N
v2.37.2
Changelog 0510957 Merge pull request #2169 from binwiederhier/release-2380
N
v2.37.1
This release fixes a database slowdown in v2.37.0 when using visitor-subscriber-rate-limiting with a user database: the subscriber activity of UnifiedPush topics was written far too often. Bug fixes + maintenance: With visitor-subscriber-rate-limiting and a user database, write a UnifiedPush topic's subscriber activity every one to two hours instead of every 5 minutes, spread over time, and not at…
N
v2.37.0
This release makes UnifiedPush work across several servers: the subscriber who pays for a topic's pushes is shared through the database, and app servers are told with 410 Gone when a subscription has been abandoned for 4 days. It also adds Retry-After and the draft RateLimit headers to rate limit responses, and frees the memory of one-off visitors sooner. Features: With visitor-subscriber-rate-lim…
N
v2.36.0
This release keeps the daily limits across restarts and, with PostgreSQL, shares them between servers, so a visitor gets one daily allowance in total. Each visitor's day now starts at its own time instead of midnight UTC. It also adds an experimental local admin socket. Features: Daily limits (messages, e-mails, phone calls) are stored in the user database, so they survive restarts; with PostgreSQ…
N
v2.35.0
This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite. Security: Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and inv…
N
v2.34.0
This release prepares the experimental cluster to run behind load balancers: nodes drain on shutdown instead of dropping all of their clients at once, ntfy can listen on several addresses, and access changes reach every node. It also fixes a revoked or deleted user keeping some of their subscriptions, on every server. Features: Allow several comma-separated addresses in listen-http, so a load bala…
N
v2.33.1
This release builds ntfy with Go 1.27.3 (security fixes, including rejecting the compromised eMudhra intermediate CAs), and adds monitoring for the experimental cluster: each node's view of its peers, per-peer and database connection pool metrics. The v2.33.0 release had an issue that made it crash on older CPU architectures. The v2.33.1 release fixes that (see #2092). Features: Show each cluster…
N
Prep v2.33.0 release: release notes, install docs
Move the unreleased server notes to v2.33.0 (released October 23, 2026) with a short intro, and bump install.md to 2.33.0.
N
v2.32.0
This release prepares ntfy.sh for a passive cluster node: jobs that write to the shared database run only on the cluster leader, and each database store now records the oldest schema version it works with. Streaming subscriptions also tell proxies not to buffer them. Features: Set the Incremental: ?1 header (RFC 10036) on streaming subscriptions, so proxies that support it forward messages without…
N
v2.31.1
This release fixes the database load that made us roll back ntfy.sh from v2.31.0: reconnecting with since=<message ID> read every message of the topic from the database. A new index makes these reconnects cheap, cheaper than in v2.30.0. It also lets ntfy start with a warning on a newer database schema, so later rollbacks need no manual step. Bug fixes + maintenance: Fix reconnects with since=<mess…
N
v2.31.0
This release fixes messages that could be lost when a client reconnects, e.g. a phone switching networks, right when messages are published: every server now reads newly written messages from its message cache once a second and sends them to the subscribers that missed them. In load tests with server restarts and crashes, this brought lost messages down from 465 to 2 out of about 615,000. It also…
N
v2.30.0
This release links attachments in email notifications, adds SMTP LOGIN auth (e.g. for OVH and Outlook), and fixes the PostgreSQL memory growth that came with v2.29.0. It also ships the first experimental version of clustering: several ntfy servers sharing one PostgreSQL database. Clustering is not ready for production yet. Features: Link attachments in email notifications, including the file name…
N
v2.29.0
This release fixes cache writes under load. On ntfy.sh, hourly cron bursts overwhelmed the batch writer: messages took up to 40s to reach the database (so poll=1 and since= missed them) and publishes stalled. Batches are now written in one statement, publishes no longer wait on the writer, and PostgreSQL connections stay idle instead of reconnecting. Features: Timezone support for delayed notifica…
N
v2.28.0
This is a hardening release. A single topic on ntfy.sh was polled continuously with poll=1 and no since cursor, which replays a topic's entire cache on every request. The changes below bound what one replay can cost, close two fields that had no size limit at all, and fix an ordering bug found while digging into it. Bug fixes + maintenance: Fix messages being returned out of publish order when pol…
N
v2.27.0
This release lets you sign in with your verified email address instead of your username, which should help if you ever signed up with an email and then forgot which username you picked. It also hardens the message templating engine against a few ways a small template could eat a lot of memory, and it drops the "experimental" label from PostgreSQL support, which has been running ntfy.sh for a while…
N
v2.26.3
This is a hotfix release, useful pretty much only for ntfy.sh. It was adds the ability to track abusive IPs mor efficiently, reducing the load on the IP banning services and preventing them from falling behind and leaving abusers unbanned for too long. It works by tracking HTTP errors, and writing out a ban file that fail2ban can read and ban offenders instantly. See ban-feed for details. Features…
N
v2.26.2
Redo the banning logic, ban.Service
N
v2.26.1
Hotfix: Add ban-file/ban-threshold/ban-weights as a more lightweight …
N
v2.26.0
This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes a denial-of-service hole. On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience, and a fix that strips unsafe URL protocols from rendered Markdown. Security: Prevent a CPU denial of service via message templates (Template: yes…
N
v2.25.0
This release adds password reset via email, and reworks email verification to use durable, link-based magic links (replacing the old in-memory 6-digit codes). Email stays optional at signup; a user can reset their password only once they have a verified "primary" (recovery)email. All of this work is probably not useful for self-hosters, but it hopefully will be useful for me, since I do have to re…
N
v2.24.0
The main feature for this release is an in-memory ACL cache (auth-access-cache) that can help bring down the read load on the production database. The topic authorization queries are consistently the highest ranking queries on the database, so this will help quite a bit. The current database load is quite low, but I'm expecting it to increase as more users join and use ntfy. Security issues: Fix c…
N
v2.23.0
Features: Add per-visitor rate limit on new topic creations (visitor-topic-creation-limit-burst / visitor-topic-creation-limit-replenish, defaults 100 burst / 1m replenish) to mitigate topic-enumeration / squatting attacks that inflate the in-memory topic map Bug fixes + maintenance: Remove stacktrace-js, stacktrace-gps, humanize-duration, and js-base64 from the web app to reduce dependency and se…
N
v2.22.0
Bug fixes + maintenance: Tighten web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching (GHSA-w9hq-5jg7-q4j7, thanks to @MightyNawaf for reporting) Fix web app not allowing access tokens to be changed to never expire (#1693/#1694, thanks to @lastsamurai26 for reporting and to @ShipItAndPray for fixing) Fix web app crashing on account page for tokens without a last acces…
N
v2.21.0
This release adds the ability to verify email addresses using the smtp-sender-verify flag. This is a change that is required because ntfy.sh was used to send unsolicited emails and the AWS SES account was suspended. Going forward, ntfy.sh won't be able to send emails unless the email address was verified ahead of time. Features: Add verified email recipients feature with smtp-sender-verify config…
N
v2.20.1
This is a small bugfix release that only affects high volume S3 backends that struggle with HTTP/2. Bug fixes + maintenance: Attachments: Add disable_http2=true S3 URL option to work around HTTP/2 stream errors with DigitalOcean Spaces and other S3-compatible providers (#1678/#1679)
N
v2.20.0
This release is another step towards making it possible to help scale ntfy up and out 🔥! With this release, you can store attachments in an S3-compatible object store as an alterative to the directory. See attachment store for details. ⚠️ Important note: With this release, ntfy will take full control over the attachment directory or S3 bucket. Files/objects in the configured attachment-cache-dir t…
N
v2.19.2
This is another small bugfix release for PostgreSQL, avoiding races between primary and read replica, as well as to further reduce primary load. Bug fixes + maintenance: Fix race condition in web push subscription causing FK constraint violation when concurrent requests hit the same endpoint Route authorization query to read-only database replica to reduce primary database load
N
v2.19.1
This is a bugfix release to avoid PostgreSQL insert failures due to invalid UTF-8 messages. It also fixes database-url validation incorrectly rejecting postgresql:// connection strings. Bug fixes + maintenance: Fix invalid UTF-8 in HTTP headers (e.g. Latin-1 encoded text) causing PostgreSQL insert failures and dropping entire message batches Fix database-url validation rejecting postgresql:// conn…
N
v2.19.0
This is a fast-follow release that enables Postgres read replica support. To offload read-heavy queries from the primary database, you can optionally configure one or more read replicas using the database-replica-urls option. When configured, non-critical read-only queries (e.g. fetching messages, checking access permissions, etc) are distributed across the replicas using round-robin, while all wr…