This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes
a denial-of-service hole.
On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience,
and a fix that strips unsafe URL protocols from rendered Markdown.
Security:
Prevent a CPU denial of service via message templates (Template: yes), #1826, thanks to @alanturing881 for reporting)
Features:
Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account (#1647, thanks to @wsw70 for reporting)
Bug fixes + maintenance:
Web app: Smooth transitions and loading animation, remove flickering
Web app: GET /account now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option (#1727, thanks to @mberlofa)
Web app: Strip unsafe URL protocols (javascript:, data:, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to @jvoisin for reporting)
Configuration
📅Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕Ignore: Close this PR and you won't be reminded about these updates again.
If you want to rebase/retry this PR, check this box
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [binwiederhier/ntfy](https://ntfy.sh/) ([source](https://github.com/binwiederhier/ntfy)) | | minor | `v2.25.0` → `v2.26.0` |
| [binwiederhier/ntfy](https://ntfy.sh/) ([source](https://github.com/binwiederhier/ntfy)) | final | minor | `v2.25.0` → `v2.26.0` |
---
> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information.
---
### Release Notes
<details>
<summary>binwiederhier/ntfy (binwiederhier/ntfy)</summary>
### [`v2.26.0`](https://github.com/binwiederhier/ntfy/releases/tag/v2.26.0)
[Compare Source](https://github.com/binwiederhier/ntfy/compare/v2.25.0...v2.26.0)
This release hardens **message templates**, which are now executed with a hard-capped execution timeout. This closes
a denial-of-service hole.
On the web app side, it adds configurable **date and time formats**, a smoother loading and page-transition experience,
and a fix that strips unsafe URL protocols from rendered Markdown.
**Security:**
- Prevent a CPU denial of service via message templates (`Template: yes`), [#​1826](https://github.com/binwiederhier/ntfy/pull/1826), thanks to [@​alanturing881](https://github.com/alanturing881) for reporting)
**Features:**
- Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account ([#​1647](https://github.com/binwiederhier/ntfy/issues/1647), thanks to [@​wsw70](https://github.com/wsw70) for reporting)
**Bug fixes + maintenance:**
- Web app: Smooth transitions and loading animation, remove flickering
- Web app: `GET /account` now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
- Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option ([#​1727](https://github.com/binwiederhier/ntfy/issues/1727), thanks to [@​mberlofa](https://github.com/mberlofa))
- Web app: Strip unsafe URL protocols (`javascript:`, `data:`, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to [@​jvoisin](https://github.com/jvoisin) for reporting)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v2.25.0→v2.26.0v2.25.0→v2.26.0Release Notes
binwiederhier/ntfy (binwiederhier/ntfy)
v2.26.0Compare Source
This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes
a denial-of-service hole.
On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience,
and a fix that strips unsafe URL protocols from rendered Markdown.
Security:
Template: yes), #1826, thanks to @alanturing881 for reporting)Features:
Bug fixes + maintenance:
GET /accountnow reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behindjavascript:,data:, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to @jvoisin for reporting)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate.