Uptime Kuma 2.3.1 → 2.5.6
9 releases · 1 breaking change · 6 security fixes · 1 advisory fixed
6security1breaking0deprecated34feature29fix
Vulnerabilities fixed by this upgrade
- 7.5 GHSA-wf2j-5mc7-5c4w Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs
Breaking changes
- breaking #7535 chore: Remove meaningless entries from en.json in 2.5.0
Security changes
- security #7858 chore: Update dependencies in 2.5.6
- security #7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent) in 2.5.4
- security GHSA-wf2j-5mc7-5c4w DoS weakness in 2.5.4
- security #7538 #7349 chore: Update dependencies in 2.5.0
- security #7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack in 2.5.0
- security (Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc) in 2.4.0
Every release in between
fix#7886 fix: use UptimeCalculator for avg-response badge endpoint
security#7858 chore: Update dependencies
fix#7848 fix: Memory leak from tcp monitor
feature#7801 feat(notification): add Signalgrid as notification provider (Thanks @signalgridco)
feature#7740 feat: add Notify! notification provider (Thanks @simplytoast1)
feature#7719 feat: add Amoot SMS notification provider (Thanks @sina3sd)
feature#7637 fix: omit content headers from cached 304 responses (Thanks @cyphercodes)
feature#7034 feat: add SFTP monitor type with password and private key authentication (Thanks @eXtgmA)
feature#7672 feat(auth): hide/show password toggle in login page (Thanks @kilian-nagel)
fix#7820 fix(real-browser): always close browser context (Thanks @EmptyPerson)
fix#7787 fix: iOS PWA icon has black background (Thanks @konstantintutsch)
fix#7739 fix: the two ping timeout ceilings were swapped in the monitor form (Thanks @evnchn)
fix#7718 fix: move afterCreate to initial mariadb pool config (Thanks @otbutz)
fix#7690 fix: accepted status codes custom range discarded on tag creation (Thanks @AmanUllah687)
security#7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent)
securityGHSA-wf2j-5mc7-5c4w DoS weakness
other#7812 #7757 chore: Translations Update from Weblate (Thanks @12LuA @aindriu80 @Aluisio @AnnAngela @AntonPalmqvist @cyril59310 @dodog @Gringit @helakostain @jamalkamaladdin @Kodashas @mcasellas @ueskici @xavivars)
fix#7754 fix: release with wrong version number
fixFix: Non-docker installation was broken in 2.5.1 (issue: #7752)
feature#7720 feat: add SMS Gateway notification provider (Thanks @mattboston)
feature#7677 feat: Add ClickUp notification provider (Thanks @nTraum)
feature#7640 feat: add TurboSMTP email notification provider (Thanks @NewtTheWolf)
feature#7638 feat(notification): add BearSMS SMS provider for Israel (Thanks @nitay12)
feature#7632 feat: Add Pinglet notification provider (Thanks @TheGlenn88)
feature#7609 feat: add Milky as Notification Provider (Thanks @nope-e)
feature#7555 feat: Add openwa notification (Thanks @ron007d)
fix#7729 fix: analytics_type's enum check was not removed, even the data type changed to string on SQLite
fix#7702 fix(radius): treat Access-Challenge as successful response (#7700) (Thanks @rikkova)
other#7715 #7646 chore: Translations Update from Weblate (Thanks @Aluisio @AntonPalmqvist @ATLWongsatorn @Cutlets @cyril59310 @DJEDIVER @dodog @dukkk2 @Gringit @helakostain @kaindlnetwork @misaka10843 @olafrv @raulmouzo @Regard1ess @steliosk98 @WoutNerd @yeonzi @zazuu0)
feature#7645 Add next-rootless docker tag
feature#7607 feat: allow unlimited interval rather than 24 days
feature#7597 feat: add voice call option to Plivo notification provider (Thanks @sarveshpatil-plivo)
feature#7584 feat: add Plivo SMS notification provider (Thanks @sarveshpatil-plivo)
feature#7571 feat: add Ooredoo (Maldives) SMS notification provider (Thanks @islandboymv)
feature#7569 feat: Add WxPusher SPT (WxPusher simple push token) notification provider (Thanks @zjiecode)
