summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-08-29[upd] pypi: Bump the minor group with 3 updates (#5166)dependabot[bot]
Bumps the minor group with 3 updates: [lxml](https://github.com/lxml/lxml), [granian[reload]](https://github.com/emmett-framework/granian) and [granian](https://github.com/emmett-framework/granian). Updates `lxml` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](https://github.com/lxml/lxml/compare/lxml-6.0.0...lxml-6.0.1) Updates `granian[reload]` from 2.5.0 to 2.5.1 - [Release notes](https://github.com/emmett-framework/granian/releases) - [Commits](https://github.com/emmett-framework/granian/compare/v2.5.0...v2.5.1) Updates `granian` from 2.5.0 to 2.5.1 - [Release notes](https://github.com/emmett-framework/granian/releases) - [Commits](https://github.com/emmett-framework/granian/compare/v2.5.0...v2.5.1)
2025-08-29[l10n] update translations from Weblate (#5168)github-actions[bot]
87a404001 - 2025-08-28 - hhadi34 <hhadi34@noreply.codeberg.org> 86cd8cd7a - 2025-08-29 - lucasmz.dev <lucasmz.dev@noreply.codeberg.org> 7488333e6 - 2025-08-29 - ghose <ghose@noreply.codeberg.org> d03da377c - 2025-08-29 - return42 <return42@noreply.codeberg.org> c63fa5248 - 2025-08-28 - kratos <makesocialfoss32@keemail.me> db35c0bfe - 2025-08-28 - Artiman <artiman@noreply.codeberg.org> 13028fa72 - 2025-08-28 - return42 <return42@noreply.codeberg.org> d984f1cef - 2025-08-28 - return42 <return42@noreply.codeberg.org> 4ec477015 - 2025-08-28 - SomeTr <sometr@noreply.codeberg.org> a74603ff8 - 2025-08-28 - sprinklerillicitly <sprinklerillicitly@noreply.codeberg.org>
2025-08-29[data] update searx.data - update_external_bangs.py (#5158)github-actions[bot]
2025-08-29[data] update searx.data - update_wikidata_units.py (#5159)github-actions[bot]
2025-08-29[data] update searx.data - update_firefox_version.py (#5160)github-actions[bot]
2025-08-29[data] update searx.data - update_ahmia_blacklist.py (#5161)github-actions[bot]
2025-08-29[data] update searx.data - update_currencies.py (#5162)github-actions[bot]
2025-08-29[data] update searx.data - update_engine_traits.py (#5163)github-actions[bot]
2025-08-29[data] update searx.data - update_engine_descriptions.py (#5164)github-actions[bot]
2025-08-28[fix] annas archive: engine broken due to site HTML changesBnyro
Apparently the layout of https://annas-archive.org has changed, making changes necessary. The issue has been reported in #5146, see there for more details. - closes #5146
2025-08-28[feat] plugins: add new time/timezone search pluginBnyro
The plugin uses the ``GeoLocation`` class, which is already implemented in the context of weather forecasts, to determine the time zone. The ``DateTime`` class is used for the localized display of date and time. Co-authored-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-27[fix] typo in the docs about HTML method POST versus GETMarkus Heiser
2025-08-26[doc] fix missing link in ``default_http_headers`` descriptionMarkus Heiser
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de> Format: reST
2025-08-26[doc] adds the missing documentation of the `server.method` settings.Markus Heiser
TL;DR; For all the issues that comes with HTTP POST I recommend instance maintainers to switch to GET and lock the property in the preferences: ```yaml server: method: GET preferences: lock: - method ``` We don't want this in the defaults of the SearXNG distributions for the pros vs cons listed in this discussion: - https://github.com/searxng/searxng/pull/3619
2025-08-26[mod] py3.9 EOL (#5148)Markus Heiser
[1] https://devguide.python.org/versions/ [2] https://peps.python.org/pep-0596/ Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-24[feat] engines: add OpenAlex Works engine (#5102)muthukumaran R
- Adds a new engine `searx/engines/openalex.py` that integrates the OpenAlex Works API to return scientific paper results using the `paper.html` template. - Uses the official API (no auth required); supports OpenAlex polite pool via `mailto`. - Adds developer docs at `docs/dev/engines/online/openalex.rst`. OpenAlex API reference: https://docs.openalex.org/how-to-use-the-api/api-overview
2025-08-22[upd] web-client (simple): Bump the minor group (#5144)dependabot[bot]
Bumps the minor group in /client/simple with 2 updates: [browserslist](https://github.com/browserslist/browserslist) and [less](https://github.com/less/less.js). Updates `browserslist` from 4.25.2 to 4.25.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](https://github.com/browserslist/browserslist/compare/4.25.2...4.25.3) Updates `less` from 4.4.0 to 4.4.1 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/less/less.js/commits) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.25.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor - dependency-name: less dependency-version: 4.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22[upd] github-actions: Bump github/codeql-action from 3.29.9 to 3.29.11 (#5143)dependabot[bot]
