This release lets you sign in with your verified email address instead of your username, which should help if you ever signed up with an email and then forgot which username you picked. It also hardens the message templating engine against a few ways a small template could eat a lot of memory, and it drops the "experimental" label from PostgreSQL support, which has been running ntfy.sh for a while now.
I also did a bunch of refactoring in, mostly in preparation for being able to cluster ntfy nodes and scale the service horizontally. It'll be a while until then, ... baby steps.
Security:
- Limit message templates (
Template: yes) to 32 KB, limitprintfwidths and precisions to below 1000, and limitindent/nindentto 100 spaces, preventing excessive memory use from a single small template - Exclude secrets from the config hash served to the web app, preventing a rather theoretical information leak
Features:
- Allow logging in with your verified primary email address (in addition to your username), so a password reset no longer leaves you unable to sign in when you only remember the email you signed up with
Bug fixes + maintenance:
- Fix Twilio phone calls and phone number verifications failing silently when Twilio rejected the request, and move the Twilio integration into its own
twiliopackage - Move the Prometheus metrics into a dedicated
metricspackage - Message cache databases from ntfy older than v1.10.0 (November 2021) can no longer be migrated; upgrade via an older ntfy version first, or delete the cache database
- Fix
user_phonetable in the SQLite user database referencing a dropped table after the v2.14 schema migration; repaired automatically by a new migration