Starstruk Logo MarkStarstruk

1.23.3

louislam/uptime-kuma1.23.3Oct 9, 2023by louislam

AI Summary

This is a security-focused patch release that fixes a persistent session tokens vulnerability allowing unauthorized access if tokens were leaked. The update logs out all existing sessions and includes several bug fixes for notifications, status pages, Kafka monitors, and HTTP header handling.

Key Highlights

  • Security fix for persistent session tokens - all sessions will be logged out after update
  • Fixed notification issue when config is too long (#3763)
  • Status page certificate expiry badge now enabled for all HTTP(s) monitors
  • Fixed Kafka producer bugs (#3771)
  • Fixed x-forwarded-host header not being used correctly (#3726)

Breaking Changes

  • All login sessions will be logged out due to security fix
  • Unofficial/3rd party tools may need to re-generate auth tokens

New Features

  • Status page certificate expiry badge now available for all HTTP(s) monitors (previously limited)

Full Release Notes

> [!WARNING]
> Due to the security fix, all login sessions will be logged out, after updated to this version.

> [!IMPORTANT]
> If you are using some unofficial/3rd party tools, it could be a breaking change. You may need to re-generate an auth token.

### 🐛 Bug Fixes
- #3763 Fixed an issue that notification is not working if the config is too long (Thanks @FJBlok)
- #3649 Enable status page certificate expiry badge for all HTTP(s) monitors (Thanks @marvinruder)
- #3771 Fixed kafka producer bugs (Thanks @mhkarimi1383)
- #3726 Fixed an issue that  `x-forwarded-host` is not being used correctly (Thanks @xuexb)
- #3849 Fixed a race condition issue that some data is not being saved in the status page editor if you clicked it too fast (Thanks @chakflying)

### ⬆️ Security Fixes
- Fixed persistent session tokens issue. There was no way to revoke session tokens even if you changed the password. 
   - Now you can revoke them by changing your password if you think they may be leaked (Read more: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g).

Please let me know if your username is missing, if your pull request has been merged in this version, or your commit has been included in one of the pull requests.