This is a hotfix release, useful pretty much only for ntfy.sh. It was adds the ability to track abusive IPs mor efficiently, reducing the load on the IP banning services and preventing them from falling behind and leaving abusers unbanned for too long. It works by tracking HTTP errors, and writing out a ban file that fail2ban can read and ban offenders instantly. See ban-feed for details. Features…
Redo the banning logic, ban.Service
Hotfix: Add ban-file/ban-threshold/ban-weights as a more lightweight …
This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes a denial-of-service hole. On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience, and a fix that strips unsafe URL protocols from rendered Markdown. Security: Prevent a CPU denial of service via message templates (Template: yes…
This release adds password reset via email, and reworks email verification to use durable, link-based magic links (replacing the old in-memory 6-digit codes). Email stays optional at signup; a user can reset their password only once they have a verified "primary" (recovery)email. All of this work is probably not useful for self-hosters, but it hopefully will be useful for me, since I do have to re…
The main feature for this release is an in-memory ACL cache (auth-access-cache) that can help bring down the read load on the production database. The topic authorization queries are consistently the highest ranking queries on the database, so this will help quite a bit. The current database load is quite low, but I'm expecting it to increase as more users join and use ntfy. Security issues: Fix c…
Features: Add per-visitor rate limit on new topic creations (visitor-topic-creation-limit-burst / visitor-topic-creation-limit-replenish, defaults 100 burst / 1m replenish) to mitigate topic-enumeration / squatting attacks that inflate the in-memory topic map Bug fixes + maintenance: Remove stacktrace-js, stacktrace-gps, humanize-duration, and js-base64 from the web app to reduce dependency and se…
Bug fixes + maintenance: Tighten web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching (GHSA-w9hq-5jg7-q4j7, thanks to @MightyNawaf for reporting) Fix web app not allowing access tokens to be changed to never expire (#1693/#1694, thanks to @lastsamurai26 for reporting and to @ShipItAndPray for fixing) Fix web app crashing on account page for tokens without a last acces…
This release adds the ability to verify email addresses using the smtp-sender-verify flag. This is a change that is required because ntfy.sh was used to send unsolicited emails and the AWS SES account was suspended. Going forward, ntfy.sh won't be able to send emails unless the email address was verified ahead of time. Features: Add verified email recipients feature with smtp-sender-verify config…
This is a small bugfix release that only affects high volume S3 backends that struggle with HTTP/2. Bug fixes + maintenance: Attachments: Add disable_http2=true S3 URL option to work around HTTP/2 stream errors with DigitalOcean Spaces and other S3-compatible providers (#1678/#1679)
This release is another step towards making it possible to help scale ntfy up and out 🔥! With this release, you can store attachments in an S3-compatible object store as an alterative to the directory. See attachment store for details. ⚠️ Important note: With this release, ntfy will take full control over the attachment directory or S3 bucket. Files/objects in the configured attachment-cache-dir t…
This is another small bugfix release for PostgreSQL, avoiding races between primary and read replica, as well as to further reduce primary load. Bug fixes + maintenance: Fix race condition in web push subscription causing FK constraint violation when concurrent requests hit the same endpoint Route authorization query to read-only database replica to reduce primary database load
This is a bugfix release to avoid PostgreSQL insert failures due to invalid UTF-8 messages. It also fixes database-url validation incorrectly rejecting postgresql:// connection strings. Bug fixes + maintenance: Fix invalid UTF-8 in HTTP headers (e.g. Latin-1 encoded text) causing PostgreSQL insert failures and dropping entire message batches Fix database-url validation rejecting postgresql:// conn…
This is a fast-follow release that enables Postgres read replica support. To offload read-heavy queries from the primary database, you can optionally configure one or more read replicas using the database-replica-urls option. When configured, non-critical read-only queries (e.g. fetching messages, checking access permissions, etc) are distributed across the replicas using round-robin, while all wr…