<![CDATA[ntfy - Package Updates]]>You can use this thread to track updates to the ntfy package.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/8687/ntfy-package-updatesRSS for NodeSun, 16 Aug 2026 06:38:05 GMTSat, 18 Feb 2023 11:20:22 GMT60<![CDATA[Reply to ntfy - Package Updates on Tue, 04 Aug 2026 11:27:40 GMT]]>[1.31.0]

  • Update ntfy to 2.27.0
  • Full Changelog
  • Limit message templates (Template: yes) to 32 KB, limit printf widths and precisions to below 1000, and limit indent/nindent to 100 spaces, preventing excessive memory use from a single small template
  • Exclude secrets from the config hash served to the web app, preventing a rather theoretical information leak
  • Allow logging in with your verified primary email address (in addition to your username), so a password reset no longer leaves you unable to sign in when you only remember the email you signed up with
  • Fix Twilio phone calls and phone number verifications failing silently when Twilio rejected the request, and move the Twilio integration into its own twilio package
  • Move the Prometheus metrics into a dedicated metrics package
  • Message cache databases from ntfy older than v1.10.0 (November 2021) can no longer be migrated; upgrade via an older ntfy version first, or delete the cache database
  • Fix user_phone table in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migration
]]>https://forum.cloudron.io/post/127699https://forum.cloudron.io/post/127699Tue, 04 Aug 2026 11:27:40 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 21 Jul 2026 15:02:01 GMT]]>[1.30.1]

  • Update ntfy to 2.26.3
  • Full Changelog
  • Add an abuse ban-feed: when enabled via ban-file, ntfy tracks a weighted strike budget per visitor and appends abusive IPs to a file that fail2ban can tail and ban on sight (ban-file, ban-window, ban-threshold, ban-weights; see ban-feed)
]]>https://forum.cloudron.io/post/127026https://forum.cloudron.io/post/127026Tue, 21 Jul 2026 15:02:01 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 14 Jul 2026 15:04:58 GMT]]>[1.30.0]

  • require web UI login for self-hosted use
  • fix email sending
]]>https://forum.cloudron.io/post/126769https://forum.cloudron.io/post/126769Tue, 14 Jul 2026 15:04:58 GMT<![CDATA[Reply to ntfy - Package Updates on Fri, 10 Jul 2026 11:06:17 GMT]]>[1.29.0]

  • Update ntfy to 2.26.0
  • Full Changelog
  • Prevent a CPU denial of service via message templates (Template: yes), #1826, thanks to @alanturing881 for reporting)
  • Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account (#1647, thanks to @wsw70 for reporting)
  • Web app: Smooth transitions and loading animation, remove flickering
  • Web app: GET /account now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
  • Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option (#1727, thanks to @mberlofa)
  • Web app: Strip unsafe URL protocols (javascript:, data:, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to @jvoisin for reporting)
]]>https://forum.cloudron.io/post/126625https://forum.cloudron.io/post/126625Fri, 10 Jul 2026 11:06:17 GMT<![CDATA[Reply to ntfy - Package Updates on Thu, 25 Jun 2026 06:49:07 GMT]]>[1.28.0]

  • Update ntfy to 2.25.0
  • Full Changelog
  • Generate access tokens, IDs, and magic-link tokens with a cryptographically secure RNG (crypto/rand) instead of a clock-seeded PRNG
  • Add password reset via emailed magic link, with a "Forgot password" link on the login page and a ntfy user reset-pass CLI command for admins
  • Rework email verification to use durable, single-use, expiring magic links instead of in-memory 6-digit codes, and add a "primary" email (used for account recovery and as the X-Email: yes target) with verified/unverified state in the account UI
  • You can now clear/read messages and delete messages with a GET request (#1771, thanks to @lemmi for reporting and to @wunter8 for implementing)
  • Add a reload button to the web app's action bar when running as an installed PWA, which clears the service worker caches and hard-refreshes the app
  • X-Email: yes (also true/1) now sends to your primary verified email regardless of the smtp-sender-verify setting (previously it was rejected unless verification was enabled); it requires being logged in with a verified address
  • Grant users full access to their own sync topic (st_...) so cross-device subscription sync works under auth-default-access: deny-all (#733, #1795, thanks to @lmorchard for the contribution)
  • Support HTTP (non-TLS) S3-compatible endpoints by preserving the endpoint scheme, e.g. for a local MinIO instance (#1794, #1734, thanks to @sskender for the contribution, and @Kernald for reporting)
  • Stop silently stripping spaces from passwords while typing in the web app's login, signup, and password-reset forms (#1246, thanks to @aldem for reporting)
  • Stop escaping <, >, and & as \u003c/\u003e/\u0026 in JSON responses (#1511, #1512, thanks to @wunter8 for the contribution)
]]>https://forum.cloudron.io/post/126083https://forum.cloudron.io/post/126083Thu, 25 Jun 2026 06:49:07 GMT<![CDATA[Reply to ntfy - Package Updates on Fri, 05 Jun 2026 06:43:47 GMT]]>[1.27.0]

