Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.6.1

Update dependency @biomejs/biome to v2.6.2

.github/workflows/ci.yml

@@ -29,14 +29,14 @@ jobs:
 
       # Setup
       - name: Set up GraalVM
-        uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4
+        uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: "graalvm"
           cache: "maven"
 
       - name: Set up NodeJS cache
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           cache: "npm"
           cache-dependency-path: 'commafeed-client/package-lock.json'
@@ -47,7 +47,7 @@ jobs:
 
       # Build & Test
       - name: Build with Maven
-        run: mvn --batch-mode --no-transfer-progress install -Pnative -P${{ matrix.database }} -DskipTests=${{ matrix.os == 'windows-latest' && matrix.database != 'h2' }}
+        run: mvn --batch-mode --no-transfer-progress install -Pnative -P${{ matrix.database }} -DskipITs=${{ matrix.os == 'windows-latest' && matrix.database != 'h2' }}
 
       # Build pages
       - name: Create pages directory structure
@@ -73,14 +73,14 @@ jobs:
 
       # Upload artifacts
       - name: Upload cross-platform app
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: matrix.os == 'ubuntu-latest' # we only need to upload the cross-platform artifact once per database
         with:
           name: commafeed-${{ matrix.database }}-jvm
           path: commafeed-server/target/commafeed-*.zip
 
       - name: Upload native executable
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: commafeed-${{ matrix.database }}-${{ runner.os }}-${{ runner.arch }}
           path: commafeed-server/target/commafeed-*-runner*
@@ -110,17 +110,17 @@ jobs:
 
       # Setup
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Install required packages
         run: sudo apt-get install -y rename unzip
 
       # Prepare artifacts
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: commafeed-${{ matrix.database }}-*
           path: ./artifacts
@@ -141,7 +141,7 @@ jobs:
 
       # Docker
       - name: Login to Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
 
       ## build but don't push for PRs and renovate
       - name: Docker build - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.native
@@ -157,7 +157,7 @@ jobs:
           platforms: linux/amd64,linux/arm64/v8
 
       - name: Docker build - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.jvm
@@ -166,7 +166,7 @@ jobs:
 
       ## build and push tag
       - name: Docker build and push tag - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         if: ${{ github.ref_type == 'tag' }}
         with:
           context: .
@@ -178,7 +178,7 @@ jobs:
             athou/commafeed:${{ github.ref_name }}-${{ matrix.database }}
 
       - name: Docker build and push tag - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         if: ${{ github.ref_type == 'tag' }}
         with:
           context: .
@@ -191,7 +191,7 @@ jobs:
 
       ## build and push master
       - name: Docker build and push master - native
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         if: ${{ github.ref_name == 'master' }}
         with:
           context: .
@@ -201,7 +201,7 @@ jobs:
           tags: athou/commafeed:master-${{ matrix.database }}
 
       - name: Docker build and push master - jvm
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         if: ${{ github.ref_name == 'master' }}
         with:
           context: .
@@ -226,7 +226,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: commafeed-*
           path: ./artifacts
@@ -280,5 +280,5 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
 
     steps:
-      - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
         id: deployment

.mvn/wrapper/maven-wrapper.properties

@@ -1,3 +1,3 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.10.0/apache-maven-3.10.0-bin.zip

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [7.4.1]
+
+- Fix entries being marked as read when scrolling back to an entry that was explicitly marked as unread (#2337)
+- Add a global failsafe timeout to the new HTTP/2 client to prevent it from hanging indefinitely
+- Add OCI source label to container images (#2335)
+
+## [7.4.0]
+
+- Add support for HTTP/2 when fetching feeds (#2317)
+- Send more default headers when fetching feeds, to avoid being rejected by some servers (#2315)
+- Harden the content cleaning of feed entries by only allowing `http`/`https` protocols in `iframe` `src` attributes
+- Fix the header in mobile mode being wrapped/cut off when too wide, even above the mobile breakpoint (#2080)
+- Document how to configure Quarkus host validation when running CommaFeed behind a reverse proxy
+
 ## [7.3.2]
 
 - Prevent users from starring/tagging entries that are not theirs and subsequently reading them (GHSA-prfv-88mm-5gpg)

README.md

@@ -167,6 +167,20 @@ CommaFeed blocks access to local resources by default to prevent [SSRF](https://
 If you want to subscribe to feeds that are only available on your local network, you can disable this security measure by setting the `commafeed.http-client.block-local-addresses` variable to `false`.
 Do this only if you trust all users of your CommaFeed instance not to access private resources.
 
+### Listen on a single network interface
+
+By default, CommaFeed listens on all interfaces. You can restrict it by setting `quarkus.http.host`.
+
+Note that if you set it to a local name like `127.0.0.1` host validation is enabled automatically. This prevents
+access if you're using a reverse proxy like Nginx. To fix, add your actual hostname to `allowed-hosts`:
+
+```
+quarkus.http.host=127.0.0.1
+quarkus.http.proxy.proxy-address-forwarding=true
+quarkus.http.proxy.allow-forwarded=true
+quarkus.http.host-validation.allowed-hosts=commafeed.example.com
+```
+
 ## Translation
 
 Files for internationalization are

commafeed-client/.npmrc

@@ -0,0 +1 @@
+loglevel=warn

commafeed-client/biome.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.6.2/schema.json",
     "formatter": {
         "indentStyle": "space",
         "indentWidth": 4,

commafeed-client/package.json

@@ -17,35 +17,35 @@
     "dependencies": {
         "@emotion/react": "11.14.0",
         "@fontsource/open-sans": "5.3.0",
-        "@lingui/core": "6.6.0",
+        "@lingui/core": "6.10.1",
-        "@lingui/react": "6.6.0",
+        "@lingui/react": "6.10.1",
-        "@mantine/core": "9.5.1",
+        "@mantine/core": "9.7.3",
-        "@mantine/dates": "9.5.1",
+        "@mantine/dates": "9.7.3",
-        "@mantine/form": "9.5.1",
+        "@mantine/form": "9.7.3",
-        "@mantine/hooks": "9.5.1",
+        "@mantine/hooks": "9.7.3",
-        "@mantine/modals": "9.5.1",
+        "@mantine/modals": "9.7.3",
-        "@mantine/notifications": "9.5.1",
+        "@mantine/notifications": "9.7.3",
-        "@mantine/spotlight": "9.5.1",
+        "@mantine/spotlight": "9.7.3",
         "@monaco-editor/react": "4.7.0",
-        "@react-querybuilder/mantine": "8.23.0",
+        "@react-querybuilder/mantine": "8.25.0",
-        "@reduxjs/toolkit": "2.12.0",
+        "@reduxjs/toolkit": "2.13.0",
-        "@rolldown/plugin-babel": "0.2.3",
+        "@rolldown/plugin-babel": "0.2.4",
-        "axios": "1.19.0",
+        "axios": "1.20.0",
         "dayjs": "1.11.23",
         "escape-string-regexp": "5.0.0",
         "interweave": "13.1.1",
-        "monaco-editor": "0.56.0",
+        "monaco-editor": "0.57.0",
         "mousetrap": "1.6.5",
-        "react": "19.2.8",
+        "react": "19.3.1",
         "react-async-hook": "4.0.0",
         "react-contexify": "6.0.0",
-        "react-dom": "19.2.8",
+        "react-dom": "19.3.1",
-        "react-draggable": "4.7.1",
+        "react-draggable": "4.7.2",
         "react-icons": "5.7.0",
         "react-infinite-scroller": "1.2.6",
-        "react-querybuilder": "8.23.0",
+        "react-querybuilder": "8.25.0",
         "react-redux": "9.3.0",
-        "react-router-dom": "7.18.2",
+        "react-router-dom": "7.18.4",
         "react-swipeable": "7.0.2",
         "style-to-object": "2.0.2",
         "throttle-debounce": "5.0.2",
@@ -54,32 +54,31 @@
         "websocket-heartbeat-js": "1.1.3"
     },
     "devDependencies": {
-        "@babel/types": "^8.0.4",
+        "@babel/types": "^8.0.6",
-        "@biomejs/biome": "2.5.9",
+        "@biomejs/biome": "2.6.2",
-        "@lingui/babel-plugin-lingui-macro": "6.6.0",
+        "@lingui/cli": "6.10.1",
-        "@lingui/cli": "6.6.0",
+        "@lingui/vite-plugin": "6.10.1",
-        "@lingui/vite-plugin": "6.6.0",
         "@testing-library/jest-dom": "7.0.1",
-        "@testing-library/react": "16.3.2",
+        "@testing-library/react": "16.3.3",
-        "@testing-library/user-event": "14.6.5",
+        "@testing-library/user-event": "14.6.8",
         "@types/mousetrap": "1.6.15",
-        "@types/react": "19.2.18",
+        "@types/react": "19.3.0",
-        "@types/react-dom": "19.2.4",
+        "@types/react-dom": "19.3.0",
         "@types/react-infinite-scroller": "1.2.5",
         "@types/throttle-debounce": "5.0.2",
         "@types/tinycon": "0.6.7",
-        "@vitejs/plugin-react": "6.0.5",
+        "@vitejs/plugin-react": "6.1.2",
-        "babel-plugin-react-compiler": "1.0.0",
+        "babel-plugin-react-compiler": "^1.0.0",
-        "jsdom": "30.0.1",
+        "jsdom": "30.1.3",
         "typescript": "7.0.2",
-        "vite": "8.2.1",
+        "vite": "8.3.5",
         "vite-plugin-checker": "0.14.5",
-        "vitest": "4.1.11",
+        "vitest": "5.0.5",
-        "yaml": "2.9.0"
+        "yaml": "2.9.1"
     },
     "overrides": {
         "react-infinite-scroller": {
-            "react": "19.2.8"
+            "react": "19.3.1"
         }
     }
 }

commafeed-client/pom.xml

@@ -6,16 +6,16 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.3.2</version>
+		<version>7.4.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>
 
 	<properties>
 		<!-- renovate: datasource=node-version depName=node -->
-		<node.version>v24.19.0</node.version>
+		<node.version>v24.22.1</node.version>
 		<!-- renovate: datasource=npm depName=npm -->
-		<npm.version>12.0.2</npm.version>
+		<npm.version>12.2.1</npm.version>
 	</properties>
 
 	<build>
@@ -110,7 +110,7 @@
 					<plugin>
 						<groupId>org.codehaus.mojo</groupId>
 						<artifactId>exec-maven-plugin</artifactId>
-						<version>3.6.3</version>
+						<version>3.6.4</version>
 						<executions>
 							<execution>
 								<id>kill-biome</id>

commafeed-client/src/app/entries/entries.test.ts

@@ -116,6 +116,30 @@ describe("entries", () => {
         expect(client.entry.mark).toHaveBeenCalledWith({ id: "3", read: true })
     })
 
+    it("flags an entry marked as unread by the user until entries are reloaded", async () => {
+        vi.mocked(client.feed.getEntries).mockResolvedValue({
+            data: {
+                entries: [{ id: "3", read: true, markable: true } as Entry],
+                hasMore: false,
+                name: "my-feed",
+                errorCount: 0,
+                feedLink: "https://mysite.com/feed",
+                timestamp: 123,
+                ignoredReadStatus: false,
+            },
+        } as AxiosResponse<Entries>)
+
+        const store = configureStore({ reducer: reducers })
+        await store.dispatch(loadEntries({ source: { type: "feed", id: "feed-id" }, clearSearch: true }))
+
+        store.dispatch(markEntry({ entry: store.getState().entries.entries[0], read: false }))
+        expect(store.getState().entries.entries[0].keepUnread).toBe(true)
+
+        // reloading the entry list resets the flag
+        await store.dispatch(loadEntries({ source: { type: "feed", id: "feed-id" }, clearSearch: false }))
+        expect(store.getState().entries.entries[0].keepUnread).toBeUndefined()
+    })
+
     it("marks all entries as read", () => {
         const store = configureStore({
             reducer: reducers,

commafeed-client/src/app/entries/slice.ts

@@ -10,7 +10,11 @@ export interface EntrySource {
     id: string
 }
 
-export type ExpendableEntry = Entry & { expanded?: boolean }
+export type ExpendableEntry = Entry & {
+    expanded?: boolean
+    /** set when the user explicitly marks the entry as unread, prevents it from being marked as read again by scrolling in expanded mode until the entry list is reloaded */
+    keepUnread?: boolean
+}
 
 interface EntriesState {
     /** selected source */
@@ -71,11 +75,13 @@ export const entriesSlice = createSlice({
         builder.addCase(markEntry.pending, (state, action) => {
             for (const e of state.entries.filter(e => e.id === action.meta.arg.entry.id)) {
                 e.read = action.meta.arg.read
+                if (!action.meta.arg.read) e.keepUnread = true
             }
         })
         builder.addCase(markMultipleEntries.pending, (state, action) => {
             for (const e of state.entries.filter(e => action.meta.arg.entries.some(e2 => e2.id === e.id))) {
                 e.read = action.meta.arg.read
+                if (!action.meta.arg.read) e.keepUnread = true
             }
         })
         builder.addCase(markAllEntries.pending, (state, action) => {

commafeed-client/src/components/ActionButton.tsx

@@ -5,14 +5,15 @@ import { forwardRef, type MouseEventHandler, type ReactNode } from "react"
 import { Constants } from "@/app/constants"
 import { useActionButton } from "@/hooks/useActionButton"
 
+export type Mode = "auto" | "mobile" | "desktop"
+
 interface ActionButtonProps {
     icon: ReactNode
     className?: string
     label?: string | MessageDescriptor
     onClick?: MouseEventHandler
     variant?: ActionIconVariant & ButtonVariant
-    hideLabelOnDesktop?: boolean
+    mode?: Mode
-    showLabelOnMobile?: boolean
 }
 
