Uptime Kuma 2.2.1 → 2.5.7
12 releases · 7 breaking changes · 7 security fixes · 1 advisory fixed
7security7breaking0deprecated47feature39fix
Vulnerabilities fixed by this upgrade
- 7.5 GHSA-wf2j-5mc7-5c4w Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs
Breaking changes
- breaking #7535 chore: Remove meaningless entries from en.json in 2.5.0
- breaking #7194 fix: Revert "add sorting to status pages" in 2.3.0
- breaking No more sorting feature in status pages. in 2.3.0
- breaking Due to bad performance. in 2.3.0
- breaking #7312 fix(database): add UPTIME_KUMA_SQLITE_SINGLE_CONNECTION in 2.3.0
- breaking For Raspberry Pi users, you may have to set it to true to avoid SQLite locking issues. in 2.3.0
- breaking Mainly affected Raspberry Pi users only, you can ignore it if you are not using devices like Raspberry Pi. in 2.3.0
Security changes
- security [Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv) in 2.5.7
- security #7858 chore: Update dependencies in 2.5.6
- security #7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent) in 2.5.4
- security GHSA-wf2j-5mc7-5c4w DoS weakness in 2.5.4
- security #7538 #7349 chore: Update dependencies in 2.5.0
- security #7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack in 2.5.0
- security (Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc) in 2.4.0
Every release in between
fix#7989 fix: retries ignored by TCP Port monitor with SSL/STARTTLS
security[Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv)
fix#7886 fix: use UptimeCalculator for avg-response badge endpoint
security#7858 chore: Update dependencies
fix#7848 fix: Memory leak from tcp monitor
feature#7801 feat(notification): add Signalgrid as notification provider (Thanks @signalgridco)
feature#7740 feat: add Notify! notification provider (Thanks @simplytoast1)
feature#7719 feat: add Amoot SMS notification provider (Thanks @sina3sd)
feature#7637 fix: omit content headers from cached 304 responses (Thanks @cyphercodes)
feature#7034 feat: add SFTP monitor type with password and private key authentication (Thanks @eXtgmA)
feature#7672 feat(auth): hide/show password toggle in login page (Thanks @kilian-nagel)
fix#7820 fix(real-browser): always close browser context (Thanks @EmptyPerson)
fix#7787 fix: iOS PWA icon has black background (Thanks @konstantintutsch)
fix#7739 fix: the two ping timeout ceilings were swapped in the monitor form (Thanks @evnchn)
fix#7718 fix: move afterCreate to initial mariadb pool config (Thanks @otbutz)
fix#7690 fix: accepted status codes custom range discarded on tag creation (Thanks @AmanUllah687)
security#7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent)
securityGHSA-wf2j-5mc7-5c4w DoS weakness
other#7812 #7757 chore: Translations Update from Weblate (Thanks @12LuA @aindriu80 @Aluisio @AnnAngela @AntonPalmqvist @cyril59310 @dodog @Gringit @helakostain @jamalkamaladdin @Kodashas @mcasellas @ueskici @xavivars)
fix#7754 fix: release with wrong version number
fixFix: Non-docker installation was broken in 2.5.1 (issue: #7752)
feature#7720 feat: add SMS Gateway notification provider (Thanks @mattboston)
feature#7677 feat: Add ClickUp notification provider (Thanks @nTraum)
feature#7640 feat: add TurboSMTP email notification provider (Thanks @NewtTheWolf)
feature#7638 feat(notification): add BearSMS SMS provider for Israel (Thanks @nitay12)
