Merge pull request #2341 from Athou/renovate/docker-login-action-4.x

Update docker/login-action action to v4.7.0
2026-10-23 21:49:05 +00:00 · 2026-10-23 20:36:02 +02:00 · 2026-10-23 18:01:41 +00:00 · 2026-10-23 08:55:25 +02:00 · 2026-10-22 20:43:24 +00:00 · 2026-10-22 17:03:04 +02:00
29 changed files with 1348 additions and 1056 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,14 +29,14 @@ jobs:

      # Setup
      - name: Set up GraalVM
-        uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4
+        uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: "graalvm"
          cache: "maven"

      - name: Set up NodeJS cache
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          cache: "npm"
          cache-dependency-path: 'commafeed-client/package-lock.json'
@@ -47,7 +47,7 @@ jobs:

      # Build & Test
      - name: Build with Maven
-        run: mvn --batch-mode --no-transfer-progress install -Pnative -P${{ matrix.database }} -DskipTests=${{ matrix.os == 'windows-latest' && matrix.database != 'h2' }}
+        run: mvn --batch-mode --no-transfer-progress install -Pnative -P${{ matrix.database }} -DskipITs=${{ matrix.os == 'windows-latest' && matrix.database != 'h2' }}

      # Build pages
      - name: Create pages directory structure
@@ -73,14 +73,14 @@ jobs:

      # Upload artifacts
      - name: Upload cross-platform app
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: matrix.os == 'ubuntu-latest' # we only need to upload the cross-platform artifact once per database
        with:
          name: commafeed-${{ matrix.database }}-jvm
          path: commafeed-server/target/commafeed-*.zip

      - name: Upload native executable
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: commafeed-${{ matrix.database }}-${{ runner.os }}-${{ runner.arch }}
          path: commafeed-server/target/commafeed-*-runner*
@@ -110,17 +110,17 @@ jobs:

      # Setup
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Install required packages
        run: sudo apt-get install -y rename unzip

      # Prepare artifacts
      - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: commafeed-${{ matrix.database }}-*
          path: ./artifacts
@@ -141,7 +141,7 @@ jobs:

      # Docker
      - name: Login to Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        if: ${{ env.DOCKERHUB_USERNAME != '' }}
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:

      ## build but don't push for PRs and renovate
      - name: Docker build - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: commafeed-server/src/main/docker/Dockerfile.native
@@ -157,7 +157,7 @@ jobs:
          platforms: linux/amd64,linux/arm64/v8

      - name: Docker build - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: commafeed-server/src/main/docker/Dockerfile.jvm
@@ -166,7 +166,7 @@ jobs:

      ## build and push tag
      - name: Docker build and push tag - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        if: ${{ github.ref_type == 'tag' }}
        with:
          context: .
@@ -178,7 +178,7 @@ jobs:
            athou/commafeed:${{ github.ref_name }}-${{ matrix.database }}

      - name: Docker build and push tag - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        if: ${{ github.ref_type == 'tag' }}
        with:
          context: .
@@ -191,7 +191,7 @@ jobs:

      ## build and push master
      - name: Docker build and push master - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        if: ${{ github.ref_name == 'master' }}
        with:
          context: .
@@ -201,7 +201,7 @@ jobs:
          tags: athou/commafeed:master-${{ matrix.database }}

      - name: Docker build and push master - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        if: ${{ github.ref_name == 'master' }}
        with:
          context: .
@@ -226,7 +226,7 @@ jobs:
          fetch-depth: 0

      - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: commafeed-*
          path: ./artifacts
@@ -280,5 +280,5 @@ jobs:
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
-      - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
        id: deployment
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -1,3 +1,3 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.10.0/apache-maven-3.10.0-bin.zip
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog

+## [7.4.1]
+
+- Fix entries being marked as read when scrolling back to an entry that was explicitly marked as unread (#2337)
+- Add a global failsafe timeout to the new HTTP/2 client to prevent it from hanging indefinitely
+- Add OCI source label to container images (#2335)
+
+## [7.4.0]
+
+- Add support for HTTP/2 when fetching feeds (#2317)
+- Send more default headers when fetching feeds, to avoid being rejected by some servers (#2315)
+- Harden the content cleaning of feed entries by only allowing `http`/`https` protocols in `iframe` `src` attributes
+- Fix the header in mobile mode being wrapped/cut off when too wide, even above the mobile breakpoint (#2080)
+- Document how to configure Quarkus host validation when running CommaFeed behind a reverse proxy
+
 ## [7.3.2]

 - Prevent users from starring/tagging entries that are not theirs and subsequently reading them (GHSA-prfv-88mm-5gpg)
--- a/README.md
+++ b/README.md
@@ -167,6 +167,20 @@ CommaFeed blocks access to local resources by default to prevent [SSRF](https://
 If you want to subscribe to feeds that are only available on your local network, you can disable this security measure by setting the `commafeed.http-client.block-local-addresses` variable to `false`.
 Do this only if you trust all users of your CommaFeed instance not to access private resources.

+### Listen on a single network interface
+
+By default, CommaFeed listens on all interfaces. You can restrict it by setting `quarkus.http.host`.
+
+Note that if you set it to a local name like `127.0.0.1` host validation is enabled automatically. This prevents
+access if you're using a reverse proxy like Nginx. To fix, add your actual hostname to `allowed-hosts`:
+
+```
+quarkus.http.host=127.0.0.1
+quarkus.http.proxy.proxy-address-forwarding=true
+quarkus.http.proxy.allow-forwarded=true
+quarkus.http.host-validation.allowed-hosts=commafeed.example.com
+```
+
 ## Translation

