pinboardTags string, markAsUnread bool) error {
 	if c.authToken == "" {
-		return fmt.Errorf("pinboard: missing auth token")
+		return errMissingCredentials
 	}
 
-	toRead := "no"
+	// We check if the url is already bookmarked to avoid overriding existing data.
+	post, err := c.getBookmark(entryURL)
+
+	if err != nil && errors.Is(err, errPostNotFound) {
+		post = NewPost(entryURL, entryTitle)
+	} else if err != nil {
+		// In case of any other error, we return immediately to avoid overriding existing data.
+		return err
+	}
+
+	post.addTag(pinboardTags)
 	if markAsUnread {
-		toRead = "yes"
+		post.SetToread()
 	}
 
 	values := url.Values{}
 	values.Add("auth_token", c.authToken)
-	values.Add("url", entryURL)
-	values.Add("description", entryTitle)
-	values.Add("tags", pinboardTags)
-	values.Add("toread", toRead)
+	post.AddValues(values)
 
 	apiEndpoint := "https://api.pinboard.in/v1/posts/add?" + values.Encode()
 	request, err := http.NewRequest(http.MethodGet, apiEndpoint, nil)
@@ -61,3 +73,46 @@ func (c *Client) CreateBookmark(entryURL, entryTitle, pinboardTags string, markA
 
 	return nil
 }
+
+// getBookmark fetches a bookmark from Pinboard. https://www.pinboard.in/api/#posts_get
+func (c *Client) getBookmark(entryURL string) (*Post, error) {
+	if c.authToken == "" {
+		return nil, errMissingCredentials
+	}
+
+	values := url.Values{}
+	values.Add("auth_token", c.authToken)
+	values.Add("url", entryURL)
+
+	apiEndpoint := "https://api.pinboard.in/v1/posts/get?" + values.Encode()
+	request, err := http.NewRequest(http.MethodGet, apiEndpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("pinboard: unable to create request: %v", err)
+	}
+
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("pinboard: unable fetch bookmark: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return nil, fmt.Errorf("pinboard: unable to fetch bookmark, status=%d", response.StatusCode)
+	}
+
+	var results posts
+	err = xml.NewDecoder(response.Body).Decode(&results)
+	if err != nil {
+		return nil, fmt.Errorf("pinboard: unable to decode XML: %v", err)
+	}
+
+	if len(results.Posts) == 0 {
+		return nil, errPostNotFound
+	}
+
+	return &results.Posts[0], nil
+}

internal/integration/pinboard/post.go

@@ -0,0 +1,62 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package pinboard // import "miniflux.app/v2/internal/integration/pinboard"
+
+import (
+	"encoding/xml"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// Post a Pinboard bookmark.  "inspiration" from https://github.com/drags/pinboard/blob/master/posts.go#L32-L42
+type Post struct {
+	XMLName     xml.Name  `xml:"post"`
+	Url         string    `xml:"href,attr"`
+	Description string    `xml:"description,attr"`
+	Tags        string    `xml:"tag,attr"`
+	Extended    string    `xml:"extended,attr"`
+	Date        time.Time `xml:"time,attr"`
+	Shared      string    `xml:"shared,attr"`
+	Toread      string    `xml:"toread,attr"`
+}
+
+// Posts A result of a Pinboard API call
+type posts struct {
+	XMLName xml.Name `xml:"posts"`
+	Posts   []Post   `xml:"post"`
+}
+
+func NewPost(url string, description string) *Post {
+	return &Post{
+		Url:         url,
+		Description: description,
+		Date:        time.Now(),
+		Toread:      "no",
+	}
+}
+
+func (p *Post) addTag(tag string) {
+	if !strings.Contains(p.Tags, tag) {
+		p.Tags += " " + tag
+	}
+}
+
+func (p *Post) SetToread() {
+	p.Toread = "yes"
+}
+
+func (p *Post) AddValues(values url.Values) {
+	values.Add("url", p.Url)
+	values.Add("description", p.Description)
+	values.Add("tags", p.Tags)
+	if p.Toread != "" {
+		values.Add("toread", p.Toread)
+	}
+	if p.Shared != "" {
+		values.Add("shared", p.Shared)
+	}
+	values.Add("dt", p.Date.Format(time.RFC3339))
+	values.Add("extended", p.Extended)
+}

