Update package version to 1.28.0

| datasource      | package           | from   | to     |
| --------------- | ----------------- | ------ | ------ |
| github-releases | FreshRSS/FreshRSS | 1.28.1 | 1.29.0 |

CHANGELOG.md

@@ -368,3 +368,118 @@
 * New shortcuts for adding user labels to articles
 * Several improvements and bug fixes
 
+[1.24.1]
+* Update FreshRSS to 1.26.1
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.1)
+* Fix back-compatibility with cURL 7.51 (we require cURL 7.52+ for `CURLPROXY_HTTPS`)
+* Add cURL version to page about system information
+* Fix regression with cURL HTTP headers breaking conditional HTTP requests
+* Fix regression with saving states of user queries
+* Fix regression with dynamic OPML
+* Fix update of the users last activity on login action
+* Fix setting category option *Maximum number of articles to keep per feed*
+* Fix priority field when processing a new feed from an extension
+* Use case-insensitive sort for categories
+* Improve dark mode of *Origine* theme
+
+[1.25.0]
+* Update base image to 5.0.0
+
+[1.25.1]
+* Update FreshRSS to 1.26.2
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2)
+* Implement JSON string concatenation with & operator [#7414](https://github.com/FreshRSS/FreshRSS/pull/7414)
+* Support multiple JSON fragments in HTML+XPath+JSON mode [#7369](https://github.com/FreshRSS/FreshRSS/pull/7369)
+* Fix escaping of tag search [#7468](https://github.com/FreshRSS/FreshRSS/pull/7468)
+* Fix CLI parsing of Boolean flags [#7430](https://github.com/FreshRSS/FreshRSS/pull/7430)
+* Fix API for labels with slash [#7437](https://github.com/FreshRSS/FreshRSS/pull/7437)
+* Fix support for feeds with XML preamble + DTD [#7515](https://github.com/FreshRSS/FreshRSS/pull/7515), [simplepie#914](https://github.com/simplepie/simplepie/pull/914)
+* Disallow `<iframe srcdoc="">` [#7494](https://github.com/FreshRSS/FreshRSS/pull/7494), [CVE-2025-32015](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wgrq-mcwc-8f8v)
+* Disallow `<button formaction="">` [#7506](https://github.com/FreshRSS/FreshRSS/pull/7506)
+* Improve favicons hash to avoid favicon pollution [#7505](https://github.com/FreshRSS/FreshRSS/pull/7505), [CVE-2025-46339](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8f79-3q3w-43c4)
+* Add `Content-Security-Policy` HTTP headers to favicons [#7471](https://github.com/FreshRSS/FreshRSS/pull/7471), [CVE-2025-31136](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr)
+
+[1.25.2]
+* Update FreshRSS to 1.26.3
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.3)
+* Keep sort and order criteria during navigation [#&#8203;7585](https://github.com/FreshRSS/FreshRSS/pull/7585)
+* Add info about `PDO::ATTR_CLIENT_VERSION` (relevant for MySQL / MariaDB with obsolete driver) [#&#8203;7591](https://github.com/FreshRSS/FreshRSS/pull/7591)
+* Fix SQL request for user labels with custom sort (affecting PostgreSQL) [#&#8203;7588](https://github.com/FreshRSS/FreshRSS/pull/7588)
+* Fix regression for favicon in GReader and Fever APIs [#&#8203;7573](https://github.com/FreshRSS/FreshRSS/pull/7573)
+* Fix newest articles (within last second) not shown [#&#8203;7577](https://github.com/FreshRSS/FreshRSS/pull/7577)
+* Fix duplicate HTTP header for POST [#&#8203;7556](https://github.com/FreshRSS/FreshRSS/pull/7556)
+* Fix important articles on reader view [#&#8203;7602](https://github.com/FreshRSS/FreshRSS/pull/7602)
+* Fix remove last share method [#&#8203;7613](https://github.com/FreshRSS/FreshRSS/pull/7613)
+* Fix API handling of default category [#&#8203;7610](https://github.com/FreshRSS/FreshRSS/pull/7610)
+* Fix user self-deletion [#&#8203;7626](https://github.com/FreshRSS/FreshRSS/pull/7626)
+
+[1.26.0]
+* Update FreshRSS to 1.27.0
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0)
+* Implement support for HTTP `429 Too Many Requests` and `503 Service Unavailable`, obey `Retry-After` [#&#8203;7760](https://github.com/FreshRSS/FreshRSS/pull/7760)  
+* Add sort by category title, or by feed title [#&#8203;7702](https://github.com/FreshRSS/FreshRSS/pull/7702)  
+* Add search operator `c:` for categories like `c:23,34` or `!c:45,56` [#&#8203;7696](https://github.com/FreshRSS/FreshRSS/pull/7696)  
+* Custom feed favicons [#&#8203;7646](https://github.com/FreshRSS/FreshRSS/pull/7646), [#&#8203;7704](https://github.com/FreshRSS/FreshRSS/pull/7704), [#&#8203;7717](https://github.com/FreshRSS/FreshRSS/pull/7717), [#&#8203;7792](https://github.com/FreshRSS/FreshRSS/pull/7792)  
+* Rework fetch favicons for fewer HTTP requests [#&#8203;7767](https://github.com/FreshRSS/FreshRSS/pull/7767)  
+* Add more unicity criteria based on title and/or content [#&#8203;7789](https://github.com/FreshRSS/FreshRSS/pull/7789)  
+* Automatically restore user configuration from backup [#&#8203;7682](https://github.com/FreshRSS/FreshRSS/pull/7682)  
+* API add support for states in `s` parameter of `streamId` [#&#8203;7695](https://github.com/FreshRSS/FreshRSS/pull/7695)  
+* Improve sharing via Print [#&#8203;7728](https://github.com/FreshRSS/FreshRSS/pull/7728)  
+* Redirect to the login page from bookmarklet instead of 403 [#&#8203;7782](https://github.com/FreshRSS/FreshRSS/pull/7782)
+
+[1.26.1]
+* Update FreshRSS to 1.27.1
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.1)
+* Automatic database recovery: skip broken entries during CLI export/import [#&#8203;7949](https://github.com/FreshRSS/FreshRSS/pull/7949)  
+* Add security option for CSP `frame-ancestors` [#&#8203;7857](https://github.com/FreshRSS/FreshRSS/pull/7857), [#&#8203;8021](https://github.com/FreshRSS/FreshRSS/pull/8021)  
+* Lazy-load `<track src>` [#&#8203;7997](https://github.com/FreshRSS/FreshRSS/pull/7997)  
+* Regenerate session ID on login [#&#8203;7829](https://github.com/FreshRSS/FreshRSS/pull/7829)  
+* Disallow setting non-existent language [#&#8203;7878](https://github.com/FreshRSS/FreshRSS/pull/7878), [#&#8203;7934](https://github.com/FreshRSS/FreshRSS/pull/7934)  
+* Safer calling of `install.php` [#&#8203;7971](https://github.com/FreshRSS/FreshRSS/pull/7971)  
+* Prevent log CR/LF injection [#&#8203;7883](https://github.com/FreshRSS/FreshRSS/pull/7883)  
+* Restrict allowed cURL parameters [#&#8203;7979](https://github.com/FreshRSS/FreshRSS/pull/7979), [#&#8203;8009](https://github.com/FreshRSS/FreshRSS/pull/8009)  
+* Fix reauthentication while updating [#&#8203;7989](https://github.com/FreshRSS/FreshRSS/pull/7989)  
+* Fix some CSRFs [#&#8203;8000](https://github.com/FreshRSS/FreshRSS/pull/8000)
+
+[1.27.0]
+* Update FreshRSS to 1.28.0
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0)
+* Move unsafe autologin to an extension [#7958](https://github.com/FreshRSS/FreshRSS/pull/7958)
+* Housekeeping of `lib_rss.php` with potential breaking changes for some extensions [#8193](https://github.com/FreshRSS/FreshRSS/pull/8193)
+* New sorting and filtering by date of *User modified* [#7886](https://github.com/FreshRSS/FreshRSS/pull/7886), [#8090](https://github.com/FreshRSS/FreshRSS/pull/8090), [#8105](https://github.com/FreshRSS/FreshRSS/pull/8105), [#8118](https://github.com/FreshRSS/FreshRSS/pull/8118), [#8130](https://github.com/FreshRSS/FreshRSS/pull/8130)
+* New sorting by article length [#8119](https://github.com/FreshRSS/FreshRSS/pull/8119)