 Files for internationalization are
--- a/commafeed-client/.npmrc
+++ b/commafeed-client/.npmrc
@@ -0,0 +1 @@
+loglevel=warn
--- a/commafeed-client/biome.json
+++ b/commafeed-client/biome.json
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
    "formatter": {
        "indentStyle": "space",
        "indentWidth": 4,
--- a/commafeed-client/package-lock.json
+++ b/commafeed-client/package-lock.json
--- a/commafeed-client/package.json
+++ b/commafeed-client/package.json
@@ -17,35 +17,35 @@
    "dependencies": {
        "@emotion/react": "11.14.0",
        "@fontsource/open-sans": "5.3.0",
-        "@lingui/core": "6.6.0",
-        "@lingui/react": "6.6.0",
-        "@mantine/core": "9.5.1",
-        "@mantine/dates": "9.5.1",
-        "@mantine/form": "9.5.1",
-        "@mantine/hooks": "9.5.1",
-        "@mantine/modals": "9.5.1",
-        "@mantine/notifications": "9.5.1",
-        "@mantine/spotlight": "9.5.1",
+        "@lingui/core": "6.10.0",
+        "@lingui/react": "6.10.0",
+        "@mantine/core": "9.7.3",
+        "@mantine/dates": "9.7.3",
+        "@mantine/form": "9.7.3",
+        "@mantine/hooks": "9.7.3",
+        "@mantine/modals": "9.7.3",
+        "@mantine/notifications": "9.7.3",
+        "@mantine/spotlight": "9.7.3",
        "@monaco-editor/react": "4.7.0",
-        "@react-querybuilder/mantine": "8.23.0",
-        "@reduxjs/toolkit": "2.12.0",
-        "@rolldown/plugin-babel": "0.2.3",
-        "axios": "1.19.0",
+        "@react-querybuilder/mantine": "8.25.0",
+        "@reduxjs/toolkit": "2.13.0",
+        "@rolldown/plugin-babel": "0.2.4",
+        "axios": "1.20.0",
        "dayjs": "1.11.23",
        "escape-string-regexp": "5.0.0",
        "interweave": "13.1.1",
-        "monaco-editor": "0.56.0",
+        "monaco-editor": "0.57.0",
        "mousetrap": "1.6.5",
-        "react": "19.2.8",
+        "react": "19.3.1",
        "react-async-hook": "4.0.0",
        "react-contexify": "6.0.0",
-        "react-dom": "19.2.8",
-        "react-draggable": "4.7.1",
+        "react-dom": "19.3.1",
+        "react-draggable": "4.7.2",
        "react-icons": "5.7.0",
        "react-infinite-scroller": "1.2.6",
-        "react-querybuilder": "8.23.0",
+        "react-querybuilder": "8.25.0",
        "react-redux": "9.3.0",
-        "react-router-dom": "7.18.2",
+        "react-router-dom": "7.18.4",
        "react-swipeable": "7.0.2",
        "style-to-object": "2.0.2",
        "throttle-debounce": "5.0.2",
@@ -54,32 +54,31 @@
        "websocket-heartbeat-js": "1.1.3"
    },
    "devDependencies": {
-        "@babel/types": "^8.0.4",
-        "@biomejs/biome": "2.5.9",
-        "@lingui/babel-plugin-lingui-macro": "6.6.0",
-        "@lingui/cli": "6.6.0",
-        "@lingui/vite-plugin": "6.6.0",
+        "@babel/types": "^8.0.6",
+        "@biomejs/biome": "2.5.15",
+        "@lingui/cli": "6.10.0",
+        "@lingui/vite-plugin": "6.10.0",
        "@testing-library/jest-dom": "7.0.1",
-        "@testing-library/react": "16.3.2",
-        "@testing-library/user-event": "14.6.5",
+        "@testing-library/react": "16.3.3",
+        "@testing-library/user-event": "14.6.8",
        "@types/mousetrap": "1.6.15",
-        "@types/react": "19.2.18",
-        "@types/react-dom": "19.2.4",
+        "@types/react": "19.3.0",
+        "@types/react-dom": "19.3.0",
        "@types/react-infinite-scroller": "1.2.5",
        "@types/throttle-debounce": "5.0.2",
        "@types/tinycon": "0.6.7",
-        "@vitejs/plugin-react": "6.0.5",
-        "babel-plugin-react-compiler": "1.0.0",
-        "jsdom": "30.0.1",
+        "@vitejs/plugin-react": "6.1.2",
+        "babel-plugin-react-compiler": "^1.0.0",
+        "jsdom": "30.1.3",
        "typescript": "7.0.2",
-        "vite": "8.2.1",
+        "vite": "8.3.4",
        "vite-plugin-checker": "0.14.5",
-        "vitest": "4.1.11",
-        "yaml": "2.9.0"
+        "vitest": "5.0.5",
+        "yaml": "2.9.1"
    },
    "overrides": {
        "react-infinite-scroller": {
-            "react": "19.2.8"
+            "react": "19.3.1"
        }
    }
 }
--- a/commafeed-client/pom.xml
+++ b/commafeed-client/pom.xml
@@ -6,16 +6,16 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.3.2</version>
+		<version>7.4.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>

 	<properties>
 		<!-- renovate: datasource=node-version depName=node -->
-		<node.version>v24.19.0</node.version>
+		<node.version>v24.22.1</node.version>
 		<!-- renovate: datasource=npm depName=npm -->
-		<npm.version>12.0.2</npm.version>
+		<npm.version>12.2.1</npm.version>
 	</properties>

 	<build>
@@ -110,7 +110,7 @@
 					<plugin>
 						<groupId>org.codehaus.mojo</groupId>
 						<artifactId>exec-maven-plugin</artifactId>
-						<version>3.6.3</version>
+						<version>3.6.4</version>
 						<executions>
 							<execution>
 								<id>kill-biome</id>
--- a/commafeed-client/src/app/entries/entries.test.ts
+++ b/commafeed-client/src/app/entries/entries.test.ts
@@ -116,6 +116,30 @@ describe("entries", () => {
        expect(client.entry.mark).toHaveBeenCalledWith({ id: "3", read: true })
    })

+    it("flags an entry marked as unread by the user until entries are reloaded", async () => {
+        vi.mocked(client.feed.getEntries).mockResolvedValue({
+            data: {
+                entries: [{ id: "3", read: true, markable: true } as Entry],
+                hasMore: false,
+                name: "my-feed",
+                errorCount: 0,
+                feedLink: "https://mysite.com/feed",
+                timestamp: 123,
+                ignoredReadStatus: false,
+            },
+        } as AxiosResponse<Entries>)
+
+        const store = configureStore({ reducer: reducers })
+        await store.dispatch(loadEntries({ source: { type: "feed", id: "feed-id" }, clearSearch: true }))
+
+        store.dispatch(markEntry({ entry: store.getState().entries.entries[0], read: false }))
+        expect(store.getState().entries.entries[0].keepUnread).toBe(true)
+
+        // reloading the entry list resets the flag
+        await store.dispatch(loadEntries({ source: { type: "feed", id: "feed-id" }, clearSearch: false }))
+        expect(store.getState().entries.entries[0].keepUnread).toBeUndefined()
+    })
+
    it("marks all entries as read", () => {
        const store = configureStore({
            reducer: reducers,
--- a/commafeed-client/src/app/entries/slice.ts
+++ b/commafeed-client/src/app/entries/slice.ts
@@ -10,7 +10,11 @@ export interface EntrySource {
    id: string
 }

-export type ExpendableEntry = Entry & { expanded?: boolean }
+export type ExpendableEntry = Entry & {
+    expanded?: boolean
+    /** set when the user explicitly marks the entry as unread, prevents it from being marked as read again by scrolling in expanded mode until the entry list is reloaded */
+    keepUnread?: boolean
+}

 interface EntriesState {
    /** selected source */
@@ -71,11 +75,13 @@ export const entriesSlice = createSlice({
        builder.addCase(markEntry.pending, (state, action) => {
            for (const e of state.entries.filter(e => e.id === action.meta.arg.entry.id)) {
                e.read = action.meta.arg.read
+                if (!action.meta.arg.read) e.keepUnread = true
            }
        })
        builder.addCase(markMultipleEntries.pending, (state, action) => {
            for (const e of state.entries.filter(e => action.meta.arg.entries.some(e2 => e2.id === e.id))) {
                e.read = action.meta.arg.read
+                if (!action.meta.arg.read) e.keepUnread = true
            }
        })
        builder.addCase(markAllEntries.pending, (state, action) => {
--- a/commafeed-client/src/components/ActionButton.tsx
+++ b/commafeed-client/src/components/ActionButton.tsx
@@ -5,14 +5,15 @@ import { forwardRef, type MouseEventHandler, type ReactNode } from "react"
 import { Constants } from "@/app/constants"
 import { useActionButton } from "@/hooks/useActionButton"

