Update miniflux/miniflux Docker tag to v2.3.3

[renovate]

This PR contains the following updates:

Package	Update	Change
miniflux/miniflux (source)	patch	2.3.2-distroless → 2.3.3-distroless

---

Release Notes

miniflux/v2 (miniflux/miniflux)

v2.3.3: Miniflux 2.3.3

Compare Source

New features

• Feed and entry language detection

  • Miniflux now reads the language declared by feeds and entries and stores it on both feeds and entries. Supported sources are the RSS <language> and <dc:language> elements, xml:lang on Atom 1.0 and 0.3 documents, dc:language in RDF/RSS 1.0 feeds, and the language field of JSON Feed.
  • Entries without their own language now inherit the language declared by the feed.
  • Article titles and content are rendered with a matching lang attribute, which improves screen reader pronunciation, hyphenation, and browser translation prompts.
  • The language field is exposed through the API and the Go client for both feeds and entries.

• Other additions

  • Feed discovery now finds the feeds offered by GitHub pages.
  • TLS certificates are reloaded when the process receives SIGHUP, so renewed certificates can be picked up without a restart.
  • The browser favicon is now served as SVG for a sharper icon on high-density displays.
  • Compressed responses are negotiated with a much more standard-compliant Accept-Encoding parser, including quality values and wildcards.

Performance improvements

• Long entry and feed lists render noticeably faster: off-screen rows no longer cost layout and paint work on initial render.
• Reduced memory allocations when stripping and truncating HTML, roughly halving the time spent on tag-heavy content.
• Compression writers are now pooled instead of being allocated for every compressed response, which significantly reduces garbage collection pressure on busy instances.

Security

• Fixed an information disclosure issue where any authenticated user could read favicons belonging to other users' feeds through GET /v1/icons/{iconID}.
• Unix sockets are now created with 0660 permissions instead of being world-writable. Deployments where the reverse proxy runs as a different user now require that user to share a group with the Miniflux process.
• Fixed an issue where limit=0 in entry queries bypassed the 1000-entry cap and returned every matching entry.
• Feed-declared language values are now validated before being stored, keeping oversized values and control characters out of the database and the rendered HTML.

Bug fixes

• Fixed a crash caused by concurrent writes to the translation catalog when several requests used a not-yet-loaded language.
• Fixed a race condition during template rendering that could return a page translated in another user's language.
• Fixed a panic during graceful shutdown when feed refresh jobs were queued while workers were draining.
• Fixed a division-by-zero crash with the entry_frequency scheduler when SCHEDULER_ENTRY_FREQUENCY_FACTOR was set to 0; the value must now be greater than or equal to 1.
• Fixed an upgrade failure of migration 127 on databases containing entries whose feed no longer exists.
• MEDIA_PROXY_RESOURCE_TYPES and TRUSTED_REVERSE_PROXY_NETWORKS now accept spaces and trailing commas in their list values instead of refusing to start.
• Fixed "Mark all as read" on the unread page, which marked entries from categories hidden from the global unread list.
• Fixed a category deletion check that could remove all of a user's categories.
• Fixed pagination in the Entries API: the total count is now correct when the requested offset is past the last entry.
• Fixed the no_media_player option being ignored when creating a feed.
• A feed proxy URL can now be cleared once it has been configured.
• Fixed entry_sorting_order validation on user modification, which returned a server error instead of a validation error for unsupported values.
• Fixed the fetch_via_proxy checkbox disappearing when the subscription page was re-rendered after an error.
• Fixed the remove_tables rewrite rule reordering article content.
• Fixed plain text content_text and summary values from JSON Feed being mangled when they contained markup-like characters.
• Fixed empty tags being sent to Raindrop when no tag was configured.
• Fixed overlapping article headings that wrap onto multiple lines.
• Fixed Atom language parsing to only consider namespace-qualified xml:lang attributes.

Dependencies

Updated several Go modules and GitHub Actions dependencies, including:

• github.com/andybalholm/brotli 1.2.2
• github.com/coreos/go-oidc/v3 3.20.0
• github.com/prometheus/client_golang 1.24.0
• golang.org/x/crypto 0.54.0
• golang.org/x/net 0.57.0
• golang.org/x/text 0.40.0

---

As always, thank you to all contributors who helped improve Miniflux in this release.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[xRahul]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Docker Compose configuration updates the Miniflux service image from 2.3.2-distroless to 2.3.3-distroless.

Changes

Miniflux service update

Layer / File(s)	Summary
Update Miniflux image version docker-compose.yml	The Miniflux service image tag changes from 2.3.2-distroless to 2.3.3-distroless.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: xrahul

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping the Miniflux Docker image tag to v2.3.3.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}