Commit graph

8887 commits

Author SHA1 Message Date
dependabot[bot]
31322a49b6
[upd] pypi: Bump the minor group with 3 updates (#5166)
Bumps the minor group with 3 updates: [lxml](https://github.com/lxml/lxml), [granian[reload]](https://github.com/emmett-framework/granian) and [granian](https://github.com/emmett-framework/granian).


Updates `lxml` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.0.0...lxml-6.0.1)

Updates `granian[reload]` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/emmett-framework/granian/releases)
- [Commits](https://github.com/emmett-framework/granian/compare/v2.5.0...v2.5.1)

Updates `granian` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/emmett-framework/granian/releases)
- [Commits](https://github.com/emmett-framework/granian/compare/v2.5.0...v2.5.1)
2025-08-29 09:13:44 +02:00
github-actions[bot]
7e353f74f7
[l10n] update translations from Weblate (#5168)
87a404001 - 2025-08-28 - hhadi34 <hhadi34@noreply.codeberg.org>
86cd8cd7a - 2025-08-29 - lucasmz.dev <lucasmz.dev@noreply.codeberg.org>
7488333e6 - 2025-08-29 - ghose <ghose@noreply.codeberg.org>
d03da377c - 2025-08-29 - return42 <return42@noreply.codeberg.org>
c63fa5248 - 2025-08-28 - kratos <makesocialfoss32@keemail.me>
db35c0bfe - 2025-08-28 - Artiman <artiman@noreply.codeberg.org>
13028fa72 - 2025-08-28 - return42 <return42@noreply.codeberg.org>
d984f1cef - 2025-08-28 - return42 <return42@noreply.codeberg.org>
4ec477015 - 2025-08-28 - SomeTr <sometr@noreply.codeberg.org>
a74603ff8 - 2025-08-28 - sprinklerillicitly <sprinklerillicitly@noreply.codeberg.org>
2025-08-29 09:12:35 +02:00
github-actions[bot]
fde4fac3ca
[data] update searx.data - update_external_bangs.py (#5158) 2025-08-29 07:07:46 +02:00
github-actions[bot]
a9263fd063
[data] update searx.data - update_wikidata_units.py (#5159) 2025-08-29 07:07:00 +02:00
github-actions[bot]
146cefe7fa
[data] update searx.data - update_firefox_version.py (#5160) 2025-08-29 07:05:08 +02:00
github-actions[bot]
2a7d26b714
[data] update searx.data - update_ahmia_blacklist.py (#5161) 2025-08-29 07:04:41 +02:00
github-actions[bot]
480914d736
[data] update searx.data - update_currencies.py (#5162) 2025-08-29 07:04:12 +02:00
github-actions[bot]
edc50768cc
[data] update searx.data - update_engine_traits.py (#5163) 2025-08-29 07:03:29 +02:00
github-actions[bot]
a519a13bfa
[data] update searx.data - update_engine_descriptions.py (#5164) 2025-08-29 07:02:31 +02:00
Bnyro
f971774773 [fix] annas archive: engine broken due to site HTML changes
Apparently the layout of https://annas-archive.org has changed, making changes necessary.

The issue has been reported in #5146, see there for more details.

- closes #5146
2025-08-28 19:24:37 +02:00
Bnyro
5ca08c1813 [feat] plugins: add new time/timezone search plugin
The plugin uses the ``GeoLocation`` class, which is already implemented in the
context of weather forecasts, to determine the time zone. The ``DateTime`` class
is used for the localized display of date and time.

