Commit Graph
8885 Commits
Author SHA1 Message Date
github-actions[bot]andGitHub fde4fac3ca [data] update searx.data - update_external_bangs.py (#5158) 2025-08-29 07:07:46 +02:00
github-actions[bot]andGitHub a9263fd063 [data] update searx.data - update_wikidata_units.py (#5159) 2025-08-29 07:07:00 +02:00
github-actions[bot]andGitHub 146cefe7fa [data] update searx.data - update_firefox_version.py (#5160) 2025-08-29 07:05:08 +02:00
github-actions[bot]andGitHub 2a7d26b714 [data] update searx.data - update_ahmia_blacklist.py (#5161) 2025-08-29 07:04:41 +02:00
github-actions[bot]andGitHub 480914d736 [data] update searx.data - update_currencies.py (#5162) 2025-08-29 07:04:12 +02:00
github-actions[bot]andGitHub edc50768cc [data] update searx.data - update_engine_traits.py (#5163) 2025-08-29 07:03:29 +02:00
github-actions[bot]andGitHub a519a13bfa [data] update searx.data - update_engine_descriptions.py (#5164) 2025-08-29 07:02:31 +02:00
BnyroandMarkus Heiser f971774773 [fix] annas archive: engine broken due to site HTML changes
Apparently the layout of https://annas-archive.org has changed, making changes necessary.

The issue has been reported in #5146, see there for more details.

- closes #5146
2025-08-28 19:24:37 +02:00
BnyroandMarkus Heiser 5ca08c1813 [feat] plugins: add new time/timezone search plugin
The plugin uses the ``GeoLocation`` class, which is already implemented in the
context of weather forecasts, to determine the time zone. The ``DateTime`` class
is used for the localized display of date and time.

Co-authored-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-28 10:49:50 +02:00
Markus Heiser 90e602b349 [fix] typo in the docs about HTML method POST versus GET 2025-08-27 10:17:24 +02:00
Markus Heiser 71f90755c4 [doc] fix missing link in `default_http_headers` description
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
Format: reST
2025-08-26 08:20:56 +02:00
Markus Heiser 92463ce6a7 [doc] adds the missing documentation of the server.method settings.
TL;DR; For all the issues that comes with HTTP POST I recommend instance
maintainers to switch to GET and lock the property in the preferences:

```yaml
server:
  method: GET

preferences:
  lock:
    - method
```

We don't want this in the defaults of the SearXNG distributions for the pros vs
cons listed in this discussion:

- https://github.com/searxng/searxng/pull/3619
2025-08-26 08:20:56 +02:00
Markus HeiserandGitHub a369fe8f29 [mod] py3.9 EOL (#5148)
[1] https://devguide.python.org/versions/
[2] https://peps.python.org/pep-0596/

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-26 07:46:20 +02:00
muthukumaran RandGitHub a0ff173799 [feat] engines: add OpenAlex Works engine (#5102)
- Adds a new engine `searx/engines/openalex.py` that integrates the OpenAlex
  Works API to return scientific paper results using the `paper.html` template.
- Uses the official API (no auth required); supports OpenAlex polite pool via `mailto`.
- Adds developer docs at `docs/dev/engines/online/openalex.rst`.

OpenAlex API reference: https://docs.openalex.org/how-to-use-the-api/api-overview
2025-08-24 14:17:30 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
11ea1a8134 [upd] web-client (simple): Bump the minor group (#5144)
Bumps the minor group in /client/simple with 2 updates: [browserslist](https://github.com/browserslist/browserslist) and [less](https://github.com/less/less.js).


