Uptime Kuma 2.1.0 → 2.5.1
11 releases · 8 breaking changes · 6 security fixes · 2 advisories fixed
6security8breaking0deprecated55feature58fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-33130 Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
- 5.3 CVE-2026-32230 Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors without needing to be on a status page
Breaking changes
- breaking #7535 chore: Remove meaningless entries from en.json in 2.5.0
- breaking #7194 fix: Revert "add sorting to status pages" in 2.3.0
- breaking No more sorting feature in status pages. in 2.3.0
- breaking Due to bad performance. in 2.3.0
- breaking #7312 fix(database): add UPTIME_KUMA_SQLITE_SINGLE_CONNECTION in 2.3.0
- breaking For Raspberry Pi users, you may have to set it to true to avoid SQLite locking issues. in 2.3.0
- breaking Mainly affected Raspberry Pi users only, you can ignore it if you are not using devices like Raspberry Pi. in 2.3.0
- breaking #7032 chore: remove @aws-sdk, @azure packages in 2.2.0
Security changes
- security #7538 #7349 chore: Update dependencies in 2.5.0
- security #7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack in 2.5.0
- security (Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc) in 2.4.0
- security GHSA-v832-4r73-wx5j - Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read (fixed in upstream dependency LiquidJS, also see: https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x) in 2.2.1
- security GHSA-c7hf-c5p5-5g6h Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors (Thanks @kuranikaran) in 2.2.0
- security #6925 chore: Update security policy and reporting guidelines in 2.1.1
Every release in between
feature#7720 feat: add SMS Gateway notification provider (Thanks @mattboston)
feature#7677 feat: Add ClickUp notification provider (Thanks @nTraum)
feature#7640 feat: add TurboSMTP email notification provider (Thanks @NewtTheWolf)
feature#7638 feat(notification): add BearSMS SMS provider for Israel (Thanks @nitay12)
feature#7632 feat: Add Pinglet notification provider (Thanks @TheGlenn88)
feature#7609 feat: add Milky as Notification Provider (Thanks @nope-e)
feature#7555 feat: Add openwa notification (Thanks @ron007d)
fix#7729 fix: analytics_type's enum check was not removed, even the data type changed to string on SQLite
fix#7702 fix(radius): treat Access-Challenge as successful response (#7700) (Thanks @rikkova)
other#7715 #7646 chore: Translations Update from Weblate (Thanks @Aluisio @AntonPalmqvist @ATLWongsatorn @Cutlets @cyril59310 @DJEDIVER @dodog @dukkk2 @Gringit @helakostain @kaindlnetwork @misaka10843 @olafrv @raulmouzo @Regard1ess @steliosk98 @WoutNerd @yeonzi @zazuu0)
feature#7645 Add next-rootless docker tag
feature#7607 feat: allow unlimited interval rather than 24 days
feature#7597 feat: add voice call option to Plivo notification provider (Thanks @sarveshpatil-plivo)
feature#7584 feat: add Plivo SMS notification provider (Thanks @sarveshpatil-plivo)
feature#7571 feat: add Ooredoo (Maldives) SMS notification provider (Thanks @islandboymv)
feature#7569 feat: Add WxPusher SPT (WxPusher simple push token) notification provider (Thanks @zjiecode)
feature#7546 feat: add Flowtriq DDoS detection notification provider (Thanks @jacob-masse @FlyingDove2493)
feature#7525 feat: add tracking support on status pages for rybbit analytics (Thanks @DanielOberlechner)
feature#7506 feat(notification): add additional headers option for SMTP (Thanks @dnagy)
feature#7214 feat: add NTP monitor type for network time protocol monitoring (Thanks @henricook)
feature#7114 feat(system-service): add PM2 picker and platform selection (Thanks @KraoESPfan1n)
fix#7654 fix: correct 12 spelling errors across codebase (Thanks @jannikbx)
fix#7641 fix: RSS service status description is wrong