internal/integration/pocket/connector.go

@@ -1,132 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package pocket // import "miniflux.app/v2/internal/integration/pocket"
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"miniflux.app/v2/internal/version"
-)
-
-// Connector manages the authorization flow with Pocket to get a personal access token.
-type Connector struct {
-	consumerKey string
-}
-
-// NewConnector returns a new Pocket Connector.
-func NewConnector(consumerKey string) *Connector {
-	return &Connector{consumerKey}
-}
-
-// RequestToken fetches a new request token from Pocket API.
-func (c *Connector) RequestToken(redirectURL string) (string, error) {
-	apiEndpoint := "https://getpocket.com/v3/oauth/request"
-	requestBody, err := json.Marshal(&createTokenRequest{ConsumerKey: c.consumerKey, RedirectURI: redirectURL})
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to encode request body: %v", err)
-	}
-
-	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to create request: %v", err)
-	}
-
-	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set("X-Accept", "application/json")
-	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
-
-	httpClient := &http.Client{Timeout: defaultClientTimeout}
-	response, err := httpClient.Do(request)
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to send request: %v", err)
-	}
-	defer response.Body.Close()
-
-	if response.StatusCode >= 400 {
-		return "", fmt.Errorf("pocket: unable get request token: url=%s status=%d", apiEndpoint, response.StatusCode)
-	}
-
-	var result createTokenResponse
-	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
-		return "", fmt.Errorf("pocket: unable to decode response: %v", err)
-	}
-
-	if result.Code == "" {
-		return "", errors.New("pocket: request token is empty")
-	}
-
-	return result.Code, nil
-}
-
-// AccessToken fetches a new access token once the end-user authorized the application.
-func (c *Connector) AccessToken(requestToken string) (string, error) {
-	apiEndpoint := "https://getpocket.com/v3/oauth/authorize"
-	requestBody, err := json.Marshal(&authorizeRequest{ConsumerKey: c.consumerKey, Code: requestToken})
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to encode request body: %v", err)
-	}
-
-	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to create request: %v", err)
-	}
-
-	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set("X-Accept", "application/json")
-	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
-
-	httpClient := &http.Client{Timeout: defaultClientTimeout}
-	response, err := httpClient.Do(request)
-	if err != nil {
-		return "", fmt.Errorf("pocket: unable to send request: %v", err)
-	}
-	defer response.Body.Close()
-
-	if response.StatusCode >= 400 {
-		return "", fmt.Errorf("pocket: unable get access token: url=%s status=%d", apiEndpoint, response.StatusCode)
-	}
-
-	var result authorizeReponse
-	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
-		return "", fmt.Errorf("pocket: unable to decode response: %v", err)
-	}
-
-	if result.AccessToken == "" {
-		return "", errors.New("pocket: access token is empty")
-	}
-
-	return result.AccessToken, nil
-}
-
-// AuthorizationURL returns the authorization URL for the end-user.
-func (c *Connector) AuthorizationURL(requestToken, redirectURL string) string {
-	return fmt.Sprintf(
-		"https://getpocket.com/auth/authorize?request_token=%s&redirect_uri=%s",
-		requestToken,
-		redirectURL,
-	)
-}
-
-type createTokenRequest struct {
-	ConsumerKey string `json:"consumer_key"`
-	RedirectURI string `json:"redirect_uri"`
-}
-
-type createTokenResponse struct {
-	Code string `json:"code"`
-}
-
-type authorizeRequest struct {
-	ConsumerKey string `json:"consumer_key"`
-	Code        string `json:"code"`
-}
-
-type authorizeReponse struct {
-	AccessToken string `json:"access_token"`
-	Username    string `json:"username"`
-}

