feedkeeper 0.28.4 → 0.28.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedkeeper",
-  "version": "0.28.4",
+  "version": "0.28.6",
   "description": "A lightweight, self-hosted RSS reader and remote MCP server for your news, blogs, and AI workflows.",
   "keywords": [
     "rss",
@@ -42,17 +42,17 @@
     "better-sqlite3": "^13.0.3",
     "cookie-session": "^2.1.1",
     "cors": "^2.8.6",
-    "dotenv": "^18.0.5",
+    "dotenv": "^18.0.8",
     "express": "^5.2.1",
     "express-rate-limit": "^8.7.1",
     "fast-xml-parser": "^5.11.2",
     "helmet": "^8.3.0",
     "ipaddr.js": "^2.5.0",
-    "jsdom": "^30.1.2",
+    "jsdom": "^30.1.3",
     "node-cron": "^4.6.0",
     "otpauth": "^9.5.2",
     "rss-parser": "^3.13.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.2",
     "web-push": "^3.6.7",
     "zod": "^4.6.5"
   }

package/server/dist/feeds/feedIcon.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import zlib from "node:zlib";
 import { Resvg } from "@resvg/resvg-js";
 import { extractLargestImageAsPng } from "@humanwhocodes/ico-to-png";
 import { db } from "../db/index.js";
@@ -36,8 +37,11 @@ function candidates(feed, declaredUrls) {
         urls.add(feed.icon_url);
     for (const source of [feed.site_url, feed.url]) {
         try {
-            if (source)
-                urls.add(`${new URL(source).origin}/favicon.ico`);
+            if (source) {
+                const origin = new URL(source).origin;
+                urls.add(`${origin}/apple-touch-icon.png`);
+                urls.add(`${origin}/favicon.ico`);
+            }
         }
         catch {
             // Try the next source.
@@ -45,6 +49,79 @@ function candidates(feed, declaredUrls) {
     }
     return [...urls];
 }
+/** Rejects 8-bit grayscale+alpha or RGBA PNGs whose alpha channel is 0 across every pixel. */
+function hasVisiblePngPixels(buffer) {
+    if (buffer.length < 33)
+        return false;
+    const width = buffer.readUInt32BE(16);
+    const height = buffer.readUInt32BE(20);
+    const bitDepth = buffer[24];
+    const colorType = buffer[25];
+    const interlace = buffer[28];
+    if (width < 1 || height < 1)
+        return false;
+    if (colorType === 0 || colorType === 2)
+        return true;
+    if (interlace !== 0 || bitDepth !== 8 || (colorType !== 4 && colorType !== 6))
+        return true;
+    const chunks = [];
+    let pos = 8;
+    while (pos + 8 <= buffer.length) {
+        const len = buffer.readUInt32BE(pos);
+        const type = buffer.toString("ascii", pos + 4, pos + 8);
+        if (pos + 12 + len > buffer.length)
+            break;
+        if (type === "IDAT")
+            chunks.push(buffer.subarray(pos + 8, pos + 8 + len));
+        pos += 12 + len;
+    }
+    if (chunks.length === 0)
+        return true;
+    try {
+        const raw = zlib.inflateSync(Buffer.concat(chunks), { finishFlush: zlib.constants.Z_SYNC_FLUSH });
+        const bpp = colorType === 6 ? 4 : 2;
+        const stride = width * bpp + 1;
+        const prev = new Uint8Array(width * bpp);
+        const curr = new Uint8Array(width * bpp);
+        for (let y = 0; y < height; y++) {
+            const rowStart = y * stride;
+            if (rowStart + stride > raw.length)
+                break;
+            const filter = raw[rowStart];
+            for (let i = 0; i < width * bpp; i++) {
+                const x = raw[rowStart + 1 + i];
+                const a = i >= bpp ? curr[i - bpp] : 0;
+                const b = prev[i];
+                const c = i >= bpp ? prev[i - bpp] : 0;
+                let val = x;
+                if (filter === 1)
+                    val = (x + a) & 0xff;
+                else if (filter === 2)
+                    val = (x + b) & 0xff;
+                else if (filter === 3)
+                    val = (x + ((a + b) >> 1)) & 0xff;
+                else if (filter === 4) {
+                    const p = a + b - c;
+                    const pa = Math.abs(p - a);
+                    const pb = Math.abs(p - b);
+                    const pc = Math.abs(p - c);
+                    const pr = pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+                    val = (x + pr) & 0xff;
+                }
+                curr[i] = val;
+            }
+            for (let px = bpp - 1; px < width * bpp; px += bpp) {
+                if (curr[px] > 0)
+                    return true;
+            }
+            prev.set(curr);
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
 /** Keep the same raster icon in every client, including clients without SVG or ICO support. */
 function rasterIcon(buffer, mime) {
     if (mime === "image/svg+xml") {
@@ -52,13 +129,18 @@ function rasterIcon(buffer, mime) {
         if (svg.width > 4096 || svg.height > 4096 || svg.width < 1 || svg.height < 1 ||
             svg.width / svg.height > 8 || svg.height / svg.width > 8)
             throw new Error("Invalid SVG icon size");
-        return { buffer: svg.render().asPng(), mime: "image/png" };
+        buffer = svg.render().asPng();
+        mime = "image/png";
     }
-    if (mime === "image/x-icon") {
+    else if (mime === "image/x-icon") {
         const image = extractLargestImageAsPng(buffer);
         if (!image)
             throw new Error("Invalid ICO icon");
-        return { buffer: Buffer.from(image.data), mime: "image/png" };
+        buffer = Buffer.from(image.data);
+        mime = "image/png";
+    }
+    if (mime === "image/png" && !hasVisiblePngPixels(buffer)) {
+        throw new Error("Blank transparent icon");
     }
     return { buffer, mime };
 }