Co-authored-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-28 10:49:50 +02:00
Markus Heiser
90e602b349 [fix] typo in the docs about HTML method POST versus GET 2025-08-27 10:17:24 +02:00
Markus Heiser
71f90755c4 [doc] fix missing link in `default_http_headers` description
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
Format: reST
2025-08-26 08:20:56 +02:00
Markus Heiser
92463ce6a7 [doc] adds the missing documentation of the server.method settings.
TL;DR; For all the issues that comes with HTTP POST I recommend instance
maintainers to switch to GET and lock the property in the preferences:

```yaml
server:
  method: GET

preferences:
  lock:
    - method
```

We don't want this in the defaults of the SearXNG distributions for the pros vs
cons listed in this discussion:

- https://github.com/searxng/searxng/pull/3619
2025-08-26 08:20:56 +02:00
Markus Heiser
a369fe8f29
[mod] py3.9 EOL (#5148)
[1] https://devguide.python.org/versions/
[2] https://peps.python.org/pep-0596/

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
2025-08-26 07:46:20 +02:00
muthukumaran R
a0ff173799
[feat] engines: add OpenAlex Works engine (#5102)
- Adds a new engine `searx/engines/openalex.py` that integrates the OpenAlex
  Works API to return scientific paper results using the `paper.html` template.
- Uses the official API (no auth required); supports OpenAlex polite pool via `mailto`.
- Adds developer docs at `docs/dev/engines/online/openalex.rst`.

OpenAlex API reference: https://docs.openalex.org/how-to-use-the-api/api-overview
2025-08-24 14:17:30 +02:00
dependabot[bot]
11ea1a8134
[upd] web-client (simple): Bump the minor group (#5144)
Bumps the minor group in /client/simple with 2 updates: [browserslist](https://github.com/browserslist/browserslist) and [less](https://github.com/less/less.js).


Updates `browserslist` from 4.25.2 to 4.25.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.25.2...4.25.3)

Updates `less` from 4.4.0 to 4.4.1
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/less/less.js/commits)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.25.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: less
  dependency-version: 4.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22 10:04:37 +02:00
dependabot[bot]
e22ebd8817
[upd] github-actions: Bump github/codeql-action from 3.29.9 to 3.29.11 (#5143)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.9 to 3.29.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](df559355d5...3c3833e0f8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-22 10:01:53 +02:00
dependabot[bot]
d8048dc75b
[upd] pypi: Bump the minor group with 4 updates (#5142)
Bumps the minor group with 4 updates: [flask](https://github.com/pallets/flask), [typer-slim](https://github.com/fastapi/typer), [pylint](https://github.com/pylint-dev/pylint) and [basedpyright](https://github.com/detachhead/basedpyright).


Updates `flask` from 3.1.1 to 3.1.2
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](https://github.com/pallets/flask/compare/3.1.1...3.1.2)

Updates `typer-slim` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](https://github.com/fastapi/typer/compare/0.16.0...0.16.1)

Updates `pylint` from 3.3.7 to 3.3.8
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](https://github.com/pylint-dev/pylint/compare/v3.3.7...v3.3.8)

Updates `basedpyright` from 1.31.0 to 1.31.3
- [Release notes](https://github.com/detachhead/basedpyright/releases)
- [Commits](https://github.com/detachhead/basedpyright/compare/v1.31.0...v1.31.3)
2025-08-22 09:53:26 +02:00
github-actions[bot]
b1e461eb4b
[l10n] update translations from Weblate (#5141)
a4922b114 - 2025-08-21 - KOUSTAV <koustav@noreply.codeberg.org>
3f61bddd1 - 2025-08-18 - reis2724 <reis2724@noreply.codeberg.org>
7313a683d - 2025-08-19 - Kemystra <kemystra@noreply.codeberg.org>
92e1bce48 - 2025-08-19 - Artiman <artiman@noreply.codeberg.org>
0f27c1bc2 - 2025-08-18 - youtherthyf <youtherthyf@noreply.codeberg.org>
60496bc76 - 2025-08-16 - alexgabi <alexgabi@noreply.codeberg.org>
742982d00 - 2025-08-15 - lucasmz.dev <lucasmz.dev@noreply.codeberg.org>
2025-08-22 09:51:03 +02:00
Markus Heiser
cfb6649b90 [build] /static 2025-08-21 14:04:13 +02:00
Amit Katyal
5ca70ca17e [feat] client/simple: move cursor to end of search input on mobile
On mobile devices, when the search input is focused, move the cursor
to the end of the existing text. This improves the user experience by
making it easier to edit or append to the current query without
manually moving the cursor first.

