gofeed from 1.3.0 to 1.4.0 #333

New issue

Closed

opened 2026-09-29 13:01:25 +00:00 by slurdge · 0 comments

slurdge commented

2026-09-29 13:01:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/slurdge/goeland/pull/337
Author: @dependabot[bot]
Created: 7/21/2026
Status: ✅ Merged
Merged: 8/7/2026
Merged by: @slurdge

Base: master ← Head: dependabot/go_modules/github.com/mmcdole/gofeed-1.4.0

📝 Commits (1)

9bfb37c chore(deps): bump github.com/mmcdole/gofeed from 1.3.0 to 1.4.0

📊 Changes

2 files changed (+9 additions, -23 deletions)

View changed files

📝 go.mod (+3 -6)
📝 go.sum (+6 -17)

📄 Description

Bumps github.com/mmcdole/gofeed from 1.3.0 to 1.4.0.

Release notes

Sourced from github.com/mmcdole/gofeed's releases.

v1.4.0

This release focuses on bug fixes for malformed and off-spec feeds. Illegal XML control characters, unusual date formats, incorrectly typed JSON Feed fields, and unescaped ampersands in URLs could previously break a parse or silently drop content. The parser now handles these cases without failing the feed or losing the affected content.

It also fixes a lazy-initialization data race when a default-configured Parser is reused across goroutines (#278). Three new options give callers more control over resource use: an HTTP response-size limit, optional retention of the original source feed, and a switch to disable RSS content-image scanning.

For RSS and Atom, the universal Parser.Parse method no longer holds two complete copies of the raw feed in memory during format detection. It examines the first 4 KiB, detects the format, and then parses directly from the reader. The returned Feed is still fully materialized, so this is not a streaming API. JSON Feed decoding still buffers the complete document.

Compatibility

Go 1.25 or newer is required. v1.4.0 updates golang.org/x/net from v0.4.0 to v0.56.0 to resolve 22 reachable vulnerabilities reported by govulncheck; that release and its golang.org/x/text dependency require Go 1.25.

ParseURL now applies a 30-second request timeout. ParseURLWithContext continues to use the caller's context.

Parse now examines only the first 4 KiB to detect the feed type. RSS and Atom roots must begin within that window. In v1.4.0, a JSON Feed whose complete document does not fit within the window is not detected by the universal Parser and returns ErrFeedTypeNotDetected.

The text returned by ErrFeedTypeNotDetected.Error() now begins with lowercase failed.

No exported v1 identifier was removed. Feed now has private storage for the original source feed, so external positional Feed{...} literals no longer compile; keyed literals are unaffected.

Added

Add Parser.MaxByteSize and ErrResponseTooLarge to limit response bodies fetched by ParseURL and ParseURLWithContext. (#286)

Add Parser.KeepOriginalFeed and Feed.OriginalFeed() for access to the parsed *rss.Feed, *atom.Feed, or *json.Feed. (#289)

Add DefaultRSSTranslator.DisableContentImageScan to skip the HTML image fallback on large feeds while preserving existing behavior by default. (#330)

Parsing and translation fixes

Fix a data race when the same default-configured Parser is reused across goroutines. (#278)

Limit universal-parser format detection to a 4 KiB lookahead, parse RSS and Atom directly from the reader without retaining two complete raw copies, and propagate reader I/O errors. (#327)

Preserve parse errors when closing an HTTP response also returns an error.

Tolerate non-HTTP URI schemes and resolve RSS and Atom xml:base values without mutating sibling scope. (#240, #283, #290)

Resolve every URI-bearing HTML attribute, including elements with multiple URI attributes. (#323)

Preserve ordinary Atom content that merely looks like base64 and trim whitespace-prefixed Atom links. (#238, #283)

Promote embedded Atom author, date, content, summary, and category elements from RSS into universal fields. (#292)

Correct RSS guid isPermaLink handling and replace the invalid itunes:subtitle feed-link fallback with atom:link. (#283, #322)

Handle illegal C0 XML controls, mixed CDATA content, namespace whitespace, <cloud> children, and non-content <encoded> elements without losing the feed. (#284, #295, #317, #318, #325)

Continue entity decoding after bare ampersands without corrupting query parameters that resemble legacy HTML entities. (#319, #321)

Correct named timezone offsets and additional date layouts. (#234, #282, #324)

Tolerate off-spec JSON Feed IDs, booleans, attachment sizes, and durations; use attachment byte size for Enclosure.Length; and reject out-of-range numeric sizes safely. (#279, #326)

Prevent sorting panics when items have nil parsed publication dates.

