Tiny RSS

Recent Commits

• dependabot[bot] (05 Jul 26)

  GitHub Actions: Bump docker/build-push-action from 7.2.0 to 7.3.0 (#389) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (05 Jul 26)

  GitHub Actions: Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#388) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (05 Jul 26)

  GitHub Actions: Bump docker/metadata-action from 6.1.0 to 6.2.0 (#387) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (05 Jul 26)

  GitHub Actions: Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#386) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (05 Jul 26)

  GitHub Actions: Bump docker/login-action from 4.2.0 to 4.4.0 (#385) Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• supahgreg (24 Jun 26)

  Remove public method 'getUnread'. Clients needing this information should use the API method of the same name. Alternatively, a plugin could be created+required that exposes this information via an unauthenticated method.

• supahgreg (02 Jul 26)

  Bump 'guzzlehttp/guzzle' to 7.13.1.

• Greg (02 Jul 26)

  Limit visibility of partial response HTML content from a failed subscribe. (#384)

• Greg (02 Jul 26)

  Merge pull request #383 from tt-rss/login-return Improve validation of the login 'return' param

• supahgreg (02 Jul 26)

  Properly restrict Rector to a max of PHP 8.2

• supahgreg (24 Jun 26)

  Improve validation of the login 'return' param.

• dependabot[bot] (02 Jul 26)

  npm: bump the development-dependencies group with 4 updates (#381) Bumps the development-dependencies group with 4 updates: [eslint](https://github.com/eslint/eslint), [globals](https://github.com/sindresorhus/globals), [less](https://github.com/less/less.js) and [stylelint](https://github.com/stylelint/stylelint). Updates `eslint` from 10.5.0 to 10.6.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.5.0...v10.6.0) Updates `globals` from 17.6.0 to 17.7.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.6.0...v17.7.0) Updates `less` from 4.6.6 to 4.6.7 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/less/less.js/compare/v4.6.6...v4.6.7) Updates `stylelint` from 17.13.0 to 17.14.0 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](https://github.com/stylelint/stylelint/compare/17.13.0...17.14.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: globals dependency-version: 17.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: less dependency-version: 4.6.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: stylelint dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (30 Jun 26)

  GitHub Actions: Bump actions/cache/restore from 5.0.5 to 6.1.0 (#378) Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (30 Jun 26)

  GitHub Actions: Bump actions/cache/save from 5.0.5 to 6.1.0 (#379) Bumps [actions/cache/save](https://github.com/actions/cache) from 5.0.5 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (23 Jun 26)

  GitHub Actions: Bump actions/checkout from 6.0.3 to 7.0.0 (#375) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• supahgreg (18 Jun 26)

  Fix getting the feed ID for feed tree context menus.

• supahgreg (18 Jun 26)

  Bump the 'web-nginx' base image to nginx 1.31.2.

• Weblate (bot) (17 Jun 26)

  Translated using Weblate (Russian) (#372) Currently translated at 100.0% (727 of 727 strings) Translation: TinyTinyRSS/webui Translate-URL: https://hosted.weblate.org/projects/tt-rss/webui/ru/ Co-authored-by: Xapitonov <[email protected]>

• Greg (17 Jun 26)

  Bump 'guzzlehttp/guzzle' to 7.12.0. (#371)

• Andrew Gaul (15 Jun 26)

  Fix native long-press leaking a tap and stranding the menu (#360) (#369) On Android the browser fires the contextmenu for a long-press itself, so the menu opens via the native path; the synthetic path #360 added is only reached on iOS. But armReleaseSwallow() -- which eats the finger-lift's compatibility mouse events -- was wired only into the synthetic path. So on Android (e.g. Firefox) the release fell through to the row: the feed tree's onClick ran Feeds.open() and collapsed the drawer, i.e. a long-press behaved like a tap. And once the menu was open, pending was null, so pointermove ignored a drag and the popup stayed open instead of dismissing. - The native contextmenu handler now arms armReleaseSwallow() when a touch press is in flight (pending is only ever set for touch, so a real mouse right-click is left alone), matching the synthetic path. - Track the origin of the press that opened a menu (opened) and, if the still-down finger drags past the slop, close the popup -- a drag means the user means to scroll, not pick an item. Reset per gesture on pointerdown / pointerup / pointercancel. References #360. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Weblate (bot) (15 Jun 26)

  Translated using Weblate (Indonesian) (#368) Currently translated at 100.0% (727 of 727 strings) Translation: TinyTinyRSS/webui Translate-URL: https://hosted.weblate.org/projects/tt-rss/webui/id/ Co-authored-by: Dony Wibowo <[email protected]>

• dependabot[bot] (15 Jun 26)

  npm: bump the development-dependencies group across 1 directory with 4 updates (#366) Bumps the development-dependencies group with 4 updates in the / directory: [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js), [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin), [eslint](https://github.com/eslint/eslint) and [less](https://github.com/less/less.js). Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@stylistic/eslint-plugin` from 5.6.1 to 5.10.0 - [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases) - [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/v5.10.0/CHANGELOG.md) - [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.10.0/packages/eslint-plugin) Updates `eslint` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.4.1...v10.5.0) Updates `less` from 4.6.4 to 4.6.6 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/less/less.js/commits/v4.6.6) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-dependencies - dependency-name: "@stylistic/eslint-plugin" dependency-version: 5.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: less dependency-version: 4.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• supahgreg (15 Jun 26)

  Address some unnecessary JS assignments. These get flagged as 'no-useless-assignment' in ESLint 10.x (https://github.com/tt-rss/tt-rss/pull/366).