Closes: https://github.com/searxng/searxng/issues/5112
2025-08-21 14:04:13 +02:00
Markus Heiser
22c2c93274 [build] /static 2025-08-21 09:07:08 +02:00
Markus Heiser
d2b3c92e81 [fix] move initial "JS is enabled?" (no-js) to client side
To avoid an `unsafe-inline` in the CSP header, the JS code must be moved to the
client side [1].

The `<script>` tag at the end of the HTML originates from the old implementation
of the JS client. Since PR-5073 [2] was merged, the `type` is now `module`, and
the tag must be moved to the beginning of the HTML.

> We need to inline this "JS is enabled?" thing to prevent layout shifts and
> temporary "no JS enabled" visuals as ESM scripts loads and evals everything
> deferred from initial DOM render [3]

That's true in theory, but in practice, this effect is unnoticeable because it's
masked by another effect (which we can't avoid): If we load the page with a
severely throttled connection, the HTML (result list) takes a long time to
load. Then the CSS is loaded, which also takes longer. Until the CSS has loaded,
there's no layout. A layout shift is therefore largely determined by the loading
of the HTML and CSS itself.

The running times of the ESM script can be neglected compared to the loading
times of HTML & CSS.

[1] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199494256
[2] https://github.com/searxng/searxng/pull/5073
[3] https://github.com/searxng/searxng-docker/pull/424#issuecomment-3199622504
2025-08-21 09:07:08 +02:00
Ivan Gabaldon
41a4a3e224
[fix] template: safesearch uses the wrong type (#5136)
This fixes a regression from
60bd8b9#diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc

Closes https://github.com/searxng/searxng/issues/5135
2025-08-20 18:04:13 +02:00
Bnyro
3649917ce6
[fix] webapp: safesearch uses wrong default value (#5134)
- this fixes a regression from 60bd8b90f0 (diff-1b714182564ef1fa942ff81b28f9ba3365ab76f75346f4255398bf9d6064b4cc)
- closes https://github.com/searxng/searxng/issues/5130
2025-08-20 14:39:05 +02:00
Bnyro
0369682690 [fix] selfhst icons: icon list url invalid, set to active
- the previous CDN icon list url no longer works
- a list of all icons is mirrored to the JSDelivr CDN however
- there's no reason to set the engine to inactive now that we use public CDNs
2025-08-20 14:27:17 +02:00
Filip Mikina
6b57705e50
[feat] engines: add GitHub Code Search engine (#5074)
This patch adds GitHub Code Search [1] engine to allow querying the codebases.

Template code.html is changed to allow passthrough of strip and highlighting
options.

Engine Searchcode is adjusted to pass filename and not rely on hardcoded
extensions.

GitHub search code API does not return the exact code line indices, this
implementation assigns the code arbitrary numbers starting from 1
(effectively relabeling the code).

The API allows for unauth calls, and the default engine settings default to
that, although the calls are heavily rate limited.

The 'text' lexer is the default pygments lexer when parsing fails.

[1] https://docs.github.com/en/rest/search/search?apiVersion=2022-11-28#search-code

Co-authored-by: Markus Heiser <markus.heiser@darmarIT.de>
2025-08-20 07:35:31 +02:00
Markus Heiser
25647c20d1 [mod] switching from pyright to basedpyright (plus first rules)
pyrightconfig.json :

  for the paths searx, searxng_extra and tests, individual rules were
  defined (for example, in test fewer / different rules are needed than in the
  searx package

searx/engines/__builtins__.pyi :

  The builtin types that are added to the global namespace of a module by the
  intended monkey patching of the engine modules / replaces the previous
  filtering of the stdout using grep.

test.pyright_modified (utils/lib_sxng_test.sh) :

  static type check of local modified files not yet commited

make test :

  prerequisite 'test.pyright' has been replaced by 'test.pyright_modified'

searx/engines/__init__.py, searx/enginelib/__init__.py :

  First, minimal typifications that were considered necessary.
2025-08-19 12:04:35 +02:00
dependabot[bot]
9bb04e288d
[upd] web-client (simple): Bump the minor group across 1 directory with 6 updates (#5128)
* [upd] web-client (simple): Bump the minor group across 1 directory with 6 updates