 /**
@@ -25,7 +26,9 @@ export const ActionButton = forwardRef<HTMLDivElement, ActionButtonProps>((props
 
     const label = typeof props.label === "string" ? props.label : props.label && _(props.label)
     const variant = props.variant ?? "subtle"
-    const iconOnly = (mobile && !props.showLabelOnMobile) || (!mobile && props.hideLabelOnDesktop)
+
+    const mode: Mode = props.mode ?? "auto"
+    const iconOnly = mode === "mobile" || (mode === "auto" && mobile)
 
     return (
         <Box ref={ref} className="cf-action-button">

commafeed-client/src/components/content/FeedEntries.tsx

@@ -111,12 +111,13 @@ export function FeedEntries() {
                     const el = document.getElementById(Constants.dom.entryId(e))
                     return el && !Constants.layout.isTopVisible(el)
                 })
-            if (currentEntry) {
+            if (currentEntry && currentEntry.id !== selectedEntryId) {
                 dispatch(
                     selectEntry({
                         entry: currentEntry,
                         expand: false,
-                        markAsRead: !!scrollMarks,
+                        // don't mark as read entries that the user explicitly marked as unread
+                        markAsRead: !!scrollMarks && !currentEntry.keepUnread,
                         scrollToEntry: false,
                     })
                 )
@@ -124,7 +125,7 @@ export function FeedEntries() {
         })
         window.addEventListener("scroll", listener)
         return () => window.removeEventListener("scroll", listener)
-    }, [dispatch, entries, viewMode, scrollMarks, scrollingToEntry])
+    }, [dispatch, entries, viewMode, scrollMarks, scrollingToEntry, selectedEntryId])
 
     useMousetrap("r", async () => await dispatch(reloadEntries()))
     useMousetrap(

commafeed-client/src/components/header/Header.tsx

@@ -2,7 +2,7 @@ import { msg } from "@lingui/core/macro"
 import { useLingui } from "@lingui/react"
 import { Box, Center, CloseButton, Divider, Group, Indicator, Popover, TextInput } from "@mantine/core"
 import { useForm } from "@mantine/form"
-import { useEffect } from "react"
+import { type ReactNode, useEffect } from "react"
 import {
     TbArrowDown,
     TbArrowUp,
@@ -31,7 +31,7 @@ function HeaderDivider() {
     return <Divider orientation="vertical" />
 }
 
-function HeaderToolbar(props: { children: React.ReactNode }) {
+function HeaderToolbar(props: { children: ReactNode }) {
     const { spacing } = useActionButton()
     const mobile = useMobile("480px")
     return mobile ? (
@@ -47,7 +47,7 @@ function HeaderToolbar(props: { children: React.ReactNode }) {
             {props.children}
         </Box>
     ) : (
-        <Group gap={spacing} className="cf-toolbar">
+        <Group gap={spacing} wrap="nowrap" className="cf-toolbar">
             {props.children}
         </Group>
     )

commafeed-client/src/pages/WelcomePage.tsx

@@ -42,7 +42,7 @@ export function WelcomePage() {
                         icon={<TbClock size={iconSize} />}
                         variant="outline"
                         onClick={async () => await login.execute({ name: "demo", password: "demo" })}
-                        showLabelOnMobile
+                        mode="desktop"
                     />
                 </Center>
             )}
@@ -100,7 +100,7 @@ function Buttons() {
                 icon={<TbKey size={iconSize} />}
                 variant="outline"
                 onClick={async () => await dispatch(redirectToLogin())}
-                showLabelOnMobile
+                mode="desktop"
             />
             {serverInfos?.allowRegistrations && (
                 <ActionButton
@@ -108,7 +108,7 @@ function Buttons() {
                     icon={<TbUserPlus size={iconSize} />}
                     variant="filled"
                     onClick={async () => await dispatch(redirectToRegistration())}
-                    showLabelOnMobile
+                    mode="desktop"
                 />
             )}
 
@@ -116,7 +116,7 @@ function Buttons() {
                 label={dark ? msg`Switch to light theme` : msg`Switch to dark theme`}
                 icon={colorScheme === "dark" ? <TbSun size={18} /> : <TbMoon size={iconSize} />}
                 onClick={() => toggleColorScheme()}
-                hideLabelOnDesktop
+                mode="mobile"
             />
 
             {isBrowserExtensionPopup && (
@@ -124,7 +124,7 @@ function Buttons() {
                     label={msg`Extension options`}
                     icon={<TbSettings size={iconSize} />}
                     onClick={() => openSettingsPage()}
-                    hideLabelOnDesktop
+                    mode="mobile"
                 />
             )}
         </Group>

commafeed-client/src/pages/app/Layout.tsx

@@ -227,7 +227,7 @@ export default function Layout(props: Readonly<LayoutProps>) {
                 )}
             </OnMobile>
             <OnDesktop>
-                <Group p="md">
+                <Group p="md" wrap="nowrap">
                     <Group justify="space-between" style={{ width: sidebarWidth - 16 }}>
                         <Box>
                             <LogoAndTitle />

commafeed-client/src/setupTests.ts

@@ -1,4 +1,4 @@
-import "@testing-library/jest-dom"
+import "@testing-library/jest-dom/vitest"
 import { vi } from "vitest"
 import { Constants } from "@/app/constants"
 

commafeed-client/vite.config.ts

@@ -7,11 +7,8 @@ import checker from "vite-plugin-checker"
 export default defineConfig(() => ({
     plugins: [
         react(),
-        babel({
+        lingui({ macroTransform: true }),
-            presets: [reactCompilerPreset()],
+        babel({ presets: [reactCompilerPreset()] }),
-            plugins: ["@lingui/babel-plugin-lingui-macro"],
-        }),
-        lingui(),
         checker({
             // temporary disabled until TypeScript 7 exposes a stable api
             // typescript: true,
@@ -44,6 +41,7 @@ export default defineConfig(() => ({
         inconsistentCjsInterop: true,
     },
     test: {
+        isolate: false,
         environment: "jsdom",
         globals: true,
         setupFiles: "./src/setupTests.ts",
@@ -51,6 +49,9 @@ export default defineConfig(() => ({
     build: {
         chunkSizeWarningLimit: 4000,
         rolldownOptions: {
+            checks: {
+                pluginTimings: false,
+            },
             output: {
                 codeSplitting: {
                     groups: [

commafeed-server/pom.xml

@@ -6,15 +6,15 @@
     <parent>
         <groupId>com.commafeed</groupId>
         <artifactId>commafeed</artifactId>
-        <version>7.3.2</version>
+        <version>7.4.1</version>
     </parent>
     <artifactId>commafeed-server</artifactId>
     <name>CommaFeed Server</name>
     <packaging>quarkus</packaging>
 
     <properties>
-        <quarkus.version>3.38.3</quarkus.version>
+        <quarkus.version>3.40.1.1</quarkus.version>
-        <querydsl.version>7.6</querydsl.version>
+        <querydsl.version>7.7</querydsl.version>
         <rome.version>2.1.0</rome.version>
         <!-- renovate: depName=com.google.googlejavaformat:google-java-format -->
         <google-java-format.version>1.36.1</google-java-format.version>
@@ -35,7 +35,7 @@
             <dependency>
                 <groupId>com.google.protobuf</groupId>
                 <artifactId>protobuf-java</artifactId>
-                <version>4.36.0</version>
+                <version>4.36.2</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
@@ -64,7 +64,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>properties-maven-plugin</artifactId>
-                <version>1.3.0</version>
+                <version>1.3.1</version>
                 <executions>
                     <execution>
                         <goals>
@@ -116,7 +116,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>
-                <version>3.6.3</version>
+                <version>3.6.4</version>
                 <dependencies>
                     <dependency>
                         <groupId>io.quarkus</groupId>
@@ -164,7 +164,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.5.6</version>
+                <version>3.6.1</version>
                 <configuration>
                     <argLine>@{argLine}</argLine>
                     <systemPropertyVariables>
@@ -176,7 +176,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-failsafe-plugin</artifactId>
-                <version>3.5.6</version>
+                <version>3.6.1</version>
                 <executions>
                     <execution>
                         <goals>
@@ -221,7 +221,7 @@
             <plugin>
                 <groupId>io.github.git-commit-id</groupId>
                 <artifactId>git-commit-id-maven-plugin</artifactId>
-                <version>10.0.0</version>
+                <version>10.0.1</version>
                 <executions>
                     <execution>
                         <goals>
@@ -245,7 +245,7 @@
                     <dependency>
                         <groupId>com.puppycrawl.tools</groupId>
                         <artifactId>checkstyle</artifactId>
-                        <version>14.0.0</version>
+                        <version>14.3.0</version>
                     </dependency>
                 </dependencies>
                 <executions>
@@ -274,7 +274,7 @@
             <plugin>
                 <groupId>com.diffplug.spotless</groupId>
                 <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.10.0</version>
+                <version>3.10.4</version>
                 <?m2e ignore?>
                 <executions>
                     <execution>
@@ -302,14 +302,14 @@
         <dependency>
             <groupId>com.commafeed</groupId>
             <artifactId>commafeed-client</artifactId>
-            <version>7.3.2</version>
+            <version>7.4.1</version>
         </dependency>
 