+export type Mode = "auto" | "mobile" | "desktop"
+
 interface ActionButtonProps {
    icon: ReactNode
    className?: string
    label?: string | MessageDescriptor
    onClick?: MouseEventHandler
    variant?: ActionIconVariant & ButtonVariant
-    hideLabelOnDesktop?: boolean
-    showLabelOnMobile?: boolean
+    mode?: Mode
 }

 /**
@@ -25,7 +26,9 @@ export const ActionButton = forwardRef<HTMLDivElement, ActionButtonProps>((props

    const label = typeof props.label === "string" ? props.label : props.label && _(props.label)
    const variant = props.variant ?? "subtle"
-    const iconOnly = (mobile && !props.showLabelOnMobile) || (!mobile && props.hideLabelOnDesktop)
+
+    const mode: Mode = props.mode ?? "auto"
+    const iconOnly = mode === "mobile" || (mode === "auto" && mobile)

    return (
        <Box ref={ref} className="cf-action-button">
--- a/commafeed-client/src/components/content/FeedEntries.tsx
+++ b/commafeed-client/src/components/content/FeedEntries.tsx
@@ -111,12 +111,13 @@ export function FeedEntries() {
                    const el = document.getElementById(Constants.dom.entryId(e))
                    return el && !Constants.layout.isTopVisible(el)
                })
-            if (currentEntry) {
+            if (currentEntry && currentEntry.id !== selectedEntryId) {
                dispatch(
                    selectEntry({
                        entry: currentEntry,
                        expand: false,
-                        markAsRead: !!scrollMarks,
+                        // don't mark as read entries that the user explicitly marked as unread
+                        markAsRead: !!scrollMarks && !currentEntry.keepUnread,
                        scrollToEntry: false,
                    })
                )
@@ -124,7 +125,7 @@ export function FeedEntries() {
        })
        window.addEventListener("scroll", listener)
        return () => window.removeEventListener("scroll", listener)
-    }, [dispatch, entries, viewMode, scrollMarks, scrollingToEntry])
+    }, [dispatch, entries, viewMode, scrollMarks, scrollingToEntry, selectedEntryId])

    useMousetrap("r", async () => await dispatch(reloadEntries()))
    useMousetrap(
--- a/commafeed-client/src/components/header/Header.tsx
+++ b/commafeed-client/src/components/header/Header.tsx
@@ -2,7 +2,7 @@ import { msg } from "@lingui/core/macro"
 import { useLingui } from "@lingui/react"
 import { Box, Center, CloseButton, Divider, Group, Indicator, Popover, TextInput } from "@mantine/core"
 import { useForm } from "@mantine/form"
-import { useEffect } from "react"
+import { type ReactNode, useEffect } from "react"
 import {
    TbArrowDown,
    TbArrowUp,
@@ -31,7 +31,7 @@ function HeaderDivider() {
    return <Divider orientation="vertical" />
 }

-function HeaderToolbar(props: { children: React.ReactNode }) {
+function HeaderToolbar(props: { children: ReactNode }) {
    const { spacing } = useActionButton()
    const mobile = useMobile("480px")
    return mobile ? (
@@ -47,7 +47,7 @@ function HeaderToolbar(props: { children: React.ReactNode }) {
            {props.children}
        </Box>
    ) : (
-        <Group gap={spacing} className="cf-toolbar">
+        <Group gap={spacing} wrap="nowrap" className="cf-toolbar">
            {props.children}
        </Group>
    )
--- a/commafeed-client/src/pages/WelcomePage.tsx
+++ b/commafeed-client/src/pages/WelcomePage.tsx
@@ -42,7 +42,7 @@ export function WelcomePage() {
                        icon={<TbClock size={iconSize} />}
                        variant="outline"
                        onClick={async () => await login.execute({ name: "demo", password: "demo" })}
-                        showLabelOnMobile
+                        mode="desktop"
                    />
                </Center>
            )}
@@ -100,7 +100,7 @@ function Buttons() {
                icon={<TbKey size={iconSize} />}
                variant="outline"
                onClick={async () => await dispatch(redirectToLogin())}
-                showLabelOnMobile
+                mode="desktop"
            />
            {serverInfos?.allowRegistrations && (
                <ActionButton
@@ -108,7 +108,7 @@ function Buttons() {
                    icon={<TbUserPlus size={iconSize} />}
                    variant="filled"
                    onClick={async () => await dispatch(redirectToRegistration())}
-                    showLabelOnMobile
+                    mode="desktop"
                />
            )}

@@ -116,7 +116,7 @@ function Buttons() {
                label={dark ? msg`Switch to light theme` : msg`Switch to dark theme`}
                icon={colorScheme === "dark" ? <TbSun size={18} /> : <TbMoon size={iconSize} />}
                onClick={() => toggleColorScheme()}
-                hideLabelOnDesktop
+                mode="mobile"
            />

            {isBrowserExtensionPopup && (
@@ -124,7 +124,7 @@ function Buttons() {
                    label={msg`Extension options`}
                    icon={<TbSettings size={iconSize} />}
                    onClick={() => openSettingsPage()}
-                    hideLabelOnDesktop
+                    mode="mobile"
                />
            )}
        </Group>
--- a/commafeed-client/src/pages/app/Layout.tsx
+++ b/commafeed-client/src/pages/app/Layout.tsx
@@ -227,7 +227,7 @@ export default function Layout(props: Readonly<LayoutProps>) {
                )}
            </OnMobile>
            <OnDesktop>
-                <Group p="md">
+                <Group p="md" wrap="nowrap">
                    <Group justify="space-between" style={{ width: sidebarWidth - 16 }}>
                        <Box>
                            <LogoAndTitle />
--- a/commafeed-client/src/setupTests.ts
+++ b/commafeed-client/src/setupTests.ts
@@ -1,4 +1,4 @@
-import "@testing-library/jest-dom"
+import "@testing-library/jest-dom/vitest"
 import { vi } from "vitest"
 import { Constants } from "@/app/constants"

--- a/commafeed-client/vite.config.ts
+++ b/commafeed-client/vite.config.ts
@@ -7,11 +7,8 @@ import checker from "vite-plugin-checker"
 export default defineConfig(() => ({
    plugins: [
        react(),
-        babel({
-            presets: [reactCompilerPreset()],
-            plugins: ["@lingui/babel-plugin-lingui-macro"],
-        }),
-        lingui(),
+        lingui({ macroTransform: true }),
+        babel({ presets: [reactCompilerPreset()] }),
        checker({
            // temporary disabled until TypeScript 7 exposes a stable api
            // typescript: true,
@@ -44,6 +41,7 @@ export default defineConfig(() => ({
        inconsistentCjsInterop: true,
    },
    test: {
+        isolate: false,
        environment: "jsdom",
        globals: true,
        setupFiles: "./src/setupTests.ts",
@@ -51,6 +49,9 @@ export default defineConfig(() => ({
    build: {
        chunkSizeWarningLimit: 4000,
        rolldownOptions: {
+            checks: {
+                pluginTimings: false,
+            },
            output: {
                codeSplitting: {
                    groups: [
--- a/commafeed-server/pom.xml
+++ b/commafeed-server/pom.xml
@@ -6,15 +6,15 @@
    <parent>
        <groupId>com.commafeed</groupId>
        <artifactId>commafeed</artifactId>
-        <version>7.3.2</version>
+        <version>7.4.1</version>
    </parent>
    <artifactId>commafeed-server</artifactId>
    <name>CommaFeed Server</name>
    <packaging>quarkus</packaging>

    <properties>
-        <quarkus.version>3.38.3</quarkus.version>
-        <querydsl.version>7.6</querydsl.version>
+        <quarkus.version>3.40.1.1</quarkus.version>
+        <querydsl.version>7.7</querydsl.version>
        <rome.version>2.1.0</rome.version>
        <!-- renovate: depName=com.google.googlejavaformat:google-java-format -->
        <google-java-format.version>1.36.1</google-java-format.version>
@@ -35,7 +35,7 @@
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
-                <version>4.36.0</version>
+                <version>4.36.2</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
@@ -64,7 +64,7 @@
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>properties-maven-plugin</artifactId>
-                <version>1.3.0</version>
+                <version>1.3.1</version>
                <executions>
                    <execution>
                        <goals>
@@ -116,7 +116,7 @@
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
-                <version>3.6.3</version>
+                <version>3.6.4</version>
                <dependencies>
                    <dependency>
                        <groupId>io.quarkus</groupId>
@@ -164,7 +164,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.5.6</version>
+                <version>3.6.0</version>
                <configuration>
                    <argLine>@{argLine}</argLine>
                    <systemPropertyVariables>
@@ -176,7 +176,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
-                <version>3.5.6</version>
+                <version>3.6.0</version>
                <executions>
                    <execution>
                        <goals>
@@ -221,7 +221,7 @@
            <plugin>
                <groupId>io.github.git-commit-id</groupId>
                <artifactId>git-commit-id-maven-plugin</artifactId>
-                <version>10.0.0</version>
+                <version>10.0.1</version>
                <executions>
                    <execution>
                        <goals>
@@ -245,7 +245,7 @@
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
-                        <version>14.0.0</version>
+                        <version>14.3.0</version>
                    </dependency>
                </dependencies>
                <executions>
@@ -274,7 +274,7 @@
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.10.0</version>
+                <version>3.10.4</version>
                <?m2e ignore?>
                <executions>
                    <execution>
@@ -302,14 +302,14 @@
        <dependency>
            <groupId>com.commafeed</groupId>
            <artifactId>commafeed-client</artifactId>
-            <version>7.3.2</version>
+            <version>7.4.1</version>
        </dependency>

        <!-- compile-time processors -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
-            <version>1.18.46</version>
+            <version>1.18.48</version>
        </dependency>
        <dependency>
            <groupId>org.kohsuke.metainf-services</groupId>
@@ -322,6 +322,11 @@
            <artifactId>quarkus-extension-processor</artifactId>
            <scope>provided</scope>
        </dependency>
+        <dependency>
+            <groupId>org.graalvm.sdk</groupId>
+            <artifactId>nativeimage</artifactId>
+            <scope>provided</scope>
+        </dependency>

        <!-- quarkus dependencies -->
        <dependency>
@@ -368,7 +373,7 @@
        <dependency>
            <groupId>io.dropwizard.metrics</groupId>
            <artifactId>metrics-json</artifactId>
-            <version>4.2.39</version>
+            <version>4.2.40</version>
        </dependency>
        <dependency>
            <groupId>io.github.openfeign.querydsl</groupId>
@@ -429,12 +434,12 @@
        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
-            <version>1.23.1</version>
+            <version>1.23.2</version>
        </dependency>
        <dependency>
            <groupId>com.ibm.icu</groupId>
            <artifactId>icu4j</artifactId>
-            <version>78.3</version>
+            <version>79.1</version>
        </dependency>
        <dependency>
            <groupId>net.sourceforge.cssparser</groupId>
@@ -449,17 +454,12 @@
        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
-            <version>5.6.4</version>
+            <version>5.6.5</version>
        </dependency>
        <dependency>
            <groupId>io.github.hakky54</groupId>
            <artifactId>ayza-for-apache5</artifactId>
-            <version>10.0.6</version>
-        </dependency>
-        <dependency>
-            <groupId>org.brotli</groupId>
-            <artifactId>dec</artifactId>
-            <version>0.1.2</version>
+            <version>10.1.0</version>
        </dependency>
        <dependency>
            <groupId>com.github.seancfoley</groupId>
@@ -476,13 +476,13 @@
        <dependency>
            <groupId>io.quarkiverse.playwright</groupId>
            <artifactId>quarkus-playwright</artifactId>
-            <version>2.3.8</version>
+            <version>2.3.10</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mock-server</groupId>
-            <artifactId>mockserver-junit-jupiter</artifactId>
-            <version>7.6.0</version>
+            <artifactId>mockserver-junit-jupiter-no-dependencies</artifactId>
+            <version>9.1.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
--- a/commafeed-server/src/main/docker/Dockerfile.jvm
+++ b/commafeed-server/src/main/docker/Dockerfile.jvm
@@ -1,4 +1,6 @@
-FROM ibm-semeru-runtimes:open-jdk-25.0.4.0-jre@sha256:524f0d04723aff42ed4142ab2621fa55f22cb691763cd75b59eee86749e2e872
+FROM ibm-semeru-runtimes:open-jdk-25.0.4.15-jre@sha256:630c738228597b4cd31d9823e479384729b03684bac23478b33fdbda13ae31b8
+LABEL org.opencontainers.image.source="https://github.com/Athou/commafeed"
+
 EXPOSE 8082

 RUN mkdir -p /commafeed/data
--- a/commafeed-server/src/main/docker/Dockerfile.native
+++ b/commafeed-server/src/main/docker/Dockerfile.native
@@ -1,4 +1,6 @@
-FROM debian:13.6@sha256:34cd9e9fd437c0a095ec39cb2e73422c9f30821b0d0848ed74fd0d43bae4d958
+FROM debian:13.7@sha256:4c25275446ca371766b8b093c696782eabce06263fccacb8d5d813b3dc44b308
+LABEL org.opencontainers.image.source="https://github.com/Athou/commafeed"
+
 ARG TARGETARCH

 EXPOSE 8082
--- a/commafeed-server/src/main/java/com/commafeed/NativeImageClasses.java
+++ b/commafeed-server/src/main/java/com/commafeed/NativeImageClasses.java
@@ -6,6 +6,8 @@ import com.codahale.metrics.Histogram;
 import com.codahale.metrics.Meter;
 import com.codahale.metrics.MetricRegistry;
 import com.codahale.metrics.Timer;
+import com.oracle.svm.core.annotate.Substitute;
+import com.oracle.svm.core.annotate.TargetClass;

 import io.quarkus.runtime.annotations.RegisterForReflection;