  • Update ntfy to 2.24.0
  • Full Changelog
  • Fix case-insensitive ACL topic matching on SQLite: an access control rule for secret no longer also matches a request for SECRET. SQLite's LIKE is case-insensitive for ASCII by default. PostgreSQL was unaffected. It's honestly incredible that this issue remained undetected for so long, especially while ntfy.sh was running on SQLite (it now runs on PostgreSQL).
  • Add opt-in in-memory ACL cache (auth-access-cache) that serves topic authorization without a database round-trip; off by default, intended for high-volume servers
  • Add ntfy --version flag to the CLI (#1722, #1748, thanks to @sskender for the contribution, and @Saucy9607 for reporting)
  • Extend account token automatically from the PWA service worker, so installed PWAs don't get logged out (#1669, #1203, #1533, thanks to @nihalgonsalves for the contribution)
  • Fix rel attribute on auto-linked notification URLs so noreferrer/noopener are actually applied (#1720, thanks to @dmitrylyzo for the contribution)
  • Add systemd sandboxing/hardening to the ntfy.service unit (#1467, thanks to @Velocifyer for the contribution)
  • Fix cmd package build on macOS (darwin) so the server compiles from source (#1631, #1696, thanks to @ShipItAndPray for the contribution, and @XYenon for reporting)
]]>https://forum.cloudron.io/post/125511https://forum.cloudron.io/post/125511Fri, 05 Jun 2026 06:43:47 GMT<![CDATA[Reply to ntfy - Package Updates on Mon, 18 May 2026 07:20:12 GMT]]>[1.26.0]

  • Update ntfy to 2.23.0
  • Full Changelog
  • Add per-visitor rate limit on new topic creations (visitor-topic-creation-limit-burst / visitor-topic-creation-limit-replenish, defaults 100 burst / 1m replenish) to mitigate topic-enumeration / squatting attacks that inflate the in-memory topic map
  • Remove stacktrace-js, stacktrace-gps, humanize-duration, and js-base64 from the web app to reduce dependency and security footprint
  • Restrict the publish dialog's local file preview to safe image types (png/jpg/gif/webp) to prevent same-origin script execution from blob URLs when previewing a crafted SVG (GHSA-j8hr-p342-xrmh, thanks to @Venukamatchi for reporting)
]]>https://forum.cloudron.io/post/124807https://forum.cloudron.io/post/124807Mon, 18 May 2026 07:20:12 GMT<![CDATA[Reply to ntfy - Package Updates on Wed, 13 May 2026 08:30:47 GMT]]>[1.25.1]

  • fix: update doc links from /apps/ to /packages/
]]>https://forum.cloudron.io/post/124671https://forum.cloudron.io/post/124671Wed, 13 May 2026 08:30:47 GMT<![CDATA[Reply to ntfy - Package Updates on Wed, 22 Apr 2026 08:03:46 GMT]]>[1.25.0]

]]>https://forum.cloudron.io/post/123837https://forum.cloudron.io/post/123837Wed, 22 Apr 2026 08:03:46 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 31 Mar 2026 06:30:53 GMT]]>[1.24.0]

  • Update ntfy to 2.21.0
  • Full Changelog
  • This release adds the ability to verify email addresses using the smtp-sender-verify flag. This is a change that is required because ntfy.sh was used to send unsolicited emails and the AWS SES account was suspended. Going forward, ntfy.sh won't be able to send emails unless the email address was verified ahead of time.
  • Add verified email recipients feature with smtp-sender-verify config flag, allowing server admins to require email
  • address verification before sending email notifications (#​1681)
]]>https://forum.cloudron.io/post/122724https://forum.cloudron.io/post/122724Tue, 31 Mar 2026 06:30:53 GMT<![CDATA[Reply to ntfy - Package Updates on Fri, 27 Mar 2026 06:09:47 GMT]]>[1.23.0]

