ntfy - Package Updates

Package Updates

[1.30.0]

Package Updates

[1.30.1]

Update ntfy to 2.26.3
Full Changelog
Add an abuse ban-feed: when enabled via ban-file, ntfy tracks a weighted strike budget per visitor and appends abusive IPs to a file that fail2ban can tail and ban on sight (ban-file, ban-window, ban-threshold, ban-weights; see ban-feed)

Package Updates

[1.31.0]

Update ntfy to 2.27.0
Full Changelog
Limit message templates (Template: yes) to 32 KB, limit printf widths and precisions to below 1000, and limit indent/nindent to 100 spaces, preventing excessive memory use from a single small template
Exclude secrets from the config hash served to the web app, preventing a rather theoretical information leak
Allow logging in with your verified primary email address (in addition to your username), so a password reset no longer leaves you unable to sign in when you only remember the email you signed up with
Fix Twilio phone calls and phone number verifications failing silently when Twilio rejected the request, and move the Twilio integration into its own twilio package
Move the Prometheus metrics into a dedicated metrics package
Message cache databases from ntfy older than v1.10.0 (November 2021) can no longer be migrated; upgrade via an older ntfy version first, or delete the cache database
Fix user_phone table in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migration

Package Updates

[1.32.0]

Update ntfy to 2.28.0
Full Changelog
Fix messages being returned out of publish order when polling or replaying several topics at once (/topic1,topic2/json?poll=1, #1297)
Limit the message title to 1 KB and all tags combined to 512 bytes, rejecting larger requests with HTTP 400 (error codes 40057 and 40058). Neither field had a size limit before, unlike the message body; on ntfy.sh the 99.9th percentile is 212 bytes for titles and 244 for tags
Cap a single cache replay at 10 MB of messages per topic. A poll without a since cursor returns a topic's entire cache, which was previously unbounded and could reach tens of megabytes on a busy topic, so one request could allocate that much on the server. The newest messages that fit are kept and a truncated response carries an X-Messages-Truncated: 1 header
visitor-attachment-daily-bandwidth-limit now also covers messages replayed from the message cache by poll requests, not just attachment traffic. A poll without a since cursor returns a topic's entire cache, so a topic that is cheap to fill can be re-read for many times its own size; polls beyond the budget are rejected with HTTP 429 (error code 42905) before anything is written. Note that heavy pollers now consume the same budget as attachment downloads, so operators serving both may want to raise the limit

Cloudron Forum