feature#7546 feat: add Flowtriq DDoS detection notification provider (Thanks @jacob-masse @FlyingDove2493)
feature#7525 feat: add tracking support on status pages for rybbit analytics (Thanks @DanielOberlechner)
feature#7506 feat(notification): add additional headers option for SMTP (Thanks @dnagy)
feature#7214 feat: add NTP monitor type for network time protocol monitoring (Thanks @henricook)
feature#7114 feat(system-service): add PM2 picker and platform selection (Thanks @KraoESPfan1n)
fix#7654 fix: correct 12 spelling errors across codebase (Thanks @jannikbx)
fix#7641 fix: RSS service status description is wrong
fix#7618 fix: widen stat_daily up/down columns from SMALLINT to unsigned INTEGER (Thanks @kushiemoon-dev)
fix#7599 fix: reduce rate-limit log spam when quota is healthy (Thanks @hexonal)
fix#7590 fix: double // in badgeUrl breaking Badge generator functionality (Thanks @jaimeagudo)
fix#7588 fix(domain-expiry): clarify unsupported RDAP warning (Thanks @arturict)
fix#7542 fix: resolve Steam monitor hostnames (Thanks @yuminn-k)
fix#7520 fix(discord): timezone with dayjs.utc() (Thanks @skkzsh)
fix#7516 fix: omit resolver port from DNS monitor service URL (Thanks @skkzsh)
fix#7515 fix(monitor): screenshot_delay not saved when editing browser engine monitor (Thanks @GhadiSaab)
fix#7472 fix: add timeout functionality to kafka (Thanks @jfgsilva)
fix#7465 fix: preserve saved protocol when loading Globalping ping monitor (Thanks @titojuanc)
fix#7460 fix: prevent tags dropdown from overflowing viewport (Thanks @Subrat-Dwivedi-22)
fix#7290 fix: allow mqtts:// in MQTT monitor (Thanks @Mrstragr @chennin)
security#7538 #7349 chore: Update dependencies
security#7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack
other#7521 #7477 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @AntonPalmqvist @arcanjobr @bill162 @ctih1 @cyril59310 @dodog @firedur @Goudarz @Gringit @helakostain @ivanbratovic @kamine81 @kiznick @Mr-Mmmc @MrEddX @OnyxOracle @PolarniMeda @ramazansancar…
other#7544 chore: change analytics_type to string type from enum
feature#7543 chore: add build "pr-test" workflow, add a message for testing to new pr.
feature#7541 chore: Add an ability to enable node.js inspector
breaking#7535 chore: Remove meaningless entries from en.json
other#7496 chore: Login form minor changes
feature#7434 feat(notification): add EgoSMS SMS provider for Uganda (Thanks @kristianinc @cursoragent)
feature#7420 feat: Add incidents to RSS (Thanks @dj-tuxis)
feature#7365 feat: Add VKTeams bot notification provider (Thanks @aleshasam)
feature#7433 feat: add optional token field for gamedig monitors (Thanks @aminoacidity)
feature#7415 feat: Adding bearer token (Thanks @aminoacidity @nyeswant)
feature#7431 fix: Add bearer token support to WebSocket upgrade monitor (Thanks @aminoacidity @nyeswant)
feature#7373 fix: update link to documentation about API keys (Thanks @eleanordoesntcode)
fix~#7453 fix(docker-only): add Let's Encrypt Gen Y root certificates~ (Please ignore this change)
fix#7451 fix: handling npm 11.16.0
fix#7351 fix: NTLM monitor over plain HTTP fails with 400 Bad Request (Thanks @karzac)
security(Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc)
other#7366 #7353 chore: Translations Update from Weblate (Thanks @aindriu80 @Aluisio @andibing @AnnAngela @Arden-Ahmad @bartoostveen @cyril59310 @dodog @Gringit @helakostain @ivanbratovic @Jumala9163 @Kf637 @master3395 @MrEddX @OnyxOracle @PolarniMeda @samsilveira @toniv90 @ttymayor @Virenbar @xuantan97)
feature#7432 chore: Implement dev data directory handling for non-master branches
other#7390 fix: normalize hidden log level lookup (Thanks @aqilaziz)
fix#7346 fix: Revert back from multiple connection to single connection for SQLite by default