release 5.6.1

Mention Arch package

.github/workflows/ci.yml

@@ -1,6 +1,10 @@
 name: ci
+permissions:
+  contents: read
 
-on: [ push ]
+on:
+  push:
+  pull_request:
 
 env:
   JAVA_VERSION: 21
@@ -8,9 +12,11 @@ env:
 
 jobs:
   build:
+    if: github.event_name != 'pull_request' || github.actor != 'renovate[bot]' # renovate already triggers the build on pushes
+
     strategy:
       matrix:
-        os: [ "ubuntu-latest", "ubuntu-24.04-arm", "windows-latest" ]
+        os: [ "ubuntu-latest", "ubuntu-22.04-arm", "windows-latest" ]
         database: [ "h2", "postgresql", "mysql", "mariadb" ]
 
     runs-on: ${{ matrix.os }}
@@ -20,13 +26,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
       # Setup
       - name: Set up GraalVM
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@b0cb26a8da53cb3e97cdc0c827d8e3071240e730 # v1
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: "graalvm"
@@ -40,23 +46,44 @@ jobs:
       - name: Build with Maven
         run: mvn --batch-mode --no-transfer-progress install -Pnative -P${{ matrix.database }} -DskipTests=${{ matrix.os == 'windows-latest' && matrix.database != 'h2' }}
 
+      # Build pages
+      - name: Copy generated markdown documentation to /documentation
+        run: mkdir documentation && cp ./commafeed-server/target/quarkus-generated-doc/config/commafeed-server.md ./documentation/README.md
+
+      - name: Generate pages
+        uses: wranders/markdown-to-pages-action@8d8a750832932ac785f5424c8c5543aa0b26bb9a # v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          out_path: target/pages
+          files: |-
+            README.md
+            documentation/README.md
+      
       # Upload artifacts
       - name: Upload cross-platform app
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+        if: matrix.os == 'ubuntu-latest' # we only need to upload the cross-platform artifact once per database
         with:
           name: commafeed-${{ matrix.database }}-jvm
           path: commafeed-server/target/commafeed-*.zip
-          overwrite: true
 
       - name: Upload native executable
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         with:
           name: commafeed-${{ matrix.database }}-${{ runner.os }}-${{ runner.arch }}
           path: commafeed-server/target/commafeed-*-runner*
 
+      - name: Upload pages
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        if: matrix.os == 'ubuntu-latest' && matrix.database == 'h2' # we only need to upload the pages once
+        with:
+          path: target/pages
+
   docker:
-    needs: build
     runs-on: ubuntu-latest
+    needs: build
+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
 
     strategy:
       matrix:
@@ -65,23 +92,23 @@ jobs:
     steps:
       # Checkout
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
       # Setup
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
 
       - name: Install required packages
         run: sudo apt-get install -y rename unzip
 
       # Prepare artifacts
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           pattern: commafeed-${{ matrix.database }}-*
           path: ./artifacts
@@ -102,55 +129,72 @@ jobs:
 
       # Docker
       - name: Login to Container Registry
-        uses: docker/login-action@v3
-        if: ${{ github.ref_type == 'tag' || github.ref_name == 'master' }}
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+        if: ${{ env.DOCKERHUB_USERNAME != '' }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      ## tags
+      ## build but don't push for PRs and renovate
+      - name: Docker build - native
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
+        with:
+          context: .
+          file: commafeed-server/src/main/docker/Dockerfile.native
+          push: false
+          platforms: linux/amd64,linux/arm64/v8
+
+      - name: Docker build - jvm
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
+        with:
+          context: .
+          file: commafeed-server/src/main/docker/Dockerfile.jvm
+          push: false
+          platforms: linux/amd64,linux/arm64/v8
+
+      ## build and push tag
       - name: Docker build and push tag - native
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         if: ${{ github.ref_type == 'tag' }}
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.native
-          push: true
+          push: ${{ env.DOCKERHUB_USERNAME != '' }}
           platforms: linux/amd64,linux/arm64/v8
           tags: |
             athou/commafeed:latest-${{ matrix.database }}
             athou/commafeed:${{ github.ref_name }}-${{ matrix.database }}
 
       - name: Docker build and push tag - jvm
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         if: ${{ github.ref_type == 'tag' }}
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.jvm
-          push: true
+          push: ${{ env.DOCKERHUB_USERNAME != '' }}
           platforms: linux/amd64,linux/arm64/v8
           tags: |
             athou/commafeed:latest-${{ matrix.database }}-jvm
             athou/commafeed:${{ github.ref_name }}-${{ matrix.database }}-jvm
 
-      ## master
+      ## build and push master
       - name: Docker build and push master - native
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         if: ${{ github.ref_name == 'master' }}
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.native
-          push: true
+          push: ${{ env.DOCKERHUB_USERNAME != '' }}
           platforms: linux/amd64,linux/arm64/v8
           tags: athou/commafeed:master-${{ matrix.database }}
 
       - name: Docker build and push master - jvm
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         if: ${{ github.ref_name == 'master' }}
         with:
           context: .
           file: commafeed-server/src/main/docker/Dockerfile.jvm
-          push: true
+          push: ${{ env.DOCKERHUB_USERNAME != '' }}
           platforms: linux/amd64,linux/arm64/v8
           tags: athou/commafeed:master-${{ matrix.database }}-jvm
 
@@ -158,16 +202,19 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build
+      - docker
+    permissions:
+      contents: write
     if: github.ref_type == 'tag'
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           pattern: commafeed-*
           path: ./artifacts
@@ -177,23 +224,49 @@ jobs:
         run: chmod +x artifacts/*-runner
 
       - name: Extract Changelog Entry
-        uses: mindsers/changelog-reader-action@v2
+        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2
         id: changelog_reader
         with:
           version: ${{ github.ref_name }}
 
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           name: CommaFeed ${{ github.ref_name }}
           body: ${{ steps.changelog_reader.outputs.changes }}
           artifacts: ./artifacts/*
 
+
+  update-dockerhub-description:
+    runs-on: ubuntu-latest
+    needs: release
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 0
+
       - name: Update Docker Hub Description
-        uses: peter-evans/dockerhub-description@v4
+        uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: athou/commafeed
           short-description: ${{ github.event.repository.description }}
           readme-filepath: commafeed-server/src/main/docker/README.md
+
+
+  deploy-pages:
+    runs-on: ubuntu-latest
+    needs: release
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        id: deployment

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [5.6.1]
+
+- Restore support for iframes in feed entries (#1688)
+- There is now a package available for Arch Linux thanks to @dcelasun (#1691)
+
+## [5.6.0]
+
+- To better respect the bandwidth of feed owners, the default value of `commafeed.feed-refresh.interval-empirical` is now true. This means feeds no longer refresh exactly every 5 minutes (the default value of `commafeed.feed-refresh.interval`) but between 5 minutes and 4 hours (the default value of the new `commafeed.feed-refresh.max-interval` setting). The interval is calculated based on feed activity, so highly active feeds refresh more often (#1677)
+- Many previously hardcoded values used in feed refresh interval calculation are now exposed as settings (#1677)
+- Access to local addresses is now blocked to mitigate server-side request forgery (SSRF) attacks, which could potentially expose internal resources. You might want to disable the new `commafeed.http-client.block-local-addresses` setting if you subscribe to feeds only available on your local network and you trust all your users
+- If a feed responds with a "429 - Too many requests" response, a backoff mechanism is triggered when the response does not contain a "Retry-After" header
+
+## [5.5.0]
+
+- CommaFeed now honors the Retry-After response header and will not try to refresh a feed sooner than the value of this header
+- Audio enclosures (e.g. podcasts) now fill available entry width
+- Fix an issue with some labels not correctly internationalized
+
 ## [5.4.0]
 
 - An arm64 native executable is now available for download on the releases page

README.md

@@ -48,10 +48,10 @@ system and database of choice.
 
 There are two types of packages:
 
-- The `linux-x86_64` and `windows-x86_64` packages are compiled natively and contain an executable that can be run
+- The `linux-x86_64`, `linux-aarch_64` and `windows-x86_64` packages are compiled natively and contain an executable that can be run
   directly.
 - The `jvm` package is a zip file containing all `.jar` files required to run the application. This package works on all
-  platforms and is started with `java -jar quarkus-run.jar`.
+  platforms but requires a JRE and is started with `java -jar quarkus-run.jar`.
 
 If available for your operating system, the native package is recommended because it has a faster startup time and lower
 memory usage.
@@ -73,6 +73,10 @@ When the build is complete:
 - if you used the native profile, the executable is located at
   `commafeed-server/target/commafeed-<version>-<database>-<platform>-<arch>-runner[.exe]`
 
+### Distribution packages
+
+- Arch Linux users can use [the CommaFeed package on AUR](https://aur.archlinux.org/pkgbase/commafeed), which builds native binaries with GraalVM for all supported databases.
+
 ## Configuration
 
 CommaFeed doesn't require any configuration to run with its embedded database (H2). The database file will be stored in
@@ -94,13 +98,13 @@ There are multiple ways to configure CommaFeed:
 
 - a `config/application.properties` [properties](https://en.wikipedia.org/wiki/.properties) file relative to the working
   directory (keys in kebab-case)
-- Command line arguments prefixed with `-D` (keys in kebab-case)
+- Command line arguments each prefixed with `-D` (keys in kebab-case)
 - Environment variables (keys in UPPER_CASE)
 - a `.env` file in the working directory (keys in UPPER_CASE)
 
 The properties file is recommended because CommaFeed will be able to warn about invalid properties and typos.
 
-All [CommaFeed settings](commafeed-server/doc/commafeed.md) are optional and have sensible default values.
+All [CommaFeed settings](https://athou.github.io/commafeed/documentation) are optional and have sensible default values.
 
 When logging in, credentials are stored in an encrypted cookie. The encryption key is randomly generated at startup,
 meaning that you will have to log back in after each restart of the application. To prevent this, you can set the

commafeed-client/index.html

@@ -1,11 +1,15 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
-  <meta charset="UTF-8" />
-  <link rel="icon" type="image/x-icon" href="favicon.ico" />
-  <link rel="manifest" href="manifest.json" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
-  <title>CommaFeed</title>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/x-icon" href="favicon.ico" />
+    <link rel="manifest" href="manifest.json" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
+
+    <link rel="stylesheet" type="text/css" href="custom_css.css" />
+    <script type="text/javascript" src="custom_js.js"></script>
+
+    <title>CommaFeed</title>
 </head>
 <body>
 <div id="root"></div>

commafeed-client/package.json

@@ -17,64 +17,69 @@
     "dependencies": {
         "@emotion/react": "^11.14.0",
         "@fontsource/open-sans": "^5.1.1",
-        "@mantine/core": "^7.16.0",
-        "@mantine/form": "^7.16.0",
-        "@mantine/hooks": "^7.16.0",
-        "@mantine/modals": "^7.16.0",
-        "@mantine/notifications": "^7.16.0",
-        "@mantine/spotlight": "^7.16.0",
-        "@lingui/core": "^5.1.2",
-        "@lingui/react": "^5.1.2",
-        "@monaco-editor/react": "^4.6.0",
-        "@reduxjs/toolkit": "^2.5.0",
+        "@lingui/core": "^5.2.0",
+        "@lingui/react": "^5.2.0",
+        "@mantine/core": "^7.17.0",
+        "@mantine/form": "^7.17.0",
+        "@mantine/hooks": "^7.17.0",
+        "@mantine/modals": "^7.17.0",
+        "@mantine/notifications": "^7.17.0",
+        "@mantine/spotlight": "^7.17.0",
+        "@monaco-editor/react": "^4.7.0",
+        "@reduxjs/toolkit": "^2.5.1",
         "axios": "^1.7.9",
         "dayjs": "^1.11.13",
         "escape-string-regexp": "^5.0.0",
-        "interweave": "^13.1.0",
+        "interweave": "^13.1.1",
         "monaco-editor": "^0.52.2",
         "mousetrap": "^1.6.5",
-        "react": "^18.3.1",
+        "react": "^19.0.0",
         "react-async-hook": "^4.0.0",
         "react-contexify": "^6.0.0",
         "react-device-detect": "^2.2.3",
-        "react-dom": "^18.3.1",
+        "react-dom": "^19.0.0",
         "react-draggable": "^4.4.6",
         "react-ga4": "^2.1.0",
-        "react-helmet": "^6.1.0",
-        "react-icons": "^5.4.0",
+        "react-icons": "^5.5.0",
         "react-infinite-scroller": "^1.2.6",
         "react-redux": "^9.2.0",
-        "react-router-dom": "^7.1.2",
+        "react-router-dom": "^7.2.0",
         "react-swipeable": "^7.0.2",
-        "redoc": "^2.3.0",
+        "redoc": "^2.4.0",
         "style-to-object": "^1.0.8",
         "throttle-debounce": "^5.0.2",
         "tinycon": "^0.6.8",
-        "tss-react": "^4.9.14",
+        "tss-react": "^4.9.15",
         "websocket-heartbeat-js": "^1.1.3"
     },
     "devDependencies": {
         "@biomejs/biome": "^1.9.4",
-        "@lingui/babel-plugin-lingui-macro": "^5.1.2",
-        "@lingui/cli": "^5.1.2",
-        "@lingui/vite-plugin": "^5.1.2",
+        "@lingui/babel-plugin-lingui-macro": "^5.2.0",
+        "@lingui/cli": "^5.2.0",
+        "@lingui/vite-plugin": "^5.2.0",
+        "@testing-library/jest-dom": "^6.6.3",
+        "@testing-library/react": "^16.2.0",
+        "@testing-library/user-event": "^14.6.1",
         "@types/mousetrap": "^1.6.15",
-        "@types/react": "^18.3.18",
-        "@types/react-dom": "^18.3.5",
-        "@types/react-helmet": "^6.1.11",
+        "@types/react": "^19.0.10",
+        "@types/react-dom": "^19.0.4",
         "@types/react-infinite-scroller": "^1.2.5",
-        "@types/swagger-ui-react": "^4.18.3",
         "@types/throttle-debounce": "^5.0.2",
         "@types/tinycon": "^0.6.7",
         "@vitejs/plugin-react": "^4.3.4",
         "babel-plugin-macros": "^3.1.0",
         "jsdom": "^26.0.0",
-        "rollup-plugin-visualizer": "^5.13.1",
+        "rollup-plugin-visualizer": "^5.14.0",
         "typescript": "^5.7.3",
-        "vite": "^6.0.7",
-        "vite-plugin-checker": "^0.8.0",
+        "vite": "^6.1.1",
+        "vite-plugin-checker": "^0.9.0",
         "vite-tsconfig-paths": "^5.1.4",
-        "vitest": "^3.0.1",
-        "vitest-mock-extended": "^2.0.2"
+        "vitest": "^3.0.6",
+        "vitest-mock-extended": "^3.0.1"
+    },
+    "overrides": {
+        "react-infinite-scroller": {
+            "react": "^19.0.0"
+        }
     }
 }

commafeed-client/pom.xml

@@ -6,16 +6,16 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>5.4.0</version>
+		<version>5.6.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>
 