  • Update ntfy to 2.20.0
  • Full Changelog
  • Add S3-compatible object storage as an alternative attachment store via attachment-cache-dir config option (#​1656/#​1672)
  • Reject invalid e-mail addresses (e.g. multiple comma-separated recipients) with HTTP 400
  • Add OpenRC init service file (#​1650, thanks to @​ageru for the contribution)
  • ⚠ Important note: With this release, ntfy will take full control over the attachment directory or S3 bucket. Files/objects in the configured attachment-cache-dir that match the message ID format (12 chars, matching ^[A-Za-z0-9]{12}$), and have no entries in the message database will be deleted. Do not use a directory or S3 bucket as attachment-cache-dir that is also used for something else.
]]>https://forum.cloudron.io/post/122557https://forum.cloudron.io/post/122557Fri, 27 Mar 2026 06:09:47 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 17 Mar 2026 02:46:33 GMT]]>[1.22.2]

  • Update ntfy to 2.19.2
  • Full Changelog
  • This is another small bugfix release for PostgreSQL, avoiding races between primary and read replica, as well as to further reduce primary load.
  • Bug fixes + maintenance:
  • Fix race condition in web push subscription causing FK constraint violation when concurrent requests hit the same endpoint
  • Route authorization query to read-only database replica to reduce primary database load
]]>https://forum.cloudron.io/post/122005https://forum.cloudron.io/post/122005Tue, 17 Mar 2026 02:46:33 GMT<![CDATA[Reply to ntfy - Package Updates on Mon, 16 Mar 2026 06:13:51 GMT]]>[1.22.1]

  • Update ntfy to 2.19.1
  • Full Changelog
  • This is a bugfix release to avoid PostgreSQL insert failures due to invalid UTF-8 messages. It also fixes database-url validation incorrectly rejecting postgresql:// connection strings.
  • Fix invalid UTF-8 in HTTP headers (e.g. Latin-1 encoded text) causing PostgreSQL insert failures and dropping entire message batches
  • Fix database-url validation rejecting postgresql:// connection strings (#​1657/#​1658)
]]>https://forum.cloudron.io/post/121929https://forum.cloudron.io/post/121929Mon, 16 Mar 2026 06:13:51 GMT<![CDATA[Reply to ntfy - Package Updates on Sun, 15 Mar 2026 17:24:29 GMT]]>[1.22.0]

]]>https://forum.cloudron.io/post/121909https://forum.cloudron.io/post/121909Sun, 15 Mar 2026 17:24:29 GMT<![CDATA[Reply to ntfy - Package Updates on Sun, 08 Mar 2026 08:38:01 GMT]]>[1.21.0]

]]>https://forum.cloudron.io/post/121419https://forum.cloudron.io/post/121419Sun, 08 Mar 2026 08:38:01 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 10 Feb 2026 07:28:02 GMT]]>[1.20.0]

  • Update ntfy to 2.17.0
  • Full Changelog
  • Server: Support templating in the priority field (#​1426, thanks to @​seantomburke for reporting)
  • Server: Add admin-only GET /v1/version endpoint returning server version, build commit, and date (#​1599, thanks to @​crivchri for reporting)
  • Server/Web: Support "copy" action button to copy a value to the clipboard (#​1364, thanks to @​SudoWatson for reporting)
  • Web: Show red notification dot on favicon when there are unread messages (#​1017, thanks to @​ad-si for reporting)
  • Server: Fix crash when commit string is shorter than 7 characters in non-GitHub-Action builds (#​1493, thanks to @​cyrinux for reporting)
  • Server: Fix server crash (nil pointer panic) when subscriber disconnects during publish (#​1598)
  • Server: Fix log spam from http: response.WriteHeader on hijacked connection for WebSocket errors (#​1362, thanks to @​bonfiresh for reporting)
  • Server: Use slices.Contains from stdlib to simplify code (#​1406, thanks to @​tanhuaan)
  • Web: Fix clear=true on action buttons not clearing the notification (#​1029, thanks to @​ElFishi for reporting)
  • Web: Fix Markdown message line height to match plain text (1.5 instead of 1.2) (#​1139, thanks to @​etfz for reporting)
]]>https://forum.cloudron.io/post/119983https://forum.cloudron.io/post/119983Tue, 10 Feb 2026 07:28:02 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 20 Jan 2026 05:20:19 GMT]]>[1.19.0]