+* New advanced search form [#8103](https://github.com/FreshRSS/FreshRSS/pull/8103), [#8122](https://github.com/FreshRSS/FreshRSS/pull/8122), [#8226](https://github.com/FreshRSS/FreshRSS/pull/8226)
+* Add compatibility with PCRE word boundary `\b` and `\B` for regex search using PostgreSQL [#8141](https://github.com/FreshRSS/FreshRSS/pull/8141)
+* More uniform SQL search and PHP search for accents and case-sensitivity (e.g. for automatically marking as read) [#8329](https://github.com/FreshRSS/FreshRSS/pull/8329)
+* New overview of dates with most unread articles [#8089](https://github.com/FreshRSS/FreshRSS/pull/8089)
+* Exclude local networks for domain-wide HTTP `Retry-After` [#8195](https://github.com/FreshRSS/FreshRSS/pull/8195)
+* Fix OpenID Connect with Debian 13 [#8032](https://github.com/FreshRSS/FreshRSS/pull/8032)
+
+[1.27.1]
+* Update FreshRSS to 1.28.1
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.1)
+* Handle Web scraping of `text/plain` as `<pre class="text-plain">` [#&#8203;8340](https://github.com/FreshRSS/FreshRSS/pull/8340)
+* New customisable message for closed registrations [#&#8203;8462](https://github.com/FreshRSS/FreshRSS/pull/8462)
+* Fix unwanted expansion of user queries (saved searches) applied to filters [#&#8203;8395](https://github.com/FreshRSS/FreshRSS/pull/8395)
+* Fix encoding of filter actions for labels [#&#8203;8368](https://github.com/FreshRSS/FreshRSS/pull/8368)
+* Fix searching of tags [#&#8203;8425](https://github.com/FreshRSS/FreshRSS/pull/8425)
+* Fix refreshing feeds with token while anonymous refresh is disabled [#&#8203;8371](https://github.com/FreshRSS/FreshRSS/pull/8371)
+* Fix RSS and OPML access by token [#&#8203;8434](https://github.com/FreshRSS/FreshRSS/pull/8434)
+* Fix MySQL/MariaDB `transliterator_transliterate` fallback (when the `php-intl` extension is unavailable) [#&#8203;8427](https://github.com/FreshRSS/FreshRSS/pull/8427)
+* Fix regression with MySQL/MariaDB index hint [#&#8203;8460](https://github.com/FreshRSS/FreshRSS/pull/8460)
+* Auto-add `lastUserModified` database column also during mark-as-read action [#&#8203;8346](https://github.com/FreshRSS/FreshRSS/pull/8346)
+
+[1.28.0]
+* Update FreshRSS to 1.29.0
+* [Full Changelog](https://github.com/FreshRSS/FreshRSS/releases/tag/1.29.0)
+* New sort order preferences at global, category, and feed levels [#8234](https://github.com/FreshRSS/FreshRSS/pull/8234)
+* New filtering by date of *Server modification date* [#8131](https://github.com/FreshRSS/FreshRSS/pull/8131), [#8576](https://github.com/FreshRSS/FreshRSS/pull/8576)
+* New option to automatically mark new articles as read if an identical GUID already exists in the same category [#8673](https://github.com/FreshRSS/FreshRSS/pull/8673)
+* Add option to enable/disable notifications, also for PWA [#8458](https://github.com/FreshRSS/FreshRSS/pull/8458)
+* Fix wrong search `toString` in case of regex-looking string [#8479](https://github.com/FreshRSS/FreshRSS/pull/8479)
+* Fix redirect to wrong view after mark as read in *reader* and *global* views [#8552](https://github.com/FreshRSS/FreshRSS/pull/8552)
+* Fix do not include hidden feeds when counting total number of unread articles [#8715](https://github.com/FreshRSS/FreshRSS/pull/8715)
+* Limit cURL to protocols HTTP, HTTPS [#8713](https://github.com/FreshRSS/FreshRSS/pull/8713)
+* New Webhook extension for automated RSS notifications [Extensions#456](https://github.com/FreshRSS/Extensions/pull/456)
+* New `cli/purge.php` to apply purge policy [#8740](https://github.com/FreshRSS/FreshRSS/pull/8740)
+