fix#7618 fix: widen stat_daily up/down columns from SMALLINT to unsigned INTEGER (Thanks @kushiemoon-dev)
fix#7599 fix: reduce rate-limit log spam when quota is healthy (Thanks @hexonal)
fix#7590 fix: double // in badgeUrl breaking Badge generator functionality (Thanks @jaimeagudo)
fix#7588 fix(domain-expiry): clarify unsupported RDAP warning (Thanks @arturict)
fix#7542 fix: resolve Steam monitor hostnames (Thanks @yuminn-k)
fix#7520 fix(discord): timezone with dayjs.utc() (Thanks @skkzsh)
fix#7516 fix: omit resolver port from DNS monitor service URL (Thanks @skkzsh)
fix#7515 fix(monitor): screenshot_delay not saved when editing browser engine monitor (Thanks @GhadiSaab)
fix#7472 fix: add timeout functionality to kafka (Thanks @jfgsilva)
fix#7465 fix: preserve saved protocol when loading Globalping ping monitor (Thanks @titojuanc)
fix#7460 fix: prevent tags dropdown from overflowing viewport (Thanks @Subrat-Dwivedi-22)
fix#7290 fix: allow mqtts:// in MQTT monitor (Thanks @Mrstragr @chennin)
security#7538 #7349 chore: Update dependencies
security#7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack
other#7521 #7477 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @AntonPalmqvist @arcanjobr @bill162 @ctih1 @cyril59310 @dodog @firedur @Goudarz @Gringit @helakostain @ivanbratovic @kamine81 @kiznick @Mr-Mmmc @MrEddX @OnyxOracle @PolarniMeda @ramazansancar…
other#7544 chore: change analytics_type to string type from enum
feature#7543 chore: add build "pr-test" workflow, add a message for testing to new pr.
feature#7541 chore: Add an ability to enable node.js inspector
breaking#7535 chore: Remove meaningless entries from en.json
other#7496 chore: Login form minor changes
feature#7434 feat(notification): add EgoSMS SMS provider for Uganda (Thanks @kristianinc @cursoragent)
feature#7420 feat: Add incidents to RSS (Thanks @dj-tuxis)
feature#7365 feat: Add VKTeams bot notification provider (Thanks @aleshasam)
feature#7433 feat: add optional token field for gamedig monitors (Thanks @aminoacidity)
feature#7415 feat: Adding bearer token (Thanks @aminoacidity @nyeswant)
feature#7431 fix: Add bearer token support to WebSocket upgrade monitor (Thanks @aminoacidity @nyeswant)
feature#7373 fix: update link to documentation about API keys (Thanks @eleanordoesntcode)
fix~#7453 fix(docker-only): add Let's Encrypt Gen Y root certificates~ (Please ignore this change)
fix#7451 fix: handling npm 11.16.0
fix#7351 fix: NTLM monitor over plain HTTP fails with 400 Bad Request (Thanks @karzac)
security(Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc)
other#7366 #7353 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @Arden-Ahmad @bartoostveen @cyril59310 @dodog @Gringit @helakostain @ivanbratovic @Jumala9163 @Kf637 @master3395 @MrEddX @OnyxOracle @PolarniMeda @samsilveira @toniv90 @ttymayor @Virenbar @xuantan97)
feature#7432 chore: Implement dev data directory handling for non-master branches
other#7390 fix: normalize hidden log level lookup (Thanks @aqilaziz)
fix#7346 fix: Revert back from multiple connection to single connection for SQLite by default
fix#7307 fix: Add busy_timeout to sqlite to avoid error SQLITE_BUSY: database is locked (Thanks @wagnerand)
other#7340 chore: Update dependencies
other#7345 chore: update to 2.3.1
other#7344 fix(push): use multi-arch Node base in push image Dockerfile (Thanks @herwinz)
breaking#7194 fix: Revert "add sorting to status pages"
breakingNo more sorting feature in status pages.
breakingDue to bad performance.
breaking#7312 fix(database): add UPTIME_KUMA_SQLITE_SINGLE_CONNECTION
breakingFor Raspberry Pi users, you may have to set it to true to avoid SQLite locking issues.
breakingMainly affected Raspberry Pi users only, you can ignore it if you are not using devices like Raspberry Pi.