@@ -346,4 +348,22 @@ import io.quarkus.runtime.annotations.RegisterForReflection;
            com.rometools.opml.feed.synd.impl.ConverterForOPML10.class,
            com.rometools.opml.feed.synd.impl.ConverterForOPML20.class,
        })
-public class NativeImageClasses {}
+public class NativeImageClasses {
+
+    // disable zstd and brotli runtime detection because it causes native image failure
+    @TargetClass(className = "org.apache.hc.client5.http.impl.ZstdRuntime")
+    static final class ZstdRuntime {
+        @Substitute
+        public static boolean available() {
+            return false;
+        }
+    }
+
+    @TargetClass(className = "org.apache.hc.client5.http.impl.Brotli4jRuntime")
+    static final class Brotli4jRuntime {
+        @Substitute
+        public static boolean available() {
+            return false;
+        }
+    }
+}
--- a/commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java
@@ -19,27 +19,27 @@ import nl.altindag.ssl.apache5.util.Apache5SslUtils;

 import org.apache.hc.client5.http.DnsResolver;
 import org.apache.hc.client5.http.SystemDefaultDnsResolver;
+import org.apache.hc.client5.http.async.methods.InflatingAsyncDataConsumer;
+import org.apache.hc.client5.http.async.methods.InflatingGzipDataConsumer;
 import org.apache.hc.client5.http.config.ConnectionConfig;
 import org.apache.hc.client5.http.config.TlsConfig;
-import org.apache.hc.client5.http.entity.DeflateInputStream;
-import org.apache.hc.client5.http.entity.InputStreamFactory;
 import org.apache.hc.client5.http.entity.compress.ContentCoding;
 import org.apache.hc.client5.http.impl.DefaultRedirectStrategy;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
-import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
-import org.apache.hc.client5.http.io.HttpClientConnectionManager;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
+import org.apache.hc.client5.http.impl.async.HttpAsyncClients;
+import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManager;
+import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
 import org.apache.hc.client5.http.protocol.RedirectStrategy;
 import org.apache.hc.core5.http.Header;
 import org.apache.hc.core5.http.HttpException;
 import org.apache.hc.core5.http.HttpRequest;
 import org.apache.hc.core5.http.HttpResponse;
 import org.apache.hc.core5.http.message.BasicHeader;
+import org.apache.hc.core5.http.nio.AsyncDataConsumer;
 import org.apache.hc.core5.http.protocol.HttpContext;
+import org.apache.hc.core5.http2.HttpVersionPolicy;
 import org.apache.hc.core5.util.TimeValue;
 import org.apache.hc.core5.util.Timeout;
-import org.brotli.dec.BrotliInputStream;

 import java.net.InetAddress;
 import java.net.URI;
@@ -48,7 +48,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.SequencedMap;
-import java.util.zip.GZIPInputStream;
+import java.util.function.UnaryOperator;

@Singleton
@RequiredArgsConstructor
@@ -60,8 +60,8 @@ public class HttpClientFactory {
    private final CommaFeedConfiguration config;
    private final CommaFeedVersion version;

-    public CloseableHttpClient newClient(int poolSize) {
-        PoolingHttpClientConnectionManager connectionManager =
+    public CloseableHttpAsyncClient newClient(int poolSize) {
+        PoolingAsyncClientConnectionManager connectionManager =
                newConnectionManager(config, poolSize);
        String userAgent =
                config.httpClient()
@@ -74,42 +74,48 @@ public class HttpClientFactory {
        return newClient(config, connectionManager, userAgent);
    }

-    private CloseableHttpClient newClient(
+    private CloseableHttpAsyncClient newClient(
            CommaFeedConfiguration config,
-            HttpClientConnectionManager connectionManager,
+            PoolingAsyncClientConnectionManager connectionManager,
            String userAgent) {
        List<Header> headers = new ArrayList<>();
        headers.add(new BasicHeader(HttpHeaders.ACCEPT_LANGUAGE, "en"));
        headers.add(new BasicHeader(HttpHeaders.PRAGMA, "No-cache"));
        headers.add(new BasicHeader(HttpHeaders.CACHE_CONTROL, "no-cache"));
+        headers.add(new BasicHeader(HttpHeaders.ACCEPT, "*/*"));
+        headers.add(new BasicHeader(HttpHeaders.SEC_FETCH_MODE, "navigate"));

-        SequencedMap<String, InputStreamFactory> contentDecoderMap = new LinkedHashMap<>();
-        contentDecoderMap.put(ContentCoding.GZIP.token(), GZIPInputStream::new);
-        contentDecoderMap.put(ContentCoding.DEFLATE.token(), DeflateInputStream::new);
-        contentDecoderMap.put(ContentCoding.BROTLI.token(), BrotliInputStream::new);
+        SequencedMap<String, UnaryOperator<AsyncDataConsumer>> contentDecoderMap =
+                new LinkedHashMap<>();
+        contentDecoderMap.put(
+                ContentCoding.DEFLATE.token(), d -> new InflatingAsyncDataConsumer(d, null));
+        contentDecoderMap.put(ContentCoding.GZIP.token(), InflatingGzipDataConsumer::new);

        RedirectStrategy redirectStrategy =
                config.httpClient().blockLocalAddresses()
                        ? new BlockLocalAddressesRedirectStrategy(DNS_RESOLVER)
                        : new DefaultRedirectStrategy();

-        return HttpClientBuilder.create()
-                .disableConnectionState()
-                .useSystemProperties()
-                .disableAutomaticRetries()
-                .disableCookieManagement()
-                .setUserAgent(userAgent)
-                .setDefaultHeaders(headers)
-                .setConnectionManager(connectionManager)
-                .evictExpiredConnections()
-                .evictIdleConnections(
-                        TimeValue.of(config.httpClient().idleConnectionsEvictionInterval()))
-                .setContentDecoderRegistry(new LinkedHashMap<>(contentDecoderMap))
-                .setRedirectStrategy(redirectStrategy)
-                .build();
+        CloseableHttpAsyncClient client =
+                HttpAsyncClients.custom()
+                        .disableConnectionState()
+                        .useSystemProperties()
+                        .disableAutomaticRetries()
+                        .disableCookieManagement()
+                        .setUserAgent(userAgent)
+                        .setDefaultHeaders(headers)
+                        .setConnectionManager(connectionManager)
+                        .evictExpiredConnections()
+                        .evictIdleConnections(
+                                TimeValue.of(config.httpClient().idleConnectionsEvictionInterval()))
+                        .setContentDecoderMap(new LinkedHashMap<>(contentDecoderMap))
+                        .setRedirectStrategy(redirectStrategy)
+                        .build();
+        client.start();
+        return client;
    }

-    private PoolingHttpClientConnectionManager newConnectionManager(
+    private PoolingAsyncClientConnectionManager newConnectionManager(
            CommaFeedConfiguration config, int poolSize) {
        SSLFactory sslFactory =
                SSLFactory.builder().withUnsafeTrustMaterial().withUnsafeHostnameVerifier().build();
@@ -118,8 +124,8 @@ public class HttpClientFactory {
                        ? new BlockLocalAddressesDnsResolver(DNS_RESOLVER)
                        : DNS_RESOLVER;

-        return PoolingHttpClientConnectionManagerBuilder.create()
-                .setTlsSocketStrategy(Apache5SslUtils.toTlsSocketStrategy(sslFactory))
+        return PoolingAsyncClientConnectionManagerBuilder.create()
+                .setTlsStrategy(Apache5SslUtils.toTlsStrategy(sslFactory))
                .setDefaultConnectionConfig(
                        ConnectionConfig.custom()
                                .setConnectTimeout(Timeout.of(config.httpClient().connectTimeout()))
@@ -129,6 +135,7 @@ public class HttpClientFactory {
                                .build())
                .setDefaultTlsConfig(
                        TlsConfig.custom()
+                                .setVersionPolicy(HttpVersionPolicy.NEGOTIATE)
                                .setHandshakeTimeout(
                                        Timeout.of(config.httpClient().sslHandshakeTimeout()))
                                .build())
--- a/commafeed-server/src/main/java/com/commafeed/backend/HttpGetter.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/HttpGetter.java
@@ -6,7 +6,6 @@ import com.commafeed.CommaFeedConfiguration.HttpClientCache;
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.collect.Iterables;
-import com.google.common.io.ByteStreams;
 import com.google.common.net.HttpHeaders;

 import jakarta.inject.Singleton;
@@ -17,39 +16,53 @@ import lombok.EqualsAndHashCode;
 import lombok.Getter;
 import lombok.Lombok;
 import lombok.RequiredArgsConstructor;
+import lombok.experimental.Delegate;
 import lombok.extern.slf4j.Slf4j;