CloudronManifest.json

@@ -5,8 +5,8 @@
   "description": "file://DESCRIPTION.md",
   "changelog": "file://CHANGELOG.md",
   "tagline": "RSS feed reader",
-  "version": "1.24.0",
+  "version": "1.28.0",
-  "upstreamVersion": "1.26.0",
+  "upstreamVersion": "1.29.0",
   "healthCheckPath": "/",
   "httpPort": 8000,
   "addons": {
@@ -51,6 +51,6 @@
   "postInstallMessage": "file://POSTINSTALL.md",
   "minBoxVersion": "8.1.0",
   "forumUrl": "https://forum.cloudron.io/category/27/freshrss",
-  "documentationUrl": "https://cloudron.io/documentation/apps/freshrss/",
+  "documentationUrl": "https://cloudron.io/documentation/packages/freshrss/",
   "optionalSso": true
 }

Dockerfile

@@ -1,4 +1,4 @@
-FROM cloudron/base:4.2.0@sha256:46da2fffb36353ef714f97ae8e962bd2c212ca091108d768ba473078319a47f4
+FROM cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c
 
 RUN apt-get update && apt-get install --no-install-recommends -y libapache2-mod-auth-openidc && rm -rf /var/cache/apt /var/lib/apt/lists
 
@@ -6,7 +6,7 @@ RUN mkdir -p /app/code
 WORKDIR /app/code
 
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS versioning=semver
-ARG FRESHRSS_VERSION=1.26.0
+ARG FRESHRSS_VERSION=1.29.0
 
 RUN curl -L https://github.com/FreshRSS/FreshRSS/archive/${FRESHRSS_VERSION}.tar.gz | tar -zxvf - --strip-components=1 && \
     mv data data-orig && ln -s /app/data data
@@ -29,15 +29,15 @@ RUN a2enmod headers expires deflate mime dir rewrite setenvif auth_openidc
 
 RUN rm -rf /var/lib/php && ln -s /run/php /var/lib/php
 
-RUN crudini --set /etc/php/8.1/apache2/php.ini PHP upload_max_filesize 64M && \
+RUN crudini --set /etc/php/8.3/apache2/php.ini PHP upload_max_filesize 64M && \
-    crudini --set /etc/php/8.1/apache2/php.ini PHP post_max_size 64M && \
+    crudini --set /etc/php/8.3/apache2/php.ini PHP post_max_size 64M && \
-    crudini --set /etc/php/8.1/apache2/php.ini PHP memory_limit 64M && \
+    crudini --set /etc/php/8.3/apache2/php.ini PHP memory_limit 64M && \
-    crudini --set /etc/php/8.1/apache2/php.ini Session session.save_path /run/php/session && \
+    crudini --set /etc/php/8.3/apache2/php.ini Session session.save_path /run/php/session && \
-    crudini --set /etc/php/8.1/apache2/php.ini Session session.gc_probability 1 && \
+    crudini --set /etc/php/8.3/apache2/php.ini Session session.gc_probability 1 && \
-    crudini --set /etc/php/8.1/apache2/php.ini Session session.gc_divisor 100
+    crudini --set /etc/php/8.3/apache2/php.ini Session session.gc_divisor 100
 
