Uptime Kuma, the self-hosted monitoring tool, has introduced a new supply-chain security measure in its 2.5.0 release by implementing a 14-day delay for integrating new npm package updates. This cooldown period is designed to mitigate the risk of supply-chain attacks, specifically targeting the window during which a malicious dependency might be published and subsequently discovered and removed.
The project, which is MIT licensed and boasts a significant presence on GitHub with 89,800 stars and 8,200 forks, runs in a container or on Node.js. Given its common deployment within networks and its role in holding credentials for over 90 notification services, Uptime Kuma's dependency tree presents an attractive target for attackers. By waiting two weeks, Uptime Kuma builds are expected to bypass most compromised packages that are typically identified and pulled within days of their release.
Beyond security enhancements, version 2.5.0 introduces several new monitoring capabilities. An NTP monitor has been added, allowing direct observation of network time servers. This is crucial for identifying time drifts or failures that can lead to issues with certificate validation and log synchronization across systems. Previously, users could only monitor the host running the time service, not the service itself.
The update also removes the previous ceiling on check intervals, which was approximately 24 days. This change enables users to set much longer monitoring periods, accommodating checks for items like certificate or domain expirations that only require quarterly attention without needing workarounds. Additionally, a `next-rootless` Docker tag has been introduced for users who prefer the monitoring process not to run as root within its container.
Several fixes are also part of the 2.5.0 release. The badge generator, which was creating broken URLs due to a doubled slash, has been corrected, resolving issues with status badges embedded in READMEs and dashboards. The MQTT monitor now supports `mqtts://` addresses, eliminating the need for workarounds when connecting to TLS-protected brokers. Steam game server monitors can now resolve hostnames, removing the requirement for direct IP addresses. The DNS monitor no longer appends the resolver port to the service URL, and Discord notifications now render timestamps in the correct timezone.
A notable database fix addresses potential data integrity issues. The `up` and `down` columns in the `stat_daily` table have been widened from `SMALLINT` to an unsigned integer. A signed `SMALLINT` has a maximum value of 32,767, which could be exceeded by monitors checking at short intervals across numerous hosts, leading to gaps or nonsensical values in uptime history on busy days. This change prevents such overflows.