 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
+import org.apache.hc.client5.http.async.methods.SimpleRequestBuilder;
+import org.apache.hc.client5.http.async.methods.SimpleRequestProducer;
 import org.apache.hc.client5.http.config.RequestConfig;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.client5.http.protocol.RedirectLocations;
 import org.apache.hc.client5.http.utils.DateUtils;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.concurrent.FutureCallback;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.EntityDetails;
+import org.apache.hc.core5.http.HttpException;
 import org.apache.hc.core5.http.HttpStatus;
+import org.apache.hc.core5.http.Message;
 import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
-import org.apache.hc.core5.util.Timeout;
+import org.apache.hc.core5.http.nio.AsyncEntityConsumer;
+import org.apache.hc.core5.http.nio.AsyncRequestProducer;
+import org.apache.hc.core5.http.nio.AsyncResponseConsumer;
+import org.apache.hc.core5.http.nio.entity.AbstractBinAsyncEntityConsumer;
+import org.apache.hc.core5.http.nio.support.BasicResponseConsumer;
 import org.jboss.resteasy.reactive.common.headers.CacheControlDelegate;

+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.net.URI;
+import java.nio.ByteBuffer;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.InstantSource;
 import java.util.Optional;
 import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;

-/** Smart HTTP getter: handles gzip, ssl, last modified and etag headers */
+/** Smart HTTP getter: handles gzip, ssl, last modified, and etag headers */
@Singleton
@Slf4j
 public class HttpGetter {
    private final CommaFeedConfiguration config;
    private final InstantSource instantSource;
-    private final CloseableHttpClient client;
+    private final CloseableHttpAsyncClient client;
    private final Cache<HttpRequest, HttpResponse> cache;

    public HttpGetter(
@@ -150,70 +163,96 @@ public class HttpGetter {
        HttpClientContext context = HttpClientContext.create();
        context.setRequestConfig(
                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
                        // causes issues with some feeds
                        // see https://github.com/Athou/commafeed/issues/1572
                        // and https://issues.apache.org/jira/browse/HTTPCLIENT-2344
                        .setProtocolUpgradeEnabled(false)
                        .build());

-        return client.execute(
-                request.toClassicHttpRequest(),
-                context,
-                resp -> {
-                    byte[] content =
-                            resp.getEntity() == null
-                                    ? null
-                                    : toByteArray(
-                                            resp.getEntity(),
-                                            config.httpClient().maxResponseSize().asLongValue());
-                    int code = resp.getCode();
-                    String lastModifiedHeader =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.LAST_MODIFIED))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .orElse(null);
-                    String eTagHeader =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.ETAG))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .orElse(null);
+        long maxResponseSize = config.httpClient().maxResponseSize().asLongValue();
+        AsyncRequestProducer req = SimpleRequestProducer.create(request.toSimpleHttpRequest());
+        AsyncResponseConsumer<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> resp =
+                new BasicResponseConsumer<>(
+                        new LimitedContentLengthEntityConsumer(
+                                new LimitedBytesEntityConsumer(maxResponseSize), maxResponseSize));
+        FutureCallback<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> callback =
+                new FutureCallback<>() {
+                    @Override
+                    public void completed(
+                            Message<org.apache.hc.core5.http.HttpResponse, byte[]> result) {}

-                    CacheControl cacheControl =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.CACHE_CONTROL))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .map(HttpGetter::toCacheControl)
-                                    .orElse(null);
+                    @Override
+                    public void failed(Exception ex) {}

-                    Instant retryAfter =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.RETRY_AFTER))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .map(this::toInstant)
-                                    .orElse(null);
+                    @Override
+                    public void cancelled() {}
+                };
+        Future<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> future =
+                client.execute(req, resp, context, callback);

-                    String contentType =
-                            Optional.ofNullable(resp.getEntity())
-                                    .map(HttpEntity::getContentType)
-                                    .orElse(null);
-                    String urlAfterRedirect =
-                            Optional.ofNullable(context.getRedirectLocations())
-                                    .map(RedirectLocations::getAll)
-                                    .map(l -> Iterables.getLast(l, null))
-                                    .map(URI::toString)
-                                    .orElse(request.getUrl());
+        try {
+            Message<org.apache.hc.core5.http.HttpResponse, byte[]> message =
+                    future.get(config.httpClient().responseTimeout().toSeconds(), TimeUnit.SECONDS);

-                    return new HttpResponse(
-                            code,
-                            lastModifiedHeader,
-                            eTagHeader,
-                            cacheControl,
-                            retryAfter,
-                            content,
-                            contentType,
-                            urlAfterRedirect);
-                });
+            byte[] content = message.getBody();
+            int code = message.getHead().getCode();
+            String lastModifiedHeader =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.LAST_MODIFIED))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .orElse(null);
+            String eTagHeader =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.ETAG))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .orElse(null);
+
+            CacheControl cacheControl =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.CACHE_CONTROL))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .map(HttpGetter::toCacheControl)
+                            .orElse(null);
+
+            Instant retryAfter =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.RETRY_AFTER))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .map(this::toInstant)
+                            .orElse(null);
+
+            String contentType =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.CONTENT_TYPE))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .orElse(null);
+            String urlAfterRedirect =
+                    Optional.ofNullable(context.getRedirectLocations())
+                            .map(RedirectLocations::getAll)
+                            .map(l -> Iterables.getLast(l, null))
+                            .map(URI::toString)
+                            .orElse(request.getUrl());
+
+            return new HttpResponse(
+                    code,
+                    lastModifiedHeader,
+                    eTagHeader,
+                    cacheControl,
+                    retryAfter,
+                    content,
+                    contentType,
+                    urlAfterRedirect);
+        } catch (InterruptedException e) {
+            future.cancel(true);
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("interrupted while fetching " + request.getUrl(), e);
+        } catch (TimeoutException e) {
+            future.cancel(true);
+            throw new IOException("timed out while fetching " + request.getUrl(), e);
+        } catch (ExecutionException e) {
+            future.cancel(true);
+            throw Lombok.sneakyThrow(e.getCause());
+        }
    }

    private static CacheControl toCacheControl(String headerValue) {
@@ -237,28 +276,6 @@ public class HttpGetter {
        return DateUtils.parseStandardDate(headerValue);
    }

-    private static byte[] toByteArray(HttpEntity entity, long maxBytes) throws IOException {
-        if (entity.getContentLength() > maxBytes) {
-            throw new IOException(
-                    "Response size (%s bytes) exceeds the maximum allowed size (%s bytes)"
-                            .formatted(entity.getContentLength(), maxBytes));
-        }
-
-        try (InputStream input = entity.getContent()) {
-            if (input == null) {
-                return null;
-            }
-
-            byte[] bytes = ByteStreams.limit(input, maxBytes + 1).readAllBytes();
-            if (bytes.length > maxBytes) {
-                throw new IOException(
-                        "Response size exceeds the maximum allowed size (%s bytes)"
-                                .formatted(maxBytes));
-            }
-            return bytes;
-        }
-    }
-
    private static Cache<HttpRequest, HttpResponse> newCache(CommaFeedConfiguration config) {
        HttpClientCache cacheConfig = config.httpClient().cache();
        if (!cacheConfig.enabled()) {
@@ -274,6 +291,60 @@ public class HttpGetter {
                .build();
    }