feature#7304 feat: websocket improve to fix issue #7268 including support authentication (Thanks @sofia-fernandez-six)
feature#7207 feat(notification): add custom message template support for Evolution provider (Thanks @kbrianps)
feature#7201 feat: add Telnyx messaging provider (Thanks @LuvForAirplanes)
feature#7182 feat: Add VK notification provider (Thanks @FunNikita)
feature#7160 feat: Add MAX messenger notification provider (Thanks @Redleks)
feature#7156 feat: add OracleDB monitor (Thanks @sitiom)
feature#7154 feat: add collapsible groups to status page (Thanks @marco-carvalho)
feature#7303 feat(ui): add a helptext that RTT for the ping monitor is not avaliable on linux (Thanks @stchigel)
feature#7300 feat(ux): changed warning msg (Thanks @hemanth5544)
feature#7128 fix: Update Home Assistant notification help text for HA 2024 Services→Actions rename (Thanks @tr4nt0r)
fix#7248 fix(notification): check for monitorJSON in Stackfield provider (Thanks @jlbrt)
fix#7166 fix: Handle SSL in setup database temp server
fix#7235 fix(uptime): ensure correct handling of missing time buckets in uptime calculations (Thanks @adrianceding)
fix#7221 fix(notification): ensure applyExisting is not saved to database
fix#7198 fix: Domain expiry doesn't seem to update #7189 (Thanks @shanto)
fix#7155 fix: propagate create errors (Thanks @otbutz)
fix#7159 fix: monitor graph gaps for sub-millisecond TCP pings (Thanks @0xRozier)
fix#7125 fix: prometheus metrics have two series for a single monitor when that monitor has tags (Thanks @nicjansma)
feature#7108 feat: Add English (United Kingdom) language support (Thanks @andibing)
other#7292 #7197 #7132 chore: Translations Update from Weblate (Thanks @aindriu80 @Ale1x @Aluisio @andibing @AnnAngela @CammarataLudovico @cyril59310 @dodog @efenow @fcordeiro @firedur @FunNikita @Gringit @Hamstio1 @helakostain @ivanbratovic @kevinheyer-dev @mlopezcoria @Mo7amm1d @MrEddX @numarkpro…
other#7317 #7195 #7133 chore: Update dependencies
feature#7204 chore: Add agents.md - anti AI slop
feature#7146 chore: Add monthly workflow to build push Docker image
feature#7109 feat: fluxer notification provider (Thanks @letruxux)
feature#7096 feat: set process.title to uptime-kuma (Thanks @Hill-98)
fix#7121 fix: isParentActive return type to boolean (Thanks @terisikk)
fix#7110 fix(ui): fix fluxer input styling; make discord input hidden (Thanks @letruxux)
fix#6915 fix: removal of uptime ratio and avg. response time from prometheus metrics (Thanks @tr4nt0r)
fix#7101 fix: revert: remove @aws-sdk, @azure packages
securityGHSA-v832-4r73-wx5j - Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read (fixed in upstream dependency LiquidJS, also see: https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x)
other#7119 #7099 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @cyril59310 @dodog @fabianovich @krmu @letruxux @maxisimonazzi @MrEddX)
other#7120 #7100 chore: Update dependencies
feature#7088 feat(proxy): allow socks proxy for the notifications (Thanks @ASLanin)
feature#7046 feat: add whatsApp (360messenger) notification provider (Thanks @WaMessenger)
feature#6989 feat: allow templating in the Signal notificaiton provider (Thanks @karthikeya-333)
feature#6979 refactor: improve SQLite multiple connections
fix#7019 fix: Uptime Kuma is not able to start on older version of Node.js 20 (~20.17.0)
fix#7076 fix(monitor-list): cannot display monitor name in full width
fix#7069 fix(monitor-list): tag list do not update
fix#7056 fix(globalping): retry creating the measurement on status 500 (Thanks @radulucut)
fix#7055 fix(globalping): show error message when using multiple locations (Thanks @radulucut)
fix#7048 fix: Fix domain validation not allowing for PTR DNS records (Thanks @sgdc3)
fix#7045 fix: Remove forced DOWN status in group monitor (Thanks @MayMeow)