internal/integration/pocket/pocket.go

@@ -1,70 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package pocket // import "miniflux.app/v2/internal/integration/pocket"
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-
-	"miniflux.app/v2/internal/version"
-)
-
-const defaultClientTimeout = 10 * time.Second
-
-type Client struct {
-	consumerKey string
-	accessToken string
-}
-
-func NewClient(consumerKey, accessToken string) *Client {
-	return &Client{consumerKey, accessToken}
-}
-
-func (c *Client) AddURL(entryURL, entryTitle string) error {
-	if c.consumerKey == "" || c.accessToken == "" {
-		return fmt.Errorf("pocket: missing consumer key or access token")
-	}
-
-	apiEndpoint := "https://getpocket.com/v3/add"
-	requestBody, err := json.Marshal(&createItemRequest{
-		AccessToken: c.accessToken,
-		ConsumerKey: c.consumerKey,
-		Title:       entryTitle,
-		URL:         entryURL,
-	})
-	if err != nil {
-		return fmt.Errorf("pocket: unable to encode request body: %v", err)
-	}
-
-	request, err := http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBody))
-	if err != nil {
-		return fmt.Errorf("pocket: unable to create request: %v", err)
-	}
-
-	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
-
-	httpClient := &http.Client{Timeout: defaultClientTimeout}
-	response, err := httpClient.Do(request)
-	if err != nil {
-		return fmt.Errorf("pocket: unable to send request: %v", err)
-	}
-	defer response.Body.Close()
-
-	if response.StatusCode >= 400 {
-		return fmt.Errorf("pocket: unable to create item: url=%s status=%d", apiEndpoint, response.StatusCode)
-	}
-
-	return nil
-}
-
-type createItemRequest struct {
-	AccessToken string `json:"access_token"`
-	ConsumerKey string `json:"consumer_key"`
-	Title       string `json:"title,omitempty"`
-	URL         string `json:"url"`
-}

internal/integration/pushover/pushover.go

@@ -0,0 +1,138 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package pushover // import "miniflux.app/v2/internal/integration/pushover"
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/version"
+)
+
+const (
+	defaultClientTimeout = 10 * time.Second
+	defaultPushoverURL   = "https://api.pushover.net"
+)
+
+type Client struct {
+	prefix string
+
+	token  string
+	user   string
+	device string
+
+	priority int
+}
+
+type Message struct {
+	Token string `json:"token"`
+	User  string `json:"user"`
+
+	Title    string `json:"title"`
+	Message  string `json:"message"`
+	Priority int    `json:"priority"`
+
+	URL      string `json:"url"`
+	URLTitle string `json:"url_title"`
+	Device   string `json:"device,omitempty"`
+}
+
+type ErrorResponse struct {
+	User    string   `json:"user"`
+	Errors  []string `json:"errors"`
+	Status  int      `json:"status"`
+	Request string   `json:"request"`
+}
+
+func New(user, token string, priority int, device, urlPrefix string) *Client {
+	if urlPrefix == "" {
+		urlPrefix = defaultPushoverURL
+	}
+	if priority < -2 {
+		priority = -2
+	}
+	if priority > 2 {
+		priority = 2
+	}
+
+	return &Client{
+		user:     user,
+		token:    token,
+		device:   device,
+		prefix:   urlPrefix,
+		priority: priority,
+	}
+}
+
+func (c *Client) SendMessages(feed *model.Feed, entries model.Entries) error {
+	if c.token == "" || c.user == "" {
+		return fmt.Errorf("pushover token and user are required")
+	}
+	for _, entry := range entries {
+		msg := &Message{
+			User:   c.user,
+			Token:  c.token,
+			Device: c.device,
+
+			Message:  entry.Title,
+			Title:    feed.Title,
+			Priority: c.priority,
+			URL:      entry.URL,
+		}
+
+		slog.Debug("Sending Pushover message",
+			slog.Int("priority", msg.Priority),
+			slog.String("message", msg.Message),
+			slog.String("entry_url", msg.URL),
+		)
+
+		if err := c.makeRequest(msg); err != nil {
+			return fmt.Errorf("c.makeRequest: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (c *Client) makeRequest(payload *Message) error {
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("json.Marshal: %w", err)
+	}
+	url := c.prefix + "/1/messages.json"
+	req, err := http.NewRequest(http.MethodPost, url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("http.NewRequest: %w", err)
+	}
+
+	req.Header.Add("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "Miniflux/"+version.Version)
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("httpClient.Do: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= http.StatusBadRequest {
+		errorMessage := resp.Status
+
+		var errResp ErrorResponse
+		if err := json.NewDecoder(resp.Body).Decode(&errResp); err != nil {
+			if len(errResp.Errors) > 0 {
+				errorMessage = strings.Join(errResp.Errors, ",")
+			}
+		}
+
+		return fmt.Errorf("pushover API error (%d): %s", resp.StatusCode, errorMessage)
+	}
+
+	return nil
+}