+    private record LimitedContentLengthEntityConsumer(
+            @Delegate AsyncEntityConsumer<byte[]> delegate, long maxBytes)
+            implements AsyncEntityConsumer<byte[]> {
+
+        @Override
+        public void streamStart(EntityDetails entityDetails, FutureCallback<byte[]> resultCallback)
+                throws HttpException, IOException {
+            long contentLength = entityDetails.getContentLength();
+            if (contentLength > maxBytes) {
+                throw new IOException(
+                        "Response size (%s bytes) exceeds the maximum allowed size (%s bytes)"
+                                .formatted(contentLength, maxBytes));
+            }
+            delegate.streamStart(entityDetails, resultCallback);
+        }
+    }
+
+    @RequiredArgsConstructor
+    private static class LimitedBytesEntityConsumer extends AbstractBinAsyncEntityConsumer<byte[]> {
+
+        private final long maxBytes;
+        private final ByteArrayOutputStream out = new ByteArrayOutputStream();
+
+        @Override
+        protected void streamStart(ContentType contentType) {}
+
+        @Override
+        protected int capacityIncrement() {
+            return Integer.MAX_VALUE;
+        }
+
+        @Override
+        protected void data(ByteBuffer src, boolean endOfStream) throws IOException {
+            if (out.size() + src.remaining() > maxBytes) {
+                throw new IOException(
+                        "Response size exceeds the maximum allowed size (%s bytes)"
+                                .formatted(maxBytes));
+            }
+            byte[] chunk = new byte[src.remaining()];
+            src.get(chunk);
+            out.write(chunk, 0, chunk.length);
+        }
+
+        @Override
+        protected byte[] generateContent() {
+            return out.toByteArray();
+        }
+
+        @Override
+        public void releaseResources() {
+            out.reset();
+        }
+    }
+
    public static class SchemeNotAllowedException extends Exception {
        private static final long serialVersionUID = 1L;

@@ -336,15 +407,15 @@ public class HttpGetter {
            return new HttpRequestBuilder().url(url);
        }

-        public ClassicHttpRequest toClassicHttpRequest() {
-            ClassicHttpRequest req = ClassicRequestBuilder.get(url).build();
+        public SimpleHttpRequest toSimpleHttpRequest() {
+            SimpleRequestBuilder builder = SimpleRequestBuilder.get(url);
            if (lastModified != null) {
-                req.addHeader(HttpHeaders.IF_MODIFIED_SINCE, lastModified);
+                builder.addHeader(HttpHeaders.IF_MODIFIED_SINCE, lastModified);
            }
            if (eTag != null) {
-                req.addHeader(HttpHeaders.IF_NONE_MATCH, eTag);
+                builder.addHeader(HttpHeaders.IF_NONE_MATCH, eTag);
            }
-            return req;
+            return builder.build();
        }
    }

--- a/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java
@@ -148,6 +148,7 @@ public class FeedEntryContentCleaningService {

        whitelist.addProtocols("a", "href", "ftp", "http", "https", "magnet", "mailto");
        whitelist.addProtocols("blockquote", "cite", "http", "https");
+        whitelist.addProtocols("iframe", "src", "http", "https");
        whitelist.addProtocols("img", "src", "http", "https");
        whitelist.addProtocols("q", "cite", "http", "https");

--- a/commafeed-server/src/main/java/com/commafeed/backend/service/PushNotificationService.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/service/PushNotificationService.java
@@ -16,26 +16,33 @@ import jakarta.inject.Singleton;
 import lombok.extern.slf4j.Slf4j;

 import org.apache.commons.lang3.StringUtils;
-import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.config.RequestConfig;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
+import org.apache.hc.client5.http.async.methods.SimpleRequestBuilder;
+import org.apache.hc.client5.http.async.methods.SimpleRequestProducer;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
 import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpResponse;
+import org.apache.hc.core5.http.Message;
 import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.io.entity.StringEntity;
 import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.apache.hc.core5.util.Timeout;
+import org.apache.hc.core5.http.nio.entity.DiscardingEntityConsumer;
+import org.apache.hc.core5.http.nio.support.BasicResponseConsumer;
+import org.apache.hc.core5.net.WWWFormCodec;

 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;

@Singleton
@Slf4j
 public class PushNotificationService {

-    private final CloseableHttpClient httpClient;
+    private final CloseableHttpAsyncClient httpClient;
    private final Meter meter;
    private final CommaFeedConfiguration config;

@@ -97,13 +104,9 @@ public class PushNotificationService {
            return;
        }

-        HttpPost request = new HttpPost(serverUrl + "/" + topic);
-        request.setConfig(
-                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
-                        .build());
+        SimpleRequestBuilder request = SimpleRequestBuilder.post(serverUrl + "/" + topic);
        request.addHeader("Title", feedTitle);
-        request.setEntity(new StringEntity(entryTitle, StandardCharsets.UTF_8));
+        request.setBody(entryTitle, ContentType.TEXT_PLAIN.withCharset(StandardCharsets.UTF_8));

        if (StringUtils.isNotBlank(entryUrl)) {
            request.addHeader("Click", entryUrl);
@@ -113,15 +116,7 @@ public class PushNotificationService {
            request.addHeader("Authorization", "Bearer " + settings.getUserSecret());
        }

-        httpClient.execute(
-                request,
-                response -> {
-                    if (response.getCode() >= 400) {
-                        throw new PushNotificationException(
-                                "ntfy notification failed with status " + response.getCode());
-                    }
-                    return null;
-                });
+        send("ntfy", request.build());
    }

    private void sendGotify(
@@ -152,23 +147,11 @@ public class PushNotificationService {
                                            .put("click", new JsonObject().put("url", entryUrl))));
        }

-        HttpPost request = new HttpPost(serverUrl + "/message");
-        request.setConfig(
-                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
-                        .build());
+        SimpleRequestBuilder request = SimpleRequestBuilder.post(serverUrl + "/message");
        request.addHeader("X-Gotify-Key", token);
-        request.setEntity(new StringEntity(json.toString(), ContentType.APPLICATION_JSON));
+        request.setBody(json.toString(), ContentType.APPLICATION_JSON);

-        httpClient.execute(
-                request,
-                response -> {
-                    if (response.getCode() >= 400) {
-                        throw new PushNotificationException(
-                                "gotify notification failed with status " + response.getCode());
-                    }
-                    return null;
-                });
+        send("gotify", request.build());
    }

    private void sendPushover(
@@ -194,22 +177,40 @@ public class PushNotificationService {
            params.add(new BasicNameValuePair("url", entryUrl));
        }

-        HttpPost request = new HttpPost("https://api.pushover.net/1/messages.json");
-        request.setConfig(
-                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
-                        .build());
-        request.setEntity(new UrlEncodedFormEntity(params, StandardCharsets.UTF_8));
+        SimpleRequestBuilder request =
+                SimpleRequestBuilder.post("https://api.pushover.net/1/messages.json");
+        request.setBody(
+                WWWFormCodec.format(params, StandardCharsets.UTF_8),
+                ContentType.APPLICATION_FORM_URLENCODED.withCharset(StandardCharsets.UTF_8));