 	<properties>
 		<!-- renovate: datasource=node-version depName=node -->
-		<node.version>v22.13.0</node.version>
+		<node.version>v22.14.0</node.version>
 		<!-- renovate: datasource=npm depName=npm -->
-		<npm.version>11.0.0</npm.version>
+		<npm.version>11.1.0</npm.version>
 	</properties>
 
 	<build>

commafeed-client/src/App.tsx

@@ -32,7 +32,6 @@ import { RegistrationPage } from "pages/auth/RegistrationPage"
 import React, { useEffect } from "react"
 import { isSafari } from "react-device-detect"
 import ReactGA from "react-ga4"
-import { Helmet } from "react-helmet"
 import { HashRouter, Navigate, Route, Routes, useLocation, useNavigate } from "react-router-dom"
 import Tinycon from "tinycon"
 
@@ -143,7 +142,7 @@ function GoogleAnalyticsHandler() {
 }
 
 function UnreadCountTitleHandler({ unreadCount, enabled }: { unreadCount: number; enabled?: boolean }) {
-    return <Helmet title={enabled && unreadCount > 0 ? `(${unreadCount}) CommaFeed` : "CommaFeed"} />
+    return <title>{enabled && unreadCount > 0 ? `(${unreadCount}) CommaFeed` : "CommaFeed"}</title>
 }
 
 function UnreadCountFaviconHandler({ unreadCount, enabled }: { unreadCount: number; enabled?: boolean }) {
@@ -170,15 +169,6 @@ function BrowserExtensionBadgeUnreadCountHandler() {
     return null
 }
 
-function CustomCode() {
-    return (
-        <Helmet>
-            <link rel="stylesheet" type="text/css" href="custom_css.css" />
-            <script type="text/javascript" src="custom_js.js" />
-        </Helmet>
-    )
-}
-
 export function App() {
     useI18n()
     const root = useAppSelector(state => state.tree.rootCategory)
@@ -202,7 +192,6 @@ export function App() {
                     <GoogleAnalyticsHandler />
                     <RedirectHandler />
                     <AppRoutes />
-                    <CustomCode />
                     {/* disable pull-to-refresh as it messes with vertical scrolling
                         safari behaves weirdly when overscroll-behavior is set to none so we disable it only for other browsers
                         https://github.com/Athou/commafeed/issues/1168

commafeed-client/src/app/constants.ts

@@ -1,13 +1,11 @@
-import { t } from "@lingui/core/macro"
 import type { IconType } from "react-icons"
 import { FaAt } from "react-icons/fa"
 import { SiBuffer, SiFacebook, SiGmail, SiInstapaper, SiPocket, SiTumblr, SiX } from "react-icons/si"
 import type { Category, Entry, SharingSettings } from "./types"
 
-const categories: Record<string, Category> = {
+const categories: Record<string, Omit<Category, "name">> = {
     all: {
         id: "all",
-        name: t`All`,
         expanded: false,
         children: [],
         feeds: [],
@@ -15,7 +13,6 @@ const categories: Record<string, Category> = {
     },
     starred: {
         id: "starred",
-        name: t`Starred`,
         expanded: false,
         children: [],
         feeds: [],

commafeed-client/src/app/entries/thunks.ts

@@ -11,6 +11,7 @@ import { flushSync } from "react-dom"
 
 const getEndpoint = (sourceType: EntrySourceType) =>
     sourceType === "category" || sourceType === "tag" ? client.category.getEntries : client.feed.getEntries
+
 export const loadEntries = createAppAsyncThunk(
     "entries/load",
     async (
@@ -28,6 +29,7 @@ export const loadEntries = createAppAsyncThunk(
         return result.data
     }
 )
+
 export const loadMoreEntries = createAppAsyncThunk("entries/loadMore", async (_, thunkApi) => {
     const state = thunkApi.getState()
     const { source } = state.entries
@@ -37,6 +39,7 @@ export const loadMoreEntries = createAppAsyncThunk("entries/loadMore", async (_,
     const result = await endpoint(buildGetEntriesPaginatedRequest(state, source, offset))
     return result.data
 })
+
 const buildGetEntriesPaginatedRequest = (state: RootState, source: EntrySource, offset: number) => ({
     id: source.type === "tag" ? Constants.categories.all.id : source.id,
     order: state.user.settings?.readingOrder,
@@ -46,15 +49,18 @@ const buildGetEntriesPaginatedRequest = (state: RootState, source: EntrySource,
     tag: source.type === "tag" ? source.id : undefined,
     keywords: state.entries.search,
 })
+
 export const reloadEntries = createAppAsyncThunk("entries/reload", (arg, thunkApi) => {
     const state = thunkApi.getState()
     thunkApi.dispatch(loadEntries({ source: state.entries.source, clearSearch: false }))
 })
+
 export const search = createAppAsyncThunk("entries/search", (arg: string, thunkApi) => {
     const state = thunkApi.getState()
     thunkApi.dispatch(setSearch(arg))
     thunkApi.dispatch(loadEntries({ source: state.entries.source, clearSearch: false }))
 })
+
 export const markEntry = createAppAsyncThunk(
     "entries/entry/mark",
     (arg: { entry: Entry; read: boolean }) => {
@@ -67,6 +73,7 @@ export const markEntry = createAppAsyncThunk(
         condition: arg => arg.entry.markable && arg.entry.read !== arg.read,
     }
 )
+
 export const markMultipleEntries = createAppAsyncThunk(
     "entries/entry/markMultiple",
     async (
@@ -84,6 +91,7 @@ export const markMultipleEntries = createAppAsyncThunk(
         thunkApi.dispatch(reloadTree())
     }
 )
+
 export const markEntriesUpToEntry = createAppAsyncThunk("entries/entry/upToEntry", (arg: Entry, thunkApi) => {
     const state = thunkApi.getState()
     const { entries } = state.entries
@@ -98,6 +106,7 @@ export const markEntriesUpToEntry = createAppAsyncThunk("entries/entry/upToEntry
         })
     )
 })
+
 export const markAllEntries = createAppAsyncThunk(
     "entries/entry/markAll",
     async (
@@ -113,6 +122,7 @@ export const markAllEntries = createAppAsyncThunk(
         thunkApi.dispatch(reloadTree())
     }
 )
+
 export const starEntry = createAppAsyncThunk(
     "entries/entry/star",
     (arg: { entry: Entry; starred: boolean }) => {
@@ -126,6 +136,7 @@ export const starEntry = createAppAsyncThunk(
         condition: arg => arg.entry.markable && arg.entry.starred !== arg.starred,
     }
 )
+
 export const selectEntry = createAppAsyncThunk(
     "entries/entry/select",
     (
@@ -191,6 +202,7 @@ export const selectEntry = createAppAsyncThunk(
         }
     }
 )
+
 const scrollToEntry = (entryElement: HTMLElement, margin: number, scrollSpeed: number | undefined, onScrollEnded: () => void) => {
     const header = document.getElementById(Constants.dom.headerId)?.getBoundingClientRect()
     const offset = (header?.bottom ?? 0) + margin
@@ -228,6 +240,7 @@ export const selectPreviousEntry = createAppAsyncThunk(
         }
     }
 )
+
 export const selectNextEntry = createAppAsyncThunk(
     "entries/entry/selectNext",
     async (
@@ -261,6 +274,7 @@ export const selectNextEntry = createAppAsyncThunk(
         }
     }
 )
+
 export const tagEntry = createAppAsyncThunk("entries/entry/tag", async (arg: TagRequest, thunkApi) => {
     await client.entry.tag(arg)
     thunkApi.dispatch(reloadTags())

commafeed-client/src/app/redirect/thunks.ts

@@ -3,43 +3,55 @@ import { Constants } from "app/constants"
 import { redirectTo } from "app/redirect/slice"
 
 export const redirectToLogin = createAppAsyncThunk("redirect/login", (_, thunkApi) => thunkApi.dispatch(redirectTo("/login")))
+
 export const redirectToRegistration = createAppAsyncThunk("redirect/register", (_, thunkApi) => thunkApi.dispatch(redirectTo("/register")))
-export const redirectToPasswordRecovery = createAppAsyncThunk("redirect/passwordRecovery", (_, thunkApi) =>
-    thunkApi.dispatch(redirectTo("/passwordRecovery"))
-)
+
 export const redirectToApiDocumentation = createAppAsyncThunk("redirect/api", (_, thunkApi) => thunkApi.dispatch(redirectTo("/api")))
 
 export const redirectToSelectedSource = createAppAsyncThunk("redirect/selectedSource", (_, thunkApi) => {
     const { source } = thunkApi.getState().entries
     thunkApi.dispatch(redirectTo(`/app/${source.type}/${source.id}`))
 })
+
 export const redirectToCategory = createAppAsyncThunk("redirect/category", (id: string, thunkApi) =>
     thunkApi.dispatch(redirectTo(`/app/category/${id}`))
 )
+
 export const redirectToRootCategory = createAppAsyncThunk(
     "redirect/category/root",
     async (_, thunkApi) => await thunkApi.dispatch(redirectToCategory(Constants.categories.all.id))
 )
+
 export const redirectToCategoryDetails = createAppAsyncThunk("redirect/category/details", (id: string, thunkApi) =>
     thunkApi.dispatch(redirectTo(`/app/category/${id}/details`))
 )
+
 export const redirectToFeed = createAppAsyncThunk("redirect/feed", (id: string | number, thunkApi) =>
     thunkApi.dispatch(redirectTo(`/app/feed/${id}`))
 )
+
 export const redirectToFeedDetails = createAppAsyncThunk("redirect/feed/details", (id: string, thunkApi) =>
     thunkApi.dispatch(redirectTo(`/app/feed/${id}/details`))
 )
+
 export const redirectToTag = createAppAsyncThunk("redirect/tag", (id: string, thunkApi) => thunkApi.dispatch(redirectTo(`/app/tag/${id}`)))
+
 export const redirectToTagDetails = createAppAsyncThunk("redirect/tag/details", (id: string, thunkApi) =>
     thunkApi.dispatch(redirectTo(`/app/tag/${id}/details`))
 )
+
 export const redirectToAdd = createAppAsyncThunk("redirect/add", (_, thunkApi) => thunkApi.dispatch(redirectTo("/app/add")))
+
 export const redirectToSettings = createAppAsyncThunk("redirect/settings", (_, thunkApi) => thunkApi.dispatch(redirectTo("/app/settings")))
+
 export const redirectToAdminUsers = createAppAsyncThunk("redirect/admin/users", (_, thunkApi) =>
     thunkApi.dispatch(redirectTo("/app/admin/users"))
 )
+
 export const redirectToMetrics = createAppAsyncThunk("redirect/admin/metrics", (_, thunkApi) =>
     thunkApi.dispatch(redirectTo("/app/admin/metrics"))
 )
+
 export const redirectToDonate = createAppAsyncThunk("redirect/donate", (_, thunkApi) => thunkApi.dispatch(redirectTo("/app/donate")))
+
 export const redirectToAbout = createAppAsyncThunk("redirect/about", (_, thunkApi) => thunkApi.dispatch(redirectTo("/app/about")))

commafeed-client/src/app/tree/thunks.ts

@@ -1,9 +1,35 @@
 import { createAppAsyncThunk } from "app/async-thunk"
 import { client } from "app/client"
+import { incrementUnreadCount } from "app/tree/slice"
 import type { CollapseRequest } from "app/types"
+import { flattenCategoryTree } from "app/utils"
 
 export const reloadTree = createAppAsyncThunk("tree/reload", async () => await client.category.getRoot().then(r => r.data))
+
 export const collapseTreeCategory = createAppAsyncThunk(
     "tree/category/collapse",
     async (req: CollapseRequest) => await client.category.collapse(req)
 )
+
+export const newFeedEntriesDiscovered = createAppAsyncThunk(
+    "tree/new-feed-entries-discovered",
+    async ({ feedId, amount }: { feedId: number; amount: number }, thunkApi) => {
+        const root = thunkApi.getState().tree.rootCategory
+        if (!root) return
+
+        const feed = flattenCategoryTree(root)
+            .flatMap(c => c.feeds)
+            .some(f => f.id === feedId)
+        if (!feed) {
+            // feed not found in the tree, reload the tree completely
+            thunkApi.dispatch(reloadTree())
+        } else {
+            thunkApi.dispatch(
+                incrementUnreadCount({
+                    feedId,
+                    amount,
+                })
+            )
+        }
+    }
+)

commafeed-client/src/app/user/thunks.ts

@@ -4,45 +4,55 @@ import { reloadEntries } from "app/entries/thunks"
 import type { IconDisplayMode, ReadingMode, ReadingOrder, ScrollMode, SharingSettings } from "app/types"
 