         <!-- compile-time processors -->
         <dependency>
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>
-            <version>1.18.46</version>
+            <version>1.18.48</version>
         </dependency>
         <dependency>
             <groupId>org.kohsuke.metainf-services</groupId>
@@ -322,6 +322,11 @@
             <artifactId>quarkus-extension-processor</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.graalvm.sdk</groupId>
+            <artifactId>nativeimage</artifactId>
+            <scope>provided</scope>
+        </dependency>
 
         <!-- quarkus dependencies -->
         <dependency>
@@ -368,7 +373,7 @@
         <dependency>
             <groupId>io.dropwizard.metrics</groupId>
             <artifactId>metrics-json</artifactId>
-            <version>4.2.39</version>
+            <version>4.2.40</version>
         </dependency>
         <dependency>
             <groupId>io.github.openfeign.querydsl</groupId>
@@ -429,12 +434,12 @@
         <dependency>
             <groupId>org.jsoup</groupId>
             <artifactId>jsoup</artifactId>
-            <version>1.23.1</version>
+            <version>1.23.2</version>
         </dependency>
         <dependency>
             <groupId>com.ibm.icu</groupId>
             <artifactId>icu4j</artifactId>
-            <version>78.3</version>
+            <version>79.1</version>
         </dependency>
         <dependency>
             <groupId>net.sourceforge.cssparser</groupId>
@@ -449,17 +454,12 @@
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
             <artifactId>httpclient5</artifactId>
-            <version>5.6.4</version>
+            <version>5.6.5</version>
         </dependency>
         <dependency>
             <groupId>io.github.hakky54</groupId>
             <artifactId>ayza-for-apache5</artifactId>
-            <version>10.0.6</version>
+            <version>10.1.0</version>
-        </dependency>
-        <dependency>
-            <groupId>org.brotli</groupId>
-            <artifactId>dec</artifactId>
-            <version>0.1.2</version>
         </dependency>
         <dependency>
             <groupId>com.github.seancfoley</groupId>
@@ -476,13 +476,13 @@
         <dependency>
             <groupId>io.quarkiverse.playwright</groupId>
             <artifactId>quarkus-playwright</artifactId>
-            <version>2.3.8</version>
+            <version>2.3.10</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mock-server</groupId>
-            <artifactId>mockserver-junit-jupiter</artifactId>
+            <artifactId>mockserver-junit-jupiter-no-dependencies</artifactId>
-            <version>7.6.0</version>
+            <version>9.1.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>

commafeed-server/src/main/docker/Dockerfile.jvm

@@ -1,4 +1,6 @@
-FROM ibm-semeru-runtimes:open-jdk-25.0.4.0-jre@sha256:524f0d04723aff42ed4142ab2621fa55f22cb691763cd75b59eee86749e2e872
+FROM ibm-semeru-runtimes:open-jdk-25.0.4.15-jre@sha256:630c738228597b4cd31d9823e479384729b03684bac23478b33fdbda13ae31b8
+LABEL org.opencontainers.image.source="https://github.com/Athou/commafeed"
+
 EXPOSE 8082
 
 RUN mkdir -p /commafeed/data

commafeed-server/src/main/docker/Dockerfile.native

@@ -1,4 +1,6 @@
-FROM debian:13.6@sha256:34cd9e9fd437c0a095ec39cb2e73422c9f30821b0d0848ed74fd0d43bae4d958
+FROM debian:13.7@sha256:4c25275446ca371766b8b093c696782eabce06263fccacb8d5d813b3dc44b308
+LABEL org.opencontainers.image.source="https://github.com/Athou/commafeed"
+
 ARG TARGETARCH
 
 EXPOSE 8082

commafeed-server/src/main/java/com/commafeed/NativeImageClasses.java

@@ -6,6 +6,8 @@ import com.codahale.metrics.Histogram;
 import com.codahale.metrics.Meter;
 import com.codahale.metrics.MetricRegistry;
 import com.codahale.metrics.Timer;
+import com.oracle.svm.core.annotate.Substitute;
+import com.oracle.svm.core.annotate.TargetClass;
 
 import io.quarkus.runtime.annotations.RegisterForReflection;
 
@@ -346,4 +348,22 @@ import io.quarkus.runtime.annotations.RegisterForReflection;
             com.rometools.opml.feed.synd.impl.ConverterForOPML10.class,
             com.rometools.opml.feed.synd.impl.ConverterForOPML20.class,
         })
-public class NativeImageClasses {}
+public class NativeImageClasses {
+
+    // disable zstd and brotli runtime detection because it causes native image failure
+    @TargetClass(className = "org.apache.hc.client5.http.impl.ZstdRuntime")
+    static final class ZstdRuntime {
+        @Substitute
+        public static boolean available() {
+            return false;
+        }
+    }
+
+    @TargetClass(className = "org.apache.hc.client5.http.impl.Brotli4jRuntime")
+    static final class Brotli4jRuntime {
+        @Substitute
+        public static boolean available() {
+            return false;
+        }
+    }
+}

commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java

@@ -19,27 +19,27 @@ import nl.altindag.ssl.apache5.util.Apache5SslUtils;
 
 import org.apache.hc.client5.http.DnsResolver;
 import org.apache.hc.client5.http.SystemDefaultDnsResolver;
+import org.apache.hc.client5.http.async.methods.InflatingAsyncDataConsumer;
+import org.apache.hc.client5.http.async.methods.InflatingGzipDataConsumer;
 import org.apache.hc.client5.http.config.ConnectionConfig;
 import org.apache.hc.client5.http.config.TlsConfig;
-import org.apache.hc.client5.http.entity.DeflateInputStream;
-import org.apache.hc.client5.http.entity.InputStreamFactory;
 import org.apache.hc.client5.http.entity.compress.ContentCoding;
 import org.apache.hc.client5.http.impl.DefaultRedirectStrategy;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
-import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
+import org.apache.hc.client5.http.impl.async.HttpAsyncClients;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
+import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManager;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
-import org.apache.hc.client5.http.io.HttpClientConnectionManager;
 import org.apache.hc.client5.http.protocol.RedirectStrategy;
 import org.apache.hc.core5.http.Header;
 import org.apache.hc.core5.http.HttpException;
 import org.apache.hc.core5.http.HttpRequest;
 import org.apache.hc.core5.http.HttpResponse;
 import org.apache.hc.core5.http.message.BasicHeader;
+import org.apache.hc.core5.http.nio.AsyncDataConsumer;
 import org.apache.hc.core5.http.protocol.HttpContext;
+import org.apache.hc.core5.http2.HttpVersionPolicy;
 import org.apache.hc.core5.util.TimeValue;
 import org.apache.hc.core5.util.Timeout;
-import org.brotli.dec.BrotliInputStream;
 
 import java.net.InetAddress;
 import java.net.URI;
@@ -48,7 +48,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.SequencedMap;
-import java.util.zip.GZIPInputStream;
+import java.util.function.UnaryOperator;
 