package/server/dist/feeds/icon.js

@@ -62,8 +62,24 @@ export function iconCheckDue(checkedAt) {
 }
 /** Include a linked web-app manifest, which often contains the site's highest-resolution icons. */
 export async function discoverIconUrls(siteUrl, signal) {
+    const discovered = await discoverPageIconUrls(siteUrl, signal);
+    if (discovered.length > 0)
+        return discovered;
+    // Many feeds set `<channel><link>` to their own feed URL instead of the site homepage.
     try {
-        const page = await fetchFeed(siteUrl, { signal });
+        const parsed = new URL(siteUrl);
+        if (parsed.pathname !== "/" && parsed.pathname !== "") {
+            return await discoverPageIconUrls(`${parsed.origin}/`, signal);
+        }
+    }
+    catch {
+        // Ignore invalid URLs.
+    }
+    return [];
+}
+async function discoverPageIconUrls(pageUrl, signal) {
+    try {
+        const page = await fetchFeed(pageUrl, { signal });
         const candidates = declaredCandidates(page.body, page.finalUrl);
         const manifestTag = headLinks(page.body).find((tag) => attribute(tag, "rel")?.toLowerCase().split(/\s+/).includes("manifest"));
         const href = manifestTag && attribute(manifestTag, "href");

package/server/dist/feeds/opml.js

@@ -101,6 +101,7 @@ function extractOutlines(node, items = [], currentFolder) {
     }
     return items;
 }
+export const MAX_OPML_FEEDS = 2000;
 /**
  * Parses an OPML document string and returns a list of feed URLs and their labels.
  */
@@ -114,7 +115,11 @@ export function parseOpml(xmlContent) {
     if (!parsed || !parsed.opml || !parsed.opml.body) {
         throw new Error("invalid_opml_format");
     }
-    return extractOutlines(parsed.opml.body.outline);
+    const feeds = extractOutlines(parsed.opml.body.outline);
+    if (feeds.length > MAX_OPML_FEEDS) {
+        throw new Error("too_many_opml_feeds");
+    }
+    return feeds;
 }
 const urlSchema = z.string().url();
 /**

package/server/dist/feeds/poller.js

@@ -26,6 +26,7 @@ function mediaAttribute(value, key) {
 }
 const parser = new Parser({
     customFields: {
+        feed: ["icon"],
         item: [
             ["media:content", "mediaContent", { keepArray: false }],
             ["media:thumbnail", "mediaThumbnail", { keepArray: false }],
@@ -33,6 +34,25 @@ const parser = new Parser({
         ],
     },
 });
+function extractFeedIconUrls(parsed, baseUrl) {
+    if (!parsed)
+        return [];
+    const urls = [];
+    for (const raw of [parsed.icon, parsed.image?.url]) {
+        if (typeof raw !== "string" || !raw.trim())
+            continue;
+        try {
+            const resolved = new URL(raw.trim(), baseUrl);
+            if (resolved.protocol === "https:" || resolved.protocol === "http:") {
+                urls.push(resolved.toString());
+            }
+        }
+        catch {
+            // Ignore malformed feed icon URLs.
+        }
+    }
+    return urls;
+}
 function cleanImageUrl(url) {
     return url.trim().replace(/&/g, "&").replace(/&/g, "&");
 }
@@ -134,9 +154,10 @@ async function pollAttempt(feed, signal) {
         if (iconCheckDue(feed.icon_checked_at)) {
             updateFeedIcon(feed.id, feed.icon_url);
             const siteUrl = parsed?.link || feed.site_url;
-            const urls = siteUrl ? await discoverIconUrls(siteUrl, signal) : [];
+            const htmlUrls = siteUrl ? await discoverIconUrls(siteUrl, signal) : [];
+            const feedUrls = extractFeedIconUrls(parsed, siteUrl || feed.url);
             signal.throwIfAborted();
-            await refreshFeedIcon(feed.id, siteUrl, urls, signal);
+            await refreshFeedIcon(feed.id, siteUrl, [...htmlUrls, ...feedUrls], signal);
         }
     }
     catch { /* Keep the successful poll; icon failures are best effort. */ }

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feedkeeper/server",
-  "version": "0.28.4",
+  "version": "0.28.6",
   "private": true,
   "type": "module"
 }