 export const reloadSettings = createAppAsyncThunk("settings/reload", async () => await client.user.getSettings().then(r => r.data))
+
 export const reloadProfile = createAppAsyncThunk("profile/reload", async () => await client.user.getProfile().then(r => r.data))
+
 export const reloadTags = createAppAsyncThunk("entries/tags", async () => await client.entry.getTags().then(r => r.data))
+
 export const changeReadingMode = createAppAsyncThunk("settings/readingMode", (readingMode: ReadingMode, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, readingMode })
     thunkApi.dispatch(reloadEntries())
 })
+
 export const changeReadingOrder = createAppAsyncThunk("settings/readingOrder", (readingOrder: ReadingOrder, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, readingOrder })
     thunkApi.dispatch(reloadEntries())
 })
+
 export const changeLanguage = createAppAsyncThunk("settings/language", (language: string, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, language })
 })
+
 export const changeScrollSpeed = createAppAsyncThunk("settings/scrollSpeed", (speed: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, scrollSpeed: speed ? 400 : 0 })
 })
+
 export const changeShowRead = createAppAsyncThunk("settings/showRead", (showRead: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, showRead })
 })
+
 export const changeScrollMarks = createAppAsyncThunk("settings/scrollMarks", (scrollMarks: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, scrollMarks })
 })
+
 export const changeScrollMode = createAppAsyncThunk("settings/scrollMode", (scrollMode: ScrollMode, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, scrollMode })
 })
+
 export const changeEntriesToKeepOnTopWhenScrolling = createAppAsyncThunk(
     "settings/entriesToKeepOnTopWhenScrolling",
     (entriesToKeepOnTopWhenScrolling: number, thunkApi) => {
@@ -51,6 +61,7 @@ export const changeEntriesToKeepOnTopWhenScrolling = createAppAsyncThunk(
         client.user.saveSettings({ ...settings, entriesToKeepOnTopWhenScrolling })
     }
 )
+
 export const changeStarIconDisplayMode = createAppAsyncThunk(
     "settings/starIconDisplayMode",
     (starIconDisplayMode: IconDisplayMode, thunkApi) => {
@@ -59,6 +70,7 @@ export const changeStarIconDisplayMode = createAppAsyncThunk(
         client.user.saveSettings({ ...settings, starIconDisplayMode })
     }
 )
+
 export const changeExternalLinkIconDisplayMode = createAppAsyncThunk(
     "settings/externalLinkIconDisplayMode",
     (externalLinkIconDisplayMode: IconDisplayMode, thunkApi) => {
@@ -67,6 +79,7 @@ export const changeExternalLinkIconDisplayMode = createAppAsyncThunk(
         client.user.saveSettings({ ...settings, externalLinkIconDisplayMode })
     }
 )
+
 export const changeMarkAllAsReadConfirmation = createAppAsyncThunk(
     "settings/markAllAsReadConfirmation",
     (markAllAsReadConfirmation: boolean, thunkApi) => {
@@ -75,26 +88,31 @@ export const changeMarkAllAsReadConfirmation = createAppAsyncThunk(
         client.user.saveSettings({ ...settings, markAllAsReadConfirmation })
     }
 )
+
 export const changeCustomContextMenu = createAppAsyncThunk("settings/customContextMenu", (customContextMenu: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, customContextMenu })
 })
+
 export const changeMobileFooter = createAppAsyncThunk("settings/mobileFooter", (mobileFooter: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, mobileFooter })
 })
+
 export const changeUnreadCountTitle = createAppAsyncThunk("settings/unreadCountTitle", (unreadCountTitle: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, unreadCountTitle })
 })
+
 export const changeUnreadCountFavicon = createAppAsyncThunk("settings/unreadCountFavicon", (unreadCountFavicon: boolean, thunkApi) => {
     const { settings } = thunkApi.getState().user
     if (!settings) return
     client.user.saveSettings({ ...settings, unreadCountFavicon })
 })
+
 export const changeSharingSetting = createAppAsyncThunk(
     "settings/sharingSetting",
     (

commafeed-client/src/components/DisablePullToRefresh.css

@@ -0,0 +1,4 @@
+html,
+body {
+    overscroll-behavior: none;
+}

commafeed-client/src/components/DisablePullToRefresh.tsx

@@ -1,15 +1,4 @@
-import { Helmet } from "react-helmet"
-
 export const DisablePullToRefresh = () => {
-    return (
-        <Helmet>
-            <style type="text/css">
-                {`
-                    html, body {
-                        overscroll-behavior: none;
-                    }
-                `}
-            </style>
-        </Helmet>
-    )
+    import("./DisablePullToRefresh.css")
+    return <></>
 }

commafeed-client/src/components/content/Content.test.tsx

@@ -0,0 +1,27 @@
+import { MantineProvider } from "@mantine/core"
+import { render } from "@testing-library/react"
+import { Content } from "components/content/Content"
+import React from "react"
+import { describe, expect, it } from "vitest"
+
+describe("Content component", () => {
+    it("renders basic content", () => {
+        const { container } = render(<Content content="<p>Hello World</p>" />, { wrapper: MantineProvider })
+        expect(container.querySelector("p")).toHaveTextContent("Hello World")
+    })
+
+    it("renders highlighted text when highlight prop is provided", () => {
+        const { container } = render(<Content content="Hello World" highlight="World" />, { wrapper: MantineProvider })
+        expect(container.querySelector("mark")).toHaveTextContent("World")
+    })
+
+    it("renders iframe tag when included in content", () => {
+        const { container } = render(<Content content='<iframe src="https://example.com"></iframe>' />, { wrapper: MantineProvider })
+        expect(container.querySelector("iframe")).toHaveAttribute("src", "https://example.com")
+    })
+
+    it("does not render unsupported tags", () => {
+        const { container } = render(<Content content='<script>alert("test")</script>' />, { wrapper: MantineProvider })
+        expect(container.querySelector("script")).toBeNull()
+    })
+})

commafeed-client/src/components/content/Content.tsx

@@ -4,7 +4,7 @@ import { calculatePlaceholderSize } from "app/utils"
 import { ImageWithPlaceholderWhileLoading } from "components/ImageWithPlaceholderWhileLoading"
 import { BasicHtmlStyles } from "components/content/BasicHtmlStyles"
 import escapeStringRegexp from "escape-string-regexp"
-import { type ChildrenNode, Interweave, type MatchResponse, Matcher, type Node, type TransformCallback } from "interweave"
+import { ALLOWED_TAG_LIST, type ChildrenNode, Interweave, type MatchResponse, Matcher, type Node, type TransformCallback } from "interweave"
 import React from "react"
 import styleToObject from "style-to-object"
 import { tss } from "tss"
@@ -88,6 +88,9 @@ class HighlightMatcher extends Matcher {
     }
 }
 
+// allow iframe tag
+const allowList = [...ALLOWED_TAG_LIST, "iframe"]
+
 // memoize component because Interweave is costly
 const Content = React.memo((props: ContentProps) => {
     const { classes } = useStyles()
@@ -96,7 +99,7 @@ const Content = React.memo((props: ContentProps) => {
     return (
         <BasicHtmlStyles>
             <Box className={classes.content}>
-                <Interweave content={props.content} transform={transform} matchers={matchers} />
+                <Interweave content={props.content} transform={transform} matchers={matchers} allowList={allowList} />
             </Box>
         </BasicHtmlStyles>
     )

commafeed-client/src/components/content/Enclosure.tsx

@@ -19,7 +19,7 @@ export function Enclosure(props: {
             )}
             {hasAudio && (
                 // biome-ignore lint/a11y/useMediaCaption: we don't have any captions for audio
-                <audio controls>
+                <audio controls style={{ width: "100%" }}>
                     <source src={props.enclosureUrl} type={props.enclosureType} />
                 </audio>
             )}

commafeed-client/src/components/content/add/Subscribe.tsx

@@ -39,8 +39,8 @@ export function Subscribe() {
         },
     })
     const subscribe = useAsyncCallback(client.feed.subscribe, {
-        onSuccess: sub => {
-            dispatch(reloadTree())
+        onSuccess: async sub => {
+            await dispatch(reloadTree())
             dispatch(redirectToFeed(sub.data))
         },
     })

commafeed-client/src/hooks/useWebSocket.ts

@@ -1,6 +1,6 @@
 import { setWebSocketConnected } from "app/server/slice"
 import { type AppDispatch, useAppDispatch, useAppSelector } from "app/store"
-import { incrementUnreadCount } from "app/tree/slice"
+import { newFeedEntriesDiscovered } from "app/tree/thunks"
 import { useEffect } from "react"
 import WebsocketHeartbeatJs from "websocket-heartbeat-js"
 
@@ -9,7 +9,7 @@ const handleMessage = (dispatch: AppDispatch, message: string) => {
     const type = parts[0]
     if (type === "new-feed-entries") {
         dispatch(
-            incrementUnreadCount({
+            newFeedEntriesDiscovered({
                 feedId: +parts[1],
                 amount: +parts[2],
             })

commafeed-client/src/pages/app/CategoryDetailsPage.tsx

@@ -1,3 +1,5 @@
+import { msg } from "@lingui/core/macro"
+import { useLingui } from "@lingui/react"
 import { Trans } from "@lingui/react/macro"
 import { Anchor, Box, Button, Code, Container, Divider, Group, Input, NumberInput, Stack, Text, TextInput, Title } from "@mantine/core"
 import { useForm } from "@mantine/form"
@@ -19,6 +21,7 @@ import { useParams } from "react-router-dom"
 
 export function CategoryDetailsPage() {
     const { id = Constants.categories.all.id } = useParams()
+    const { _ } = useLingui()
 
     const apiKey = useAppSelector(state => state.user.profile?.apiKey)
     const dispatch = useAppDispatch()
@@ -26,7 +29,7 @@ export function CategoryDetailsPage() {
     const query = useAsync(async () => await client.category.getRoot(), [])
     const category =
         id === Constants.categories.starred.id
-            ? Constants.categories.starred
+            ? { ...Constants.categories.starred, name: _(msg`Starred`) }
             : query.result && flattenCategoryTree(query.result.data).find(c => c.id === id)
 
     const form = useForm<CategoryModificationRequest>()
@@ -63,14 +66,14 @@ export function CategoryDetailsPage() {
     }
 
     useEffect(() => {
-        if (!category) return
+        if (!category?.id) return
         setValues({
             id: +category.id,
             name: category.name,
             parentId: category.parentId,
             position: category.position,
         })
-    }, [setValues, category])
+    }, [setValues, category?.id, category?.name, category?.parentId, category?.position])
 
     const editable = id !== Constants.categories.all.id && id !== Constants.categories.starred.id
     if (!category) return <Loader />

commafeed-client/src/pages/app/Layout.tsx

@@ -18,7 +18,7 @@ import { useBrowserExtension } from "hooks/useBrowserExtension"
 import { useMobile } from "hooks/useMobile"
 import { useWebSocket } from "hooks/useWebSocket"
 import { LoadingPage } from "pages/LoadingPage"
-import { type ReactNode, Suspense, useEffect, useRef } from "react"
+import { type ReactNode, type RefObject, Suspense, useEffect, useRef } from "react"
 import Draggable from "react-draggable"
 import { TbMenu2, TbPlus, TbX } from "react-icons/tb"
 import { Outlet } from "react-router-dom"
@@ -185,7 +185,7 @@ export default function Layout(props: LayoutProps) {
                 </AppShell.Navbar>
                 <OnDesktop>
                     <Draggable
-                        nodeRef={draggableSeparator}
+                        nodeRef={draggableSeparator as RefObject<HTMLElement>}
                         axis="x"
                         defaultPosition={{
                             x: sidebarWidth,

commafeed-client/src/setupTests.ts

@@ -0,0 +1,16 @@
+import "@testing-library/jest-dom"
+import { vi } from "vitest"
+
+Object.defineProperty(window, "matchMedia", {
+    writable: true,
+    value: vi.fn().mockImplementation(query => ({
+        matches: false,
+        media: query,
+        onchange: null,
+        addListener: vi.fn(), // deprecated
+        removeListener: vi.fn(), // deprecated
+        addEventListener: vi.fn(),
+        removeEventListener: vi.fn(),
+        dispatchEvent: vi.fn(),
+    })),
+})

commafeed-client/vite.config.ts

@@ -52,5 +52,7 @@ export default defineConfig(() => ({
     },
     test: {
         environment: "jsdom",
+        globals: true,
+        setupFiles: "./src/setupTests.ts",
     },
 }))

