Update binwiederhier/ntfy Docker tag to v2.35.0 #74

Merged

mathieu merged 1 commit from renovate/binwiederhier-ntfy-2.x into main

2026-10-31 11:55:09 +00:00

Renovate_Bot commented

2026-10-30 23:00:39 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
binwiederhier/ntfy (source)	minor	`v2.34.0` → `v2.35.0`

Release Notes

binwiederhier/ntfy (binwiederhier/ntfy)

`v2.35.0`

Compare Source

This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite.

Security:

Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and invalid UTF-8 from the topic after authorization, so an anonymous push key like /sec%00ret was authorized against an unmatched topic and then stored under the protected topic secret (SQLite only; on PostgreSQL the request was denied; thanks to Efe Çam for reporting)

Features:

A tier change (an upgrade, a downgrade, or a tier edited in place) applies on the user's next request and keeps what was already spent; before, it refilled the request, email and attachment bandwidth limits (#2104, #2105)
A tier's daily email limit is a hard cap; before, the tier's email burst came on top of it, so a user could send more emails a day than the tier allows

Bug fixes + maintenance:

Fix intermittent 403s and panics in the account handlers under concurrent requests from the same IP: a login or logout could change the user under another request, so a request with valid credentials was treated as anonymous, or the other way around. Every request now gets its own visitor (#1051, #2113, #2118, thanks to @ivanetinajero for reporting)
A tier with a daily email limit of zero sends no emails; before, it could still send the server's email burst (visitor-email-limit-burst)
An attachment upload rejected at a size limit is no longer charged to the attachment bandwidth limit for the part that went over
Rate limits live in one shared limit service, keyed by ip:<prefix> or user:<id>, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path
Accept terabyte units (e.g. 1T) in size settings such as attachment and tier limits, matching how sizes are displayed (#2078, thanks to @cangen185-sudo for the contribution)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [binwiederhier/ntfy](https://ntfy.sh/) ([source](https://github.com/binwiederhier/ntfy)) | minor | `v2.34.0` → `v2.35.0` | --- ### Release Notes <details> <summary>binwiederhier/ntfy (binwiederhier/ntfy)</summary> ### [`v2.35.0`](https://github.com/binwiederhier/ntfy/releases/tag/v2.35.0) [Compare Source](https://github.com/binwiederhier/ntfy/compare/v2.34.0...v2.35.0) This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite. **Security:** - Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and invalid UTF-8 from the topic after authorization, so an anonymous push key like `/sec%00ret` was authorized against an unmatched topic and then stored under the protected topic `secret` (SQLite only; on PostgreSQL the request was denied; thanks to [Efe Çam](https://github.com/the-arma-of-owl) for reporting) **Features:** - A tier change (an upgrade, a downgrade, or a tier edited in place) applies on the user's next request and keeps what was already spent; before, it refilled the request, email and attachment bandwidth limits ([#2104](https://github.com/binwiederhier/ntfy/pull/2104), [#2105](https://github.com/binwiederhier/ntfy/pull/2105)) - A tier's daily email limit is a hard cap; before, the tier's email burst came on top of it, so a user could send more emails a day than the tier allows **Bug fixes + maintenance:** - Fix intermittent 403s and panics in the account handlers under concurrent requests from the same IP: a login or logout could change the user under another request, so a request with valid credentials was treated as anonymous, or the other way around. Every request now gets its own visitor ([#1051](https://github.com/binwiederhier/ntfy/issues/1051), [#2113](https://github.com/binwiederhier/ntfy/issues/2113), [#2118](https://github.com/binwiederhier/ntfy/pull/2118), thanks to [@ivanetinajero](https://github.com/ivanetinajero) for reporting) - A tier with a daily email limit of zero sends no emails; before, it could still send the server's email burst (`visitor-email-limit-burst`) - An attachment upload rejected at a size limit is no longer charged to the attachment bandwidth limit for the part that went over - Rate limits live in one shared limit service, keyed by `ip:<prefix>` or `user:<id>`, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path - Accept terabyte units (e.g. `1T`) in size settings such as attachment and tier limits, matching how sizes are displayed ([#2078](https://github.com/binwiederhier/ntfy/pull/2078), thanks to [@cangen185-sudo](https://github.com/cangen185-sudo) for the contribution) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Renovate_Bot added 1 commit

2026-10-30 23:00:39 +00:00

Update binwiederhier/ntfy Docker tag to v2.35.0 0b87b76cc9