-RUN ln -s /app/data/php.ini /etc/php/8.1/apache2/conf.d/99-cloudron.ini && \
+RUN ln -s /app/data/php.ini /etc/php/8.3/apache2/conf.d/99-cloudron.ini && \
-    ln -s /app/data/php.ini /etc/php/8.1/cli/conf.d/99-cloudron.ini
+    ln -s /app/data/php.ini /etc/php/8.3/cli/conf.d/99-cloudron.ini
 
 ADD start.sh /app/code/start.sh
 

apache/freshrss.conf

@@ -1,8 +1,10 @@
 # https://github.com/FreshRSS/FreshRSS/blob/edge/Docker/FreshRSS.Apache.conf
 
-ServerName %{HTTP_HOST}
+ServerName localhost
 
 <VirtualHost *:8000>
+    ServerName localhost
+    UseCanonicalName Off
     DocumentRoot /app/code/p
     AllowEncodedSlashes On
 

start.sh

@@ -54,7 +54,7 @@ php cli/reconfigure.php ${extra_args} --base_url "https://${CLOUDRON_APP_DOMAIN}
     --disable_update
 
 echo "==> Setting permissions"
-chown -R www-data.www-data /run/php /app/data /tmp/log_api.txt
+chown -R www-data:www-data /run/php /app/data /tmp/log_api.txt
 
 echo "==> Starting apache"
 APACHE_CONFDIR="" source /etc/apache2/envvars

test/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "test",
-  "version": "1.0.0",
-  "description": "",
-  "main": "index.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "author": "",
-  "license": "ISC",
-  "dependencies": {
-    "chromedriver": "^133.0.2",
-    "expect.js": "^0.3.1",
-    "mocha": "^11.1.0",
-    "selenium-webdriver": "^4.29.0",
-    "superagent": "^10.1.1"
-  }
-}

test/test.js

@@ -1,237 +1,132 @@
 #!/usr/bin/env node
 
-/* global it, xit, describe, before, after, afterEach */
+import assert from 'node:assert/strict';
+import superagent from '@cloudron/superagent';
 
-'use strict';
+import { app, clearCache, click, cloudronCli, press, goto, loginOIDC, password, sendKeys, setupBrowser, takeScreenshot, teardownBrowser, username, waitFor } from '@cloudron/charlie';
 
-require('chromedriver');
+/* global it, describe, before, after, afterEach */
-
-const execSync = require('child_process').execSync,
-    expect = require('expect.js'),
-    fs = require('fs'),
-    path = require('path'),
-    superagent = require('superagent'),
-    { Builder, By, Key, until } = require('selenium-webdriver'),
-    { Options } = require('selenium-webdriver/chrome');
-
-const admin_username = 'admin', admin_password = 'changeme';
-
-if (!process.env.USERNAME || !process.env.PASSWORD) {
-    console.log('USERNAME and PASSWORD env vars need to be set');
-    process.exit(1);
-}
 
 describe('Application life cycle test', function () {
-    this.timeout(0);
+    const admin_username = 'admin';
+    const admin_password = 'changeme';
 