commafeed-server/doc/commafeed.md

@@ -1,799 +0,0 @@
-🔒: Configuration property fixed at build time - All other configuration properties are overridable at runtime
-
-<table>
-<thead>
-<tr>
-<th align="left">Configuration property</th>
-<th>Type</th>
-<th>Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td>
-
-`commafeed.hide-from-web-crawlers`
-
-Whether to expose a robots.txt file that disallows web crawlers and search engine indexers.
-
-
-
-Environment variable: `COMMAFEED_HIDE_FROM_WEB_CRAWLERS`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`true`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.image-proxy-enabled`
-
-If enabled, images in feed entries will be proxied through the server instead of accessed directly by the browser.
-
-This is useful if commafeed is accessed through a restricting proxy that blocks some feeds that are followed.
-
-
-
-Environment variable: `COMMAFEED_IMAGE_PROXY_ENABLED`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`false`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.password-recovery-enabled`
-
-Enable password recovery via email.
-
-Quarkus mailer will need to be configured.
-
-
-
-Environment variable: `COMMAFEED_PASSWORD_RECOVERY_ENABLED`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`false`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.announcement`
-
-Message displayed in a notification at the bottom of the page.
-
-
-
-Environment variable: `COMMAFEED_ANNOUNCEMENT`</td>
-<td>
-
-string
-</td>
-<td>
-
-
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.google-analytics-tracking-code`
-
-Google Analytics tracking code.
-
-
-
-Environment variable: `COMMAFEED_GOOGLE_ANALYTICS_TRACKING_CODE`</td>
-<td>
-
-string
-</td>
-<td>
-
-
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.google-auth-key`
-
-Google Auth key for fetching Youtube channel favicons.
-
-
-
-Environment variable: `COMMAFEED_GOOGLE_AUTH_KEY`</td>
-<td>
-
-string
-</td>
-<td>
-
-
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-HTTP client configuration
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.http-client.user-agent`
-
-User-Agent string that will be used by the http client, leave empty for the default one.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_USER_AGENT`</td>
-<td>
-
-string
-</td>
-<td>
-
-
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.connect-timeout`
-
-Time to wait for a connection to be established.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_CONNECT_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`5S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.ssl-handshake-timeout`
-
-Time to wait for SSL handshake to complete.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_SSL_HANDSHAKE_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`5S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.socket-timeout`
-
-Time to wait between two packets before timeout.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_SOCKET_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`10S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.response-timeout`
-
-Time to wait for the full response to be received.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_RESPONSE_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`10S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.connection-time-to-live`
-
-Time to live for a connection in the pool.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_CONNECTION_TIME_TO_LIVE`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`30S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.idle-connections-eviction-interval`
-
-Time between eviction runs for idle connections.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_IDLE_CONNECTIONS_EVICTION_INTERVAL`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`1M`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.max-response-size`
-
-If a feed is larger than this, it will be discarded to prevent memory issues while parsing the feed.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_MAX_RESPONSE_SIZE`</td>
-<td>
-
-MemorySize [🛈](#memory-size-note-anchor)
-</td>
-<td>
-
-`5M`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-&nbsp;&nbsp;&nbsp;&nbsp;HTTP client cache configuration
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.http-client.cache.enabled`
-
-Whether to enable the cache. This cache is used to avoid spamming feeds in short bursts (e.g. when subscribing to a feed for the
-first time or when clicking "fetch all my feeds now").
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_CACHE_ENABLED`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`true`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.cache.maximum-memory-size`
-
-Maximum amount of memory the cache can use.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_CACHE_MAXIMUM_MEMORY_SIZE`</td>
-<td>
-
-MemorySize [🛈](#memory-size-note-anchor)
-</td>
-<td>
-
-`10M`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.http-client.cache.expiration`
-
-Duration after which an entry is removed from the cache.
-
-
-
-Environment variable: `COMMAFEED_HTTP_CLIENT_CACHE_EXPIRATION`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`1M`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-Feed refresh engine settings
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.feed-refresh.interval`
-
-Amount of time CommaFeed will wait before refreshing the same feed.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_INTERVAL`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`5M`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.interval-empirical`
-
-If true, CommaFeed will calculate the next refresh time based on the feed's average time between entries and the time since the
-last entry was published. The interval will be somewhere between the default refresh interval and 24h.
-
-See <code>FeedRefreshIntervalCalculator</code> for details.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_INTERVAL_EMPIRICAL`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`false`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.http-threads`
-
-Amount of http threads used to fetch feeds.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_HTTP_THREADS`</td>
-<td>
-
-int
-</td>
-<td>
-
-`3`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.database-threads`
-
-Amount of threads used to insert new entries in the database.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_DATABASE_THREADS`</td>
-<td>
-
-int
-</td>
-<td>
-
-`1`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.user-inactivity-period`
-
-Duration after which a user is considered inactive. Feeds for inactive users are not refreshed until they log in again.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_USER_INACTIVITY_PERIOD`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`0S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.filtering-expression-evaluation-timeout`
-
-Duration after which the evaluation of a filtering expresion to mark an entry as read is considered to have timed out.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_FILTERING_EXPRESSION_EVALUATION_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`500MS`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.feed-refresh.force-refresh-cooldown-duration`
-
-Duration after which the "Fetch all my feeds now" action is available again after use to avoid spamming feeds.
-
-
-
-Environment variable: `COMMAFEED_FEED_REFRESH_FORCE_REFRESH_COOLDOWN_DURATION`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`0S`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-Database settings
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.database.query-timeout`
-
-Timeout applied to all database queries.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_QUERY_TIMEOUT`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`0S`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-&nbsp;&nbsp;&nbsp;&nbsp;Database cleanup settings
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.database.cleanup.entries-max-age`
-
-Maximum age of feed entries in the database. Older entries will be deleted.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_CLEANUP_ENTRIES_MAX_AGE`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`365D`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.database.cleanup.statuses-max-age`
-
-Maximum age of feed entry statuses (read/unread) in the database. Older statuses will be deleted.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_CLEANUP_STATUSES_MAX_AGE`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`0S`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.database.cleanup.max-feed-capacity`
-
-Maximum number of entries per feed to keep in the database.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_CLEANUP_MAX_FEED_CAPACITY`</td>
-<td>
-
-int
-</td>
-<td>
-
-`500`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.database.cleanup.max-feeds-per-user`
-
-Limit the number of feeds a user can subscribe to.
-
-0 to disable.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_CLEANUP_MAX_FEEDS_PER_USER`</td>
-<td>
-
-int
-</td>
-<td>
-
-`0`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.database.cleanup.batch-size`
-
-Rows to delete per query while cleaning up old entries.
-
-
-
-Environment variable: `COMMAFEED_DATABASE_CLEANUP_BATCH_SIZE`</td>
-<td>
-
-int
-</td>
-<td>
-
-`100`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-Users settings
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.users.allow-registrations`
-
-Whether to let users create accounts for themselves.
-
-
-
-Environment variable: `COMMAFEED_USERS_ALLOW_REGISTRATIONS`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`false`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.users.strict-password-policy`
-
-Whether to enable strict password validation (1 uppercase char, 1 lowercase char, 1 digit, 1 special char).
-
-
-
-Environment variable: `COMMAFEED_USERS_STRICT_PASSWORD_POLICY`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`true`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.users.create-demo-account`
-
-Whether to create a demo account the first time the app starts.
-
-
-
-Environment variable: `COMMAFEED_USERS_CREATE_DEMO_ACCOUNT`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`false`
-</td>
-</tr>
-<thead>
-<tr>
-<th align="left" colspan="3">
-Websocket settings
-</th>
-</tr>
-</thead>
-
-<tr>
-<td>
-
-`commafeed.websocket.enabled`
-
-Enable websocket connection so the server can notify web clients that there are new entries for feeds.
-
-
-
-Environment variable: `COMMAFEED_WEBSOCKET_ENABLED`</td>
-<td>
-
-boolean
-</td>
-<td>
-
-`true`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.websocket.ping-interval`
-
-Interval at which the client will send a ping message on the websocket to keep the connection alive.
-
-
-
-Environment variable: `COMMAFEED_WEBSOCKET_PING_INTERVAL`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`15M`
-</td>
-</tr>
-<tr>
-<td>
-
-`commafeed.websocket.tree-reload-interval`
-
-If the websocket connection is disabled or the connection is lost, the client will reload the feed tree at this interval.
-
-
-
-Environment variable: `COMMAFEED_WEBSOCKET_TREE_RELOAD_INTERVAL`</td>
-<td>
-
-[Duration](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html) [🛈](#duration-note-anchor)
-</td>
-<td>
-
-`30S`
-</td>
-</tr>
-</tbody>
-</table>
-
-<a name="duration-note-anchor"></a>
-
-> [!NOTE]
-> ### About the Duration format
-> 
-> To write duration values, use the standard `java.time.Duration` format.
-> See the [Duration#parse()](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/time/Duration.html#parse(java.lang.CharSequence)) Java API documentation] for more information.
-> 
-> You can also use a simplified format, starting with a number:
-> 
-> * If the value is only a number, it represents time in seconds.
-> * If the value is a number followed by `ms`, it represents time in milliseconds.
-> 
-> In other cases, the simplified format is translated to the `java.time.Duration` format for parsing:
-> 
-> * If the value is a number followed by `h`, `m`, or `s`, it is prefixed with `PT`.
-> * If the value is a number followed by `d`, it is prefixed with `P`.
-<a name="memory-size-note-anchor"></a>
-
-> [!NOTE]
-> ### About the MemorySize format
-> 
-> A size configuration option recognizes strings in this format (shown as a regular expression): `[0-9]+[KkMmGgTtPpEeZzYy]?`.
-> 
-> If no suffix is given, assume bytes.

commafeed-server/pom.xml

@@ -6,13 +6,13 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>5.4.0</version>
+		<version>5.6.1</version>
 	</parent>
 	<artifactId>commafeed-server</artifactId>
 	<name>CommaFeed Server</name>
 
 	<properties>
-		<quarkus.version>3.17.7</quarkus.version>
+		<quarkus.version>3.18.4</quarkus.version>
 		<querydsl.version>6.10.1</querydsl.version>
 		<rome.version>2.1.0</rome.version>
 		<swagger.version>2.2.28</swagger.version>
@@ -115,6 +115,34 @@
 					</execution>
 				</executions>
 			</plugin>
+			<plugin>
+				<groupId>org.codehaus.mojo</groupId>
+				<artifactId>exec-maven-plugin</artifactId>
+				<version>3.5.0</version>
+				<dependencies>
+					<dependency>
+						<groupId>io.quarkus</groupId>
+						<artifactId>quarkus-extension-processor</artifactId>
+						<version>${quarkus.version}</version>
+					</dependency>
+				</dependencies>
+				<configuration>
+					<includePluginDependencies>true</includePluginDependencies>
+					<mainClass>com.commafeed.tools.CommaFeedPropertiesGenerator</mainClass>
+					<arguments>
+						<argument>${project.build.directory}</argument>
+					</arguments>
+				</configuration>
+				<executions>
+					<execution>
+						<phase>process-test-resources</phase>
+						<goals>
+							<goal>java</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-assembly-plugin</artifactId>
@@ -241,7 +269,7 @@
 					<dependency>
 						<groupId>com.puppycrawl.tools</groupId>
 						<artifactId>checkstyle</artifactId>
-						<version>10.21.1</version>
+						<version>10.21.2</version>
 					</dependency>
 				</dependencies>
 				<executions>
@@ -270,7 +298,7 @@
 			<plugin>
 				<groupId>com.diffplug.spotless</groupId>
 				<artifactId>spotless-maven-plugin</artifactId>
-				<version>2.44.2</version>
+				<version>2.44.3</version>
 				<?m2e ignore?>
 				<executions>
 					<execution>
@@ -297,7 +325,7 @@
 		<dependency>
 			<groupId>com.commafeed</groupId>
 			<artifactId>commafeed-client</artifactId>
-			<version>5.4.0</version>
+			<version>5.6.1</version>
 		</dependency>
 
 		<!-- compile-time processors -->
@@ -453,7 +481,7 @@
 		<dependency>
 			<groupId>org.apache.httpcomponents.client5</groupId>
 			<artifactId>httpclient5</artifactId>
-			<version>5.4.1</version>
+			<version>5.4.2</version>
 		</dependency>
 		<!-- add brotli support for httpclient5 -->
 		<dependency>
@@ -492,7 +520,7 @@
 		<dependency>
 			<groupId>com.microsoft.playwright</groupId>
 			<artifactId>playwright</artifactId>
-			<version>1.49.0</version>
+			<version>1.50.0</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>

commafeed-server/src/main/docker/Dockerfile.jvm

@@ -1,4 +1,4 @@
-FROM ibm-semeru-runtimes:open-21.0.5_11-jre
+FROM ibm-semeru-runtimes:open-21.0.6_7-jre
 EXPOSE 8082
 
 RUN mkdir -p /commafeed/data

commafeed-server/src/main/docker/README.md

@@ -68,7 +68,7 @@ CommaFeed also supports:
 
 ## Configuration
 
-All [CommaFeed settings](https://github.com/Athou/commafeed/blob/master/commafeed-server/doc/commafeed.md) are
+All [CommaFeed settings](https://athou.github.io/commafeed/documentation) are
 optional and have sensible default values.
 
 Settings are overrideable with environment variables. For instance, `commafeed.feed-refresh.interval-empirical` can be

commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java

@@ -138,6 +138,16 @@ public interface CommaFeedConfiguration {
 		@WithDefault("5M")
 		MemorySize maxResponseSize();
 
+		/**
+		 * Prevent access to local addresses to mitigate server-side request forgery (SSRF) attacks, which could potentially expose internal
+		 * resources.
+		 *
+		 * You may want to disable this if you subscribe to feeds that are only available on your local network and you trust all users of
+		 * your CommaFeed instance.
+		 */
+		@WithDefault("true")
+		boolean blockLocalAddresses();
+
 		/**
 		 * HTTP client cache configuration
 		 */
@@ -168,20 +178,39 @@ public interface CommaFeedConfiguration {
 
 	interface FeedRefresh {
 		/**
-		 * Amount of time CommaFeed will wait before refreshing the same feed.
+		 * Default amount of time CommaFeed will wait before refreshing a feed.
 		 */
 		@WithDefault("5m")
 		Duration interval();
 
 		/**
-		 * If true, CommaFeed will calculate the next refresh time based on the feed's average time between entries and the time since the
-		 * last entry was published. The interval will be somewhere between the default refresh interval and 24h.
+		 * Maximum amount of time CommaFeed will wait before refreshing a feed. This is used as an upper bound when:
+		 *
+		 * <ul>
+		 * <li>an error occurs while refreshing a feed and we're backing off exponentially</li>
+		 * <li>we receive a Cache-Control header from the feed</li>
+		 * <li>we receive a Retry-After header from the feed</li>
+		 * </ul>
+		 */
+		@WithDefault("4h")
+		Duration maxInterval();
+
+		/**
+		 * If enabled, CommaFeed will calculate the next refresh time based on the feed's average time between entries and the time since
+		 * the last entry was published. The interval will be sometimes between the default refresh interval
+		 * (`commafeed.feed-refresh.interval`) and the maximum refresh interval (`commafeed.feed-refresh.max-interval`).
 		 * 
 		 * See {@link FeedRefreshIntervalCalculator} for details.
 		 */
-		@WithDefault("false")
+		@WithDefault("true")
 		boolean intervalEmpirical();
 
+		/**
+		 * Feed refresh engine error handling settings.
+		 */
+		@ConfigDocSection
+		FeedRefreshErrorHandling errors();
+
 		/**
 		 * Amount of http threads used to fetch feeds.
 		 */
@@ -217,6 +246,21 @@ public interface CommaFeedConfiguration {
 		Duration forceRefreshCooldownDuration();
 	}
 
+	interface FeedRefreshErrorHandling {
+		/**
+		 * Number of retries before backoff is applied.
+		 */
+		@Min(0)
+		@WithDefault("3")
+		int retriesBeforeBackoff();
+
+		/**
+		 * Duration to wait before retrying after an error. Will be multiplied by the number of errors since the last successful fetch.
+		 */
+		@WithDefault("1h")
+		Duration backoffInterval();
+	}
+
 	interface Database {
 		/**
 		 * Timeout applied to all database queries.

commafeed-server/src/main/java/com/commafeed/CommaFeedProducers.java

@@ -1,5 +1,7 @@
 package com.commafeed;
 
+import java.time.InstantSource;
+
 import com.codahale.metrics.MetricRegistry;
 
 import jakarta.enterprise.inject.Produces;
@@ -8,9 +10,16 @@ import jakarta.inject.Singleton;
 @Singleton
 public class CommaFeedProducers {
 