Bumps the minor group with 6 updates in the /client/simple directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.1.3` | `2.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.2.0` | `24.3.0` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.25.1` | `4.25.2` |
| [edge.js](https://github.com/edge-js/edge) | `6.2.1` | `6.3.0` |
| [stylelint](https://github.com/stylelint/stylelint) | `16.23.0` | `16.23.1` |
| [vite-bundle-analyzer](https://github.com/nonzzz/vite-bundle-analyzer) | `1.1.0` | `1.2.1` |



Updates `@biomejs/biome` from 2.1.3 to 2.2.0
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.2.0/packages/@biomejs/biome)

Updates `@types/node` from 24.2.0 to 24.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `browserslist` from 4.25.1 to 4.25.2
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.25.1...4.25.2)

Updates `edge.js` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/edge-js/edge/releases)
- [Changelog](https://github.com/edge-js/edge/blob/6.x/CHANGELOG.md)
- [Commits](https://github.com/edge-js/edge/compare/v6.2.1...v6.3.0)

Updates `stylelint` from 16.23.0 to 16.23.1
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint/stylelint/compare/16.23.0...16.23.1)

Updates `vite-bundle-analyzer` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/nonzzz/vite-bundle-analyzer/releases)
- [Changelog](https://github.com/nonzzz/vite-bundle-analyzer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nonzzz/vite-bundle-analyzer/compare/v1.1.0...v1.2.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: "@types/node"
  dependency-version: 24.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: browserslist
  dependency-version: 4.25.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: edge.js
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: stylelint
  dependency-version: 16.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: vite-bundle-analyzer
  dependency-version: 1.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* [fix] themes/simple: recreate lock

* [fix] themes/simple: promote from nursery

- noAwaitInLoop
- noBitwiseOperators
- noConstantBinaryExpression
- noGlobalDirnameFilename
- noImplicitCoercion
- noUnassignedVariables
- noUselessBackrefInRegex
- noUselessEscapeInString
- useAdjacentGetterSetter
- useConsistentObjectDefinition
- useConsistentResponse
- useIndexOf
- useIterableCallbackReturn
- useJsonImportAttribute
- useNumericSeparators
- useObjectSpread
- useParseIntRadix
- useReadonlyClassProperties
- useSingleJsDocAsterisk
- useUnifiedTypeSignature

* [fix] themes/simple: build static

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ivan Gabaldon <igabaldon@inetol.net>
2025-08-18 23:17:50 +02:00
Ivan Gabaldon
5f364ad999
[fix] container: change mirror (#5127)
`mirrors.edge.kernel.org` has weird issues, use the official mirror and avoid
future issues.
2025-08-18 21:33:27 +02:00
dependabot[bot]
547d9dcee7
[upd] pypi: Bump the minor group across 1 directory with 2 updates (#5126)
Bumps the minor group with 2 updates in the / directory: [valkey](https://github.com/valkey-io/valkey-py) and [selenium](https://github.com/SeleniumHQ/Selenium).


Updates `valkey` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/valkey-io/valkey-py/releases)
- [Commits](https://github.com/valkey-io/valkey-py/compare/v6.1.0...v6.1.1)

Updates `selenium` from 4.34.2 to 4.35.0
- [Release notes](https://github.com/SeleniumHQ/Selenium/releases)
- [Commits](https://github.com/SeleniumHQ/Selenium/commits/selenium-4.35.0)

---
updated-dependencies:
- dependency-name: valkey
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: selenium
  dependency-version: 4.35.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18 20:00:37 +02:00
github-actions[bot]
4304150d7f
[l10n] update translations from Weblate (#5117)
b0a695592 - 2025-08-14 - zymurge <zymurge@noreply.codeberg.org>
17c30fdae - 2025-08-14 - c2qd <c2qd@noreply.codeberg.org>
a1dc25ec1 - 2025-08-12 - Kemystra <kemystra@noreply.codeberg.org>
a6c4a30e3 - 2025-08-12 - ijxp <ijxp@noreply.codeberg.org>

