ntfy - Package Updates

[Package Updates]

[1.35.0]

• Update ntfy to 2.31.0
• Full Changelog
• Add /v1/ready for load balancers, and the node's role to /v1/health; with clustering, a node with no other active node leads right away instead of after a one-minute hold-off (#2050)
• Experimental clustering: add experimental-cluster-role to run a passive node that never leads and never takes over another node's subscribers, e.g. one that is not behind the load balancer (#2049)
• Fix messages lost when a client reconnects before they are written to the message cache, or when a cluster node's fan-out is lost: every node now reads newly written messages once a second and sends them to the subscribers that missed them (#2040)
• Write user stats (messages, emails, calls) as increments, so servers sharing one database add up instead of overwriting each other's counts (#1989)
• Don't add a visitor's anonymous usage to an account's stats when the account takes over that visitor, e.g. right after upgrading (#2041)
• A reconnect with since=<message ID> now also returns the messages published in the same second as that message, so none are skipped when several servers write out of order. The ntfy apps and web app drop these by ID; your own scripts may see a few duplicates (#2040)
• Experimental clustering only: this release changes the cluster's node registry schema (version 1 to 2). Downgrading a clustered server to v2.30.0 afterwards requires setting the version back by hand first: UPDATE schema_version SET version = 1 WHERE store = 'node_registry' (#2049)

[Package Updates]

[1.35.1]

• Update ntfy to 2.31.1
• Full Changelog
• Fix reconnects with since=<message ID> reading every message of the topic from the database, which overloaded ntfy.sh's database right after the v2.31.0 upgrade; the message cache gets a new index: (topic, published, id) on PostgreSQL, (topic, published, time) on SQLite (#2058)
• Start with a warning instead of failing when the database schema is newer than this version of ntfy supports, so a rollback or a rolling cluster upgrade needs no manual schema change (#2059)
• Web app: Fix the wrong topic opening when subscribed to the same topic on two different servers (#858)
• Web app: Fix the "Upgrade to ntfy Pro" banner covering the bottom of a long topic list (#1007)
• Web app: The "Notifications are disabled" and "Notifications are blocked" warnings can now be closed (#1220)
• Web app: Fix a crash when opening the subscribe dialog before the topic list has loaded, e.g. while another tab holds the browser database (#2014, #1881)
• This release changes the message database schema (version 16 to 17: an index for since=<message ID> reconnects). Downgrading to v2.31.0 or earlier afterwards requires setting the version back by hand first: UPDATE schema_version SET version = 16 WHERE store = 'message' on PostgreSQL, or UPDATE schemaVersion SET version = 16 WHERE id = 1 in the SQLite cache-file. From this release on, a newer schema only logs a warning (#2059)

[Package Updates]

[1.36.0]

• Update ntfy to 2.32.0
• Full Changelog
• Set the Incremental: ?1 header (RFC 10036) on streaming subscriptions, so proxies that support it forward messages without buffering (#2056, thanks to @bt90 for the suggestion)
• Fix template files (?tpl=<name>) ignoring the priority sent with the request when the file has no priority key (#2045, thanks to @6801318d8d for reporting)
• Return HTTP 409 instead of 500 when deleting or changing the password of a user provisioned via auth-users through the admin API (#2062, thanks to @daniloamiranda for reporting)
• Run the shared-database housekeeping (pruning expired messages, attachments and tokens, web push expiry warnings, writing the published-messages total) on the cluster leader only, so a passive node no longer overwrites the total with its own count (experimental clustering)
• Record the oldest schema version each database store still works with, so an older ntfy refuses to start on a database that a newer version migrated in a breaking way, instead of misreading it; none of today's migrations are breaking (#2060)

[Package Updates]

[1.36.1]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[1.37.0]

• Update ntfy to 2.33.0
• Full Changelog
• Show each cluster node's view of its peers with ntfy cluster status, /v1/cluster/status on the cluster listener, and per-peer metrics, so a link that only works in one direction is visible (experimental clustering, see cluster status)
• Export PostgreSQL connection pool metrics (ntfy_db_pool_*: connections in use, and queries that waited for a free connection, per pool), to size pool_max_conns (see PostgreSQL)
• Build with Go 1.27.3, which includes the security fixes of Go 1.27.2 (crypto/tls, net/http, html/template and others) and 1.27.3 (crypto/x509: certificate chains through the compromised eMudhra intermediate CAs are rejected)
• Reject phone number verification unless Twilio confirms the code as approved, instead of accepting any successful response
• Ignore duplicate topics in a subscription and limit a subscription to 150 topics, so a single request cannot replay the same topic's cache over and over
• Count published messages from every cluster node: each node adds its own publishes to the stored total instead of the leader overwriting it with its own count (experimental clustering)