 @Singleton
 @RequiredArgsConstructor
@@ -60,8 +60,8 @@ public class HttpClientFactory {
     private final CommaFeedConfiguration config;
     private final CommaFeedVersion version;
 
-    public CloseableHttpClient newClient(int poolSize) {
+    public CloseableHttpAsyncClient newClient(int poolSize) {
-        PoolingHttpClientConnectionManager connectionManager =
+        PoolingAsyncClientConnectionManager connectionManager =
                 newConnectionManager(config, poolSize);
         String userAgent =
                 config.httpClient()
@@ -74,42 +74,48 @@ public class HttpClientFactory {
         return newClient(config, connectionManager, userAgent);
     }
 
-    private CloseableHttpClient newClient(
+    private CloseableHttpAsyncClient newClient(
             CommaFeedConfiguration config,
-            HttpClientConnectionManager connectionManager,
+            PoolingAsyncClientConnectionManager connectionManager,
             String userAgent) {
         List<Header> headers = new ArrayList<>();
         headers.add(new BasicHeader(HttpHeaders.ACCEPT_LANGUAGE, "en"));
         headers.add(new BasicHeader(HttpHeaders.PRAGMA, "No-cache"));
         headers.add(new BasicHeader(HttpHeaders.CACHE_CONTROL, "no-cache"));
+        headers.add(new BasicHeader(HttpHeaders.ACCEPT, "*/*"));
+        headers.add(new BasicHeader(HttpHeaders.SEC_FETCH_MODE, "navigate"));
 
-        SequencedMap<String, InputStreamFactory> contentDecoderMap = new LinkedHashMap<>();
+        SequencedMap<String, UnaryOperator<AsyncDataConsumer>> contentDecoderMap =
-        contentDecoderMap.put(ContentCoding.GZIP.token(), GZIPInputStream::new);
+                new LinkedHashMap<>();
-        contentDecoderMap.put(ContentCoding.DEFLATE.token(), DeflateInputStream::new);
+        contentDecoderMap.put(
-        contentDecoderMap.put(ContentCoding.BROTLI.token(), BrotliInputStream::new);
+                ContentCoding.DEFLATE.token(), d -> new InflatingAsyncDataConsumer(d, null));
+        contentDecoderMap.put(ContentCoding.GZIP.token(), InflatingGzipDataConsumer::new);
 
         RedirectStrategy redirectStrategy =
                 config.httpClient().blockLocalAddresses()
                         ? new BlockLocalAddressesRedirectStrategy(DNS_RESOLVER)
                         : new DefaultRedirectStrategy();
 
-        return HttpClientBuilder.create()
+        CloseableHttpAsyncClient client =
-                .disableConnectionState()
+                HttpAsyncClients.custom()
-                .useSystemProperties()
+                        .disableConnectionState()
-                .disableAutomaticRetries()
+                        .useSystemProperties()
-                .disableCookieManagement()
+                        .disableAutomaticRetries()
-                .setUserAgent(userAgent)
+                        .disableCookieManagement()
-                .setDefaultHeaders(headers)
+                        .setUserAgent(userAgent)
-                .setConnectionManager(connectionManager)
+                        .setDefaultHeaders(headers)
-                .evictExpiredConnections()
+                        .setConnectionManager(connectionManager)
-                .evictIdleConnections(
+                        .evictExpiredConnections()
-                        TimeValue.of(config.httpClient().idleConnectionsEvictionInterval()))
+                        .evictIdleConnections(
-                .setContentDecoderRegistry(new LinkedHashMap<>(contentDecoderMap))
+                                TimeValue.of(config.httpClient().idleConnectionsEvictionInterval()))
-                .setRedirectStrategy(redirectStrategy)
+                        .setContentDecoderMap(new LinkedHashMap<>(contentDecoderMap))
-                .build();
+                        .setRedirectStrategy(redirectStrategy)
+                        .build();
+        client.start();
+        return client;
     }
 
-    private PoolingHttpClientConnectionManager newConnectionManager(
+    private PoolingAsyncClientConnectionManager newConnectionManager(
             CommaFeedConfiguration config, int poolSize) {
         SSLFactory sslFactory =
                 SSLFactory.builder().withUnsafeTrustMaterial().withUnsafeHostnameVerifier().build();
@@ -118,8 +124,8 @@ public class HttpClientFactory {
                         ? new BlockLocalAddressesDnsResolver(DNS_RESOLVER)
                         : DNS_RESOLVER;
 
-        return PoolingHttpClientConnectionManagerBuilder.create()
+        return PoolingAsyncClientConnectionManagerBuilder.create()
-                .setTlsSocketStrategy(Apache5SslUtils.toTlsSocketStrategy(sslFactory))
+                .setTlsStrategy(Apache5SslUtils.toTlsStrategy(sslFactory))
                 .setDefaultConnectionConfig(
                         ConnectionConfig.custom()
                                 .setConnectTimeout(Timeout.of(config.httpClient().connectTimeout()))
@@ -129,6 +135,7 @@ public class HttpClientFactory {
                                 .build())
                 .setDefaultTlsConfig(
                         TlsConfig.custom()
+                                .setVersionPolicy(HttpVersionPolicy.NEGOTIATE)
                                 .setHandshakeTimeout(
                                         Timeout.of(config.httpClient().sslHandshakeTimeout()))
                                 .build())

commafeed-server/src/main/java/com/commafeed/backend/HttpGetter.java

@@ -6,7 +6,6 @@ import com.commafeed.CommaFeedConfiguration.HttpClientCache;
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.collect.Iterables;
-import com.google.common.io.ByteStreams;
 import com.google.common.net.HttpHeaders;
 
 import jakarta.inject.Singleton;
@@ -17,39 +16,53 @@ import lombok.EqualsAndHashCode;
 import lombok.Getter;
 import lombok.Lombok;
 import lombok.RequiredArgsConstructor;
+import lombok.experimental.Delegate;
 import lombok.extern.slf4j.Slf4j;
 
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
+import org.apache.hc.client5.http.async.methods.SimpleRequestBuilder;
+import org.apache.hc.client5.http.async.methods.SimpleRequestProducer;
 import org.apache.hc.client5.http.config.RequestConfig;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.client5.http.protocol.RedirectLocations;
 import org.apache.hc.client5.http.utils.DateUtils;
-import org.apache.hc.core5.http.ClassicHttpRequest;
+import org.apache.hc.core5.concurrent.FutureCallback;
-import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.EntityDetails;
+import org.apache.hc.core5.http.HttpException;
 import org.apache.hc.core5.http.HttpStatus;
+import org.apache.hc.core5.http.Message;
 import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
+import org.apache.hc.core5.http.nio.AsyncEntityConsumer;
-import org.apache.hc.core5.util.Timeout;
+import org.apache.hc.core5.http.nio.AsyncRequestProducer;
+import org.apache.hc.core5.http.nio.AsyncResponseConsumer;
+import org.apache.hc.core5.http.nio.entity.AbstractBinAsyncEntityConsumer;
+import org.apache.hc.core5.http.nio.support.BasicResponseConsumer;
 import org.jboss.resteasy.reactive.common.headers.CacheControlDelegate;
 