Updates `browserslist` from 4.25.2 to 4.25.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.25.2...4.25.3)

Updates `less` from 4.4.0 to 4.4.1
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/less/less.js/commits)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.25.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: less
  dependency-version: 4.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22 10:04:37 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
e22ebd8817 [upd] github-actions: Bump github/codeql-action from 3.29.9 to 3.29.11 (#5143)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.9 to 3.29.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/df559355d593797519d70b90fc8edd5db049e7a2...3c3833e0f8c1c83d449a7478aa59c036a9165498)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22 10:01:53 +02:00
dependabot[bot]andGitHub d8048dc75b [upd] pypi: Bump the minor group with 4 updates (#5142)
Bumps the minor group with 4 updates: [flask](https://github.com/pallets/flask), [typer-slim](https://github.com/fastapi/typer), [pylint](https://github.com/pylint-dev/pylint) and [basedpyright](https://github.com/detachhead/basedpyright).


Updates `flask` from 3.1.1 to 3.1.2
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](https://github.com/pallets/flask/compare/3.1.1...3.1.2)

Updates `typer-slim` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](https://github.com/fastapi/typer/compare/0.16.0...0.16.1)

Updates `pylint` from 3.3.7 to 3.3.8
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](https://github.com/pylint-dev/pylint/compare/v3.3.7...v3.3.8)

Updates `basedpyright` from 1.31.0 to 1.31.3
- [Release notes](https://github.com/detachhead/basedpyright/releases)
- [Commits](https://github.com/detachhead/basedpyright/compare/v1.31.0...v1.31.3)
2025-08-22 09:53:26 +02:00
github-actions[bot]andGitHub b1e461eb4b [l10n] update translations from Weblate (#5141)
a4922b114 - 2025-08-21 - KOUSTAV <koustav@noreply.codeberg.org>
3f61bddd1 - 2025-08-18 - reis2724 <reis2724@noreply.codeberg.org>
7313a683d - 2025-08-19 - Kemystra <kemystra@noreply.codeberg.org>
92e1bce48 - 2025-08-19 - Artiman <artiman@noreply.codeberg.org>
0f27c1bc2 - 2025-08-18 - youtherthyf <youtherthyf@noreply.codeberg.org>
60496bc76 - 2025-08-16 - alexgabi <alexgabi@noreply.codeberg.org>
742982d00 - 2025-08-15 - lucasmz.dev <lucasmz.dev@noreply.codeberg.org>
2025-08-22 09:51:03 +02:00
Markus Heiser cfb6649b90 [build] /static 2025-08-21 14:04:13 +02:00
Amit KatyalandMarkus Heiser 5ca70ca17e [feat] client/simple: move cursor to end of search input on mobile
On mobile devices, when the search input is focused, move the cursor
to the end of the existing text. This improves the user experience by
making it easier to edit or append to the current query without
manually moving the cursor first.

Closes: https://github.com/searxng/searxng/issues/5112
2025-08-21 14:04:13 +02:00
Markus Heiser 22c2c93274 [build] /static 2025-08-21 09:07:08 +02:00
Markus Heiser d2b3c92e81 [fix] move initial "JS is enabled?" (no-js) to client side
To avoid an `unsafe-inline` in the CSP header, the JS code must be moved to the
client side [1].

The `<script>` tag at the end of the HTML originates from the old implementation
of the JS client. Since PR-5073 [2] was merged, the `type` is now `module`, and
the tag must be moved to the beginning of the HTML.

> We need to inline this "JS is enabled?" thing to prevent layout shifts and
> temporary "no JS enabled" visuals as ESM scripts loads and evals everything
> deferred from initial DOM render [3]

That's true in theory, but in practice, this effect is unnoticeable because it's
masked by another effect (which we can't avoid): If we load the page with a
severely throttled connection, the HTML (result list) takes a long time to
load. Then the CSS is loaded, which also takes longer. Until the CSS has loaded,
there's no layout. A layout shift is therefore largely determined by the loading
of the HTML and CSS itself.

The running times of the ESM script can be neglected compared to the loading
times of HTML & CSS.