internal/integration/raindrop/raindrop.go

@@ -0,0 +1,78 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package raindrop // import "miniflux.app/v2/internal/integration/raindrop"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	token        string
+	collectionID string
+	tags         []string
+}
+
+func NewClient(token, collectionID, tags string) *Client {
+	return &Client{token: token, collectionID: collectionID, tags: strings.Split(tags, ",")}
+}
+
+// https://developer.raindrop.io/v1/raindrops/single#create-raindrop
+func (c *Client) CreateRaindrop(entryURL, entryTitle string) error {
+	if c.token == "" {
+		return fmt.Errorf("raindrop: missing token")
+	}
+
+	var request *http.Request
+	requestBodyJson, err := json.Marshal(&raindrop{
+		Link:       entryURL,
+		Title:      entryTitle,
+		Collection: collection{Id: c.collectionID},
+		Tags:       c.tags,
+	})
+	if err != nil {
+		return fmt.Errorf("raindrop: unable to encode request body: %v", err)
+	}
+
+	request, err = http.NewRequest(http.MethodPost, "https://api.raindrop.io/rest/v1/raindrop", bytes.NewReader(requestBodyJson))
+	if err != nil {
+		return fmt.Errorf("raindrop: unable to create request: %v", err)
+	}
+	request.Header.Set("Content-Type", "application/json")
+
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+	request.Header.Set("Authorization", "Bearer "+c.token)
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("raindrop: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("raindrop: unable to create bookmark: status=%d", response.StatusCode)
+	}
+
+	return nil
+}
+
+type raindrop struct {
+	Link       string     `json:"link"`
+	Title      string     `json:"title"`
+	Collection collection `json:"collection,omitempty"`
+	Tags       []string   `json:"tags"`
+}
+
+type collection struct {
+	Id string `json:"$id"`
+}