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.net.URI;
+import java.nio.ByteBuffer;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.InstantSource;
 import java.util.Optional;
 import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 
-/** Smart HTTP getter: handles gzip, ssl, last modified and etag headers */
+/** Smart HTTP getter: handles gzip, ssl, last modified, and etag headers */
 @Singleton
 @Slf4j
 public class HttpGetter {
     private final CommaFeedConfiguration config;
     private final InstantSource instantSource;
-    private final CloseableHttpClient client;
+    private final CloseableHttpAsyncClient client;
     private final Cache<HttpRequest, HttpResponse> cache;
 
     public HttpGetter(
@@ -150,70 +163,96 @@ public class HttpGetter {
         HttpClientContext context = HttpClientContext.create();
         context.setRequestConfig(
                 RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
                         // causes issues with some feeds
                         // see https://github.com/Athou/commafeed/issues/1572
                         // and https://issues.apache.org/jira/browse/HTTPCLIENT-2344
                         .setProtocolUpgradeEnabled(false)
                         .build());
 
-        return client.execute(
+        long maxResponseSize = config.httpClient().maxResponseSize().asLongValue();
-                request.toClassicHttpRequest(),
+        AsyncRequestProducer req = SimpleRequestProducer.create(request.toSimpleHttpRequest());
-                context,
+        AsyncResponseConsumer<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> resp =
-                resp -> {
+                new BasicResponseConsumer<>(
-                    byte[] content =
+                        new LimitedContentLengthEntityConsumer(
-                            resp.getEntity() == null
+                                new LimitedBytesEntityConsumer(maxResponseSize), maxResponseSize));
-                                    ? null
+        FutureCallback<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> callback =
-                                    : toByteArray(
+                new FutureCallback<>() {
-                                            resp.getEntity(),
+                    @Override
-                                            config.httpClient().maxResponseSize().asLongValue());
+                    public void completed(
-                    int code = resp.getCode();
+                            Message<org.apache.hc.core5.http.HttpResponse, byte[]> result) {}
-                    String lastModifiedHeader =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.LAST_MODIFIED))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .orElse(null);
-                    String eTagHeader =
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.ETAG))
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .orElse(null);
 
-                    CacheControl cacheControl =
+                    @Override
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.CACHE_CONTROL))
+                    public void failed(Exception ex) {}
-                                    .map(NameValuePair::getValue)
-                                    .map(StringUtils::trimToNull)
-                                    .map(HttpGetter::toCacheControl)
-                                    .orElse(null);
 
-                    Instant retryAfter =
+                    @Override
-                            Optional.ofNullable(resp.getFirstHeader(HttpHeaders.RETRY_AFTER))
+                    public void cancelled() {}
-                                    .map(NameValuePair::getValue)
+                };
-                                    .map(StringUtils::trimToNull)
+        Future<Message<org.apache.hc.core5.http.HttpResponse, byte[]>> future =
-                                    .map(this::toInstant)
+                client.execute(req, resp, context, callback);
-                                    .orElse(null);
 
-                    String contentType =
+        try {
-                            Optional.ofNullable(resp.getEntity())
+            Message<org.apache.hc.core5.http.HttpResponse, byte[]> message =
-                                    .map(HttpEntity::getContentType)
+                    future.get(config.httpClient().responseTimeout().toSeconds(), TimeUnit.SECONDS);
-                                    .orElse(null);
-                    String urlAfterRedirect =
-                            Optional.ofNullable(context.getRedirectLocations())
-                                    .map(RedirectLocations::getAll)
-                                    .map(l -> Iterables.getLast(l, null))
-                                    .map(URI::toString)
-                                    .orElse(request.getUrl());
 
-                    return new HttpResponse(
+            byte[] content = message.getBody();
-                            code,
+            int code = message.getHead().getCode();
-                            lastModifiedHeader,
+            String lastModifiedHeader =
-                            eTagHeader,
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.LAST_MODIFIED))
-                            cacheControl,
+                            .map(NameValuePair::getValue)
-                            retryAfter,
+                            .map(StringUtils::trimToNull)
-                            content,
+                            .orElse(null);
-                            contentType,
+            String eTagHeader =
-                            urlAfterRedirect);
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.ETAG))
-                });
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .orElse(null);
+
+            CacheControl cacheControl =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.CACHE_CONTROL))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .map(HttpGetter::toCacheControl)
+                            .orElse(null);
+
+            Instant retryAfter =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.RETRY_AFTER))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .map(this::toInstant)
+                            .orElse(null);
+
+            String contentType =
+                    Optional.ofNullable(message.getHead().getFirstHeader(HttpHeaders.CONTENT_TYPE))
+                            .map(NameValuePair::getValue)
+                            .map(StringUtils::trimToNull)
+                            .orElse(null);
+            String urlAfterRedirect =
+                    Optional.ofNullable(context.getRedirectLocations())
+                            .map(RedirectLocations::getAll)
+                            .map(l -> Iterables.getLast(l, null))
+                            .map(URI::toString)
+                            .orElse(request.getUrl());
+
+            return new HttpResponse(
+                    code,
+                    lastModifiedHeader,
+                    eTagHeader,
+                    cacheControl,
+                    retryAfter,
+                    content,
+                    contentType,
+                    urlAfterRedirect);
+        } catch (InterruptedException e) {
+            future.cancel(true);
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("interrupted while fetching " + request.getUrl(), e);
+        } catch (TimeoutException e) {
+            future.cancel(true);
+            throw new IOException("timed out while fetching " + request.getUrl(), e);
+        } catch (ExecutionException e) {
+            future.cancel(true);
+            throw Lombok.sneakyThrow(e.getCause());
+        }
     }
 
     private static CacheControl toCacheControl(String headerValue) {
@@ -237,28 +276,6 @@ public class HttpGetter {
         return DateUtils.parseStandardDate(headerValue);
     }
 
-    private static byte[] toByteArray(HttpEntity entity, long maxBytes) throws IOException {
-        if (entity.getContentLength() > maxBytes) {
-            throw new IOException(
-                    "Response size (%s bytes) exceeds the maximum allowed size (%s bytes)"
-                            .formatted(entity.getContentLength(), maxBytes));
-        }
-
-        try (InputStream input = entity.getContent()) {
-            if (input == null) {
-                return null;
-            }
-
-            byte[] bytes = ByteStreams.limit(input, maxBytes + 1).readAllBytes();
-            if (bytes.length > maxBytes) {
-                throw new IOException(
-                        "Response size exceeds the maximum allowed size (%s bytes)"
-                                .formatted(maxBytes));
-            }
-            return bytes;
-        }
-    }
-
     private static Cache<HttpRequest, HttpResponse> newCache(CommaFeedConfiguration config) {
         HttpClientCache cacheConfig = config.httpClient().cache();
         if (!cacheConfig.enabled()) {
@@ -274,6 +291,60 @@ public class HttpGetter {
                 .build();
     }
 
