Uptime Kuma 2.5.7 → 2.5.9
2 releases · 0 breaking changes · 4 security fixes · 1 advisory fixed
4security0breaking0deprecated0feature7fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-86ch-2247-gr56 Unauthenticated Host-header injection and RSS cache poisoning
Breaking changes
None in the release notes.
Security changes
- security GHSA-86ch-2247-gr56 fix: RSS cache poisoning (Thanks @the-arma-of-owl) in 2.5.9
- security #8080 chore: drop outdated apicache, migrate to http-cache-semantics (related to the above issue) in 2.5.9
- security #8050 chore: Update dependencies in 2.5.9
- security GHSA-v2p3-6f5h-6hhf [Admin Only] RCE (Thanks @Sami111-Afk) (Open a help issue to ask to reveal it after 7 days, in case i forget to) in 2.5.8
Every release in between
fix#8082 fix: runtime timeout fallback used milliseconds for a seconds field
fix#8081 fix: reset push monitor retries from the last stored heartbeat
fix#8079 fix: remove duplicated refresh timer on status page
fix#8064 fix: display recurring maintenance in its configured timezone (Thanks @kuxiaowo)
securityGHSA-86ch-2247-gr56 fix: RSS cache poisoning (Thanks @the-arma-of-owl)
security#8080 chore: drop outdated apicache, migrate to http-cache-semantics (related to the above issue)
security#8050 chore: Update dependencies
fix#8049 fix: Docker verification check sometimes not catching invalid responses (2.5.X backport) (Thanks @Abestanis)
fix#8038 fix: add next-slim-rootless docker tag
fix#8028 fix: drop TLS support from the TCP Port monitor (It never worked as expected and very buggy, all existing monitors will become normal TCP monitors)
securityGHSA-v2p3-6f5h-6hhf [Admin Only] RCE (Thanks @Sami111-Afk) (Open a help issue to ask to reveal it after 7 days, in case i forget to)
other#8037 revert: hide/show password toggle in login page (#7672) (Because the height is inconsistent)