[1] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199494256
[2] https://github.com/searxng/searxng/pull/5073
[3] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199622504
2025-08-21 09:07:08 +02:00
Ivan GabaldonandGitHub 41a4a3e224 [fix] template: safesearch uses the wrong type (#5136)
This fixes a regression from
60bd8b9#diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc

Closes https://github.com/searxng/searxng/issues/5135
2025-08-20 18:04:13 +02:00
BnyroandGitHub 3649917ce6 [fix] webapp: safesearch uses wrong default value (#5134)
- this fixes a regression from https://github.com/searxng/searxng/commit/60bd8b90f04d5d825fc8ac279cb7fdfde9fe78ea#diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc
- closes https://github.com/searxng/searxng/issues/5130
2025-08-20 14:39:05 +02:00
Bnyro 0369682690 [fix] selfhst icons: icon list url invalid, set to active
- the previous CDN icon list url no longer works
- a list of all icons is mirrored to the JSDelivr CDN however
- there's no reason to set the engine to inactive now that we use public CDNs
2025-08-20 14:27:17 +02:00
6b57705e50 [feat] engines: add GitHub Code Search engine (#5074)
This patch adds GitHub Code Search [1] engine to allow querying the codebases.

Template code.html is changed to allow passthrough of strip and highlighting
options.

Engine Searchcode is adjusted to pass filename and not rely on hardcoded
extensions.

GitHub search code API does not return the exact code line indices, this
implementation assigns the code arbitrary numbers starting from 1
(effectively relabeling the code).

The API allows for unauth calls, and the default engine settings default to
that, although the calls are heavily rate limited.

The 'text' lexer is the default pygments lexer when parsing fails.

[1] https://docs.github.com/en/rest/search/search?apiVersion=2022-11-28#search-code

Co-authored-by: Markus Heiser <markus.heiser@darmarIT.de>
2025-08-20 07:35:31 +02:00
Markus Heiser 25647c20d1 [mod] switching from pyright to basedpyright (plus first rules)
pyrightconfig.json :

  for the paths searx, searxng_extra and tests, individual rules were
  defined (for example, in test fewer / different rules are needed than in the
  searx package

searx/engines/__builtins__.pyi :

  The builtin types that are added to the global namespace of a module by the
  intended monkey patching of the engine modules / replaces the previous
  filtering of the stdout using grep.

test.pyright_modified (utils/lib_sxng_test.sh) :

  static type check of local modified files not yet commited

make test :

  prerequisite 'test.pyright' has been replaced by 'test.pyright_modified'

searx/engines/__init__.py, searx/enginelib/__init__.py :

  First, minimal typifications that were considered necessary.
2025-08-19 12:04:35 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Ivan Gabaldon
9bb04e288d [upd] web-client (simple): Bump the minor group across 1 directory with 6 updates (#5128)
* [upd] web-client (simple): Bump the minor group across 1 directory with 6 updates

Bumps the minor group with 6 updates in the /client/simple directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.1.3` | `2.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.2.0` | `24.3.0` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.25.1` | `4.25.2` |
| [edge.js](https://github.com/edge-js/edge) | `6.2.1` | `6.3.0` |
| [stylelint](https://github.com/stylelint/stylelint) | `16.23.0` | `16.23.1` |
| [vite-bundle-analyzer](https://github.com/nonzzz/vite-bundle-analyzer) | `1.1.0` | `1.2.1` |



Updates `@biomejs/biome` from 2.1.3 to 2.2.0
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.2.0/packages/@biomejs/biome)

Updates `@types/node` from 24.2.0 to 24.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `browserslist` from 4.25.1 to 4.25.2
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.25.1...4.25.2)

Updates `edge.js` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/edge-js/edge/releases)
- [Changelog](https://github.com/edge-js/edge/blob/6.x/CHANGELOG.md)
- [Commits](https://github.com/edge-js/edge/compare/v6.2.1...v6.3.0)