+	@Produces
+	@Singleton
+	public InstantSource instantSource() {
+		return InstantSource.system();
+	}
+
 	@Produces
 	@Singleton
 	public MetricRegistry metricRegistry() {
 		return new MetricRegistry();
 	}
+
 }

commafeed-server/src/main/java/com/commafeed/backend/HttpGetter.java

@@ -2,15 +2,17 @@ package com.commafeed.backend;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.net.IDN;
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.UnknownHostException;
 import java.time.Duration;
+import java.time.Instant;
+import java.time.InstantSource;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
 import java.util.concurrent.ExecutionException;
+import java.util.stream.Stream;
 
 import org.apache.commons.lang3.StringUtils;
 import org.apache.hc.client5.http.DnsResolver;
@@ -25,6 +27,7 @@ import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuil
 import org.apache.hc.client5.http.io.HttpClientConnectionManager;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.client5.http.protocol.RedirectLocations;
+import org.apache.hc.client5.http.utils.DateUtils;
 import org.apache.hc.core5.http.ClassicHttpRequest;
 import org.apache.hc.core5.http.Header;
 import org.apache.hc.core5.http.HttpEntity;
@@ -51,6 +54,7 @@ import jakarta.ws.rs.core.CacheControl;
 import lombok.Builder;
 import lombok.EqualsAndHashCode;
 import lombok.Getter;
+import lombok.RequiredArgsConstructor;
 import lombok.Value;
 import lombok.extern.slf4j.Slf4j;
 import nl.altindag.ssl.SSLFactory;
@@ -64,11 +68,14 @@ import nl.altindag.ssl.apache5.util.Apache5SslUtils;
 public class HttpGetter {
 
 	private final CommaFeedConfiguration config;
+	private final InstantSource instantSource;
 	private final CloseableHttpClient client;
 	private final Cache<HttpRequest, HttpResponse> cache;
+	private final DnsResolver dnsResolver = SystemDefaultDnsResolver.INSTANCE;
 
-	public HttpGetter(CommaFeedConfiguration config, CommaFeedVersion version, MetricRegistry metrics) {
+	public HttpGetter(CommaFeedConfiguration config, InstantSource instantSource, CommaFeedVersion version, MetricRegistry metrics) {
 		this.config = config;
+		this.instantSource = instantSource;
 
 		PoolingHttpClientConnectionManager connectionManager = newConnectionManager(config);
 		String userAgent = config.httpClient()
@@ -88,11 +95,20 @@ public class HttpGetter {
 				() -> cache == null ? 0 : cache.asMap().values().stream().mapToInt(e -> e.content != null ? e.content.length : 0).sum());
 	}
 
-	public HttpResult get(String url) throws IOException, NotModifiedException {
+	public HttpResult get(String url)
+			throws IOException, NotModifiedException, TooManyRequestsException, SchemeNotAllowedException, HostNotAllowedException {
 		return get(HttpRequest.builder(url).build());
 	}
 
-	public HttpResult get(HttpRequest request) throws IOException, NotModifiedException {
+	public HttpResult get(HttpRequest request)
+			throws IOException, NotModifiedException, TooManyRequestsException, SchemeNotAllowedException, HostNotAllowedException {
+		URI uri = URI.create(request.getUrl());
+		ensureHttpScheme(uri.getScheme());
+
+		if (config.httpClient().blockLocalAddresses()) {
+			ensurePublicAddress(uri.getHost());
+		}
+
 		final HttpResponse response;
 		if (cache == null) {
 			response = invoke(request);
@@ -109,9 +125,15 @@ public class HttpGetter {
 		}
 
 		int code = response.getCode();
+		if (code == HttpStatus.SC_TOO_MANY_REQUESTS || code == HttpStatus.SC_SERVICE_UNAVAILABLE && response.getRetryAfter() != null) {
+			throw new TooManyRequestsException(response.getRetryAfter());
+		}
+
 		if (code == HttpStatus.SC_NOT_MODIFIED) {
 			throw new NotModifiedException("'304 - not modified' http code received");
-		} else if (code >= 300) {
+		}
+
+		if (code >= 300) {
 			throw new HttpResponseException(code, "Server returned HTTP error code " + code);
 		}
 
@@ -134,6 +156,28 @@ public class HttpGetter {
 				response.getUrlAfterRedirect(), validFor);
 	}
 
+	private void ensureHttpScheme(String scheme) throws SchemeNotAllowedException {
+		if (!"http".equals(scheme) && !"https".equals(scheme)) {
+			throw new SchemeNotAllowedException(scheme);
+		}
+	}
+
+	private void ensurePublicAddress(String host) throws HostNotAllowedException, UnknownHostException {
+		if (host == null) {
+			throw new HostNotAllowedException(null);
+		}
+
+		InetAddress[] addresses = dnsResolver.resolve(host);
+		if (Stream.of(addresses).anyMatch(this::isPrivateAddress)) {
+			throw new HostNotAllowedException(host);
+		}
+	}
+
+	private boolean isPrivateAddress(InetAddress address) {
+		return address.isSiteLocalAddress() || address.isAnyLocalAddress() || address.isLinkLocalAddress() || address.isLoopbackAddress()
+				|| address.isMulticastAddress();
+	}
+
 	private HttpResponse invoke(HttpRequest request) throws IOException {
 		log.debug("fetching {}", request.getUrl());
 
@@ -165,6 +209,12 @@ public class HttpGetter {
 					.map(HttpGetter::toCacheControl)
 					.orElse(null);
 
+			Instant retryAfter = Optional.ofNullable(resp.getFirstHeader(HttpHeaders.RETRY_AFTER))
+					.map(NameValuePair::getValue)
+					.map(StringUtils::trimToNull)
+					.map(this::toInstant)
+					.orElse(null);
+
 			String contentType = Optional.ofNullable(resp.getEntity()).map(HttpEntity::getContentType).orElse(null);
 			String urlAfterRedirect = Optional.ofNullable(context.getRedirectLocations())
 					.map(RedirectLocations::getAll)
@@ -172,7 +222,7 @@ public class HttpGetter {
 					.map(URI::toString)
 					.orElse(request.getUrl());
 
-			return new HttpResponse(code, lastModifiedHeader, eTagHeader, cacheControl, content, contentType, urlAfterRedirect);
+			return new HttpResponse(code, lastModifiedHeader, eTagHeader, cacheControl, retryAfter, content, contentType, urlAfterRedirect);
 		});
 	}
 
@@ -185,6 +235,18 @@ public class HttpGetter {
 		}
 	}
 
+	private Instant toInstant(String headerValue) {
+		if (headerValue == null) {
+			return null;
+		}
+
+		if (StringUtils.isNumeric(headerValue)) {
+			return instantSource.instant().plusSeconds(Long.parseLong(headerValue));
+		}
+
+		return DateUtils.parseStandardDate(headerValue);
+	}
+
 	private static byte[] toByteArray(HttpEntity entity, long maxBytes) throws IOException {
 		if (entity.getContentLength() > maxBytes) {
 			throw new IOException(
@@ -204,7 +266,7 @@ public class HttpGetter {
 		}
 	}
 
-	private static PoolingHttpClientConnectionManager newConnectionManager(CommaFeedConfiguration config) {
+	private PoolingHttpClientConnectionManager newConnectionManager(CommaFeedConfiguration config) {
 		SSLFactory sslFactory = SSLFactory.builder().withUnsafeTrustMaterial().withUnsafeHostnameVerifier().build();
 
 		int poolSize = config.feedRefresh().httpThreads();
@@ -218,7 +280,7 @@ public class HttpGetter {
 				.setDefaultTlsConfig(TlsConfig.custom().setHandshakeTimeout(Timeout.of(config.httpClient().sslHandshakeTimeout())).build())
 				.setMaxConnPerRoute(poolSize)
 				.setMaxConnTotal(poolSize)
-				.setDnsResolver(new InternationalizedDomainNameToAsciiDnsResolver(SystemDefaultDnsResolver.INSTANCE))
+				.setDnsResolver(dnsResolver)
 				.build();
 
 	}
@@ -255,15 +317,19 @@ public class HttpGetter {
 				.build();
 	}
 
-	private record InternationalizedDomainNameToAsciiDnsResolver(DnsResolver delegate) implements DnsResolver {
-		@Override
-		public InetAddress[] resolve(String host) throws UnknownHostException {
-			return delegate.resolve(IDN.toASCII(host));
-		}
+	public static class SchemeNotAllowedException extends Exception {
+		private static final long serialVersionUID = 1L;
 
-		@Override
-		public String resolveCanonicalHostname(String host) throws UnknownHostException {
-			return delegate.resolveCanonicalHostname(IDN.toASCII(host));
+		public SchemeNotAllowedException(String scheme) {
+			super("Scheme not allowed: " + scheme);
+		}
+	}
+
+	public static class HostNotAllowedException extends Exception {
+		private static final long serialVersionUID = 1L;
+
+		public HostNotAllowedException(String host) {
+			super("Host not allowed: " + host);
 		}
 	}
 
@@ -292,6 +358,14 @@ public class HttpGetter {
 		}
 	}
 
+	@RequiredArgsConstructor
+	@Getter
+	public static class TooManyRequestsException extends Exception {
+		private static final long serialVersionUID = 1L;
+
+		private final Instant retryAfter;
+	}
+
 	@Getter
 	public static class HttpResponseException extends IOException {
 		private static final long serialVersionUID = 1L;
@@ -334,6 +408,7 @@ public class HttpGetter {
 		String lastModifiedHeader;
 		String eTagHeader;
 		CacheControl cacheControl;
+		Instant retryAfter;
 		byte[] content;
 		String contentType;
 		String urlAfterRedirect;

commafeed-server/src/main/java/com/commafeed/backend/favicon/YoutubeFaviconFetcher.java

@@ -11,8 +11,11 @@ import org.apache.hc.core5.net.URIBuilder;
 
 import com.commafeed.CommaFeedConfiguration;
 import com.commafeed.backend.HttpGetter;
+import com.commafeed.backend.HttpGetter.HostNotAllowedException;
 import com.commafeed.backend.HttpGetter.HttpResult;
 import com.commafeed.backend.HttpGetter.NotModifiedException;
+import com.commafeed.backend.HttpGetter.SchemeNotAllowedException;
+import com.commafeed.backend.HttpGetter.TooManyRequestsException;
 import com.commafeed.backend.model.Feed;
 import com.fasterxml.jackson.core.JsonPointer;
 import com.fasterxml.jackson.databind.JsonNode;
@@ -91,7 +94,8 @@ public class YoutubeFaviconFetcher extends AbstractFaviconFetcher {
 		return new Favicon(bytes, contentType);
 	}
 
-	private byte[] fetchForUser(String googleAuthKey, String userId) throws IOException, NotModifiedException {
+	private byte[] fetchForUser(String googleAuthKey, String userId)
+			throws IOException, NotModifiedException, TooManyRequestsException, HostNotAllowedException, SchemeNotAllowedException {
 		URI uri = UriBuilder.fromUri("https://www.googleapis.com/youtube/v3/channels")
 				.queryParam("part", "snippet")
 				.queryParam("key", googleAuthKey)
@@ -100,7 +104,8 @@ public class YoutubeFaviconFetcher extends AbstractFaviconFetcher {
 		return getter.get(uri.toString()).getContent();
 	}
 
-	private byte[] fetchForChannel(String googleAuthKey, String channelId) throws IOException, NotModifiedException {
+	private byte[] fetchForChannel(String googleAuthKey, String channelId)
+			throws IOException, NotModifiedException, TooManyRequestsException, HostNotAllowedException, SchemeNotAllowedException {
 		URI uri = UriBuilder.fromUri("https://www.googleapis.com/youtube/v3/channels")
 				.queryParam("part", "snippet")
 				.queryParam("key", googleAuthKey)
@@ -109,7 +114,8 @@ public class YoutubeFaviconFetcher extends AbstractFaviconFetcher {
 		return getter.get(uri.toString()).getContent();
 	}
 
-	private byte[] fetchForPlaylist(String googleAuthKey, String playlistId) throws IOException, NotModifiedException {
+	private byte[] fetchForPlaylist(String googleAuthKey, String playlistId)
+			throws IOException, NotModifiedException, TooManyRequestsException, HostNotAllowedException, SchemeNotAllowedException {
 		URI uri = UriBuilder.fromUri("https://www.googleapis.com/youtube/v3/playlists")
 				.queryParam("part", "snippet")
 				.queryParam("key", googleAuthKey)

commafeed-server/src/main/java/com/commafeed/backend/feed/FeedFetcher.java

@@ -10,13 +10,16 @@ import org.apache.commons.lang3.StringUtils;
 
 import com.commafeed.backend.Digests;
 import com.commafeed.backend.HttpGetter;
+import com.commafeed.backend.HttpGetter.HostNotAllowedException;
 import com.commafeed.backend.HttpGetter.HttpRequest;
 import com.commafeed.backend.HttpGetter.HttpResult;
 import com.commafeed.backend.HttpGetter.NotModifiedException;
+import com.commafeed.backend.HttpGetter.SchemeNotAllowedException;
+import com.commafeed.backend.HttpGetter.TooManyRequestsException;
 import com.commafeed.backend.feed.parser.FeedParser;
+import com.commafeed.backend.feed.parser.FeedParser.FeedParsingException;
 import com.commafeed.backend.feed.parser.FeedParserResult;
 import com.commafeed.backend.urlprovider.FeedURLProvider;
-import com.rometools.rome.io.FeedException;
 
 import io.quarkus.arc.All;
 import jakarta.inject.Singleton;
@@ -40,7 +43,8 @@ public class FeedFetcher {
 	}
 
 	public FeedFetcherResult fetch(String feedUrl, boolean extractFeedUrlFromHtml, String lastModified, String eTag,
-			Instant lastPublishedDate, String lastContentHash) throws FeedException, IOException, NotModifiedException {
+			Instant lastPublishedDate, String lastContentHash) throws FeedParsingException, IOException, NotModifiedException,
+			TooManyRequestsException, SchemeNotAllowedException, HostNotAllowedException, NoFeedFoundException {
 		log.debug("Fetching feed {}", feedUrl);
 