feature#7632 feat: Add Pinglet notification provider (Thanks @TheGlenn88)
feature#7609 feat: add Milky as Notification Provider (Thanks @nope-e)
feature#7555 feat: Add openwa notification (Thanks @ron007d)
fix#7729 fix: analytics_type's enum check was not removed, even the data type changed to string on SQLite
fix#7702 fix(radius): treat Access-Challenge as successful response (#7700) (Thanks @rikkova)
other#7715 #7646 chore: Translations Update from Weblate (Thanks @Aluisio @AntonPalmqvist @ATLWongsatorn @Cutlets @cyril59310 @DJEDIVER @dodog @dukkk2 @Gringit @helakostain @kaindlnetwork @misaka10843 @olafrv @raulmouzo @Regard1ess @steliosk98 @WoutNerd @yeonzi @zazuu0)
feature#7645 Add next-rootless docker tag
feature#7607 feat: allow unlimited interval rather than 24 days
feature#7597 feat: add voice call option to Plivo notification provider (Thanks @sarveshpatil-plivo)
feature#7584 feat: add Plivo SMS notification provider (Thanks @sarveshpatil-plivo)
feature#7571 feat: add Ooredoo (Maldives) SMS notification provider (Thanks @islandboymv)
feature#7569 feat: Add WxPusher SPT (WxPusher simple push token) notification provider (Thanks @zjiecode)
feature#7546 feat: add Flowtriq DDoS detection notification provider (Thanks @jacob-masse @FlyingDove2493)
feature#7525 feat: add tracking support on status pages for rybbit analytics (Thanks @DanielOberlechner)
feature#7506 feat(notification): add additional headers option for SMTP (Thanks @dnagy)
feature#7214 feat: add NTP monitor type for network time protocol monitoring (Thanks @henricook)
feature#7114 feat(system-service): add PM2 picker and platform selection (Thanks @KraoESPfan1n)
fix#7654 fix: correct 12 spelling errors across codebase (Thanks @jannikbx)
fix#7641 fix: RSS service status description is wrong
fix#7618 fix: widen stat_daily up/down columns from SMALLINT to unsigned INTEGER (Thanks @kushiemoon-dev)
fix#7599 fix: reduce rate-limit log spam when quota is healthy (Thanks @hexonal)
fix#7590 fix: double // in badgeUrl breaking Badge generator functionality (Thanks @jaimeagudo)
fix#7588 fix(domain-expiry): clarify unsupported RDAP warning (Thanks @arturict)
fix#7542 fix: resolve Steam monitor hostnames (Thanks @yuminn-k)
fix#7520 fix(discord): timezone with dayjs.utc() (Thanks @skkzsh)
fix#7516 fix: omit resolver port from DNS monitor service URL (Thanks @skkzsh)
fix#7515 fix(monitor): screenshot_delay not saved when editing browser engine monitor (Thanks @GhadiSaab)
fix#7472 fix: add timeout functionality to kafka (Thanks @jfgsilva)
fix#7465 fix: preserve saved protocol when loading Globalping ping monitor (Thanks @titojuanc)
fix#7460 fix: prevent tags dropdown from overflowing viewport (Thanks @Subrat-Dwivedi-22)
fix#7290 fix: allow mqtts:// in MQTT monitor (Thanks @Mrstragr @chennin)
security#7538 #7349 chore: Update dependencies
security#7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack
other#7521 #7477 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @AntonPalmqvist @arcanjobr @bill162 @ctih1 @cyril59310 @dodog @firedur @Goudarz @Gringit @helakostain @ivanbratovic @kamine81 @kiznick @Mr-Mmmc @MrEddX @OnyxOracle @PolarniMeda @ramazansancar…
other#7544 chore: change analytics_type to string type from enum
feature#7543 chore: add build "pr-test" workflow, add a message for testing to new pr.