Updates `stylelint` from 16.23.0 to 16.23.1
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint/stylelint/compare/16.23.0...16.23.1)

Updates `vite-bundle-analyzer` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/nonzzz/vite-bundle-analyzer/releases)
- [Changelog](https://github.com/nonzzz/vite-bundle-analyzer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nonzzz/vite-bundle-analyzer/compare/v1.1.0...v1.2.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: "@types/node"
  dependency-version: 24.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: browserslist
  dependency-version: 4.25.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: edge.js
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: stylelint
  dependency-version: 16.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: vite-bundle-analyzer
  dependency-version: 1.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* [fix] themes/simple: recreate lock

* [fix] themes/simple: promote from nursery

- noAwaitInLoop
- noBitwiseOperators
- noConstantBinaryExpression
- noGlobalDirnameFilename
- noImplicitCoercion
- noUnassignedVariables
- noUselessBackrefInRegex
- noUselessEscapeInString
- useAdjacentGetterSetter
- useConsistentObjectDefinition
- useConsistentResponse
- useIndexOf
- useIterableCallbackReturn
- useJsonImportAttribute
- useNumericSeparators
- useObjectSpread
- useParseIntRadix
- useReadonlyClassProperties
- useSingleJsDocAsterisk
- useUnifiedTypeSignature

* [fix] themes/simple: build static

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ivan Gabaldon <igabaldon@inetol.net>
2025-08-18 23:17:50 +02:00
Ivan GabaldonandGitHub 5f364ad999 [fix] container: change mirror (#5127)
`mirrors.edge.kernel.org` has weird issues, use the official mirror and avoid
future issues.
2025-08-18 21:33:27 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
547d9dcee7 [upd] pypi: Bump the minor group across 1 directory with 2 updates (#5126)
Bumps the minor group with 2 updates in the / directory: [valkey](https://github.com/valkey-io/valkey-py) and [selenium](https://github.com/SeleniumHQ/Selenium).


Updates `valkey` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/valkey-io/valkey-py/releases)
- [Commits](https://github.com/valkey-io/valkey-py/compare/v6.1.0...v6.1.1)

Updates `selenium` from 4.34.2 to 4.35.0
- [Release notes](https://github.com/SeleniumHQ/Selenium/releases)
- [Commits](https://github.com/SeleniumHQ/Selenium/commits/selenium-4.35.0)

---
updated-dependencies:
- dependency-name: valkey
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: selenium
  dependency-version: 4.35.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18 20:00:37 +02:00
4304150d7f [l10n] update translations from Weblate (#5117)
b0a695592 - 2025-08-14 - zymurge <zymurge@noreply.codeberg.org>
17c30fdae - 2025-08-14 - c2qd <c2qd@noreply.codeberg.org>
a1dc25ec1 - 2025-08-12 - Kemystra <kemystra@noreply.codeberg.org>
a6c4a30e3 - 2025-08-12 - ijxp <ijxp@noreply.codeberg.org>

Co-authored-by: searxng-bot <searxng-bot@users.noreply.github.com>
2025-08-18 19:42:38 +02:00
Markus Heiser 9b4ea64429 [build] /static 2025-08-18 16:38:32 +02:00
Markus Heiser 4e586a7eca [fix] add missing nvm environment to the "./manage dev.env" command 2025-08-18 16:38:32 +02:00
Markus Heiser 48cec1fff6 [fix] drop obsolte client/simple/static/ 2025-08-18 16:38:32 +02:00
Markus Heiser 34e993a854 [license] client/simple: SPDX-License-Identifier: AGPL-3.0-or-later
SPDX short-form identifiers to communicate license information in a simple,
efficient, portable and machine-readable manner [1]

[1] https://spdx.dev/learn/handling-license-info/
2025-08-18 16:38:32 +02:00
Ivan GabaldonandMarkus Heiser 60bd8b90f0 [enh] theme/simple: custom router
Lay the foundation for loading scripts granularly depending on the endpoint it's
on.

