Is it safe to update Uptime Kuma?
Tracking louislam/uptime-kuma
Safe to update.
The 2.4.0 release notes list only additive new features (new notification providers, RSS incidents), optional improvements (bearer token support, gamedig token field), and bug fixes — none of which require migration or manual upgrade steps. Notably, the release patches a Remote Code Execution vulnerability in the LiquidJS dependency (GHSA-gf2q-c269-pqgc), making the update actively advisable for security. No breaking changes, deprecations, or required configuration changes are called out.
What changed
Uptime Kuma 2.4.0 adds two new notification providers — EgoSMS (for Uganda-based SMS) and VKTeams bot — and now includes incidents in RSS feeds. Monitor configuration gains bearer token support across HTTP and WebSocket upgrade monitors, plus an optional token field for GameDig monitors. A critical security fix patches a Remote Code Execution vulnerability in the LiquidJS dependency used by notification templates. The release also resolves a long-standing bug where NTLM monitors over plain HTTP would fail with a 400 Bad Request error.
Source
Every verdict on Bumplog traces back to a GitHub release. No invented details.