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.9 to 3.29.11. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/df559355d593797519d70b90fc8edd5db049e7a2...3c3833e0f8c1c83d449a7478aa59c036a9165498) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.29.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22[upd] pypi: Bump the minor group with 4 updates (#5142)dependabot[bot]
Bumps the minor group with 4 updates: [flask](https://github.com/pallets/flask), [typer-slim](https://github.com/fastapi/typer), [pylint](https://github.com/pylint-dev/pylint) and [basedpyright](https://github.com/detachhead/basedpyright). Updates `flask` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/flask/compare/3.1.1...3.1.2) Updates `typer-slim` from 0.16.0 to 0.16.1 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](https://github.com/fastapi/typer/compare/0.16.0...0.16.1) Updates `pylint` from 3.3.7 to 3.3.8 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](https://github.com/pylint-dev/pylint/compare/v3.3.7...v3.3.8) Updates `basedpyright` from 1.31.0 to 1.31.3 - [Release notes](https://github.com/detachhead/basedpyright/releases) - [Commits](https://github.com/detachhead/basedpyright/compare/v1.31.0...v1.31.3)
2025-08-22[l10n] update translations from Weblate (#5141)github-actions[bot]
a4922b114 - 2025-08-21 - KOUSTAV <koustav@noreply.codeberg.org> 3f61bddd1 - 2025-08-18 - reis2724 <reis2724@noreply.codeberg.org> 7313a683d - 2025-08-19 - Kemystra <kemystra@noreply.codeberg.org> 92e1bce48 - 2025-08-19 - Artiman <artiman@noreply.codeberg.org> 0f27c1bc2 - 2025-08-18 - youtherthyf <youtherthyf@noreply.codeberg.org> 60496bc76 - 2025-08-16 - alexgabi <alexgabi@noreply.codeberg.org> 742982d00 - 2025-08-15 - lucasmz.dev <lucasmz.dev@noreply.codeberg.org>
2025-08-21[build] /staticMarkus Heiser
2025-08-21[feat] client/simple: move cursor to end of search input on mobileAmit Katyal
On mobile devices, when the search input is focused, move the cursor to the end of the existing text. This improves the user experience by making it easier to edit or append to the current query without manually moving the cursor first. Closes: https://github.com/searxng/searxng/issues/5112
2025-08-21[build] /staticMarkus Heiser
2025-08-21[fix] move initial "JS is enabled?" (no-js) to client sideMarkus Heiser
To avoid an `unsafe-inline` in the CSP header, the JS code must be moved to the client side [1]. The `<script>` tag at the end of the HTML originates from the old implementation of the JS client. Since PR-5073 [2] was merged, the `type` is now `module`, and the tag must be moved to the beginning of the HTML. > We need to inline this "JS is enabled?" thing to prevent layout shifts and > temporary "no JS enabled" visuals as ESM scripts loads and evals everything > deferred from initial DOM render [3] That's true in theory, but in practice, this effect is unnoticeable because it's masked by another effect (which we can't avoid): If we load the page with a severely throttled connection, the HTML (result list) takes a long time to load. Then the CSS is loaded, which also takes longer. Until the CSS has loaded, there's no layout. A layout shift is therefore largely determined by the loading of the HTML and CSS itself. The running times of the ESM script can be neglected compared to the loading times of HTML & CSS. [1] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199494256 [2] https://github.com/searxng/searxng/pull/5073 [3] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199622504
2025-08-20[fix] template: safesearch uses the wrong type (#5136)Ivan Gabaldon
This fixes a regression from 60bd8b9#diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc Closes https://github.com/searxng/searxng/issues/5135
2025-08-20[fix] webapp: safesearch uses wrong default value (#5134)Bnyro
- this fixes a regression from https://github.com/searxng/searxng/commit/60bd8b90f04d5d825fc8ac279cb7fdfde9fe78ea#diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc - closes https://github.com/searxng/searxng/issues/5130
2025-08-20[fix] selfhst icons: icon list url invalid, set to activeBnyro
- the previous CDN icon list url no longer works - a list of all icons is mirrored to the JSDelivr CDN however - there's no reason to set the engine to inactive now that we use public CDNs
2025-08-20[feat] engines: add GitHub Code Search engine (#5074)Filip Mikina