fix#7043 fix: Setting Status Page Analytics Type to "None" fails with SQLite constraint violation
fix#7011 fix(edit-monitor): several issues in edit page
fix#7010 fix(edit-monitor): url validation is incorrect
fix#6999 fix: show actual bind address in startup logs (Thanks @mixelburg)
fix#6994 fix: preserve Domain Name Expiry Notification setting when editing monitor (Thanks @RohitDarekar816)
fix#6984 fix: show certificate expiry on status page for TCP monitors (Thanks @mixelburg)
securityGHSA-c7hf-c5p5-5g6h Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors (Thanks @kuranikaran)
other#7072 #7007 chore: Translations Update from Weblate (Thanks @2000Arion @abcsnoob @aindriu80 @Aluisio @AnnAngela @AntonPalmqvist @BelenCaSa @cyril59310 @dodog @florian-berger @helakostain @ivanbratovic @kiznick @LovesAsuna @mariogarridopt @MrDariusz @MrEddX @robertcoroianu @Virenbar)
other#7015 chore: follow up #7013
feature#7013 chore: add PR description template check workflow
other#5179 feat: structured logging (JSON) (Thanks @SapphicCode)
other#7092 chore: update to 2.2.0
other#7071 #6991 chore: Update dependencies
breaking#7032 chore: remove @aws-sdk, @azure packages
other#7077 chore: generate package-lock.json from scratch to ensure accuracy
other#7058 chore: improve changelog generator
fix#6981 fix: rdap data is not actually cached
feature#6952 feat: Notification provider Teltonika RUTxxx SMS gateway (Thanks @unixerius)
feature#6939 feat: add tags to teams notifications (Thanks @thelfensdrfer)
feature#6850 feat: add DNS support via Globalping (Thanks @radulucut)
feature#6971 refactor: improve dynamic RDAP DNS data
fix#6933 fix: Clear 2.1.0 frontend PWA cache
fix#6978 fix: Add helptext about usage to expiry checkboxes
fix#6977 fix: handle undefined monitor name in PagerDuty notification summary (Thanks @mixelburg)
fix#6960 fix: typo in DNS monitor error message (specifiy → specify) (Thanks @redbasecap-buiss)
fix#6897 fix: clearing heartbeats on paused monitors leaves them paused (Thanks @bruce691)
other#6945 chore: Translations Update from Weblate (Thanks @2000Arion @Aluisio @cyril59310 @DJEDIVER @dodog @florian-berger @hernikplays @Kf637 @MrEddX @thelfensdrfer @VeerGosai)
feature#6969 chore: Add automated npm dependency update workflow
other#6968 chore: Update dependencies
other#6963 chore: Update pull request template with AI usage warning
other#6951 chore: Update PR template with AI usage warning
other#6948 fix: Restrict scheduled workflows to upstream repository
other#6970 fix: npm dependency update GitHub workflow
feature#6899 feat: add customizable matrix notifications (Thanks @namatery)
feature#6868 feat: Add Group Name column to the Monitors table on dashboard page (Thanks @evolvomind)
fix#6923 fix: Gamedig unable to resolve SRV records by removing redundant DNS resolution in GameDigMonitorType
fix#6907 fix: Remove vite-plugin-pwa, avoid this plugin caches files unexpectedly
fix#6894 fix: discord notification timestamp & update notification message (Thanks @ryangurn)
fix#6887 fix(dashboard): add scroll bar to tags dropdown (Thanks @smartcoder0777)
fix#6884 fix(domain-expiry): only enable domain expiry notification when TLD has RDAP support (Thanks @BitWise-0x)
other#6878 #6853 chore: Translations Update from Weblate (Thanks @2000Arion @alihatamitajik @Aluisio @AnnAngela @cyril59310 @dodog @florian-berger @jochemp264 @JWeinelt @Kf637 @michi-onl @MrEddX @Saibamen @simonghpub @tvpetersen)
otherOther small changes, code refactoring and comment/doc updates in this repo:
other#6927 chore: Update dependencies
other#6877 chore: npm update
security#6925 chore: Update security policy and reporting guidelines
fix#6890 chore(generate-changelog): Fix Translation PRs did not merge together
other#6875 chore: Update final release workflow
other#6879 chore: update to 2.1.0