Remove vendor specific prefixes as there are now managed by browserslist and
LightningCSS.

Enabled quite a few rules in Biome that don't come in recommended to better
catch issues and improve consistency.

Related:

- https://github.com/searxng/searxng/pull/5073#discussion_r2256037965
- https://github.com/searxng/searxng/pull/5073#discussion_r2256057100
2025-08-18 16:38:32 +02:00
Ivan GabaldonandMarkus Heiser adc4361eb9 [fix] theme/simple: broken highlightResult
From `mod-simple-strict`
2025-08-18 16:38:32 +02:00
Ivan GabaldonandMarkus Heiser 7e1c7096ce [enh] theme/simple: package.json revision
Set minor versioning for most of the packages that iterate fast or we know won't
cause problems, and fixed versioning for the rest.

Packages going into bundles should be placed in "dependencies".

The inspection of prod bundles is necessary. Although it does not make a lot of
sense right now, it will be useful in later PR and will give us a reference to
start with.
2025-08-18 16:38:32 +02:00
Ivan GabaldonandMarkus Heiser 0b913053a7 [mod] theme/simple: migrate codebase to TypeScript
TypeScript is a superset of JavaScript, converting the entire theme to
TypeScript allows us to receive much more feedback on possible issues made in
package updates or our own typos, furthermore, it allows to transpile properly
to lower specs. This PR couldn't be done in smaller commits, a lot of work
needed to make everything *work properly*:

- A browser baseline has been set that requires minimum **Chromium 93, Firefox
  92 and Safari 15** (proper visuals/operation on older browser versions is not
  guaranteed)
- LightningCSS now handles minification and prefix creation for CSS.
- All hardcoded polyfills and support for previous browser baseline versions
  have been removed.
- Convert codebase to TypeScript.
- Convert IIFE to ESM, handling globals with IIFE is cumbersome, ESM is the
  standard for virtually any use of JS nowadays.
- Vite now builds the theme without the need for `vite-plugin-static-copy`.
- `searxng.ready` now accepts an array of conditions for the callback to be
  executed.
- Replace `leaflet` with `ol` as there were some issues with proper Vite
  bundling.
- Merged `head` with `main` script, as head was too small now.
- Add `assertElement` to properly check the existence of critical DOM elements.
- `searxng.on` renamed to `searxng.listen` with some handling improvements.
2025-08-18 16:38:32 +02:00
Markus HeiserandGitHub 4fb6105d69 [fix] revision of utils.HTMLTextExtractor (#5125)
Related:

- https://github.com/searxng/searxng/pull/5073#issuecomment-3196282632
2025-08-18 16:30:51 +02:00
Ishbir SinghandGitHub b606103352 [fix] reuters: published date not parsed correctly in some cases
FIxes publishedDate format in reuters engine to encompass ISO 8601 times both with and without milliseconds.
Why is this change important?

Previously, the engine would sometimes fail saying:

2025-08-12 21:13:23,091 ERROR:searx.engines.reuters: exception : time data '2024-04-15T19:08:30.833Z' does not match format '%Y-%m-%dT%H:%M:%SZ'

Traceback (most recent call last):

...
  File "/usr/local/searxng/searx/engines/reuters.py", line 87, in response

    publishedDate=datetime.strptime(result["display_time"], "%Y-%m-%dT%H:%M:%SZ"),

                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...