+    private record LimitedContentLengthEntityConsumer(
+            @Delegate AsyncEntityConsumer<byte[]> delegate, long maxBytes)
+            implements AsyncEntityConsumer<byte[]> {
+
+        @Override
+        public void streamStart(EntityDetails entityDetails, FutureCallback<byte[]> resultCallback)
+                throws HttpException, IOException {
+            long contentLength = entityDetails.getContentLength();
+            if (contentLength > maxBytes) {
+                throw new IOException(
+                        "Response size (%s bytes) exceeds the maximum allowed size (%s bytes)"
+                                .formatted(contentLength, maxBytes));
+            }
+            delegate.streamStart(entityDetails, resultCallback);
+        }
+    }
+
+    @RequiredArgsConstructor
+    private static class LimitedBytesEntityConsumer extends AbstractBinAsyncEntityConsumer<byte[]> {
+
+        private final long maxBytes;
+        private final ByteArrayOutputStream out = new ByteArrayOutputStream();
+
+        @Override
+        protected void streamStart(ContentType contentType) {}
+
+        @Override
+        protected int capacityIncrement() {
+            return Integer.MAX_VALUE;
+        }
+
+        @Override
+        protected void data(ByteBuffer src, boolean endOfStream) throws IOException {
+            if (out.size() + src.remaining() > maxBytes) {
+                throw new IOException(
+                        "Response size exceeds the maximum allowed size (%s bytes)"
+                                .formatted(maxBytes));
+            }
+            byte[] chunk = new byte[src.remaining()];
+            src.get(chunk);
+            out.write(chunk, 0, chunk.length);
+        }
+
+        @Override
+        protected byte[] generateContent() {
+            return out.toByteArray();
+        }
+
+        @Override
+        public void releaseResources() {
+            out.reset();
+        }
+    }
+
     public static class SchemeNotAllowedException extends Exception {
         private static final long serialVersionUID = 1L;
 
@@ -336,15 +407,15 @@ public class HttpGetter {
             return new HttpRequestBuilder().url(url);
         }
 
-        public ClassicHttpRequest toClassicHttpRequest() {
+        public SimpleHttpRequest toSimpleHttpRequest() {
-            ClassicHttpRequest req = ClassicRequestBuilder.get(url).build();
+            SimpleRequestBuilder builder = SimpleRequestBuilder.get(url);
             if (lastModified != null) {
-                req.addHeader(HttpHeaders.IF_MODIFIED_SINCE, lastModified);
+                builder.addHeader(HttpHeaders.IF_MODIFIED_SINCE, lastModified);
             }
             if (eTag != null) {
-                req.addHeader(HttpHeaders.IF_NONE_MATCH, eTag);
+                builder.addHeader(HttpHeaders.IF_NONE_MATCH, eTag);
             }
-            return req;
+            return builder.build();
         }
     }
 

commafeed-server/src/main/java/com/commafeed/backend/service/FeedEntryContentCleaningService.java

@@ -148,6 +148,7 @@ public class FeedEntryContentCleaningService {
 
         whitelist.addProtocols("a", "href", "ftp", "http", "https", "magnet", "mailto");
         whitelist.addProtocols("blockquote", "cite", "http", "https");
+        whitelist.addProtocols("iframe", "src", "http", "https");
         whitelist.addProtocols("img", "src", "http", "https");
         whitelist.addProtocols("q", "cite", "http", "https");
 

commafeed-server/src/main/java/com/commafeed/backend/service/PushNotificationService.java

@@ -16,26 +16,33 @@ import jakarta.inject.Singleton;
 import lombok.extern.slf4j.Slf4j;
 
 import org.apache.commons.lang3.StringUtils;
-import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
-import org.apache.hc.client5.http.config.RequestConfig;
+import org.apache.hc.client5.http.async.methods.SimpleRequestBuilder;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
+import org.apache.hc.client5.http.async.methods.SimpleRequestProducer;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
 import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpResponse;
+import org.apache.hc.core5.http.Message;
 import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.io.entity.StringEntity;
 import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.apache.hc.core5.util.Timeout;
+import org.apache.hc.core5.http.nio.entity.DiscardingEntityConsumer;
+import org.apache.hc.core5.http.nio.support.BasicResponseConsumer;
+import org.apache.hc.core5.net.WWWFormCodec;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 
 @Singleton
 @Slf4j
 public class PushNotificationService {
 
-    private final CloseableHttpClient httpClient;
+    private final CloseableHttpAsyncClient httpClient;
     private final Meter meter;
     private final CommaFeedConfiguration config;
 
@@ -97,13 +104,9 @@ public class PushNotificationService {
             return;
         }
 
-        HttpPost request = new HttpPost(serverUrl + "/" + topic);
+        SimpleRequestBuilder request = SimpleRequestBuilder.post(serverUrl + "/" + topic);
-        request.setConfig(
-                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
-                        .build());
         request.addHeader("Title", feedTitle);
-        request.setEntity(new StringEntity(entryTitle, StandardCharsets.UTF_8));
+        request.setBody(entryTitle, ContentType.TEXT_PLAIN.withCharset(StandardCharsets.UTF_8));
 
         if (StringUtils.isNotBlank(entryUrl)) {
             request.addHeader("Click", entryUrl);
@@ -113,15 +116,7 @@ public class PushNotificationService {
             request.addHeader("Authorization", "Bearer " + settings.getUserSecret());
         }
 
-        httpClient.execute(
+        send("ntfy", request.build());
-                request,
-                response -> {
-                    if (response.getCode() >= 400) {
-                        throw new PushNotificationException(
-                                "ntfy notification failed with status " + response.getCode());
-                    }
-                    return null;
-                });
     }
 
     private void sendGotify(
@@ -152,23 +147,11 @@ public class PushNotificationService {
                                             .put("click", new JsonObject().put("url", entryUrl))));
         }
 
-        HttpPost request = new HttpPost(serverUrl + "/message");
+        SimpleRequestBuilder request = SimpleRequestBuilder.post(serverUrl + "/message");
-        request.setConfig(
-                RequestConfig.custom()
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
-                        .build());
         request.addHeader("X-Gotify-Key", token);
-        request.setEntity(new StringEntity(json.toString(), ContentType.APPLICATION_JSON));
+        request.setBody(json.toString(), ContentType.APPLICATION_JSON);
 
-        httpClient.execute(
+        send("gotify", request.build());
-                request,
-                response -> {
-                    if (response.getCode() >= 400) {
-                        throw new PushNotificationException(
-                                "gotify notification failed with status " + response.getCode());
-                    }
-                    return null;
-                });
     }
 
     private void sendPushover(
@@ -194,22 +177,40 @@ public class PushNotificationService {
             params.add(new BasicNameValuePair("url", entryUrl));
         }
 
-        HttpPost request = new HttpPost("https://api.pushover.net/1/messages.json");
+        SimpleRequestBuilder request =
-        request.setConfig(
+                SimpleRequestBuilder.post("https://api.pushover.net/1/messages.json");
-                RequestConfig.custom()
+        request.setBody(
-                        .setResponseTimeout(Timeout.of(config.httpClient().responseTimeout()))
+                WWWFormCodec.format(params, StandardCharsets.UTF_8),
-                        .build());
+                ContentType.APPLICATION_FORM_URLENCODED.withCharset(StandardCharsets.UTF_8));
-        request.setEntity(new UrlEncodedFormEntity(params, StandardCharsets.UTF_8));
 