This patch adds GitHub Code Search [1] engine to allow querying the codebases. Template code.html is changed to allow passthrough of strip and highlighting options. Engine Searchcode is adjusted to pass filename and not rely on hardcoded extensions. GitHub search code API does not return the exact code line indices, this implementation assigns the code arbitrary numbers starting from 1 (effectively relabeling the code). The API allows for unauth calls, and the default engine settings default to that, although the calls are heavily rate limited. The 'text' lexer is the default pygments lexer when parsing fails. [1] https://docs.github.com/en/rest/search/search?apiVersion=2022-11-28#search-code Co-authored-by: Markus Heiser <markus.heiser@darmarIT.de>
2025-08-19[mod] switching from pyright to basedpyright (plus first rules)Markus Heiser
pyrightconfig.json : for the paths searx, searxng_extra and tests, individual rules were defined (for example, in test fewer / different rules are needed than in the searx package searx/engines/__builtins__.pyi : The builtin types that are added to the global namespace of a module by the intended monkey patching of the engine modules / replaces the previous filtering of the stdout using grep. test.pyright_modified (utils/lib_sxng_test.sh) : static type check of local modified files not yet commited make test : prerequisite 'test.pyright' has been replaced by 'test.pyright_modified' searx/engines/__init__.py, searx/enginelib/__init__.py : First, minimal typifications that were considered necessary.
2025-08-18[upd] web-client (simple): Bump the minor group across 1 directory with 6 ↵dependabot[bot]
updates (#5128) * [upd] web-client (simple): Bump the minor group across 1 directory with 6 updates Bumps the minor group with 6 updates in the /client/simple directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.1.3` | `2.2.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.2.0` | `24.3.0` | | [browserslist](https://github.com/browserslist/browserslist) | `4.25.1` | `4.25.2` | | [edge.js](https://github.com/edge-js/edge) | `6.2.1` | `6.3.0` | | [stylelint](https://github.com/stylelint/stylelint) | `16.23.0` | `16.23.1` | | [vite-bundle-analyzer](https://github.com/nonzzz/vite-bundle-analyzer) | `1.1.0` | `1.2.1` | Updates `@biomejs/biome` from 2.1.3 to 2.2.0 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.2.0/packages/@biomejs/biome) Updates `@types/node` from 24.2.0 to 24.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `browserslist` from 4.25.1 to 4.25.2 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](https://github.com/browserslist/browserslist/compare/4.25.1...4.25.2) Updates `edge.js` from 6.2.1 to 6.3.0 - [Release notes](https://github.com/edge-js/edge/releases) - [Changelog](https://github.com/edge-js/edge/blob/6.x/CHANGELOG.md) - [Commits](https://github.com/edge-js/edge/compare/v6.2.1...v6.3.0) Updates `stylelint` from 16.23.0 to 16.23.1 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](https://github.com/stylelint/stylelint/compare/16.23.0...16.23.1) Updates `vite-bundle-analyzer` from 1.1.0 to 1.2.1 - [Release notes](https://github.com/nonzzz/vite-bundle-analyzer/releases) - [Changelog](https://github.com/nonzzz/vite-bundle-analyzer/blob/master/CHANGELOG.md) - [Commits](https://github.com/nonzzz/vite-bundle-analyzer/compare/v1.1.0...v1.2.1) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@types/node" dependency-version: 24.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor - dependency-name: browserslist dependency-version: 4.25.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor - dependency-name: edge.js dependency-version: 6.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor - dependency-name: stylelint dependency-version: 16.23.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor - dependency-name: vite-bundle-analyzer dependency-version: 1.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com> * [fix] themes/simple: recreate lock * [fix] themes/simple: promote from nursery - noAwaitInLoop - noBitwiseOperators - noConstantBinaryExpression - noGlobalDirnameFilename - noImplicitCoercion - noUnassignedVariables - noUselessBackrefInRegex - noUselessEscapeInString - useAdjacentGetterSetter - useConsistentObjectDefinition - useConsistentResponse - useIndexOf - useIterableCallbackReturn - useJsonImportAttribute - useNumericSeparators - useObjectSpread - useParseIntRadix - useReadonlyClassProperties - useSingleJsDocAsterisk - useUnifiedTypeSignature * [fix] themes/simple: build static --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ivan Gabaldon <igabaldon@inetol.net>
2025-08-18[fix] container: change mirror (#5127)Ivan Gabaldon
`mirrors.edge.kernel.org` has weird issues, use the official mirror and avoid future issues.