Note that most queries seem to work with Reuters, but there are some results that have the additional milliseconds and fail. Regardless, the change is backwards compatible as both the formats (with and without the ms) should now parse correctly.
2025-08-16 15:50:38 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
792ec2afea [upd] github-actions: Bump actions/checkout from 4.2.2 to 5.0.0 (#5118)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 18:06:22 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
90f997c181 [upd] github-actions: Bump github/codeql-action from 3.29.6 to 3.29.9 (#5119)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.6 to 3.29.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/a4e1a019f5e24960714ff6296aee04b736cbc3cf...df559355d593797519d70b90fc8edd5db049e7a2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 18:05:43 +02:00
Zhijie HeandGitHub 6b1516d6ad [fix] baidu captcha detection (#5111)
Add Baidu Captcha detection to reduce `JSONDecodeError` error

Baidu will redirect to `wappass.baidu.com` and return a captcha challenge.
Current behavior will get the data from `wappass.baidu.com` then return a
`json.decoder.JSONDecodeError` error.
2025-08-12 15:18:46 +02:00
Markus HeiserandGitHub 6cccb46f2b [fix] replace X-Scheme by X-Forwarded-Proto header (#5107)
The HTTP X-Forwarded-Proto (XFP) request header is a *de-facto* standard header
for identifying the protocol (HTTP or HTTPS) that a client used to connect to a
proxy or load balancer.[1]

The ``X-Scheme`` header was added 10 years ago, why ``X-Scheme`` was used back
then and not ``X-Forwarded-Proto``, nobody knows today / possibly because
``X-Forwarded-Proto`` wasn't a *de-facto* standard back then.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto
[2] https://github.com/searx/searx/commit/6ef7c3276
2025-08-10 13:05:40 +02:00
Markus HeiserandGitHub a0dd416e8a [fix] use X-Forwarded-Proto header if the URL scheme is unknown (#5106)
The HTTP X-Forwarded-Proto (XFP) request header is a de-facto standard header
for identifying the protocol (HTTP or HTTPS) that a client used to connect to a
proxy or load balancer.[1]

In our documentation[2] we recommend to set the `X-Scheme` header. This header
is not required if the `server.base_url` is set correctly.[3]

If none of these URL scheme details exist, then the header X-Forwarded-Proto is
evaluated as a third alternative.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto
[2] https://docs.searxng.org/admin/installation-apache.html#apache-s-searxng-site
[3] https://docs.searxng.org/admin/settings/settings_server.html

Closes: https://github.com/searxng/searxng/issues/5105
2025-08-10 11:08:57 +02:00
Markus HeiserandGitHub 935f3fe332 [fix] limiter: trusted proxies doc-string (#5104) 2025-08-09 23:30:48 +02:00
Ivan GabaldonandGitHub ce8929cabe [mod] limiter: trusted proxies (#4911)
Replaces `x_for` functionality with `trusted_proxies`. This allows defining
which IP / ranges to trust extracting the client IP address from X-Forwarded-For
and X-Real-IP headers.

We don't know if the proxy chain will give us the proper client
address (REMOTE_ADDR in the WSGI environment), so we rely on reading the headers
of the proxy before SearXNG (if there is one, in that case it must be added to
trusted_proxies) hoping it has done the proper checks. In case a proxy in the
chain does not check the client address correctly, integrity is compromised and
this should be fixed by whoever manages the proxy, not us.

Closes:

- https://github.com/searxng/searxng/issues/4940
- https://github.com/searxng/searxng/issues/4939
- https://github.com/searxng/searxng/issues/4907
- https://github.com/searxng/searxng/issues/3632
- https://github.com/searxng/searxng/issues/3191
- https://github.com/searxng/searxng/issues/1237

Related:

- https://github.com/searxng/searxng-docker/issues/386
- https://github.com/inetol-infrastructure/searxng-container/issues/81
2025-08-09 23:03:30 +02:00
Markus HeiserandGitHub 341d718c7f [fix] duckduckgo weather: add type hints and fix WEATHERKIT_TO_CONDITION (#5101) 2025-08-09 12:24:19 +02:00
Markus HeiserandGitHub 6172beba1a [doc] Development Quickstart: debug with the Python Debugger pdb (#5100)
Related:

- https://github.com/searxng/searxng/pull/5037#issuecomment-3166851578
2025-08-09 12:16:19 +02:00