Uptime Kuma 2.5.1 → 2.5.7
6 releases · 0 breaking changes · 4 security fixes · 1 advisory fixed
4security0breaking0deprecated6feature10fix
Vulnerabilities fixed by this upgrade
- 7.5 GHSA-wf2j-5mc7-5c4w Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs
Breaking changes
None in the release notes.
Security changes
- security [Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv) in 2.5.7
- security #7858 chore: Update dependencies in 2.5.6
- security #7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent) in 2.5.4
- security GHSA-wf2j-5mc7-5c4w DoS weakness in 2.5.4
Every release in between
fix#7989 fix: retries ignored by TCP Port monitor with SSL/STARTTLS
security[Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv)
fix#7886 fix: use UptimeCalculator for avg-response badge endpoint
security#7858 chore: Update dependencies
fix#7848 fix: Memory leak from tcp monitor
feature#7801 feat(notification): add Signalgrid as notification provider (Thanks @signalgridco)
feature#7740 feat: add Notify! notification provider (Thanks @simplytoast1)
feature#7719 feat: add Amoot SMS notification provider (Thanks @sina3sd)
feature#7637 fix: omit content headers from cached 304 responses (Thanks @cyphercodes)
feature#7034 feat: add SFTP monitor type with password and private key authentication (Thanks @eXtgmA)
feature#7672 feat(auth): hide/show password toggle in login page (Thanks @kilian-nagel)
fix#7820 fix(real-browser): always close browser context (Thanks @EmptyPerson)
fix#7787 fix: iOS PWA icon has black background (Thanks @konstantintutsch)
fix#7739 fix: the two ping timeout ceilings were swapped in the monitor form (Thanks @evnchn)
fix#7718 fix: move afterCreate to initial mariadb pool config (Thanks @otbutz)
fix#7690 fix: accepted status codes custom range discarded on tag creation (Thanks @AmanUllah687)
security#7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent)
securityGHSA-wf2j-5mc7-5c4w DoS weakness
other#7812 #7757 chore: Translations Update from Weblate (Thanks @12LuA @aindriu80 @Aluisio @AnnAngela @AntonPalmqvist @cyril59310 @dodog @Gringit @helakostain @jamalkamaladdin @Kodashas @mcasellas @ueskici @xavivars)
fix#7754 fix: release with wrong version number
fixFix: Non-docker installation was broken in 2.5.1 (issue: #7752)