-        httpClient.execute(
-                request,
-                response -> {
-                    if (response.getCode() >= 400) {
-                        throw new PushNotificationException(
-                                "pushover notification failed with status " + response.getCode());
-                    }
-                    return null;
-                });
+        send("pushover", request.build());
+    }
+
+    private void send(String name, SimpleHttpRequest request) throws IOException {
+        Future<Message<HttpResponse, Object>> future =
+                httpClient.execute(
+                        SimpleRequestProducer.create(request),
+                        new BasicResponseConsumer<>(new DiscardingEntityConsumer<>()),
+                        null);
+        try {
+            HttpResponse response =
+                    future.get(config.httpClient().responseTimeout().toSeconds(), TimeUnit.SECONDS)
+                            .getHead();
+            if (response.getCode() >= 400) {
+                throw new PushNotificationException(
+                        name + " notification failed with status " + response.getCode());
+            }
+        } catch (InterruptedException e) {
+            future.cancel(true);
+            Thread.currentThread().interrupt();
+            throw new IOException("interrupted while sending " + name + " notification", e);
+        } catch (TimeoutException e) {
+            future.cancel(true);
+            throw new IOException("timed out while sending " + name + " notification", e);
+        } catch (ExecutionException e) {
+            future.cancel(true);
+            throw new IOException(e.getCause());
+        }
    }

    public static class PushNotificationException extends RuntimeException {
--- a/commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
+++ b/commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
@@ -11,6 +11,8 @@ import com.google.common.net.HttpHeaders;

 import io.quarkus.runtime.configuration.MemorySize;

+import lombok.extern.slf4j.Slf4j;
+
 import org.apache.commons.io.IOUtils;
 import org.apache.hc.client5.http.ConnectTimeoutException;
 import org.apache.hc.core5.http.HttpStatus;
@@ -29,12 +31,12 @@ import org.mockserver.model.Delay;
 import org.mockserver.model.HttpRequest;
 import org.mockserver.model.HttpResponse;
 import org.mockserver.model.MediaType;
+import org.mockserver.model.Protocol;

 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.net.NoRouteToHostException;
-import java.net.SocketTimeoutException;
 import java.net.UnknownHostException;
 import java.time.Duration;
 import java.time.Instant;
@@ -45,6 +47,7 @@ import java.util.concurrent.atomic.AtomicInteger;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.GZIPOutputStream;

+@Slf4j
 class HttpGetterTest {

    private static final Instant NOW = Instant.now();
@@ -237,7 +240,7 @@ class HttpGetterTest {
                .when(HttpRequest.request().withMethod("GET"))
                .respond(HttpResponse.response().withDelay(Delay.milliseconds(1000)));

-        Assertions.assertThrows(SocketTimeoutException.class, () -> getter.get(this.feedUrl));
+        Assertions.assertThrows(IOException.class, () -> getter.get(this.feedUrl));
    }

    @Test
@@ -416,7 +419,7 @@ class HttpGetterTest {
    @Nested
    class Compression {

-        private static final String ACCEPT_ENCODING = "gzip, deflate, br";
+        private static final String ACCEPT_ENCODING = "deflate, gzip";

        @Test
        void gzip() throws Exception {
@@ -437,24 +440,30 @@ class HttpGetterTest {
                    .when(HttpRequest.request().withMethod("GET"))
                    .respond(
                            req -> {
-                                String acceptEncodingHeader =
-                                        req.getFirstHeader(HttpHeaders.ACCEPT_ENCODING);
-                                if (!ACCEPT_ENCODING.equals(acceptEncodingHeader)) {
-                                    throw new Exception(
-                                            "Wrong value in the Accept-Encoding header, should be '%s' but was '%s'"
-                                                    .formatted(
-                                                            ACCEPT_ENCODING, acceptEncodingHeader));
-                                }
+                                try {
+                                    String acceptEncodingHeader =
+                                            req.getFirstHeader(HttpHeaders.ACCEPT_ENCODING);
+                                    if (!ACCEPT_ENCODING.equals(acceptEncodingHeader)) {
+                                        throw new Exception(
+                                                "Wrong value in the Accept-Encoding header, should be '%s' but was '%s'"
+                                                        .formatted(
+                                                                ACCEPT_ENCODING,
+                                                                acceptEncodingHeader));
+                                    }

-                                ByteArrayOutputStream output = new ByteArrayOutputStream();
-                                try (OutputStream compressionOutputStream =
-                                        compressionFunction.apply(output)) {
-                                    compressionOutputStream.write(body.getBytes());
-                                }
+                                    ByteArrayOutputStream output = new ByteArrayOutputStream();
+                                    try (OutputStream compressionOutputStream =
+                                            compressionFunction.apply(output)) {
+                                        compressionOutputStream.write(body.getBytes());
+                                    }

-                                return HttpResponse.response()
-                                        .withBody(output.toByteArray())
-                                        .withHeader(HttpHeaders.CONTENT_ENCODING, encoding);
+                                    return HttpResponse.response()
+                                            .withBody(output.toByteArray())
+                                            .withHeader(HttpHeaders.CONTENT_ENCODING, encoding);
+                                } catch (Exception e) {
+                                    log.error("Error in compression callback", e);
+                                    throw e;
+                                }
                            });

            HttpResult result = getter.get(HttpGetterTest.this.feedUrl);
@@ -590,4 +599,30 @@ class HttpGetterTest {
                    UnknownHostException.class, () -> getter.get("http://[::a00:1]")); // 10.0.0.1
        }
    }
+
+    @Nested
+    class Protocols {
+        @Test
+        void usesHttp2OverTls() throws Exception {
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_2))
+                    .respond(HttpResponse.response().withBody("h2"));
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_1_1))
+                    .respond(HttpResponse.response().withBody("h1"));
+
+            HttpResult result = getter.get("https://localhost:" + mockServerClient.getPort());
+            Assertions.assertEquals("h2", new String(result.content()));
+        }
+
+        @Test
+        void fallsBackToHttp1OverCleartext() throws Exception {
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_1_1))
+                    .respond(HttpResponse.response().withBody("h1"));
+
+            HttpResult result = getter.get("http://localhost:" + mockServerClient.getPort());
+            Assertions.assertEquals("h1", new String(result.content()));
+        }
+    }
 }
--- a/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java
+++ b/commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java
@@ -15,7 +15,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="alt-desc" decoding="async" sizes="(max-width: 965px) 100vw, 965px" style="width: 100%; opacity: 0">
-				<iframe src="url" style="width: 100%; opacity: 0"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width: 100%; opacity: 0"></iframe>
 				<forbidden-element>aaa</forbidden-element>
 				""";
        String result = feedEntryContentCleaningService.clean(content, "baseUri", false);
@@ -25,7 +25,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" alt="alt-desc" style="width:100%;">
-				<iframe src="url" style="width:100%;"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width:100%;"></iframe>
 				aaa
 				</p>
 				"""
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@

 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.3.2</version>
+	<version>7.4.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>

@@ -19,7 +19,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.15.0</version>
+				<version>3.16.0</version>
 				<configuration>
 					<parameters>true</parameters>