Co-authored-by: searxng-bot <searxng-bot@users.noreply.github.com>
2025-08-18 19:42:38 +02:00
Markus Heiser
9b4ea64429 [build] /static 2025-08-18 16:38:32 +02:00
Markus Heiser
4e586a7eca [fix] add missing nvm environment to the "./manage dev.env" command 2025-08-18 16:38:32 +02:00
Markus Heiser
48cec1fff6 [fix] drop obsolte client/simple/static/ 2025-08-18 16:38:32 +02:00
Markus Heiser
34e993a854 [license] client/simple: SPDX-License-Identifier: AGPL-3.0-or-later
SPDX short-form identifiers to communicate license information in a simple,
efficient, portable and machine-readable manner [1]

[1] https://spdx.dev/learn/handling-license-info/
2025-08-18 16:38:32 +02:00
Ivan Gabaldon
60bd8b90f0 [enh] theme/simple: custom router
Lay the foundation for loading scripts granularly depending on the endpoint it's
on.

Remove vendor specific prefixes as there are now managed by browserslist and
LightningCSS.

Enabled quite a few rules in Biome that don't come in recommended to better
catch issues and improve consistency.

Related:

- https://github.com/searxng/searxng/pull/5073#discussion_r2256037965
- https://github.com/searxng/searxng/pull/5073#discussion_r2256057100
2025-08-18 16:38:32 +02:00
Ivan Gabaldon
adc4361eb9 [fix] theme/simple: broken highlightResult
From `mod-simple-strict`
2025-08-18 16:38:32 +02:00
Ivan Gabaldon
7e1c7096ce [enh] theme/simple: package.json revision
Set minor versioning for most of the packages that iterate fast or we know won't
cause problems, and fixed versioning for the rest.

Packages going into bundles should be placed in "dependencies".

The inspection of prod bundles is necessary. Although it does not make a lot of
sense right now, it will be useful in later PR and will give us a reference to
start with.
2025-08-18 16:38:32 +02:00
Ivan Gabaldon
0b913053a7 [mod] theme/simple: migrate codebase to TypeScript
TypeScript is a superset of JavaScript, converting the entire theme to
TypeScript allows us to receive much more feedback on possible issues made in
package updates or our own typos, furthermore, it allows to transpile properly
to lower specs. This PR couldn't be done in smaller commits, a lot of work
needed to make everything *work properly*:

- A browser baseline has been set that requires minimum **Chromium 93, Firefox
  92 and Safari 15** (proper visuals/operation on older browser versions is not
  guaranteed)
- LightningCSS now handles minification and prefix creation for CSS.
- All hardcoded polyfills and support for previous browser baseline versions
  have been removed.
- Convert codebase to TypeScript.
- Convert IIFE to ESM, handling globals with IIFE is cumbersome, ESM is the
  standard for virtually any use of JS nowadays.
- Vite now builds the theme without the need for `vite-plugin-static-copy`.
- `searxng.ready` now accepts an array of conditions for the callback to be
  executed.
- Replace `leaflet` with `ol` as there were some issues with proper Vite
  bundling.
- Merged `head` with `main` script, as head was too small now.
- Add `assertElement` to properly check the existence of critical DOM elements.
- `searxng.on` renamed to `searxng.listen` with some handling improvements.
2025-08-18 16:38:32 +02:00
Markus Heiser
4fb6105d69
[fix] revision of utils.HTMLTextExtractor (#5125)
Related:

- https://github.com/searxng/searxng/pull/5073#issuecomment-3196282632
2025-08-18 16:30:51 +02:00
Ishbir Singh
b606103352
[fix] reuters: published date not parsed correctly in some cases
FIxes publishedDate format in reuters engine to encompass ISO 8601 times both with and without milliseconds.
Why is this change important?

Previously, the engine would sometimes fail saying:

2025-08-12 21:13:23,091 ERROR:searx.engines.reuters: exception : time data '2024-04-15T19:08:30.833Z' does not match format '%Y-%m-%dT%H:%M:%SZ'

Traceback (most recent call last):

...
  File "/usr/local/searxng/searx/engines/reuters.py", line 87, in response

    publishedDate=datetime.strptime(result["display_time"], "%Y-%m-%dT%H:%M:%SZ"),

                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...