Dependencies and maintenance

Replace jsoniter with encoding/json. (#280)

Migrate to github.com/mmcdole/goxpp/v2 v2.0.0. (#329)

Replace goquery and cascadia with direct x/net/html traversal. (#330)

Upgrade golang.org/x/net and golang.org/x/text for security, and upgrade testify and urfave/cli.

Expand regression fixtures and consolidate parser and translator control flow. (#332, #333)

Add contributor guidance and test-fixture conventions. (#331)

Modernize GitHub Actions with stable/oldstable builds, race-enabled shuffled tests, Staticcheck, govulncheck, Codecov, and Dependabot; remove the defunct Travis configuration. (#297, #335)

Contributors

Contributions in this release came from @mmcdole, @TypicalAM, @oprudkyi, and @akfaew.

... (truncated)

Commits

ec8fd42 Remove defunct Travis CI configuration (#335)
16bfe36 Route the parser element loops through one shared helper (#333)
d9ae564 Flatten the translator micro-methods (#332)
33df57e Add CONTRIBUTING.md (#331)
f8a5f28 Add DisableContentImageScan and drop the goquery dependency (#330)
8727c27 Migrate to goxpp v2 (#329)
8cd10be Bump goxpp to v1.3.0 (#328)
6011645 Stream XML feeds through Parse; surface reader I/O errors (#327)
18a93c2 Coerce out-of-range float sizes to 0 instead of overflow garbage (#326)
f66719a Trim namespace URIs once, inside PrefixForNamespace (#325)
Additional commits viewable in compare view