-    const LOCATION = process.env.LOCATION || 'test';
+    before(setupBrowser);
-    const TEST_TIMEOUT = parseInt(process.env.TIMEOUT, 10) || 10000;
+    after(teardownBrowser);
-    const EXEC_ARGS = { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' };
-
-    const USERNAME = process.env.USERNAME;
-    const PASSWORD = process.env.PASSWORD;
-
-    let browser, app;
-    let athenticated_by_oidc = false;
-
-    before(function () {
-        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
-        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
-        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
-        if (!fs.existsSync('./screenshots')) fs.mkdirSync('./screenshots');
-    });
-
-    after(function () {
-        browser.quit();
-    });
 
     afterEach(async function () {
-        if (!process.env.CI || !app) return;
+        await takeScreenshot(this.currentTest);
-
-        const currentUrl = await browser.getCurrentUrl();
-        if (!currentUrl.includes(app.domain)) return;
-        expect(this.currentTest.title).to.be.a('string');
-
-        const screenshotData = await browser.takeScreenshot();
-        fs.writeFileSync(`./screenshots/${new Date().getTime()}-${this.currentTest.title.replaceAll(' ', '_')}.png`, screenshotData, 'base64');
     });
 
-    function getAppInfo() {
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location.indexOf(LOCATION) === 0; })[0];
-        expect(app).to.be.an('object');
-    }
-
     function baseUrl() {
         if (app.manifest.version === '1.4.0') return `https://${app.fqdn}/p`;
         return `https://${app.fqdn}`;
     }
 
-    async function waitForElement(elem) {
+    async function login(uname, pass) {
-        await browser.wait(until.elementLocated(elem), TEST_TIMEOUT);
+        await goto(`https://${app.fqdn}`, 'label=Username');
-        await browser.wait(until.elementIsVisible(browser.findElement(elem)), TEST_TIMEOUT);
+        await sendKeys('label=Username', uname);
+        await sendKeys('label=Password', pass);
+        await click('Login', { role: 'button' }); // there is a link at the top
+        await waitFor('Subscription management');
     }
 
-    async function login(username, password) {
+    async function loginViaOIDC() {
-        await browser.get('https://' + app.fqdn);
+        await goto(`https://${app.fqdn}/i/`);
-        await waitForElement(By.id('loginButton'));
+        await loginOIDC('css=#btn-subscription');
-        await browser.findElement(By.id('username')).sendKeys(username);
-        await browser.findElement(By.id('passwordPlain')).sendKeys(password);
-        await browser.findElement(By.id('loginButton')).click();
-        await waitForElement(By.id('btn-subscription'));
-    }
-
-    async function loginOIDC(username, password) {
-        browser.manage().deleteAllCookies();
-        await browser.get(`https://${app.fqdn}/i/`);
-
-        if (!athenticated_by_oidc) {
-            await waitForElement(By.id('inputUsername'));
-            await browser.findElement(By.id('inputUsername')).sendKeys(username);
-            await browser.findElement(By.id('inputPassword')).sendKeys(password);
-            await browser.findElement(By.id('loginSubmitButton')).click();
-
-            athenticated_by_oidc = true;
-        }
-
-        await waitForElement(By.id('btn-subscription'));
-    }
-
-    async function logout() {
-        var logout_btn = By.xpath('//li/a[@class="signout"]');
-
-        await browser.get('https://' + app.fqdn);
-        await waitForElement(By.id('stream'));
-        await browser.findElement(By.className('dropdown-toggle')).click();
-        await waitForElement(logout_btn);
-        await browser.findElement(logout_btn).click();
-        await waitForElement(By.id('loginButton'));
     }
 
     async function addSubscription() {
-        var url = 'https://blog.cloudron.io/rss/';
+        await goto(`${baseUrl()}/i/?c=subscription&a=add`, 'label=Feed URL');
-        const addUrl = app.manifest.version === '1.10.0' ? `${baseUrl()}/i/?c=subscription` : `${baseUrl()}/i/?c=subscription&a=add`;
+        await sendKeys('label=Feed URL', 'https://blog.cloudron.io/rss/');
-
+        await press('label=Feed URL', 'Enter'); // there are multiple "Add" buttons on that page
-        await browser.get(addUrl);
+        await waitFor('RSS feed Cloudron has been added');
-        await waitForElement(By.xpath('//input[@name="url_rss"]'));
-        await browser.findElement(By.xpath('//input[@name="url_rss"]')).sendKeys(url);
-        await browser.findElement(By.xpath('//form[@id="add_rss"]//button[text()="Add"]')).click();
-        await waitForElement(By.xpath('//div[@id="notification" and contains(@class, "good")]'));
     }
 