 		HttpResult result = getter.get(HttpRequest.builder(feedUrl).lastModified(lastModified).eTag(eTag).build());
@@ -49,17 +53,17 @@ public class FeedFetcher {
 		FeedParserResult parserResult;
 		try {
 			parserResult = parser.parse(result.getUrlAfterRedirect(), content);
-		} catch (FeedException e) {
+		} catch (FeedParsingException e) {
 			if (extractFeedUrlFromHtml) {
 				String extractedUrl = extractFeedUrl(urlProviders, feedUrl, new String(result.getContent(), StandardCharsets.UTF_8));
-				if (org.apache.commons.lang3.StringUtils.isNotBlank(extractedUrl)) {
+				if (StringUtils.isNotBlank(extractedUrl)) {
 					feedUrl = extractedUrl;
 
 					result = getter.get(HttpRequest.builder(extractedUrl).lastModified(lastModified).eTag(eTag).build());
 					content = result.getContent();
 					parserResult = parser.parse(result.getUrlAfterRedirect(), content);
 				} else {
-					throw e;
+					throw new NoFeedFoundException(e);
 				}
 			} else {
 				throw e;
@@ -107,4 +111,12 @@ public class FeedFetcher {
 			String contentHash, Duration validFor) {
 	}
 
+	public static class NoFeedFoundException extends Exception {
+		private static final long serialVersionUID = 1L;
+
+		public NoFeedFoundException(Throwable cause) {
+			super("This URL does not point to an RSS feed or a website with an RSS feed.", cause);
+		}
+	}
+
 }

commafeed-server/src/main/java/com/commafeed/backend/feed/FeedRefreshIntervalCalculator.java

@@ -2,77 +2,83 @@ package com.commafeed.backend.feed;
 
 import java.time.Duration;
 import java.time.Instant;
+import java.time.InstantSource;
 import java.time.temporal.ChronoUnit;
 
+import org.apache.commons.lang3.ObjectUtils;
+
 import com.commafeed.CommaFeedConfiguration;
+import com.commafeed.CommaFeedConfiguration.FeedRefreshErrorHandling;
+import com.google.common.primitives.Longs;
 
 import jakarta.inject.Singleton;
 
 @Singleton
 public class FeedRefreshIntervalCalculator {
 
-	private final Duration refreshInterval;
-	private final boolean empiricalInterval;
+	private final Duration interval;
+	private final Duration maxInterval;
+	private final boolean empirical;
+	private final FeedRefreshErrorHandling errorHandling;
+	private final InstantSource instantSource;
 
-	public FeedRefreshIntervalCalculator(CommaFeedConfiguration config) {
-		this.refreshInterval = config.feedRefresh().interval();
-		this.empiricalInterval = config.feedRefresh().intervalEmpirical();
+	public FeedRefreshIntervalCalculator(CommaFeedConfiguration config, InstantSource instantSource) {
+		this.interval = config.feedRefresh().interval();
+		this.maxInterval = config.feedRefresh().maxInterval();
+		this.empirical = config.feedRefresh().intervalEmpirical();
+		this.errorHandling = config.feedRefresh().errors();
+		this.instantSource = instantSource;
 	}
 
-	public Instant onFetchSuccess(Instant publishedDate, Long averageEntryInterval) {
-		Instant defaultRefreshInterval = getDefaultRefreshInterval();
-		return empiricalInterval ? computeEmpiricalRefreshInterval(publishedDate, averageEntryInterval, defaultRefreshInterval)
-				: defaultRefreshInterval;
+	public Instant onFetchSuccess(Instant publishedDate, Long averageEntryInterval, Duration validFor) {
+		Instant instant = empirical ? computeEmpiricalRefreshInterval(publishedDate, averageEntryInterval)
+				: instantSource.instant().plus(interval);
+		return constrainToBounds(ObjectUtils.max(instant, instantSource.instant().plus(validFor)));
 	}
 
 	public Instant onFeedNotModified(Instant publishedDate, Long averageEntryInterval) {
-		return onFetchSuccess(publishedDate, averageEntryInterval);
+		return onFetchSuccess(publishedDate, averageEntryInterval, Duration.ZERO);
+	}
+
+	public Instant onTooManyRequests(Instant retryAfter, int errorCount) {
+		return constrainToBounds(ObjectUtils.max(retryAfter, onFetchError(errorCount)));
 	}
 
 	public Instant onFetchError(int errorCount) {
-		int retriesBeforeDisable = 3;
-		if (errorCount < retriesBeforeDisable || !empiricalInterval) {
-			return getDefaultRefreshInterval();
+		if (errorCount < errorHandling.retriesBeforeBackoff()) {
+			return constrainToBounds(instantSource.instant().plus(interval));
 		}
 
-		int disabledHours = Math.min(24 * 7, errorCount - retriesBeforeDisable + 1);
-		return Instant.now().plus(Duration.ofHours(disabledHours));
+		Duration retryInterval = errorHandling.backoffInterval().multipliedBy(errorCount - errorHandling.retriesBeforeBackoff() + 1L);
+		return constrainToBounds(instantSource.instant().plus(retryInterval));
 	}
 
-	private Instant getDefaultRefreshInterval() {
-		return Instant.now().plus(refreshInterval);
-	}
-
-	private Instant computeEmpiricalRefreshInterval(Instant publishedDate, Long averageEntryInterval, Instant defaultRefreshInterval) {
-		Instant now = Instant.now();
+	private Instant computeEmpiricalRefreshInterval(Instant publishedDate, Long averageEntryInterval) {
+		Instant now = instantSource.instant();
 
 		if (publishedDate == null) {
-			// feed with no entries, recheck in 24 hours
-			return now.plus(Duration.ofHours(24));
-		} else if (ChronoUnit.DAYS.between(publishedDate, now) >= 30) {
-			// older than a month, recheck in 24 hours
-			return now.plus(Duration.ofHours(24));
-		} else if (ChronoUnit.DAYS.between(publishedDate, now) >= 14) {
-			// older than two weeks, recheck in 12 hours
-			return now.plus(Duration.ofHours(12));
-		} else if (ChronoUnit.DAYS.between(publishedDate, now) >= 7) {
-			// older than a week, recheck in 6 hours
-			return now.plus(Duration.ofHours(6));
+			return now.plus(maxInterval);
+		}
+
+		long daysSinceLastPublication = ChronoUnit.DAYS.between(publishedDate, now);
+		if (daysSinceLastPublication >= 30) {
+			return now.plus(maxInterval);
+		} else if (daysSinceLastPublication >= 14) {
+			return now.plus(maxInterval.dividedBy(2));
+		} else if (daysSinceLastPublication >= 7) {
+			return now.plus(maxInterval.dividedBy(4));
 		} else if (averageEntryInterval != null) {
 			// use average time between entries to decide when to refresh next, divided by factor
 			int factor = 2;
-
-			// not more than 6 hours
-			long date = Math.min(now.plus(Duration.ofHours(6)).toEpochMilli(), now.toEpochMilli() + averageEntryInterval / factor);
-
-			// not less than default refresh interval
-			date = Math.max(defaultRefreshInterval.toEpochMilli(), date);
-
-			return Instant.ofEpochMilli(date);
+			long millis = Longs.constrainToRange(averageEntryInterval / factor, interval.toMillis(), maxInterval.dividedBy(4).toMillis());
+			return now.plusMillis(millis);
 		} else {
-			// unknown case, recheck in 24 hours
-			return now.plus(Duration.ofHours(24));
+			// unknown case
+			return now.plus(maxInterval);
 		}
 	}
 
+	private Instant constrainToBounds(Instant instant) {
+		return ObjectUtils.max(ObjectUtils.min(instant, instantSource.instant().plus(maxInterval)), instantSource.instant().plus(interval));
+	}
 }

commafeed-server/src/main/java/com/commafeed/backend/feed/FeedRefreshWorker.java

@@ -6,13 +6,13 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 
-import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 
 import com.codahale.metrics.Meter;
 import com.codahale.metrics.MetricRegistry;
 import com.commafeed.CommaFeedConfiguration;
 import com.commafeed.backend.HttpGetter.NotModifiedException;
+import com.commafeed.backend.HttpGetter.TooManyRequestsException;
 import com.commafeed.backend.feed.FeedFetcher.FeedFetcherResult;
 import com.commafeed.backend.feed.parser.FeedParserResult.Entry;
 import com.commafeed.backend.model.Feed;
@@ -77,9 +77,8 @@ public class FeedRefreshWorker {
 
 			feed.setErrorCount(0);
 			feed.setMessage(null);
-			feed.setDisabledUntil(ObjectUtils.max(
-					refreshIntervalCalculator.onFetchSuccess(result.feed().lastPublishedDate(), result.feed().averageEntryInterval()),
-					Instant.now().plus(result.validFor())));
+			feed.setDisabledUntil(refreshIntervalCalculator.onFetchSuccess(result.feed().lastPublishedDate(),
+					result.feed().averageEntryInterval(), result.validFor()));
 
 			return new FeedRefreshWorkerResult(feed, entries);
 		} catch (NotModifiedException e) {
@@ -97,6 +96,14 @@ public class FeedRefreshWorker {
 				feed.setEtagHeader(e.getNewEtagHeader());
 			}
 
+			return new FeedRefreshWorkerResult(feed, Collections.emptyList());
+		} catch (TooManyRequestsException e) {
+			log.debug("Too many requests : {}", feed.getUrl());
+
+			feed.setErrorCount(feed.getErrorCount() + 1);
+			feed.setMessage("Server indicated that we are sending too many requests");
+			feed.setDisabledUntil(refreshIntervalCalculator.onTooManyRequests(e.getRetryAfter(), feed.getErrorCount()));
+
 			return new FeedRefreshWorkerResult(feed, Collections.emptyList());
 		} catch (Exception e) {
 			log.debug("unable to refresh feed {}", feed.getUrl(), e);

commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java

@@ -35,7 +35,6 @@ import com.rometools.rome.feed.synd.SyndEntry;
 import com.rometools.rome.feed.synd.SyndFeed;
 import com.rometools.rome.feed.synd.SyndLink;
 import com.rometools.rome.feed.synd.SyndLinkImpl;
-import com.rometools.rome.io.FeedException;
 import com.rometools.rome.io.SyndFeedInput;
 
 import jakarta.inject.Singleton;
@@ -56,12 +55,12 @@ public class FeedParser {
 	private final EncodingDetector encodingDetector;
 	private final FeedCleaner feedCleaner;
 
-	public FeedParserResult parse(String feedUrl, byte[] xml) throws FeedException {
+	public FeedParserResult parse(String feedUrl, byte[] xml) throws FeedParsingException {
 		try {
 			Charset encoding = encodingDetector.getEncoding(xml);
 			String xmlString = feedCleaner.trimInvalidXmlCharacters(new String(xml, encoding));
 			if (xmlString == null) {
-				throw new FeedException("Input string is null for url " + feedUrl);
+				throw new FeedParsingException("Input string is null for url " + feedUrl);
 			}
 			xmlString = feedCleaner.replaceHtmlEntitiesWithNumericEntities(xmlString);
 			xmlString = feedCleaner.removeDoctypeDeclarations(xmlString);
@@ -81,8 +80,10 @@ public class FeedParser {
 			Long averageEntryInterval = averageTimeBetweenEntries(entries);
 
 			return new FeedParserResult(title, link, lastPublishedDate, averageEntryInterval, lastEntryDate, entries);
+		} catch (FeedParsingException e) {
+			throw e;
 		} catch (Exception e) {
-			throw new FeedException(String.format("Could not parse feed from %s : %s", feedUrl, e.getMessage()), e);
+			throw new FeedParsingException(String.format("Could not parse feed from %s : %s", feedUrl, e.getMessage()), e);
 		}
 	}
 
@@ -268,4 +269,16 @@ public class FeedParser {
 		return (long) stats.getMean();
 	}
 
+	public static class FeedParsingException extends Exception {
+		private static final long serialVersionUID = 1L;
+
+		public FeedParsingException(String message) {
+			super(message);
+		}
+
+		public FeedParsingException(String message, Throwable cause) {
+			super(message, cause);
+		}
+	}
+
 }

commafeed-server/src/main/java/com/commafeed/backend/urlprovider/YoutubeFeedURLProvider.java

@@ -1,7 +1,6 @@
 package com.commafeed.backend.urlprovider;
 
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import org.apache.commons.lang3.StringUtils;
 
 import jakarta.inject.Singleton;
 
@@ -14,12 +13,16 @@ import jakarta.inject.Singleton;
 @Singleton
 public class YoutubeFeedURLProvider implements FeedURLProvider {
 
-	private static final Pattern REGEXP = Pattern.compile("(.*\\byoutube\\.com)\\/channel\\/([^\\/]+)", Pattern.CASE_INSENSITIVE);
+	private static final String PREFIX = "https://www.youtube.com/channel/";
+	private static final String REPLACEMENT_PREFIX = "https://www.youtube.com/feeds/videos.xml?channel_id=";
 
 	@Override
 	public String get(String url, String urlContent) {
-		Matcher matcher = REGEXP.matcher(url);
-		return matcher.find() ? matcher.group(1) + "/feeds/videos.xml?channel_id=" + matcher.group(2) : null;
+		if (!StringUtils.startsWithIgnoreCase(url, PREFIX)) {
+			return null;
+		}
+
+		return REPLACEMENT_PREFIX + url.substring(PREFIX.length());
 	}
 
 }

commafeed-server/src/main/java/com/commafeed/frontend/resource/FeedREST.java

@@ -264,10 +264,7 @@ public class FeedREST {
 			info = fetchFeedInternal(req.getUrl());
 		} catch (Exception e) {
 			Throwable cause = Throwables.getRootCause(e);
-			return Response.status(Status.INTERNAL_SERVER_ERROR)
-					.entity(cause.getClass().getName() + ": " + cause.getMessage())
-					.type(MediaType.TEXT_PLAIN)
-					.build();
+			return Response.status(Status.INTERNAL_SERVER_ERROR).entity(cause.getMessage()).type(MediaType.TEXT_PLAIN).build();
 		}
 		return Response.ok(info).build();
 	}

commafeed-server/src/main/java/com/commafeed/tools/CommaFeedPropertiesGenerator.java