2025-08-18[upd] pypi: Bump the minor group across 1 directory with 2 updates (#5126)dependabot[bot]
Bumps the minor group with 2 updates in the / directory: [valkey](https://github.com/valkey-io/valkey-py) and [selenium](https://github.com/SeleniumHQ/Selenium). Updates `valkey` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/valkey-io/valkey-py/releases) - [Commits](https://github.com/valkey-io/valkey-py/compare/v6.1.0...v6.1.1) Updates `selenium` from 4.34.2 to 4.35.0 - [Release notes](https://github.com/SeleniumHQ/Selenium/releases) - [Commits](https://github.com/SeleniumHQ/Selenium/commits/selenium-4.35.0) --- updated-dependencies: - dependency-name: valkey dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor - dependency-name: selenium dependency-version: 4.35.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18[l10n] update translations from Weblate (#5117)github-actions[bot]
b0a695592 - 2025-08-14 - zymurge <zymurge@noreply.codeberg.org> 17c30fdae - 2025-08-14 - c2qd <c2qd@noreply.codeberg.org> a1dc25ec1 - 2025-08-12 - Kemystra <kemystra@noreply.codeberg.org> a6c4a30e3 - 2025-08-12 - ijxp <ijxp@noreply.codeberg.org> Co-authored-by: searxng-bot <searxng-bot@users.noreply.github.com>
2025-08-18[build] /staticMarkus Heiser
2025-08-18[fix] add missing nvm environment to the "./manage dev.env" commandMarkus Heiser
2025-08-18[fix] drop obsolte client/simple/static/Markus Heiser
2025-08-18[license] client/simple: SPDX-License-Identifier: AGPL-3.0-or-laterMarkus Heiser
SPDX short-form identifiers to communicate license information in a simple, efficient, portable and machine-readable manner [1] [1] https://spdx.dev/learn/handling-license-info/
2025-08-18[enh] theme/simple: custom routerIvan Gabaldon
Lay the foundation for loading scripts granularly depending on the endpoint it's on. Remove vendor specific prefixes as there are now managed by browserslist and LightningCSS. Enabled quite a few rules in Biome that don't come in recommended to better catch issues and improve consistency. Related: - https://github.com/searxng/searxng/pull/5073#discussion_r2256037965 - https://github.com/searxng/searxng/pull/5073#discussion_r2256057100
2025-08-18[fix] theme/simple: broken highlightResultIvan Gabaldon
From `mod-simple-strict`
2025-08-18[enh] theme/simple: package.json revisionIvan Gabaldon
Set minor versioning for most of the packages that iterate fast or we know won't cause problems, and fixed versioning for the rest. Packages going into bundles should be placed in "dependencies". The inspection of prod bundles is necessary. Although it does not make a lot of sense right now, it will be useful in later PR and will give us a reference to start with.
2025-08-18[mod] theme/simple: migrate codebase to TypeScriptIvan Gabaldon
TypeScript is a superset of JavaScript, converting the entire theme to TypeScript allows us to receive much more feedback on possible issues made in package updates or our own typos, furthermore, it allows to transpile properly to lower specs. This PR couldn't be done in smaller commits, a lot of work needed to make everything *work properly*: - A browser baseline has been set that requires minimum **Chromium 93, Firefox 92 and Safari 15** (proper visuals/operation on older browser versions is not guaranteed) - LightningCSS now handles minification and prefix creation for CSS. - All hardcoded polyfills and support for previous browser baseline versions have been removed. - Convert codebase to TypeScript. - Convert IIFE to ESM, handling globals with IIFE is cumbersome, ESM is the standard for virtually any use of JS nowadays. - Vite now builds the theme without the need for `vite-plugin-static-copy`. - `searxng.ready` now accepts an array of conditions for the callback to be executed. - Replace `leaflet` with `ol` as there were some issues with proper Vite bundling. - Merged `head` with `main` script, as head was too small now. - Add `assertElement` to properly check the existence of critical DOM elements. - `searxng.on` renamed to `searxng.listen` with some handling improvements.