-    async function addUser(username, password) {
+    async function enableApi({ relogin = true } = {}) {
-        await browser.get(`${baseUrl()}/i/?c=user&a=manage`);
+        await goto(`${baseUrl()}/i/?c=auth`);
-        await waitForElement(By.id('new_user_name'));
-        await browser.findElement(By.id('new_user_name')).sendKeys(username);
-        await browser.findElement(By.id('new_user_passwordPlain')).sendKeys(password);
-        await browser.findElement(By.xpath('//button[text()="Create"]')).click();
-        await waitForElement(By.xpath('//div[@id="notification" and contains(@class, "good")]'));
-    }
 
-    async function enableApi() {
+        if (relogin) {
-        await browser.get(`${baseUrl()}/i/?c=auth`);
+            await sendKeys('label=Password', admin_password);
-        await waitForElement(By.id('api_enabled'));
+            await click('Login');
-        await browser.findElement(By.id('api_enabled')).click();
+        }
-        await browser.findElement(By.xpath('//button[text()="Submit"]')).click();
+
-        await browser.sleep(5000);
+        await click(/Allow API access/);
+        await click('Submit');
+        await waitFor(/Configuration has been updated/);
     }
 
     async function checkApiConfiguration() {
-        await browser.get(`${baseUrl()}/api/`);
+        await goto(`${baseUrl()}/api/`, /PASS/);
-        await waitForElement(By.xpath('//dd[@id="greaderOutput" and contains(text(), "PASS")]'));
+        await waitFor(/PASS/);
-        await waitForElement(By.xpath('//dd[@id="feverOutput" and contains(text(), "PASS")]'));
     }
 
     async function subscriptionExists() {
-        await browser.get(`${baseUrl()}/i/?get=c_1`);
+        await goto(`${baseUrl()}/i/?get=c_1`, 'Cloudron');
-        return waitForElement(By.xpath('//span[text()="Cloudron"]'));
     }
 
     async function getStaticExtensionFile() {
-        const response = await superagent.get(`${baseUrl()}/ext.php?f=xExtension-StickyFeeds/static/script.js&t=js`)
+        const url = `${baseUrl()}/ext.php?f=xExtension-StickyFeeds/static/script.js&t=js`;
-            .buffer(true)
+        const response = await superagent.get(url)
+            .set('Cache-Control', 'no-store')
+            .set('Pragma', 'no-cache')
             .ok(() => true);
-        expect(response.statusCode).to.be(200);
+        assert.strictEqual(response.status, 200);
-        expect(response.text).to.contain('sticky_feeds'); // relies on the buffer flag above
+        assert.ok(response.body.toString('utf8').includes('sticky_feeds')); // content-type is application/javascript, so body is a buffer
     }
 
-    xit('build app', function () { execSync('cloudron build', EXEC_ARGS); });
     // No SSO
-    it('install app (no sso)', function () { execSync('cloudron install --no-sso --location ' + LOCATION, EXEC_ARGS); });
+    it('install app (no sso)', () => cloudronCli.install({ noSso: true }));
-
-    it('can get app information', getAppInfo);
 
     it('can login', login.bind(null, admin_username, admin_password));
     it('can subscribe', addSubscription);
-    it('can add users', addUser.bind(null, 'test', admin_password));
+    it('can enable API', () => enableApi({ relogin: true }));
-    it('can enable API', enableApi);
     it('can check configuration', checkApiConfiguration);
     it('subscription exists', subscriptionExists);
     it('can get static extension file', getStaticExtensionFile);
-    it('can logout', logout);
+    it('can logout', clearCache);
-    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });
+    it('uninstall app', cloudronCli.uninstall);
 