feature#7541 chore: Add an ability to enable node.js inspector
breaking#7535 chore: Remove meaningless entries from en.json
other#7496 chore: Login form minor changes
feature#7434 feat(notification): add EgoSMS SMS provider for Uganda (Thanks @kristianinc @cursoragent)
feature#7420 feat: Add incidents to RSS (Thanks @dj-tuxis)
feature#7365 feat: Add VKTeams bot notification provider (Thanks @aleshasam)
feature#7433 feat: add optional token field for gamedig monitors (Thanks @aminoacidity)
feature#7415 feat: Adding bearer token (Thanks @aminoacidity @nyeswant)
feature#7431 fix: Add bearer token support to WebSocket upgrade monitor (Thanks @aminoacidity @nyeswant)
feature#7373 fix: update link to documentation about API keys (Thanks @eleanordoesntcode)
fix~#7453 fix(docker-only): add Let's Encrypt Gen Y root certificates~ (Please ignore this change)
fix#7451 fix: handling npm 11.16.0
fix#7351 fix: NTLM monitor over plain HTTP fails with 400 Bad Request (Thanks @karzac)
security(Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc)
other#7366 #7353 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @Arden-Ahmad @bartoostveen @cyril59310 @dodog @Gringit @helakostain @ivanbratovic @Jumala9163 @Kf637 @master3395 @MrEddX @OnyxOracle @PolarniMeda @samsilveira @toniv90 @ttymayor @Virenbar @xuantan97)
feature#7432 chore: Implement dev data directory handling for non-master branches
other#7390 fix: normalize hidden log level lookup (Thanks @aqilaziz)
fix#7346 fix: Revert back from multiple connection to single connection for SQLite by default
fix#7307 fix: Add busy_timeout to sqlite to avoid error SQLITE_BUSY: database is locked (Thanks @wagnerand)
other#7340 chore: Update dependencies
other#7345 chore: update to 2.3.1
other#7344 fix(push): use multi-arch Node base in push image Dockerfile (Thanks @herwinz)
breaking#7194 fix: Revert "add sorting to status pages"
breakingNo more sorting feature in status pages.
breakingDue to bad performance.
breaking#7312 fix(database): add UPTIME_KUMA_SQLITE_SINGLE_CONNECTION
breakingFor Raspberry Pi users, you may have to set it to true to avoid SQLite locking issues.
breakingMainly affected Raspberry Pi users only, you can ignore it if you are not using devices like Raspberry Pi.
feature#7304 feat: websocket improve to fix issue #7268 including support authentication (Thanks @sofia-fernandez-six)
feature#7207 feat(notification): add custom message template support for Evolution provider (Thanks @kbrianps)
feature#7201 feat: add Telnyx messaging provider (Thanks @LuvForAirplanes)
feature#7182 feat: Add VK notification provider (Thanks @FunNikita)
feature#7160 feat: Add MAX messenger notification provider (Thanks @Redleks)
feature#7156 feat: add OracleDB monitor (Thanks @sitiom)
feature#7154 feat: add collapsible groups to status page (Thanks @marco-carvalho)
feature#7303 feat(ui): add a helptext that RTT for the ping monitor is not avaliable on linux (Thanks @stchigel)
feature#7300 feat(ux): changed warning msg (Thanks @hemanth5544)
feature#7128 fix: Update Home Assistant notification help text for HA 2024 Services→Actions rename (Thanks @tr4nt0r)
fix#7248 fix(notification): check for monitorJSON in Stackfield provider (Thanks @jlbrt)
fix#7166 fix: Handle SSL in setup database temp server
fix#7235 fix(uptime): ensure correct handling of missing time buckets in uptime calculations (Thanks @adrianceding)
fix#7221 fix(notification): ensure applyExisting is not saved to database
fix#7198 fix: Domain expiry doesn't seem to update #7189 (Thanks @shanto)
fix#7155 fix: propagate create errors (Thanks @otbutz)
fix#7159 fix: monitor graph gaps for sub-millisecond TCP pings (Thanks @0xRozier)
fix#7125 fix: prometheus metrics have two series for a single monitor when that monitor has tags (Thanks @nicjansma)
feature#7108 feat: Add English (United Kingdom) language support (Thanks @andibing)
other#7292 #7197 #7132 chore: Translations Update from Weblate (Thanks @aindriu80 @Ale1x @Aluisio @andibing @AnnAngela @CammarataLudovico @cyril59310 @dodog @efenow @fcordeiro @firedur @FunNikita @Gringit @Hamstio1 @helakostain @ivanbratovic @kevinheyer-dev @mlopezcoria @Mo7amm1d @MrEddX @numarkpro…
other#7317 #7195 #7133 chore: Update dependencies
feature#7204 chore: Add agents.md - anti AI slop
feature#7146 chore: Add monthly workflow to build push Docker image