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/slurdge/goeland/pull/337 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 8/7/2026 **Merged by:** [@slurdge](https://github.com/slurdge) **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/mmcdole/gofeed-1.4.0` --- ### 📝 Commits (1) - [`9bfb37c`](https://github.com/slurdge/goeland/commit/9bfb37cbdce962f2e575c3bc248ce8d23cc92889) chore(deps): bump github.com/mmcdole/gofeed from 1.3.0 to 1.4.0 ### 📊 Changes **2 files changed** (+9 additions, -23 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+3 -6) 📝 `go.sum` (+6 -17) </details> ### 📄 Description Bumps [github.com/mmcdole/gofeed](https://github.com/mmcdole/gofeed) from 1.3.0 to 1.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mmcdole/gofeed/releases">github.com/mmcdole/gofeed's releases</a>.</em></p> <blockquote> <h2>v1.4.0</h2> <p>This release focuses on bug fixes for malformed and off-spec feeds. Illegal XML control characters, unusual date formats, incorrectly typed JSON Feed fields, and unescaped ampersands in URLs could previously break a parse or silently drop content. The parser now handles these cases without failing the feed or losing the affected content.</p> <p>It also fixes a lazy-initialization data race when a default-configured <code>Parser</code> is reused across goroutines (<a href="https://redirect.github.com/mmcdole/gofeed/issues/278">#278</a>). Three new options give callers more control over resource use: an HTTP response-size limit, optional retention of the original source feed, and a switch to disable RSS content-image scanning.</p> <p>For RSS and Atom, the universal <code>Parser.Parse</code> method no longer holds two complete copies of the raw feed in memory during format detection. It examines the first 4 KiB, detects the format, and then parses directly from the reader. The returned <code>Feed</code> is still fully materialized, so this is not a streaming API. JSON Feed decoding still buffers the complete document.</p> <h2>Compatibility</h2> <ul> <li>Go 1.25 or newer is required. v1.4.0 updates <code>golang.org/x/net</code> from v0.4.0 to v0.56.0 to resolve 22 reachable vulnerabilities reported by <code>govulncheck</code>; that release and its <code>golang.org/x/text</code> dependency require Go 1.25.</li> <li><code>ParseURL</code> now applies a 30-second request timeout. <code>ParseURLWithContext</code> continues to use the caller's context.</li> <li><code>Parse</code> now examines only the first 4 KiB to detect the feed type. RSS and Atom roots must begin within that window. In v1.4.0, a JSON Feed whose complete document does not fit within the window is not detected by the universal <code>Parser</code> and returns <code>ErrFeedTypeNotDetected</code>.</li> <li>The text returned by <code>ErrFeedTypeNotDetected.Error()</code> now begins with lowercase <code>failed</code>.</li> <li>No exported v1 identifier was removed. <code>Feed</code> now has private storage for the original source feed, so external positional <code>Feed{...}</code> literals no longer compile; keyed literals are unaffected.</li> </ul> <h2>Added</h2> <ul> <li>Add <code>Parser.MaxByteSize</code> and <code>ErrResponseTooLarge</code> to limit response bodies fetched by <code>ParseURL</code> and <code>ParseURLWithContext</code>. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/286">#286</a>)</li> <li>Add <code>Parser.KeepOriginalFeed</code> and <code>Feed.OriginalFeed()</code> for access to the parsed <code>*rss.Feed</code>, <code>*atom.Feed</code>, or <code>*json.Feed</code>. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/289">#289</a>)</li> <li>Add <code>DefaultRSSTranslator.DisableContentImageScan</code> to skip the HTML image fallback on large feeds while preserving existing behavior by default. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/330">#330</a>)</li> </ul> <h2>Parsing and translation fixes</h2> <ul> <li>Fix a data race when the same default-configured <code>Parser</code> is reused across goroutines. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/278">#278</a>)</li> <li>Limit universal-parser format detection to a 4 KiB lookahead, parse RSS and Atom directly from the reader without retaining two complete raw copies, and propagate reader I/O errors. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/327">#327</a>)</li> <li>Preserve parse errors when closing an HTTP response also returns an error.</li> <li>Tolerate non-HTTP URI schemes and resolve RSS and Atom <code>xml:base</code> values without mutating sibling scope. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/240">#240</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/283">#283</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/290">#290</a>)</li> <li>Resolve every URI-bearing HTML attribute, including elements with multiple URI attributes. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/323">#323</a>)</li> <li>Preserve ordinary Atom content that merely looks like base64 and trim whitespace-prefixed Atom links. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/238">#238</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/283">#283</a>)</li> <li>Promote embedded Atom author, date, content, summary, and category elements from RSS into universal fields. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/292">#292</a>)</li> <li>Correct RSS <code>guid</code> <code>isPermaLink</code> handling and replace the invalid <code>itunes:subtitle</code> feed-link fallback with <code>atom:link</code>. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/283">#283</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/322">#322</a>)</li> <li>Handle illegal C0 XML controls, mixed CDATA content, namespace whitespace, <code><cloud></code> children, and non-content <code><encoded></code> elements without losing the feed. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/284">#284</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/295">#295</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/317">#317</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/318">#318</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/325">#325</a>)</li> <li>Continue entity decoding after bare ampersands without corrupting query parameters that resemble legacy HTML entities. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/319">#319</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/321">#321</a>)</li> <li>Correct named timezone offsets and additional date layouts. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/234">#234</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/282">#282</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/324">#324</a>)</li> <li>Tolerate off-spec JSON Feed IDs, booleans, attachment sizes, and durations; use attachment byte size for <code>Enclosure.Length</code>; and reject out-of-range numeric sizes safely. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/279">#279</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/326">#326</a>)</li> <li>Prevent sorting panics when items have nil parsed publication dates.</li> </ul> <h2>Dependencies and maintenance</h2> <ul> <li>Replace <code>jsoniter</code> with <code>encoding/json</code>. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/280">#280</a>)</li> <li>Migrate to <code>github.com/mmcdole/goxpp/v2</code> v2.0.0. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/329">#329</a>)</li> <li>Replace <code>goquery</code> and <code>cascadia</code> with direct <code>x/net/html</code> traversal. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/330">#330</a>)</li> <li>Upgrade <code>golang.org/x/net</code> and <code>golang.org/x/text</code> for security, and upgrade <code>testify</code> and <code>urfave/cli</code>.</li> <li>Expand regression fixtures and consolidate parser and translator control flow. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/332">#332</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/333">#333</a>)</li> <li>Add contributor guidance and test-fixture conventions. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/331">#331</a>)</li> <li>Modernize GitHub Actions with stable/oldstable builds, race-enabled shuffled tests, Staticcheck, govulncheck, Codecov, and Dependabot; remove the defunct Travis configuration. (<a href="https://redirect.github.com/mmcdole/gofeed/issues/297">#297</a>, <a href="https://redirect.github.com/mmcdole/gofeed/issues/335">#335</a>)</li> </ul> <h2>Contributors</h2> <p>Contributions in this release came from <a href="https://github.com/mmcdole"><code>@mmcdole</code></a>, <a href="https://github.com/TypicalAM"><code>@TypicalAM</code></a>, <a href="https://github.com/oprudkyi"><code>@oprudkyi</code></a>, and <a href="https://github.com/akfaew"><code>@akfaew</code></a>.</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mmcdole/gofeed/commit/ec8fd42b318434c513e276d7206a937103b760ee"><code>ec8fd42</code></a> Remove defunct Travis CI configuration (<a href="https://redirect.github.com/mmcdole/gofeed/issues/335">#335</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/16bfe363a6b3edb2cb29de9a08d6d493c701eb63"><code>16bfe36</code></a> Route the parser element loops through one shared helper (<a href="https://redirect.github.com/mmcdole/gofeed/issues/333">#333</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/d9ae5640ff8a003c28906e30b35ff8a881c02c26"><code>d9ae564</code></a> Flatten the translator micro-methods (<a href="https://redirect.github.com/mmcdole/gofeed/issues/332">#332</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/33df57e598ec5ace3e64d3e3039f6e1e4a6153ac"><code>33df57e</code></a> Add CONTRIBUTING.md (<a href="https://redirect.github.com/mmcdole/gofeed/issues/331">#331</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/f8a5f28a6f970d36ca2ae93f803134fe9ec21dfe"><code>f8a5f28</code></a> Add DisableContentImageScan and drop the goquery dependency (<a href="https://redirect.github.com/mmcdole/gofeed/issues/330">#330</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/8727c27e87f0c860e0603476876effeb3b36f7ab"><code>8727c27</code></a> Migrate to goxpp v2 (<a href="https://redirect.github.com/mmcdole/gofeed/issues/329">#329</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/8cd10be78ba6510475c48f76b2ae373e6675934c"><code>8cd10be</code></a> Bump goxpp to v1.3.0 (<a href="https://redirect.github.com/mmcdole/gofeed/issues/328">#328</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/6011645855e5c531e951f2bbafa86bc2ce897e9b"><code>6011645</code></a> Stream XML feeds through Parse; surface reader I/O errors (<a href="https://redirect.github.com/mmcdole/gofeed/issues/327">#327</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/18a93c20ae46813cfb4d82daa76738bcb49df8ce"><code>18a93c2</code></a> Coerce out-of-range float sizes to 0 instead of overflow garbage (<a href="https://redirect.github.com/mmcdole/gofeed/issues/326">#326</a>)</li> <li><a href="https://github.com/mmcdole/gofeed/commit/f66719a089624a03d6c93f3b0338eac4f9bd1b63"><code>f66719a</code></a> Trim namespace URIs once, inside PrefixForNamespace (<a href="https://redirect.github.com/mmcdole/gofeed/issues/325">#325</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mmcdole/gofeed/compare/v1.3.0...v1.4.0">compare view</a></li> </ul> </details> <br /> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>