Update docker.io/binwiederhier/ntfy Docker tag to v2.26.0 #111

Merged

c6ristian merged 1 commit from renovate/all-stable-minor-patch into main

2026-07-09 21:35:04 +02:00

renovate commented

2026-07-09 21:00:58 +02:00

Member

This PR contains the following updates:

Package	Update	Change
docker.io/binwiederhier/ntfy (source)	minor	`v2.25.0` → `v2.26.0`

Release Notes

binwiederhier/ntfy (docker.io/binwiederhier/ntfy)

`v2.26.0`

Compare Source

This release hardens message templates, which are now executed with a hard-capped execution timeout. This closes
a denial-of-service hole.

On the web app side, it adds configurable date and time formats, a smoother loading and page-transition experience,
and a fix that strips unsafe URL protocols from rendered Markdown.

Security:

Prevent a CPU denial of service via message templates (Template: yes) (GHSA-rhwf-xgc9-m9fp, #1826, thanks to @alanturing881 for reporting)

Features:

Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account (#1647, thanks to @wsw70 for reporting)

Bug fixes + maintenance:

Web app: Smooth transitions and loading animation, remove flickering
Web app: GET /account now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option (#1727, thanks to @mberlofa)
Web app: Strip unsafe URL protocols (javascript:, data:, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to @jvoisin for reporting)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/binwiederhier/ntfy](https://ntfy.sh/) ([source](https://github.com/binwiederhier/ntfy)) | minor | `v2.25.0` → `v2.26.0` | --- ### Release Notes <details> <summary>binwiederhier/ntfy (docker.io/binwiederhier/ntfy)</summary> ### [`v2.26.0`](https://github.com/binwiederhier/ntfy/releases/tag/v2.26.0) [Compare Source](https://github.com/binwiederhier/ntfy/compare/v2.25.0...v2.26.0) This release hardens **message templates**, which are now executed with a hard-capped execution timeout. This closes a denial-of-service hole. On the web app side, it adds configurable **date and time formats**, a smoother loading and page-transition experience, and a fix that strips unsafe URL protocols from rendered Markdown. **Security:** - Prevent a CPU denial of service via message templates (`Template: yes`) ([GHSA-rhwf-xgc9-m9fp](https://github.com/binwiederhier/ntfy/security/advisories/GHSA-rhwf-xgc9-m9fp), [#1826](https://github.com/binwiederhier/ntfy/pull/1826), thanks to [@alanturing881](https://github.com/alanturing881) for reporting) **Features:** - Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account ([#1647](https://github.com/binwiederhier/ntfy/issues/1647), thanks to [@wsw70](https://github.com/wsw70) for reporting) **Bug fixes + maintenance:** - Web app: Smooth transitions and loading animation, remove flickering - Web app: `GET /account` now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind - Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option ([#1727](https://github.com/binwiederhier/ntfy/issues/1727), thanks to [@mberlofa](https://github.com/mberlofa)) - Web app: Strip unsafe URL protocols (`javascript:`, `data:`, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to [@jvoisin](https://github.com/jvoisin) for reporting) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

renovate

label

2026-07-09 21:00:58 +02:00

renovate added 1 commit

2026-07-09 21:00:59 +02:00

Update docker.io/binwiederhier/ntfy Docker tag to v2.26.0

/ build (pull_request) Successful in 30s

Details

/ Ansible Lint (pull_request) Successful in 3m28s

Details

/ cleanup-staging (pull_request) Successful in 3s