2025-08-18[fix] revision of utils.HTMLTextExtractor (#5125)Markus Heiser
Related: - https://github.com/searxng/searxng/pull/5073#issuecomment-3196282632
2025-08-16[fix] reuters: published date not parsed correctly in some casesIshbir Singh
FIxes publishedDate format in reuters engine to encompass ISO 8601 times both with and without milliseconds. Why is this change important? Previously, the engine would sometimes fail saying: 2025-08-12 21:13:23,091 ERROR:searx.engines.reuters: exception : time data '2024-04-15T19:08:30.833Z' does not match format '%Y-%m-%dT%H:%M:%SZ' Traceback (most recent call last): ... File "/usr/local/searxng/searx/engines/reuters.py", line 87, in response publishedDate=datetime.strptime(result["display_time"], "%Y-%m-%dT%H:%M:%SZ"), ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... Note that most queries seem to work with Reuters, but there are some results that have the additional milliseconds and fail. Regardless, the change is backwards compatible as both the formats (with and without the ms) should now parse correctly.
2025-08-15[upd] github-actions: Bump actions/checkout from 4.2.2 to 5.0.0 (#5118)dependabot[bot]
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15[upd] github-actions: Bump github/codeql-action from 3.29.6 to 3.29.9 (#5119)dependabot[bot]
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.6 to 3.29.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/a4e1a019f5e24960714ff6296aee04b736cbc3cf...df559355d593797519d70b90fc8edd5db049e7a2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.29.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12[fix] baidu captcha detection (#5111)Zhijie He
Add Baidu Captcha detection to reduce `JSONDecodeError` error Baidu will redirect to `wappass.baidu.com` and return a captcha challenge. Current behavior will get the data from `wappass.baidu.com` then return a `json.decoder.JSONDecodeError` error.
2025-08-10[fix] replace X-Scheme by X-Forwarded-Proto header (#5107)Markus Heiser
The HTTP X-Forwarded-Proto (XFP) request header is a *de-facto* standard header for identifying the protocol (HTTP or HTTPS) that a client used to connect to a proxy or load balancer.[1] The ``X-Scheme`` header was added 10 years ago, why ``X-Scheme`` was used back then and not ``X-Forwarded-Proto``, nobody knows today / possibly because ``X-Forwarded-Proto`` wasn't a *de-facto* standard back then. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto [2] https://github.com/searx/searx/commit/6ef7c3276
2025-08-10[fix] use X-Forwarded-Proto header if the URL scheme is unknown (#5106)Markus Heiser
The HTTP X-Forwarded-Proto (XFP) request header is a de-facto standard header for identifying the protocol (HTTP or HTTPS) that a client used to connect to a proxy or load balancer.[1] In our documentation[2] we recommend to set the `X-Scheme` header. This header is not required if the `server.base_url` is set correctly.[3] If none of these URL scheme details exist, then the header X-Forwarded-Proto is evaluated as a third alternative. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto [2] https://docs.searxng.org/admin/installation-apache.html#apache-s-searxng-site [3] https://docs.searxng.org/admin/settings/settings_server.html Closes: https://github.com/searxng/searxng/issues/5105
2025-08-09[fix] limiter: trusted proxies doc-string (#5104)Markus Heiser
2025-08-09[mod] limiter: trusted proxies (#4911)Ivan Gabaldon
Replaces `x_for` functionality with `trusted_proxies`. This allows defining which IP / ranges to trust extracting the client IP address from X-Forwarded-For and X-Real-IP headers. We don't know if the proxy chain will give us the proper client address (REMOTE_ADDR in the WSGI environment), so we rely on reading the headers of the proxy before SearXNG (if there is one, in that case it must be added to trusted_proxies) hoping it has done the proper checks. In case a proxy in the chain does not check the client address correctly, integrity is compromised and this should be fixed by whoever manages the proxy, not us. Closes: - https://github.com/searxng/searxng/issues/4940 - https://github.com/searxng/searxng/issues/4939 - https://github.com/searxng/searxng/issues/4907 - https://github.com/searxng/searxng/issues/3632 - https://github.com/searxng/searxng/issues/3191 - https://github.com/searxng/searxng/issues/1237 Related: - https://github.com/searxng/searxng-docker/issues/386 - https://github.com/inetol-infrastructure/searxng-container/issues/81
generated by cgit v1.2.3 (git 2.25.1) at 2026-03-24 06:22:52 +0000