Note that most queries seem to work with Reuters, but there are some results that have the additional milliseconds and fail. Regardless, the change is backwards compatible as both the formats (with and without the ms) should now parse correctly.
2025-08-16 15:50:38 +00:00
dependabot[bot]
792ec2afea
[upd] github-actions: Bump actions/checkout from 4.2.2 to 5.0.0 (#5118)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](11bd71901b...08c6903cd8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 18:06:22 +02:00
dependabot[bot]
90f997c181
[upd] github-actions: Bump github/codeql-action from 3.29.6 to 3.29.9 (#5119)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.6 to 3.29.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](a4e1a019f5...df559355d5)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 18:05:43 +02:00
Zhijie He
6b1516d6ad
[fix] baidu captcha detection (#5111)
Add Baidu Captcha detection to reduce `JSONDecodeError` error

Baidu will redirect to `wappass.baidu.com` and return a captcha challenge.
Current behavior will get the data from `wappass.baidu.com` then return a
`json.decoder.JSONDecodeError` error.
2025-08-12 15:18:46 +02:00
Markus Heiser
6cccb46f2b
[fix] replace X-Scheme by X-Forwarded-Proto header (#5107)
The HTTP X-Forwarded-Proto (XFP) request header is a *de-facto* standard header
for identifying the protocol (HTTP or HTTPS) that a client used to connect to a
proxy or load balancer.[1]

The ``X-Scheme`` header was added 10 years ago, why ``X-Scheme`` was used back
then and not ``X-Forwarded-Proto``, nobody knows today / possibly because
``X-Forwarded-Proto`` wasn't a *de-facto* standard back then.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto
[2] https://github.com/searx/searx/commit/6ef7c3276
2025-08-10 13:05:40 +02:00
Markus Heiser
a0dd416e8a
[fix] use X-Forwarded-Proto header if the URL scheme is unknown (#5106)
The HTTP X-Forwarded-Proto (XFP) request header is a de-facto standard header
for identifying the protocol (HTTP or HTTPS) that a client used to connect to a
proxy or load balancer.[1]

In our documentation[2] we recommend to set the `X-Scheme` header. This header
is not required if the `server.base_url` is set correctly.[3]

If none of these URL scheme details exist, then the header X-Forwarded-Proto is
evaluated as a third alternative.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto
[2] https://docs.searxng.org/admin/installation-apache.html#apache-s-searxng-site
[3] https://docs.searxng.org/admin/settings/settings_server.html

Closes: https://github.com/searxng/searxng/issues/5105
2025-08-10 11:08:57 +02:00
Markus Heiser
935f3fe332
[fix] limiter: trusted proxies doc-string (#5104) 2025-08-09 23:30:48 +02:00
Ivan Gabaldon
ce8929cabe
[mod] limiter: trusted proxies (#4911)
Replaces `x_for` functionality with `trusted_proxies`. This allows defining
which IP / ranges to trust extracting the client IP address from X-Forwarded-For
and X-Real-IP headers.

We don't know if the proxy chain will give us the proper client
address (REMOTE_ADDR in the WSGI environment), so we rely on reading the headers
of the proxy before SearXNG (if there is one, in that case it must be added to
trusted_proxies) hoping it has done the proper checks. In case a proxy in the
chain does not check the client address correctly, integrity is compromised and
this should be fixed by whoever manages the proxy, not us.

Closes:

- https://github.com/searxng/searxng/issues/4940
- https://github.com/searxng/searxng/issues/4939
- https://github.com/searxng/searxng/issues/4907
- https://github.com/searxng/searxng/issues/3632
- https://github.com/searxng/searxng/issues/3191
- https://github.com/searxng/searxng/issues/1237

Related:

- https://github.com/searxng/searxng-docker/issues/386
- https://github.com/inetol-infrastructure/searxng-container/issues/81
2025-08-09 23:03:30 +02:00