[Package Updates]

[1.37.1]

• Update ntfy to 2.33.1
• Full Changelog
• Show each cluster node's view of its peers with ntfy cluster status, /v1/cluster/status on the cluster listener, and per-peer metrics, so a link that only works in one direction is visible (experimental clustering, see cluster status)
• Export PostgreSQL connection pool metrics (ntfy_db_pool_*: connections in use, and queries that waited for a free connection, per pool), to size pool_max_conns (see PostgreSQL)
• Build with Go 1.27.3, which includes the security fixes of Go 1.27.2 (crypto/tls, net/http, html/template and others) and 1.27.3 (crypto/x509: certificate chains through the compromised eMudhra intermediate CAs are rejected)
• Reject phone number verification unless Twilio confirms the code as approved, instead of accepting any successful response
• Ignore duplicate topics in a subscription and limit a subscription to 150 topics, so a single request cannot replay the same topic's cache over and over
• Count published messages from every cluster node: each node adds its own publishes to the stored total instead of the leader overwriting it with its own count (experimental clustering)
• Fix "Illegal instruction" crash of the amd64 binaries on CPUs without x86-64-v3 (AVX2/BMI2), by building releases on Ubuntu 24.04 again (#2092, thanks to @frank-bg for reporting)

[Package Updates]

[1.38.0]

• Update ntfy to 2.34.0
• Full Changelog
• Allow several comma-separated addresses in listen-http, so a load balancer can hold more than ~63k connections to one ntfy node
• Cluster nodes drain on shutdown: an active node withdraws (stops being ready), then turns read-only and closes its subscriber connections gradually (experimental-cluster-drain-delay, experimental-cluster-drain-duration), so its clients move to the other nodes without a reconnect storm (experimental, see draining on shutdown)
• End all of a user's subscriptions when their access to a topic is reset or the user is deleted: only the first one was ended, so the others kept receiving the topic's messages (#1845, thanks to @gigioneggiando for reporting)
• In an experimental cluster, tell the other nodes when access changes (e.g. a reservation or a revoked permission), so they reload their access cache and disconnect subscribers who lost access; the access cache reload also catches changes made elsewhere, e.g. by the ntfy access CLI, and now runs every 67 seconds instead of 87
• Fix a deadlock when ending subscriptions (reserving a topic with live subscribers, revoking access, deleting a user) while debug logging or log-level-overrides is on: the subscriptions' topic stayed locked for good
• Fix a data race when log-level-overrides changes (e.g. on a config reload with SIGHUP) while the server logs

[Package Updates]

[1.39.0]

• Update ntfy to 2.35.0
• Full Changelog
• Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and invalid UTF-8 from the topic after authorization, so an anonymous push key like /sec%00ret was authorized against an unmatched topic and then stored under the protected topic secret (SQLite only; on PostgreSQL the request was denied; thanks to Efe am for reporting)
• A tier change (an upgrade, a downgrade, or a tier edited in place) applies on the user's next request and keeps what was already spent; before, it refilled the request, email and attachment bandwidth limits (#2104, #2105)
• A tier's daily email limit is a hard cap; before, the tier's email burst came on top of it, so a user could send more emails a day than the tier allows
• Fix intermittent 403s and panics in the account handlers under concurrent requests from the same IP: a login or logout could change the user under another request, so a request with valid credentials was treated as anonymous, or the other way around. Every request now gets its own visitor (#1051, #2113, #2118, thanks to @ivanetinajero for reporting)
• A tier with a daily email limit of zero sends no emails; before, it could still send the server's email burst (visitor-email-limit-burst)
• An attachment upload rejected at a size limit is no longer charged to the attachment bandwidth limit for the part that went over
• Rate limits live in one shared limit service, keyed by ip:<prefix> or user:<id>, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path
• Accept terabyte units (e.g. 1T) in size settings such as attachment and tier limits, matching how sizes are displayed (#2078, thanks to @cangen185-sudo for the contribution)

