Uptime Kuma 2.5.0 Npm Package Trust Delay 2 Weeks

Post Views: 15

Uptime Kuma 2.5.0 introduces a 14-day delay for new npm package integration to mitigate supply-chain risks.

Uptime Kuma 2.5.0 Introduces 14-Day Delay for New npm Package Integration to Mitigate Supply-Chain Risks

Uptime Kuma is a self-hosted monitoring solution that tracks the availability of websites, Docker containers, DNS records, and Steam game servers, sending alerts via Telegram, Slack, or other channels when services become unresponsive. The open-source tool, distributed under the MIT license, operates in containerized environments or via Node.js and maintains a significant presence on GitHub with 89,800 stars and 8,200 forks. The latest release, version 2.5.0, introduces a critical change to its dependency management process to address evolving security threats.

14-Day Waiting Period for npm Package Updates

A key update in this version is the implementation of a 14-day waiting period before accepting new npm package updates. This measure is designed to reduce the risk of supply-chain attacks by creating a buffer during which maliciously altered dependencies can be identified and removed. Attackers often exploit the initial window after a compromised package is published, as projects that immediately adopt the latest versions are more vulnerable. By delaying integration, Uptime Kuma minimizes exposure to such threats, particularly given its role in managing credentials for over 90 notification services.

New Monitor Capabilities

The 2.5.0 release expands the tool’s monitoring capabilities with two significant additions. First, an NTP (Network Time Protocol) monitor allows direct oversight of network time servers. This feature addresses the cascading issues caused by time synchronization failures, such as certificate validation errors and misaligned log timestamps across systems. Previously, users could only monitor the host machine running the time service, not the service itself. Second, the update removes the previous 24-day limit on check intervals, enabling longer monitoring cycles. This change benefits scenarios requiring infrequent checks, such as tracking certificate expiration dates or domain renewal deadlines. A new Docker tag, “next-rootless,” also simplifies deployment for users who prefer to avoid running the monitoring process with root privileges.

Technical Fixes and Improvements

Several bug fixes and enhancements improve reliability and functionality. The badge generator, which previously produced invalid URLs due to double slashes, now generates correct links for status badges embedded in README files and dashboards. The MQTT monitor now supports mqtts:// connections, allowing secure TLS-protected brokers to be accessed without workarounds. Steam game server monitoring has been updated to resolve hostnames instead of relying on IP addresses, while the DNS monitor no longer appends resolver ports to service URLs. Discord notifications now display timestamps in the correct timezone. A critical database update expands the “up” and “down” columns in the “stat_daily” table from SMALLINT to unsigned integers, preventing overflow issues that could cause data inaccuracies on high-traffic systems. The release also includes minor adjustments, such as improved hostname resolution for Steam servers and enhanced compatibility with TLS-secured MQTT brokers.

Conclusion

These updates collectively strengthen Uptime Kuma’s reliability and security posture, ensuring it remains a robust solution for network and service monitoring.