@@ -0,0 +1,80 @@
+package com.commafeed.tools;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+import com.commafeed.CommaFeedConfiguration;
+
+import io.quarkus.annotation.processor.Outputs;
+import io.quarkus.annotation.processor.documentation.config.model.AbstractConfigItem;
+import io.quarkus.annotation.processor.documentation.config.model.ConfigProperty;
+import io.quarkus.annotation.processor.documentation.config.model.ConfigRoot;
+import io.quarkus.annotation.processor.documentation.config.model.ConfigSection;
+import io.quarkus.annotation.processor.documentation.config.model.JavadocElements;
+import io.quarkus.annotation.processor.documentation.config.model.ResolvedModel;
+import io.quarkus.annotation.processor.documentation.config.util.JacksonMappers;
+
+/**
+ * This class generates an application.properties file with all the properties from {@link CommaFeedConfiguration}.
+ *
+ * This is useful for people who want to be able to configure CommaFeed without having to look at the code or the documentation, or for
+ * distribution packages that want to provide a default configuration file.
+ *
+ **/
+public class CommaFeedPropertiesGenerator {
+
+	private final List<String> lines = new ArrayList<>();
+
+	public static void main(String[] args) throws Exception {
+		new CommaFeedPropertiesGenerator().generate(args);
+	}
+
+	private void generate(String[] args) throws IOException {
+		Path targetPath = Paths.get(args[0]);
+
+		ResolvedModel resolvedModel = JacksonMappers.yamlObjectReader()
+				.readValue(targetPath.resolve(Outputs.QUARKUS_CONFIG_DOC_MODEL).toFile(), ResolvedModel.class);
+		JavadocElements javadocElements = JacksonMappers.yamlObjectReader()
+				.readValue(targetPath.resolve(Outputs.QUARKUS_CONFIG_DOC_JAVADOC).toFile(), JavadocElements.class);
+
+		for (ConfigRoot configRoot : resolvedModel.getConfigRoots()) {
+			for (AbstractConfigItem item : configRoot.getItems()) {
+				handleAbstractConfigItem(item, javadocElements);
+			}
+		}
+
+		Files.writeString(targetPath.resolve("quarkus-generated-doc").resolve("application.properties"), String.join("\n", lines));
+	}
+
+	private void handleAbstractConfigItem(AbstractConfigItem item, JavadocElements javadocElements) {
+		if (item.isSection()) {
+			handleSection((ConfigSection) item, javadocElements);
+		} else {
+			handleProperty((ConfigProperty) item, javadocElements);
+		}
+	}
+
+	private void handleSection(ConfigSection section, JavadocElements javadocElements) {
+		for (AbstractConfigItem item : section.getItems()) {
+			handleAbstractConfigItem(item, javadocElements);
+		}
+	}
+
+	private void handleProperty(ConfigProperty property, JavadocElements javadocElements) {
+		String key = property.getPath().property();
+		String description = javadocElements.elements()
+				.get(property.getSourceType() + "." + property.getSourceElementName())
+				.description()
+				.replace("\n", "\n# ");
+		String defaultValue = Optional.ofNullable(property.getDefaultValue()).orElse("").toLowerCase();
+
+		lines.add("# " + description);
+		lines.add(key + "=" + defaultValue);
+		lines.add("");
+	}
+}

commafeed-server/src/main/resources/application.properties

@@ -50,6 +50,7 @@ quarkus.native.add-all-charsets=true
 %test.commafeed.users.allow-registrations=true
 %test.commafeed.password-recovery-enabled=true
 %test.commafeed.http-client.cache.enabled=false
+%test.commafeed.http-client.block-local-addresses=false
 %test.commafeed.database.cleanup.entries-max-age=0
 %test.commafeed.feed-refresh.force-refresh-cooldown-duration=1m
 

commafeed-server/src/test/java/com/commafeed/CommaFeedConfigurationTest.java

@@ -1,22 +0,0 @@
-package com.commafeed;
-
-import java.io.File;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-
-import org.apache.commons.io.FileUtils;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.Test;
-
-class CommaFeedConfigurationTest {
-
-	@Test
-	void verifyMarkdownDocIsUpToDate() throws IOException {
-		String versionedDocumentationFile = FileUtils.readFileToString(new File("doc/commafeed.md"), StandardCharsets.UTF_8);
-		String generatedDocumentationFile = FileUtils.readFileToString(new File("target/quarkus-generated-doc/config/commafeed-server.md"),
-				StandardCharsets.UTF_8);
-
-		Assertions.assertLinesMatch(versionedDocumentationFile.lines(), generatedDocumentationFile.lines());
-	}
-
-}

commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java

@@ -6,6 +6,7 @@ import java.io.OutputStream;
 import java.math.BigInteger;
 import java.net.SocketTimeoutException;
 import java.time.Duration;
+import java.time.Instant;
 import java.util.Arrays;
 import java.util.Objects;
 import java.util.Optional;
@@ -39,6 +40,7 @@ import com.commafeed.CommaFeedVersion;
 import com.commafeed.backend.HttpGetter.HttpResponseException;
 import com.commafeed.backend.HttpGetter.HttpResult;
 import com.commafeed.backend.HttpGetter.NotModifiedException;
+import com.commafeed.backend.HttpGetter.TooManyRequestsException;
 import com.google.common.net.HttpHeaders;
 
 import io.quarkus.runtime.configuration.MemorySize;
@@ -46,9 +48,12 @@ import io.quarkus.runtime.configuration.MemorySize;
 @ExtendWith(MockServerExtension.class)
 class HttpGetterTest {
 
+	private static final Instant NOW = Instant.now();
+
 	private MockServerClient mockServerClient;
 	private String feedUrl;
 	private byte[] feedContent;
+
 	private CommaFeedConfiguration config;
 
 	private HttpGetter getter;
@@ -73,7 +78,7 @@ class HttpGetterTest {
 		Mockito.when(config.httpClient().cache().expiration()).thenReturn(Duration.ofMinutes(1));
 		Mockito.when(config.feedRefresh().httpThreads()).thenReturn(3);
 
-		this.getter = new HttpGetter(config, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
+		this.getter = new HttpGetter(config, () -> NOW, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
 	}
 
 	@ParameterizedTest
@@ -94,7 +99,8 @@ class HttpGetterTest {
 						.withContentType(MediaType.APPLICATION_ATOM_XML)
 						.withHeader(HttpHeaders.LAST_MODIFIED, "123456")
 						.withHeader(HttpHeaders.ETAG, "78910")
-						.withHeader(HttpHeaders.CACHE_CONTROL, "max-age=60, must-revalidate"));
+						.withHeader(HttpHeaders.CACHE_CONTROL, "max-age=60, must-revalidate")
+						.withHeader(HttpHeaders.RETRY_AFTER, "120"));
 
 		HttpResult result = getter.get(this.feedUrl);
 		Assertions.assertArrayEquals(feedContent, result.getContent());
@@ -117,6 +123,27 @@ class HttpGetterTest {
 		Assertions.assertEquals(Duration.ZERO, result.getValidFor());
 	}
 
+	@Test
+	void tooManyRequestsExceptionSeconds() {
+		this.mockServerClient.when(HttpRequest.request().withMethod("GET"))
+				.respond(
+						HttpResponse.response().withStatusCode(HttpStatus.SC_TOO_MANY_REQUESTS).withHeader(HttpHeaders.RETRY_AFTER, "120"));
+
+		TooManyRequestsException e = Assertions.assertThrows(TooManyRequestsException.class, () -> getter.get(this.feedUrl));
+		Assertions.assertEquals(NOW.plusSeconds(120), e.getRetryAfter());
+	}
+
+	@Test
+	void tooManyRequestsExceptionDate() {
+		this.mockServerClient.when(HttpRequest.request().withMethod("GET"))
+				.respond(HttpResponse.response()
+						.withStatusCode(HttpStatus.SC_TOO_MANY_REQUESTS)
+						.withHeader(HttpHeaders.RETRY_AFTER, "Wed, 21 Oct 2015 07:28:00 GMT"));
+
+		TooManyRequestsException e = Assertions.assertThrows(TooManyRequestsException.class, () -> getter.get(this.feedUrl));
+		Assertions.assertEquals(Instant.parse("2015-10-21T07:28:00Z"), e.getRetryAfter());
+	}
+
 	@ParameterizedTest
 	@ValueSource(
 			ints = { HttpStatus.SC_MOVED_PERMANENTLY, HttpStatus.SC_MOVED_TEMPORARILY, HttpStatus.SC_TEMPORARY_REDIRECT,
@@ -145,7 +172,7 @@ class HttpGetterTest {
 	@Test
 	void dataTimeout() {
 		Mockito.when(config.httpClient().responseTimeout()).thenReturn(Duration.ofMillis(500));
-		this.getter = new HttpGetter(config, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
+		this.getter = new HttpGetter(config, () -> NOW, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
 
 		this.mockServerClient.when(HttpRequest.request().withMethod("GET"))
 				.respond(HttpResponse.response().withDelay(Delay.milliseconds(1000)));
@@ -156,7 +183,7 @@ class HttpGetterTest {
 	@Test
 	void connectTimeout() {
 		Mockito.when(config.httpClient().connectTimeout()).thenReturn(Duration.ofMillis(500));
-		this.getter = new HttpGetter(config, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
+		this.getter = new HttpGetter(config, () -> NOW, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
 		// try to connect to a non-routable address
 		// https://stackoverflow.com/a/904609
 		Assertions.assertThrows(ConnectTimeoutException.class, () -> getter.get("http://10.255.255.1"));
@@ -209,7 +236,7 @@ class HttpGetterTest {
 	}
 
 	@Test
-	void cacheSubsequentCalls() throws IOException, NotModifiedException {
+	void cacheSubsequentCalls() throws Exception {
 		AtomicInteger calls = new AtomicInteger();
 
 		this.mockServerClient.when(HttpRequest.request().withMethod("GET")).respond(req -> {
@@ -275,17 +302,16 @@ class HttpGetterTest {
 	class Compression {
 
 		@Test
-		void deflate() throws IOException, NotModifiedException {
+		void deflate() throws Exception {
 			supportsCompression("deflate", DeflaterOutputStream::new);
 		}
 
 		@Test
-		void gzip() throws IOException, NotModifiedException {
+		void gzip() throws Exception {
 			supportsCompression("gzip", GZIPOutputStream::new);
 		}
 
-		void supportsCompression(String encoding, CompressionOutputStreamFunction compressionOutputStreamFunction)
-				throws IOException, NotModifiedException {
+		void supportsCompression(String encoding, CompressionOutputStreamFunction compressionOutputStreamFunction) throws Exception {
 			String body = "my body";
 
 			HttpGetterTest.this.mockServerClient.when(HttpRequest.request().withMethod("GET")).respond(req -> {
@@ -313,4 +339,64 @@ class HttpGetterTest {
 
 	}
 
+	@Nested
+	class SchemeNotAllowed {
+		@Test
+		void file() {
+			Assertions.assertThrows(HttpGetter.SchemeNotAllowedException.class, () -> getter.get("file://localhost"));
+		}
+
+		@Test
+		void ftp() {
+			Assertions.assertThrows(HttpGetter.SchemeNotAllowedException.class, () -> getter.get("ftp://localhost"));
+		}
+	}
+
+	@Nested
+	class HostNotAllowed {
+
+		@BeforeEach
+		void init() {
+			Mockito.when(config.httpClient().blockLocalAddresses()).thenReturn(true);
+			getter = new HttpGetter(config, () -> NOW, Mockito.mock(CommaFeedVersion.class), Mockito.mock(MetricRegistry.class));
+		}
+
+		@Test
+		void localhost() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://localhost"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://127.0.0.1"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://2130706433"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://0x7F.0x00.0x00.0X01"));
+		}
+
+		@Test
+		void zero() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://0.0.0.0"));
+		}
+
+		@Test
+		void linkLocal() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://169.254.12.34"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://169.254.169.254"));
+		}
+
+		@Test
+		void multicast() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://224.2.3.4"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://239.255.255.254"));
+		}
+
+		@Test
+		void privateIpv4Ranges() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://10.0.0.1"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://172.16.0.1"));
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://192.168.0.1"));
+		}
+
+		@Test
+		void privateIpv6Ranges() {
+			Assertions.assertThrows(HttpGetter.HostNotAllowedException.class, () -> getter.get("http://fd12:3456:789a:1::1"));
+		}
+	}
+
 }

commafeed-server/src/test/java/com/commafeed/backend/feed/FeedRefreshIntervalCalculatorTest.java

