Uptime Kuma 2.5.0 waits two weeks before trusting a new npm package
Uptime Kuma checks whether a website, a Docker container, a DNS record, or a Steam game server is still answering, and pushes a message to Telegram, Slack, or email when one stops.
The self-hosted monitoring tool is MIT licensed, runs in a container or on Node.js, and has 89,800 stars and 8,200 forks on GitHub. The change with the widest reach in version 2.5.0 is that the project now sets a 14-day cooldown on npm updates to minimize supply-chain attacks.
That cooldown is aimed at the window in which a hijacked package does its work. When an attacker publishes a malicious version of a dependency, the poisoned release usually gets pulled within days of discovery, so the projects that get hit hardest are the ones that grab the newest version the moment it exists.
Uptime Kuma sits inside networks and holds credentials for the 90-plus notification services it can reach, which makes its dependency tree worth attacking. Waiting two weeks means Uptime Kuma builds skip most of the packages that get yanked.
New monitor types
Uptime Kuma now has an NTP monitor so it watch a network time server directly. NTP is how machines agree on what time it is, and when a time source drifts or dies, certificate checks start failing and log timestamps stop lining up across hosts. Before this release, you could monitor the box running the time service but not the service itself.
A second change lifts the ceiling on check intervals, which previously topped out around 24 days. Anyone tracking something that only needs a look once a quarter, like a certificate or a domain expiry, no longer has to fake it with a shorter interval. The author also added a next-rootless Docker tag for people who do not want the monitoring process running as root in its container.
Fixes worth knowing about
The badge generator was producing broken URLs because of a doubled slash, so status badges embedded in READMEs and dashboards were failing. The MQTT monitor now accepts mqtts:// addresses, meaning a TLS-protected broker no longer needs a workaround. Steam game server monitors resolve hostnames instead of requiring an IP. The DNS monitor stops appending the resolver port to the service URL, and Discord notifications now render timestamps in the right timezone.
One database fix is quieter and worth reading twice: the up and down columns in the stat_daily table were widened from SMALLINT to an unsigned integer. A signed SMALLINT stops at 32,767, and monitors checking at short intervals across many hosts can push a daily counter past that. If your uptime history has gaps or nonsense values on busy days, this is a candidate explanation.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!