]]>https://forum.cloudron.io/post/118811https://forum.cloudron.io/post/118811Tue, 20 Jan 2026 05:20:19 GMT<![CDATA[Reply to ntfy - Package Updates on Mon, 17 Nov 2025 07:47:47 GMT]]>[1.18.0]

]]>https://forum.cloudron.io/post/115480https://forum.cloudron.io/post/115480Mon, 17 Nov 2025 07:47:47 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 05 Aug 2025 09:32:41 GMT]]>[1.17.0]

  • Update ntfy to 2.14.0
  • Full Changelog
  • Declarative users, declarative ACL entries and declarative tokens (#464, #1384, #1413, thanks to pinpox for reporting, to @wunter8 for reviewing and implementing parts of it)
  • Pre-defined templates and custom templates for enhanced JSON webhook support (#1390)
  • Support of advanced template functions based on the Sprig library (#1121, thanks to @davidatkinsondoyle for reporting, to @wunter8 for implementing, and to the Sprig team for their work)
]]>https://forum.cloudron.io/post/111257https://forum.cloudron.io/post/111257Tue, 05 Aug 2025 09:32:41 GMT<![CDATA[Reply to ntfy - Package Updates on Wed, 30 Jul 2025 10:13:17 GMT]]>[1.16.0]

  • checklist added to manifest
]]>https://forum.cloudron.io/post/111001https://forum.cloudron.io/post/111001Wed, 30 Jul 2025 10:13:17 GMT<![CDATA[Reply to ntfy - Package Updates on Fri, 11 Jul 2025 07:00:18 GMT]]>[1.15.0]

]]>https://forum.cloudron.io/post/110008https://forum.cloudron.io/post/110008Fri, 11 Jul 2025 07:00:18 GMT<![CDATA[Reply to ntfy - Package Updates on Fri, 30 May 2025 18:34:02 GMT]]>[1.14.0]

  • Update ntfy to 2.12.0
  • Full Changelog
  • Add username/password auth to email publishing (#1164, thanks to @bishtawi)
  • Write VAPID keys to file in ntfy webpush --output-file (#1138, thanks to @nogweii)
  • Add latest subscription param for grabbing just the most recent message (#1216, thanks to @wunter8)
  • Allow using NTFY_PASSWORD_HASH in ntfy user command instead of raw password (#1340, thanks to @Tom-Hubrecht for implementing)
  • You can now change passwords via v1/users API (#1267, thanks to @wunter8 for implementing)
  • Make WebPush subscription warning/expiry configurable, increase default to 55/60 days (#1212, thanks to @KuroSetsuna29)
  • Support systemd user service ntfy-client.service (#1002, thanks to @dandersch)
  • Security updates for dependencies and Docker images (#1341)
  • Upgrade to Vite 6 (#1342, thanks Dependabot)
  • Fix iOS delivery issues for read-protected topics (#1207, thanks a lot to @barart!)
]]>https://forum.cloudron.io/post/107919https://forum.cloudron.io/post/107919Fri, 30 May 2025 18:34:02 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 01 Apr 2025 14:45:59 GMT]]>[1.13.0]

  • Update base image to 5.0.0
]]>https://forum.cloudron.io/post/104907https://forum.cloudron.io/post/104907Tue, 01 Apr 2025 14:45:59 GMT<![CDATA[Reply to ntfy - Package Updates on Tue, 14 May 2024 08:39:21 GMT]]>[1.12.0]

  • Update ntfy to 2.11.0
  • Full changelog
  • Re-add database index idx_topic to the messages table to fix performance issues on ntfy.sh (no ticket, big thanks to @tcaputi for finding this issue)
  • Do not set rate visitor for non-eligible topics (no ticket)
  • Do not cache config.js (#1098, thanks to @wunter8)
]]>https://forum.cloudron.io/post/88437https://forum.cloudron.io/post/88437Tue, 14 May 2024 08:39:21 GMT