Is it safe to update ntfy?
Tracking binwiederhier/ntfy
Safe to update.
The release notes call out no breaking changes, required migrations, or manual upgrade steps. The security fix (template DoS timeout) and XSS-class URL-stripping fix are strictly defensive hardening — both reduce risk without altering user-visible behavior in a breaking way. All other changes are opt-in features or polish.
What changed
v2.26.0 patches a CPU denial-of-service vulnerability in message template execution by introducing a hard-capped timeout, making this a security-relevant release for anyone using the `Template: yes` feature. The web app gains configurable date and time formats (ISO 8601, DMY, MDY, 12/24-hour clock) that default to the system locale and sync across devices when signed in. A web rendering bug that allowed unsafe URL protocols like `javascript:` and `data:` in Markdown messages has been fixed, closing a potential XSS vector. Additional polish includes smoother page transitions, and the account view now reads from the primary database to avoid showing stale data after changes.
Source
Every verdict on Bumplog traces back to a GitHub release. No invented details.
