ntfy releases - releaseport

Review required

v2.23.0 Security relevant 17d

Dependencies Auth

Safe image preview restriction

Open

v2.22.0 Security relevant 1mo

Security fixes

SSRF vulnerability in web push endpoint allow-list regex (GHSA-w9hq-5jg7-q4j7)

Notable features

Access tokens can now be set to never expire in web app
Fixed web app crash on account page for tokens without last access time

Full changelog

Bug fixes + maintenance:

Tighten web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching (GHSA-w9hq-5jg7-q4j7, thanks to @MightyNawaf for reporting)
Fix web app not allowing access tokens to be changed to never expire (#1693/#1694, thanks to @lastsamurai26 for reporting and to @ShipItAndPray for fixing)
Fix web app crashing on account page for tokens without a last access time (#1651, #1684, thanks to @Pulsar7 and @rzhli for reporting)

View release on GitHub

v2.21.0 New feature 2mo

Notable features

Email address verification support

View release on GitHub

v2.20.1 Bug fix 2mo

Added disable_http2=true S3 URL option to work around HTTP/2 stream errors with S3-compatible providers.

View release on GitHub

v2.20.0 New feature 2mo

Breaking changes

Attachment directory behavior changed: files matching message ID format with no database entries will be deleted

Notable features

S3-compatible object storage for attachments
OpenRC init service

View release on GitHub

v2.19.2 Bugfix 2mo

Fixed race condition in web push subscriptions causing constraint violations. Routed authorization queries to read-only replicas to reduce primary database load.

View release on GitHub

v2.19.1 Bug fix 2mo

Fixed invalid UTF-8 character handling in HTTP headers causing PostgreSQL insert failures. Fixed database-url validation rejecting postgresql:// connection strings.

View release on GitHub

v2.19.0 New feature 2mo

Notable features