Uptime Kuma 2.5.0 → 2.5.7
7 releases · 0 breaking changes · 4 security fixes · 1 advisory fixed
4security0breaking0deprecated13feature12fix
Vulnerabilities fixed by this upgrade
- 7.5 GHSA-wf2j-5mc7-5c4w Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs
Breaking changes
None in the release notes.
Security changes
- security [Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv) in 2.5.7
- security #7858 chore: Update dependencies in 2.5.6
- security #7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent) in 2.5.4
- security GHSA-wf2j-5mc7-5c4w DoS weakness in 2.5.4
Every release in between
fix#7989 fix: retries ignored by TCP Port monitor with SSL/STARTTLS
security[Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv)
fix#7886 fix: use UptimeCalculator for avg-response badge endpoint
security#7858 chore: Update dependencies
fix#7848 fix: Memory leak from tcp monitor
feature#7801 feat(notification): add Signalgrid as notification provider (Thanks @signalgridco)
feature#7740 feat: add Notify! notification provider (Thanks @simplytoast1)
feature#7719 feat: add Amoot SMS notification provider (Thanks @sina3sd)
feature#7637 fix: omit content headers from cached 304 responses (Thanks @cyphercodes)
feature#7034 feat: add SFTP monitor type with password and private key authentication (Thanks @eXtgmA)
feature#7672 feat(auth): hide/show password toggle in login page (Thanks @kilian-nagel)
fix#7820 fix(real-browser): always close browser context (Thanks @EmptyPerson)
fix#7787 fix: iOS PWA icon has black background (Thanks @konstantintutsch)
fix#7739 fix: the two ping timeout ceilings were swapped in the monitor form (Thanks @evnchn)
fix#7718 fix: move afterCreate to initial mariadb pool config (Thanks @otbutz)
fix#7690 fix: accepted status codes custom range discarded on tag creation (Thanks @AmanUllah687)
security#7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent)
securityGHSA-wf2j-5mc7-5c4w DoS weakness
other#7812 #7757 chore: Translations Update from Weblate (Thanks @12LuA @aindriu80 @Aluisio @AnnAngela @AntonPalmqvist @cyril59310 @dodog @Gringit @helakostain @jamalkamaladdin @Kodashas @mcasellas @ueskici @xavivars)
fix#7754 fix: release with wrong version number
fixFix: Non-docker installation was broken in 2.5.1 (issue: #7752)
feature#7720 feat: add SMS Gateway notification provider (Thanks @mattboston)
feature#7677 feat: Add ClickUp notification provider (Thanks @nTraum)
feature#7640 feat: add TurboSMTP email notification provider (Thanks @NewtTheWolf)
feature#7638 feat(notification): add BearSMS SMS provider for Israel (Thanks @nitay12)
feature#7632 feat: Add Pinglet notification provider (Thanks @TheGlenn88)
feature#7609 feat: add Milky as Notification Provider (Thanks @nope-e)
feature#7555 feat: Add openwa notification (Thanks @ron007d)
fix#7729 fix: analytics_type's enum check was not removed, even the data type changed to string on SQLite
fix#7702 fix(radius): treat Access-Challenge as successful response (#7700) (Thanks @rikkova)
other#7715 #7646 chore: Translations Update from Weblate (Thanks @Aluisio @AntonPalmqvist @ATLWongsatorn @Cutlets @cyril59310 @DJEDIVER @dodog @dukkk2 @Gringit @helakostain @kaindlnetwork @misaka10843 @olafrv @raulmouzo @Regard1ess @steliosk98 @WoutNerd @yeonzi @zazuu0)