github.com/mmcdole/gofeed

This patch fixes two parser regressions. JSON feeds larger than the 4096-byte detection window are now detected and parsed completely, and RSS feeds with an unknown default namespace on <rss> are parsed as native RSS while recognized extension namespaces retain their meaning.

Changes

• Detect JSON feeds larger than the sniffing window. (#348)
• Tolerate an unknown default namespace on the RSS root. (#347)
• Update actions/setup-go from v6 to v7. (#337)

Full changelog: v1.4.1...v1.4.2

This patch fixes namespace handling for Atom links embedded in RSS feeds. Atom self and WebSub hub links are now preserved in Feed.Extensions["atom"]["link"] even when a feed uses a local default namespace or a different prefix.

It also makes prefixed Atom and RDF documents parse consistently, preserves compatibility with commonly seen content:encoded namespace variants, and updates golang.org/x/net to v0.57.0.

Changes

• Fix namespace-aware Atom extension parsing. (#339)
• Update golang.org/x/net to v0.57.0. (#336)

Full changelog: v1.4.0...v1.4.1

This release focuses on bug fixes for malformed and off-spec feeds. Illegal XML control characters, unusual date formats, incorrectly typed JSON Feed fields, and unescaped ampersands in URLs could previously break a parse or silently drop content. The parser now handles these cases without failing the feed or losing the affected content.

It also fixes a lazy-initialization data race when a default-configured Parser is reused across goroutines (#278). Three new options give callers more control over resource use: an HTTP response-size limit, optional retention of the original source feed, and a switch to disable RSS content-image scanning.

For RSS and Atom, the universal Parser.Parse method no longer holds two complete copies of the raw feed in memory during format detection. It examines the first 4 KiB, detects the format, and then parses directly from the reader. The returned Feed is still fully materialized, so this is not a streaming API. JSON Feed decoding still buffers the complete document.

Compatibility

• Go 1.25 or newer is required. v1.4.0 updates golang.org/x/net from v0.4.0 to v0.56.0 to resolve 22 reachable vulnerabilities reported by govulncheck; that release and its golang.org/x/text dependency require Go 1.25.
• ParseURL now applies a 30-second request timeout. ParseURLWithContext continues to use the caller's context.
• Parse now examines only the first 4 KiB to detect the feed type. RSS and Atom roots must begin within that window. In v1.4.0, a JSON Feed whose complete document does not fit within the window is not detected by the universal Parser and returns ErrFeedTypeNotDetected.
• The text returned by ErrFeedTypeNotDetected.Error() now begins with lowercase failed.
• No exported v1 identifier was removed. Feed now has private storage for the original source feed, so external positional Feed{...} literals no longer compile; keyed literals are unaffected.

Added

• Add Parser.MaxByteSize and ErrResponseTooLarge to limit response bodies fetched by ParseURL and ParseURLWithContext. (#286)
• Add Parser.KeepOriginalFeed and Feed.OriginalFeed() for access to the parsed *rss.Feed, *atom.Feed, or *json.Feed. (#289)
• Add DefaultRSSTranslator.DisableContentImageScan to skip the HTML image fallback on large feeds while preserving existing behavior by default. (#330)

Parsing and translation fixes

• Fix a data race when the same default-configured Parser is reused across goroutines. (#278)
• Limit universal-parser format detection to a 4 KiB lookahead, parse RSS and Atom directly from the reader without retaining two complete raw copies, and propagate reader I/O errors. (#327)
• Preserve parse errors when closing an HTTP response also returns an error.
• Tolerate non-HTTP URI schemes and resolve RSS and Atom xml:base values without mutating sibling scope. (#240, #283, #290)
• Resolve every URI-bearing HTML attribute, including elements with multiple URI attributes. (#323)
• Preserve ordinary Atom content that merely looks like base64 and trim whitespace-prefixed Atom links. (#238, #283)
• Promote embedded Atom author, date, content, summary, and category elements from RSS into universal fields. (#292)
• Correct RSS guid isPermaLink handling and replace the invalid itunes:subtitle feed-link fallback with atom:link. (#283, #322)
• Handle illegal C0 XML controls, mixed CDATA content, namespace whitespace, <cloud> children, and non-content <encoded> elements without losing the feed. (#284, #295, #317, #318, #325)
• Continue entity decoding after bare ampersands without corrupting query parameters that resemble legacy HTML entities. (#319, #321)
• Correct named timezone offsets and additional date layouts. (#234, #282, #324)
• Tolerate off-spec JSON Feed IDs, booleans, attachment sizes, and durations; use attachment byte size for Enclosure.Length; and reject out-of-range numeric sizes safely. (#279, #326)
• Prevent sorting panics when items have nil parsed publication dates.

Dependencies and maintenance

• Replace jsoniter with encoding/json. (#280)
• Migrate to github.com/mmcdole/goxpp/v2 v2.0.0. (#329)
• Replace goquery and cascadia with direct x/net/html traversal. (#330)
• Upgrade golang.org/x/net and golang.org/x/text for security, and upgrade testify and urfave/cli.
• Expand regression fixtures and consolidate parser and translator control flow. (#332, #333)
• Add contributor guidance and test-fixture conventions. (#331)
• Modernize GitHub Actions with stable/oldstable builds, race-enabled shuffled tests, Staticcheck, govulncheck, Codecov, and Dependabot; remove the defunct Travis configuration. (#297, #335)

Contributors

Contributions in this release came from @mmcdole, @TypicalAM, @oprudkyi, and @akfaew.

Full changelog: v1.3.0...v1.4.0

What's Changed

• Added oddball date format by @rodmcelrath in #204
• chore: slice append replace loop by @testwill in #213
• chore: remove refs to deprecated io/ioutil by @testwill in #212
• Use itunes:summary if no description tag in feed and items description by @rdelaage in #209
• Remove spaces from go identifiers in readme by @infogulch in #215
• Update translator.go by @Strubbl in #216
• Fix RSS enclosure parsing by @sgodart in #218
• Added fallback to atom icon when atom logo is missing by @spacecowboy in #221
• Extract feed and item images from more places by @infogulch in #220
• Fix handling of RSS content:encoded by @cristoper in #223
• Atom: use correct xml:base for decoded elements by @cristoper in #222

New Contributors

• @testwill made their first contribution in #213
• @rdelaage made their first contribution in #209
• @infogulch made their first contribution in #215
• @Strubbl made their first contribution in #216
• @sgodart made their first contribution in #218
• @spacecowboy made their first contribution in #221

Full Changelog: v1.2.1...v1.3.0

Fixes concurrency / thread safety issues when re-using a parser.

Bug fixes and support for multiple link tags in rss feeds.

Ability to parse custom fields in rss that are not part of the spec (#…

…177)

Support multiple links (#164)

* Add Feed.Links

* Update tests, don't create empty list

* Use same rel logic for RSS atom extensions

* Support for JSON feed

* Fix invalid JSON and run `go mod tidy`

* Fix tests, don't return empty strings

We have JSON Feeds!

Huge thanks to @sudhanshuraheja and @nkanaev for getting JSON feed support across the finish line!