[Package Updates]

[1.40.0]

• Update ntfy to 2.36.0
• Full Changelog
• Daily limits (messages, e-mails, phone calls) are stored in the user database, so they survive restarts; with PostgreSQL, all servers share them. Each visitor's day starts at its own time instead of midnight UTC, and the account page and /v1/account (stats.reset_at) show when it resets (#2131, see message limits)
• Experimental local admin socket (experimental-listen-admin-unix, off by default) that serves the admin API without credentials to whoever can open it; the shipped systemd unit sets RuntimeDirectory=ntfy for it (see admin socket)
• Export ntfy_db_up per PostgreSQL pool, and health-check the primary like the replicas (#2133)
• Everyone's daily counts start over at the upgrade: the stats_* columns of the user table are zeroed and no longer used
• Servers that share a PostgreSQL database must keep their clocks in sync (NTP)
• Visitors without a tier have a daily e-mail limit again (24h / visitor-email-limit-replenish)
• The whole server config is checked again when base-url or a message-size-limit above 4K is set, so an invalid config that used to start now fails at startup (#1969, thanks to @mikejgray for the contribution)
• Web app: Messages replayed by a poll or a reconnect no longer bring back deleted notifications, lose their read state or notify again (#2098, #2090, thanks to @mattford63, @arminus and @tobykaspar79 for reporting)
• CLI: ntfy pub --wait-pid now waits for processes owned by other users instead of failing with "not running" (#1710, thanks to @bekoeppel for the contribution)
• Admin API (internal): manage other users' tokens, tiers and password reset links, return 4xx instead of 500 for invalid input, and remove a deleted user's web push subscriptions

[Package Updates]

[1.41.0]

• Update ntfy to 2.37.1
• Full Changelog
• With visitor-subscriber-rate-limiting and a user database, write a UnifiedPush topic's subscriber activity every one to two hours instead of every 5 minutes, spread over time, and not at all when a poll or reconnect only repeats the same subscriber; on ntfy.sh, v2.37.0's writes of ~45k topics every 5 minutes, all due in the same minute, slowed down the database (#2151)
• With visitor-subscriber-rate-limiting, the subscriber of a UnifiedPush topic (who pays for its pushes) is kept in the user database and shared by all servers, so a push to any server is billed to the subscriber instead of answered with 507 (#2136; see subscriber-based rate limiting)
• Send a Retry-After header with HTTP 429 responses that are caused by a rate limit with a known wait, e.g. the request, e-mail or daily message limits (#2142; see rate limiting)
• Send the IETF draft RateLimit-Policy and RateLimit headers with publish responses (and with every 429 caused by a limit with a quota), for the request and daily message limits (#2143; see rate limiting)
• New metric ntfy_topics_unifiedpush_total: the UnifiedPush topics whose subscriber state a server keeps in memory (#2136)
• With visitor-subscriber-rate-limiting, a UnifiedPush push to a topic that has had no subscriber (subscribe, poll or open stream) for 4 days is answered with 410 (error code 41002) instead of 507, so app servers like Mastodon remove the expired subscription (#664, #2136); a Matrix push to such a topic gets its pushkey rejected (before: after 12 hours without a subscriber on the server that got the push)
• With visitor-subscriber-rate-limiting, UnifiedPush messages are counted against the subscriber's account only while it has a tier, and against the subscriber's IP address otherwise (also after the account lost its tier or was deleted); a tier change applies to the next message (#2136)
• Ban feed: weights may be fractional (down to 0.001), auth failures (42909) now weigh 2 instead of 10, and a UnifiedPush push without a subscriber (50701) or to an abandoned topic (41002) weighs 0.05, so app servers pushing to many offline phones are not banned for it (#2147)
• With PostgreSQL and several servers, daily usage a server counted in the last seconds of a visitor's 24-hour period is no longer added to the next period (a double count); it is dropped instead (#2136)
• Cluster: a forwarded message for a topic without subscribers on the receiving node now counts as wasted (ntfy_cluster_messages_wasted_total) and no longer keeps that idle topic in memory (#2140)