Uptime Kuma, a self-hosted monitoring tool, checks if a website, Docker container, DNS record, or Steam game server is still responding and sends notifications to Telegram, Slack, or email when one stops. It has 89,800 stars and 8,200 forks on GitHub.
The tool is MIT licensed and runs in a container or on Node.js. Its latest version, 2.5.0, introduces a 14-day cooldown on npm updates to minimize supply-chain attacks.
Cooldown on npm Updates
This cooldown targets the window in which a hijacked package does its work. When an attacker publishes a malicious version of a dependency, it usually gets pulled within days of discovery.
Uptime Kuma’s dependency tree is worth attacking since it holds credentials for over 90 notification services. By waiting two weeks, Uptime Kuma builds skip most packages that get yanked.
New Features and Fixes
Uptime Kuma now has an NTP monitor to watch a network time server directly. NTP is how machines agree on what time it is, and when a time source drifts or dies, certificate checks start failing.
A second change lifts the ceiling on check intervals, which previously topped out around 24 days. This allows users to track things that only need a look once a quarter, like a certificate or domain expiry.
Related: Qodana update boosts Java code security
The author also added a next-rootless Docker tag for people who do not want the monitoring process running as root in its container.
Other fixes include resolving issues with the badge generator, MQTT monitor, and Steam game server monitors. The DNS monitor now stops appending the resolver port to the service URL, and Discord notifications render timestamps in the right timezone.
A database fix widened the up and down columns in the stat_daily table from SMALLINT to an unsigned integer. This prevents daily counters from pushing past 32,767 and causing gaps or nonsense values in uptime history.
Comparison to Similar Tools
Uptime Kuma’s approach to minimizing supply-chain attacks is similar to other tools in the industry.
Uptime Kuma’s latest version, 2.5.0, is a significant update that addresses several issues and adds new features. With its MIT license and large community of users, Uptime Kuma continues to be a popular choice for monitoring and notification needs.