@@ -0,0 +1,278 @@
+package com.commafeed.backend.feed;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.time.InstantSource;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import com.commafeed.CommaFeedConfiguration;
+import com.commafeed.CommaFeedConfiguration.FeedRefreshErrorHandling;
+
+@ExtendWith(MockitoExtension.class)
+class FeedRefreshIntervalCalculatorTest {
+
+	private static final Instant NOW = Instant.now();
+	private static final Duration DEFAULT_INTERVAL = Duration.ofHours(1);
+	private static final Duration MAX_INTERVAL = Duration.ofDays(1);
+
+	@Mock
+	private InstantSource instantSource;
+
+	@Mock
+	private CommaFeedConfiguration config;
+
+	@Mock
+	private FeedRefreshErrorHandling errorHandling;
+
+	private FeedRefreshIntervalCalculator calculator;
+
+	@BeforeEach
+	void setUp() {
+		Mockito.when(instantSource.instant()).thenReturn(NOW);
+		Mockito.when(config.feedRefresh()).thenReturn(Mockito.mock(CommaFeedConfiguration.FeedRefresh.class));
+		Mockito.when(config.feedRefresh().interval()).thenReturn(DEFAULT_INTERVAL);
+		Mockito.when(config.feedRefresh().maxInterval()).thenReturn(MAX_INTERVAL);
+		Mockito.when(config.feedRefresh().errors()).thenReturn(errorHandling);
+
+		calculator = new FeedRefreshIntervalCalculator(config, instantSource);
+	}
+
+	@Nested
+	class FetchSuccess {
+
+		@Nested
+		class EmpiricalDisabled {
+			@ParameterizedTest
+			@ValueSource(longs = { 0, 1, 300, 86400000L })
+			void withoutValidFor(long averageEntryInterval) {
+				// averageEntryInterval is ignored when empirical is disabled
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), averageEntryInterval, Duration.ZERO);
+				Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+			}
+
+			@Test
+			void withValidForGreaterThanMaxInterval() {
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), 1L, MAX_INTERVAL.plusDays(1));
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+			}
+
+			@Test
+			void withValidForLowerThanMaxInterval() {
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), 1L, MAX_INTERVAL.minusSeconds(1));
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL).minusSeconds(1), result);
+			}
+		}
+
+		@Nested
+		class EmpiricalEnabled {
+			@BeforeEach
+			void setUp() {
+				Mockito.when(config.feedRefresh().intervalEmpirical()).thenReturn(true);
+				calculator = new FeedRefreshIntervalCalculator(config, instantSource);
+			}
+
+			@Test
+			void withNullPublishedDate() {
+				Instant result = calculator.onFetchSuccess(null, 1L, Duration.ZERO);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+			}
+
+			@Test
+			void with31DaysOldPublishedDate() {
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(31)), 1L, Duration.ZERO);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+			}
+
+			@Test
+			void with15DaysOldPublishedDate() {
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(15)), 1L, Duration.ZERO);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(2)), result);
+			}
+
+			@Test
+			void with8DaysOldPublishedDate() {
+				Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(8)), 1L, Duration.ZERO);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(4)), result);
+			}
+
+			@Nested
+			class FiveDaysOld {
+				@Test
+				void averageBetweenBounds() {
+					Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), Duration.ofHours(4).toMillis(),
+							Duration.ZERO);
+					Assertions.assertEquals(NOW.plus(Duration.ofHours(2)), result);
+				}
+
+				@Test
+				void averageBelowMinimum() {
+					Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), 10L, Duration.ZERO);
+					Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+				}
+
+				@Test
+				void averageAboveMaximum() {
+					Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), Long.MAX_VALUE, Duration.ZERO);
+					Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(4)), result);
+				}
+
+				@Test
+				void noAverage() {
+					Instant result = calculator.onFetchSuccess(NOW.minus(Duration.ofDays(5)), null, Duration.ZERO);
+					Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+				}
+			}
+		}
+	}
+
+	@Nested
+	class FeedNotModified {
+
+		@Nested
+		class EmpiricalDisabled {
+			@ParameterizedTest
+			@ValueSource(longs = { 0, 1, 300, 86400000L })
+			void withoutValidFor(long averageEntryInterval) {
+				// averageEntryInterval is ignored when empirical is disabled
+				Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(5)), averageEntryInterval);
+				Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+			}
+		}
+
+		@Nested
+		class EmpiricalEnabled {
+			@BeforeEach
+			void setUp() {
+				Mockito.when(config.feedRefresh().intervalEmpirical()).thenReturn(true);
+				calculator = new FeedRefreshIntervalCalculator(config, instantSource);
+			}
+
+			@Test
+			void withNullPublishedDate() {
+				Instant result = calculator.onFeedNotModified(null, 1L);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+			}
+
+			@Test
+			void with31DaysOldPublishedDate() {
+				Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(31)), 1L);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+			}
+
+			@Test
+			void with15DaysOldPublishedDate() {
+				Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(15)), 1L);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(2)), result);
+			}
+
+			@Test
+			void with8DaysOldPublishedDate() {
+				Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(8)), 1L);
+				Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(4)), result);
+			}
+
+			@Nested
+			class FiveDaysOld {
+				@Test
+				void averageBetweenBounds() {
+					Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(5)), Duration.ofHours(4).toMillis());
+					Assertions.assertEquals(NOW.plus(Duration.ofHours(2)), result);
+				}
+
+				@Test
+				void averageBelowMinimum() {
+					Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(5)), 10L);
+					Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+				}
+
+				@Test
+				void averageAboveMaximum() {
+					Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(5)), Long.MAX_VALUE);
+					Assertions.assertEquals(NOW.plus(MAX_INTERVAL.dividedBy(4)), result);
+				}
+
+				@Test
+				void noAverage() {
+					Instant result = calculator.onFeedNotModified(NOW.minus(Duration.ofDays(5)), null);
+					Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+				}
+			}
+		}
+	}
+
+	@Nested
+	class FetchError {
+		@BeforeEach
+		void setUp() {
+			Mockito.when(config.feedRefresh().errors().retriesBeforeBackoff()).thenReturn(3);
+		}
+
+		@Test
+		void lowErrorCount() {
+			Instant result = calculator.onFetchError(1);
+			Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+		}
+
+		@Test
+		void highErrorCount() {
+			Mockito.when(config.feedRefresh().errors().backoffInterval()).thenReturn(Duration.ofHours(1));
+
+			Instant result = calculator.onFetchError(5);
+			Assertions.assertEquals(NOW.plus(Duration.ofHours(3)), result);
+		}
+
+		@Test
+		void veryHighErrorCount() {
+			Mockito.when(config.feedRefresh().errors().backoffInterval()).thenReturn(Duration.ofHours(1));
+
+			Instant result = calculator.onFetchError(100000);
+			Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+		}
+	}
+
+	@Nested
+	class TooManyRequests {
+
+		@BeforeEach
+		void setUp() {
+			Mockito.when(config.feedRefresh().errors().retriesBeforeBackoff()).thenReturn(3);
+		}
+
+		@Test
+		void withRetryAfterZero() {
+			Instant result = calculator.onTooManyRequests(NOW, 1);
+			Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+		}
+
+		@Test
+		void withRetryAfterLowerThanInterval() {
+			Instant retryAfter = NOW.plus(DEFAULT_INTERVAL.minusSeconds(10));
+			Instant result = calculator.onTooManyRequests(retryAfter, 1);
+			Assertions.assertEquals(NOW.plus(DEFAULT_INTERVAL), result);
+		}
+
+		@Test
+		void withRetryAfterBetweenBounds() {
+			Instant retryAfter = NOW.plus(DEFAULT_INTERVAL.plusSeconds(10));
+			Instant result = calculator.onTooManyRequests(retryAfter, 1);
+			Assertions.assertEquals(retryAfter, result);
+		}
+
+		@Test
+		void withRetryAfterGreaterThanMaxInterval() {
+			Instant retryAfter = NOW.plus(MAX_INTERVAL.plusSeconds(10));
+			Instant result = calculator.onTooManyRequests(retryAfter, 1);
+			Assertions.assertEquals(NOW.plus(MAX_INTERVAL), result);
+		}
+	}
+}

commafeed-server/src/test/java/com/commafeed/backend/urlprovider/YoutubeFeedURLProviderTest.java

@@ -0,0 +1,22 @@
+package com.commafeed.backend.urlprovider;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+class YoutubeFeedURLProviderTest {
+
+	private final YoutubeFeedURLProvider provider = new YoutubeFeedURLProvider();
+
+	@Test
+	void matchesYoutubeChannelURL() {
+		Assertions.assertEquals("https://www.youtube.com/feeds/videos.xml?channel_id=abc",
+				provider.get("https://www.youtube.com/channel/abc", null));
+	}
+
+	@Test
+	void doesNotmatchYoutubeChannelURL() {
+		Assertions.assertNull(provider.get("https://www.anothersite.com/channel/abc", null));
+		Assertions.assertNull(provider.get("https://www.youtube.com/user/abc", null));
+	}
+
+}

commafeed-server/src/test/java/com/commafeed/e2e/ReadingIT.java

@@ -6,6 +6,8 @@ import java.util.concurrent.TimeUnit;
 import java.util.regex.Pattern;
 
 import org.apache.commons.io.IOUtils;
+import org.apache.hc.core5.http.HttpStatus;
+import org.awaitility.Awaitility;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -14,6 +16,7 @@ import org.mockserver.integration.ClientAndServer;
 import org.mockserver.model.HttpRequest;
 import org.mockserver.model.HttpResponse;
 
+import com.commafeed.frontend.model.Entries;
 import com.microsoft.playwright.Browser;
 import com.microsoft.playwright.Locator;
 import com.microsoft.playwright.Page;
@@ -22,6 +25,7 @@ import com.microsoft.playwright.assertions.PlaywrightAssertions;
 import com.microsoft.playwright.options.AriaRole;
 
 import io.quarkus.test.junit.QuarkusTest;
+import io.restassured.RestAssured;
 
 @QuarkusTest
 class ReadingIT {
@@ -40,11 +44,15 @@ class ReadingIT {
 				.respond(HttpResponse.response()
 						.withBody(IOUtils.toString(getClass().getResource("/feed/rss.xml"), StandardCharsets.UTF_8))
 						.withDelay(TimeUnit.MILLISECONDS, 100));
+
+		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
 	@AfterEach
 	void cleanup() {
 		playwright.close();
+
+		RestAssured.reset();
 	}
 
 	@Test
@@ -70,18 +78,28 @@ class ReadingIT {
 		sidebar.getByText(Pattern.compile("CommaFeed test feed\\d+")).click();
 
 		// we have two unread entries
-		PlaywrightAssertions.assertThat(main.locator(".mantine-Paper-root")).hasCount(2);
+		PlaywrightAssertions.assertThat(main.getByRole(AriaRole.ARTICLE)).hasCount(2);
 
 		// click on first entry
 		main.getByText("Item 1").click();
 		PlaywrightAssertions.assertThat(main.getByText("Item 1 description")).hasCount(1);
 		PlaywrightAssertions.assertThat(main.getByText("Item 2 description")).hasCount(0);
 
+		// wait for the entry to be marked as read since the UI is updated immediately while the entry is marked as read in the background
+		Awaitility.await()
+				.atMost(15, TimeUnit.SECONDS)
+				.until(() -> RestAssured.given()
+						.get("rest/category/entries?id=all&readType=unread")
+						.then()
+						.statusCode(HttpStatus.SC_OK)
+						.extract()
+						.as(Entries.class), e -> e.getEntries().size() == 1);
+
 		// click on subscription
-		sidebar.getByText(Pattern.compile("CommaFeed test feed\\d+")).click();
+		sidebar.getByText(Pattern.compile("CommaFeed test feed\\d*")).click();
 
 		// only one unread entry now
-		PlaywrightAssertions.assertThat(main.locator(".mantine-Paper-root")).hasCount(1);
+		PlaywrightAssertions.assertThat(main.getByRole(AriaRole.ARTICLE)).hasCount(1);
 
 		// click on second entry
 		main.getByText("Item 2").click();

commafeed-server/src/test/java/com/commafeed/integration/WebSocketIT.java

@@ -13,6 +13,7 @@ import java.util.stream.Collectors;
 
 import org.apache.hc.core5.http.HttpStatus;
 import org.awaitility.Awaitility;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -41,6 +42,11 @@ class WebSocketIT extends BaseIT {
 		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
+	@AfterEach
+	void tearDown() {
+		RestAssured.reset();
+	}
+
 	@Test
 	void sessionClosedIfNotLoggedIn() throws DeploymentException, IOException {
 		AtomicBoolean connected = new AtomicBoolean();

commafeed-server/src/test/java/com/commafeed/integration/rest/AdminIT.java

@@ -3,6 +3,7 @@ package com.commafeed.integration.rest;
 import java.util.List;
 
 import org.apache.hc.core5.http.HttpStatus;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
@@ -25,6 +26,11 @@ class AdminIT extends BaseIT {
 		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Nested
 	class Users {
 		@Test

commafeed-server/src/test/java/com/commafeed/integration/rest/FeedIT.java

@@ -11,6 +11,7 @@ import java.util.Objects;
 import org.apache.commons.io.IOUtils;
 import org.apache.hc.core5.http.HttpStatus;
 import org.awaitility.Awaitility;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
@@ -38,6 +39,11 @@ class FeedIT extends BaseIT {
 		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Nested
 	class Fetch {
 		@Test

commafeed-server/src/test/java/com/commafeed/integration/rest/FeverIT.java

@@ -1,6 +1,7 @@
 package com.commafeed.integration.rest;
 
 import org.apache.hc.core5.http.HttpStatus;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -37,6 +38,11 @@ class FeverIT extends BaseIT {
 		this.userId = user.getId();
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Test
 	void invalidApiKey() {
 		FeverResponse response = fetch("feeds", "invalid-key");

commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java

@@ -2,6 +2,7 @@ package com.commafeed.integration.rest;
 
 import java.util.List;
 
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -29,6 +30,11 @@ class UserIT extends BaseIT {
 		mailbox.clear();
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Test
 	void resetPassword() {
 		PasswordResetRequest req = new PasswordResetRequest();

commafeed-server/src/test/java/com/commafeed/integration/servlet/CustomCodeIT.java

@@ -2,6 +2,7 @@ package com.commafeed.integration.servlet;
 
 import org.apache.hc.core5.http.HttpStatus;
 import org.hamcrest.CoreMatchers;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -20,6 +21,11 @@ class CustomCodeIT extends BaseIT {
 		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Test
 	void test() {
 		// get settings

commafeed-server/src/test/java/com/commafeed/integration/servlet/NextUnreadIT.java

@@ -1,6 +1,7 @@
 package com.commafeed.integration.servlet;
 
 import org.apache.hc.core5.http.HttpStatus;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -18,6 +19,11 @@ class NextUnreadIT extends BaseIT {
 		RestAssured.authentication = RestAssured.preemptive().basic("admin", "admin");
 	}
 
+	@AfterEach
+	void cleanup() {
+		RestAssured.reset();
+	}
+
 	@Test
 	void test() {
 		subscribeAndWaitForEntries(getFeedUrl());

pom.xml

@@ -5,7 +5,7 @@
 
 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>5.4.0</version>
+	<version>5.6.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>
 
@@ -19,7 +19,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.13.0</version>
+				<version>3.14.0</version>
 				<configuration>
 					<parameters>true</parameters>
 

renovate.json

@@ -4,6 +4,7 @@
     "config:recommended",
     "customManagers:mavenPropertyVersions",
     "customManagers:biomeVersions",
+    "helpers:pinGitHubActionDigests",
     ":automergePatch",
     ":automergeBranch",
     ":automergeRequireAllStatusChecks",
@@ -31,7 +32,7 @@
       "matchDatasources": "docker",
       "matchPackageNames": "ibm-semeru-runtimes",
       "versioning": "regex:^open-(?<major>\\d+)?(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?([\\._+](?<build>(\\d\\.?)+))?(-(?<compatibility>.*))?$",
-      "allowedVersions": "/^open-(?:8|11|17|21)(?:\\.|-|$)/"
+      "allowedVersions": "/^open-(?:8|11|17|21|25)(?:\\.|-|$)/"
     }
   ]
 }