-        httpClient.execute(
+        send("pushover", request.build());
-                request,
+    }
-                response -> {
+
-                    if (response.getCode() >= 400) {
+    private void send(String name, SimpleHttpRequest request) throws IOException {
-                        throw new PushNotificationException(
+        Future<Message<HttpResponse, Object>> future =
-                                "pushover notification failed with status " + response.getCode());
+                httpClient.execute(
-                    }
+                        SimpleRequestProducer.create(request),
-                    return null;
+                        new BasicResponseConsumer<>(new DiscardingEntityConsumer<>()),
-                });
+                        null);
+        try {
+            HttpResponse response =
+                    future.get(config.httpClient().responseTimeout().toSeconds(), TimeUnit.SECONDS)
+                            .getHead();
+            if (response.getCode() >= 400) {
+                throw new PushNotificationException(
+                        name + " notification failed with status " + response.getCode());
+            }
+        } catch (InterruptedException e) {
+            future.cancel(true);
+            Thread.currentThread().interrupt();
+            throw new IOException("interrupted while sending " + name + " notification", e);
+        } catch (TimeoutException e) {
+            future.cancel(true);
+            throw new IOException("timed out while sending " + name + " notification", e);
+        } catch (ExecutionException e) {
+            future.cancel(true);
+            throw new IOException(e.getCause());
+        }
     }
 
     public static class PushNotificationException extends RuntimeException {

commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java

@@ -11,6 +11,8 @@ import com.google.common.net.HttpHeaders;
 
 import io.quarkus.runtime.configuration.MemorySize;
 
+import lombok.extern.slf4j.Slf4j;
+
 import org.apache.commons.io.IOUtils;
 import org.apache.hc.client5.http.ConnectTimeoutException;
 import org.apache.hc.core5.http.HttpStatus;
@@ -29,12 +31,12 @@ import org.mockserver.model.Delay;
 import org.mockserver.model.HttpRequest;
 import org.mockserver.model.HttpResponse;
 import org.mockserver.model.MediaType;
+import org.mockserver.model.Protocol;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.net.NoRouteToHostException;
-import java.net.SocketTimeoutException;
 import java.net.UnknownHostException;
 import java.time.Duration;
 import java.time.Instant;
@@ -45,6 +47,7 @@ import java.util.concurrent.atomic.AtomicInteger;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.GZIPOutputStream;
 
+@Slf4j
 class HttpGetterTest {
 
     private static final Instant NOW = Instant.now();
@@ -237,7 +240,7 @@ class HttpGetterTest {
                 .when(HttpRequest.request().withMethod("GET"))
                 .respond(HttpResponse.response().withDelay(Delay.milliseconds(1000)));
 
-        Assertions.assertThrows(SocketTimeoutException.class, () -> getter.get(this.feedUrl));
+        Assertions.assertThrows(IOException.class, () -> getter.get(this.feedUrl));
     }
 
     @Test
@@ -416,7 +419,7 @@ class HttpGetterTest {
     @Nested
     class Compression {
 
-        private static final String ACCEPT_ENCODING = "gzip, deflate, br";
+        private static final String ACCEPT_ENCODING = "deflate, gzip";
 
         @Test
         void gzip() throws Exception {
@@ -437,24 +440,30 @@ class HttpGetterTest {
                     .when(HttpRequest.request().withMethod("GET"))
                     .respond(
                             req -> {
-                                String acceptEncodingHeader =
+                                try {
-                                        req.getFirstHeader(HttpHeaders.ACCEPT_ENCODING);
+                                    String acceptEncodingHeader =
-                                if (!ACCEPT_ENCODING.equals(acceptEncodingHeader)) {
+                                            req.getFirstHeader(HttpHeaders.ACCEPT_ENCODING);
-                                    throw new Exception(
+                                    if (!ACCEPT_ENCODING.equals(acceptEncodingHeader)) {
-                                            "Wrong value in the Accept-Encoding header, should be '%s' but was '%s'"
+                                        throw new Exception(
-                                                    .formatted(
+                                                "Wrong value in the Accept-Encoding header, should be '%s' but was '%s'"
-                                                            ACCEPT_ENCODING, acceptEncodingHeader));
+                                                        .formatted(
-                                }
+                                                                ACCEPT_ENCODING,
+                                                                acceptEncodingHeader));
+                                    }
 
-                                ByteArrayOutputStream output = new ByteArrayOutputStream();
+                                    ByteArrayOutputStream output = new ByteArrayOutputStream();
-                                try (OutputStream compressionOutputStream =
+                                    try (OutputStream compressionOutputStream =
-                                        compressionFunction.apply(output)) {
+                                            compressionFunction.apply(output)) {
-                                    compressionOutputStream.write(body.getBytes());
+                                        compressionOutputStream.write(body.getBytes());
-                                }
+                                    }
 
-                                return HttpResponse.response()
+                                    return HttpResponse.response()
-                                        .withBody(output.toByteArray())
+                                            .withBody(output.toByteArray())
-                                        .withHeader(HttpHeaders.CONTENT_ENCODING, encoding);
+                                            .withHeader(HttpHeaders.CONTENT_ENCODING, encoding);
+                                } catch (Exception e) {
+                                    log.error("Error in compression callback", e);
+                                    throw e;
+                                }
                             });
 
             HttpResult result = getter.get(HttpGetterTest.this.feedUrl);
@@ -590,4 +599,30 @@ class HttpGetterTest {
                     UnknownHostException.class, () -> getter.get("http://[::a00:1]")); // 10.0.0.1
         }
     }
+
+    @Nested
+    class Protocols {
+        @Test
+        void usesHttp2OverTls() throws Exception {
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_2))
+                    .respond(HttpResponse.response().withBody("h2"));
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_1_1))
+                    .respond(HttpResponse.response().withBody("h1"));
+
+            HttpResult result = getter.get("https://localhost:" + mockServerClient.getPort());
+            Assertions.assertEquals("h2", new String(result.content()));
+        }
+
+        @Test
+        void fallsBackToHttp1OverCleartext() throws Exception {
+            mockServerClient
+                    .when(HttpRequest.request().withMethod("GET").withProtocol(Protocol.HTTP_1_1))
+                    .respond(HttpResponse.response().withBody("h1"));
+
+            HttpResult result = getter.get("http://localhost:" + mockServerClient.getPort());
+            Assertions.assertEquals("h1", new String(result.content()));
+        }
+    }
 }

commafeed-server/src/test/java/com/commafeed/backend/service/FeedEntryContentCleaningServiceTest.java

@@ -15,7 +15,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="alt-desc" decoding="async" sizes="(max-width: 965px) 100vw, 965px" style="width: 100%; opacity: 0">
-				<iframe src="url" style="width: 100%; opacity: 0"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width: 100%; opacity: 0"></iframe>
 				<forbidden-element>aaa</forbidden-element>
 				""";
         String result = feedEntryContentCleaningService.clean(content, "baseUri", false);
@@ -25,7 +25,7 @@ class FeedEntryContentCleaningServiceTest {
 				<p>
 				Some text
 				<img width="965" height="320" src="https://localhost/an-image.png" alt="alt-desc" style="width:100%;">
-				<iframe src="url" style="width:100%;"></iframe>
+				<iframe src="https://localhost/an-iframe" style="width:100%;"></iframe>
 				aaa
 				</p>
 				"""

pom.xml

@@ -5,7 +5,7 @@
 
 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.3.2</version>
+	<version>7.4.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>
 
@@ -19,7 +19,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.15.0</version>
+				<version>3.16.0</version>
 				<configuration>
 					<parameters>true</parameters>