     // SSO
-    it('install app (sso)', function () { execSync('cloudron install --location ' + LOCATION, EXEC_ARGS); });
+    it('install app (sso)', cloudronCli.install);
 
-    it('can get app information', getAppInfo);
+    it('can make user Administrator', () => cloudronCli.exec(`bash -c "php cli/reconfigure.php --default-user ${username}"`));
-
+    it('can login OIDC', () => loginViaOIDC(username, password));
-    it('can make user Administrator', function () { execSync(`cloudron exec --app ${app.id} -- bash -c "php cli/reconfigure.php --default-user ${USERNAME}"`); });
-    it('can login OIDC', loginOIDC.bind(null, USERNAME, PASSWORD));
     it('can subscribe', addSubscription);
-    it('can enable API', enableApi);
+    it('can enable API', () => enableApi({ relogin: false }));
     it('can check configuration', checkApiConfiguration);
     it('subscription exists', subscriptionExists);
     it('can get static extension file', getStaticExtensionFile);
 
-    it('backup app', function () { execSync('cloudron backup create --app ' + app.id, EXEC_ARGS); });
+    it('backup app', cloudronCli.createBackup);
+    it('restore app', cloudronCli.restoreFromLatestBackup);
 
-    it('restore app', function () {
+    it('can login OIDC', loginViaOIDC);
-        const backups = JSON.parse(execSync(`cloudron backup list --raw --app ${app.id}`));
-        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
-        execSync('cloudron install --location ' + LOCATION, EXEC_ARGS);
-        getAppInfo();
-        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, EXEC_ARGS);
-    });
-
-    it('can login OIDC', loginOIDC.bind(null, USERNAME, PASSWORD));
     it('can check configuration', checkApiConfiguration);
     it('subscription exists', subscriptionExists);
     it('can get static extension file', getStaticExtensionFile);
 
-    it('move to different location', function () {
+    it('move to different location', cloudronCli.changeLocation);
-        browser.manage().deleteAllCookies();
-        execSync('cloudron configure --location ' + LOCATION + '2 --app ' + app.id, EXEC_ARGS);
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION + '2'; })[0];
-        expect(app).to.be.an('object');
-    });
 
-    it('can login OIDC', loginOIDC.bind(null, USERNAME, PASSWORD));
+    it('can login OIDC', loginViaOIDC);
     it('can check configuration', checkApiConfiguration);
     it('subscription exists', subscriptionExists);
     it('can get static extension file', getStaticExtensionFile);
 
-    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });
+    it('uninstall app', cloudronCli.uninstall);
 
     // test update
-    it('can install app for update', function () { execSync('cloudron install --appstore-id org.freshrss.cloudronapp --location ' + LOCATION, EXEC_ARGS); });
+    it('can install app for update', cloudronCli.appstoreInstall);
 
-    it('can get app information', getAppInfo);
+    it('can login OIDC', loginViaOIDC);
-    it('can login OIDC', loginOIDC.bind(null, USERNAME, PASSWORD));
+    it('can make user Administrator', () => cloudronCli.exec(`bash -c "php cli/reconfigure.php --default-user ${username}"`));
-    it('can make user Administrator', function () { execSync(`cloudron exec --app ${app.id} -- bash -c "php cli/reconfigure.php --default-user ${USERNAME}"`); });
     it('can subscribe', addSubscription);
 
-    it('can update', function () {
+    it('can update', cloudronCli.update);
-        execSync('cloudron update --app ' + app.id, EXEC_ARGS);
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-        expect(app).to.be.an('object');
-    });
 
-    it('can add users', addUser.bind(null, 'test', admin_password));
+    it('can login OIDC', loginViaOIDC);
     it('subscription exists', subscriptionExists);
     it('can get static extension file', getStaticExtensionFile);
 
-    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });
+    it('uninstall app', cloudronCli.uninstall);
 });