• supahgreg (14 Jun 26)

  Check for JS dev dependency updates less often + group into a single PR.

• supahgreg (13 Jun 26)

  Bump to Alpine 3.24.1. https://alpinelinux.org/posts/Alpine-3.24.1-released.html

• Andrew Gaul (13 Jun 26)

  Set mobile keyboard and password-manager hints on the login form (#361) Phone keyboards capitalise and autocorrect the login field by default, and password managers need the autocomplete roles to offer credentials reliably on mobile. - Login: autocomplete="username", autocapitalize="none", autocorrect="off", spellcheck="false". - Password: autocomplete="current-password". The dojo parser forwards autocorrect to the widget as a param just like the other attributes; whether it reaches the rendered input is then gated on the browser exposing a matching IDL property. WebKit does, so iOS Safari -- the only engine with an autocorrect feature -- renders it. Chromium has neither the property nor the feature, so the attribute is simply absent there, with nothing lost. Verified on the rendered login page that the attributes survive the parser and that logging in still works, and that simulating WebKit's autocorrect IDL property makes the attribute reach the input. References #157. Co-authored-by: Claude Fable 5 <[email protected]>

• Andrew Gaul (12 Jun 26)

  Open context menus with a long-press on iOS (#360) iOS Safari never fires a contextmenu event for a touch long-press, and contextmenu is the only trigger the delegated dijit.Menu bindings listen for, so the headline and feed-tree context menus were unreachable on iPhones and iPads. Android fires the event natively at ~500ms and already worked. - App.initLongPressContextMenu() times the press itself via pointer events on #headlines-frame and #feeds-holder and dispatches the contextmenu event dijit expects at the pressed element; selector delegation, currentTarget and menu position behave exactly as for a real right-click. - The 600ms timer sits above Android's native delay on purpose: where a native contextmenu exists it wins and cancels the pending press, and a late native duplicate arriving just after a synthesised open is eaten before dijit can open the menu twice. Movement past 10px, pointerup/pointercancel or a second finger cancels the press, so scrolling, swipe-to-read and pinch are unaffected. - The menu opens while the finger is still down, so the release would land its compatibility mousedown/mouseup/click on the just-opened menu or the modal popup backdrop. Those events are swallowed at the document, armed only until just after the opening pointer lifts; the next deliberate tap (e.g. on a menu item) goes through normally. - (pointer: coarse) CSS applies user-select / -webkit-touch-callout none to the menu-bearing elements (headline title wraps, the vfeed chip, group headers, feed tree rows) so iOS's link-preview sheet and selection callout don't fire on the same press; article content stays selectable. Verified end to end on the dev instance with synthetic pointer events (untrusted events bypass Chromium's native long-press gesture, reproducing iOS's missing contextmenu): long-press opens the correct row's menu on the phone and tablet layouts, menu items execute (starred state and DB flip and stick), the release tap is swallowed, quick taps and scrolls pass through untouched, Android's native path stays single-fire, the device Back gesture still closes the menu first, and desktop right-click is unchanged. References #157. Co-authored-by: Claude Fable 5 <[email protected]>

• Weblate (bot) (12 Jun 26)

  Translated using Weblate (Albanian) (#358) Currently translated at 96.9% (705 of 727 strings) Translation: TinyTinyRSS/webui Translate-URL: https://hosted.weblate.org/projects/tt-rss/webui/sq/ Co-authored-by: Besnik Bleta <[email protected]>

• Greg (12 Jun 26)

  Bump to Alpine 3.24. (#357)

• Andrew Gaul (12 Jun 26)

  Clamp article titles at two lines on the narrow layout (#359) Closed rows on phones previously truncated the title to a single nowrap line. Let the title block (title plus inline preview or excerpt) wrap onto a second line instead, clamped with an ellipsis via -webkit-line-clamp, in both list (.hl) and combined (.cdm.expandable) rows. Open (.active) combined rows keep their existing full wrap, and the docked desktop layout is unchanged. The clamped element trades its bottom padding for a margin because the CDM excerpt is a sibling of the clamp-truncated title anchor: it still lays out lines past the clamp, and their glyph tops would otherwise paint through the padding before the overflow clip. The excerpt's own nowrap is relaxed so it can flow through the second line. References #157. Co-authored-by: Claude Fable 5 <[email protected]>