internal/integration/readeck/readeck.go

@@ -0,0 +1,149 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package readeck // import "miniflux.app/v2/internal/integration/readeck"
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"strings"
+	"time"
+
+	"miniflux.app/v2/internal/urllib"
+	"miniflux.app/v2/internal/version"
+)
+
+const defaultClientTimeout = 10 * time.Second
+
+type Client struct {
+	baseURL string
+	apiKey  string
+	labels  string
+	onlyURL bool
+}
+
+func NewClient(baseURL, apiKey, labels string, onlyURL bool) *Client {
+	return &Client{baseURL: baseURL, apiKey: apiKey, labels: labels, onlyURL: onlyURL}
+}
+
+func (c *Client) CreateBookmark(entryURL, entryTitle string, entryContent string) error {
+	if c.baseURL == "" || c.apiKey == "" {
+		return fmt.Errorf("readeck: missing base URL or API key")
+	}
+
+	apiEndpoint, err := urllib.JoinBaseURLAndPath(c.baseURL, "/api/bookmarks/")
+	if err != nil {
+		return fmt.Errorf(`readeck: invalid API endpoint: %v`, err)
+	}
+
+	labelsSplitFn := func(c rune) bool {
+		return c == ',' || c == ' '
+	}
+	labelsSplit := strings.FieldsFunc(c.labels, labelsSplitFn)
+
+	var request *http.Request
+	if c.onlyURL {
+		requestBodyJson, err := json.Marshal(&readeckBookmark{
+			Url:    entryURL,
+			Title:  entryTitle,
+			Labels: labelsSplit,
+		})
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body: %v", err)
+		}
+		request, err = http.NewRequest(http.MethodPost, apiEndpoint, bytes.NewReader(requestBodyJson))
+		if err != nil {
+			return fmt.Errorf("readeck: unable to create request: %v", err)
+		}
+		request.Header.Set("Content-Type", "application/json")
+	} else {
+		requestBody := new(bytes.Buffer)
+		multipartWriter := multipart.NewWriter(requestBody)
+
+		urlPart, err := multipartWriter.CreateFormField("url")
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body (entry url): %v", err)
+		}
+		urlPart.Write([]byte(entryURL))
+
+		titlePart, err := multipartWriter.CreateFormField("title")
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body (entry title): %v", err)
+		}
+		titlePart.Write([]byte(entryTitle))
+
+		featurePart, err := multipartWriter.CreateFormField("feature_find_main")
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body (feature_find_main flag): %v", err)
+		}
+		featurePart.Write([]byte("false")) // false to disable readability
+
+		for _, label := range labelsSplit {
+			labelPart, err := multipartWriter.CreateFormField("labels")
+			if err != nil {
+				return fmt.Errorf("readeck: unable to encode request body (entry labels): %v", err)
+			}
+			labelPart.Write([]byte(label))
+		}
+
+		contentBodyHeader, err := json.Marshal(&partContentHeader{
+			Url:           entryURL,
+			ContentHeader: contentHeader{ContentType: "text/html; charset=utf-8"},
+		})
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body (entry content header): %v", err)
+		}
+
+		contentPart, err := multipartWriter.CreateFormFile("resource", "blob")
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body (entry content): %v", err)
+		}
+		contentPart.Write(contentBodyHeader)
+		contentPart.Write([]byte("\n"))
+		contentPart.Write([]byte(entryContent))
+
+		err = multipartWriter.Close()
+		if err != nil {
+			return fmt.Errorf("readeck: unable to encode request body: %v", err)
+		}
+		request, err = http.NewRequest(http.MethodPost, apiEndpoint, requestBody)
+		if err != nil {
+			return fmt.Errorf("readeck: unable to create request: %v", err)
+		}
+		request.Header.Set("Content-Type", multipartWriter.FormDataContentType())
+	}
+
+	request.Header.Set("User-Agent", "Miniflux/"+version.Version)
+	request.Header.Set("Authorization", "Bearer "+c.apiKey)
+
+	httpClient := &http.Client{Timeout: defaultClientTimeout}
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("readeck: unable to send request: %v", err)
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 400 {
+		return fmt.Errorf("readeck: unable to create bookmark: url=%s status=%d", apiEndpoint, response.StatusCode)
+	}
+
+	return nil
+}
+
+type readeckBookmark struct {
+	Url    string   `json:"url"`
+	Title  string   `json:"title"`
+	Labels []string `json:"labels,omitempty"`
+}
+
+type contentHeader struct {
+	ContentType string `json:"content-type"`
+}
+
+type partContentHeader struct {
+	Url           string        `json:"url"`
+	ContentHeader contentHeader `json:"headers"`
+}