Uptime Kuma, one of the more popular self-hosted uptime monitors in the homelab world, just shipped version 2.5.0. The release is signed and published on the project’s official GitHub page, and it’s a bigger jump than the version number suggests: a new monitor type, no more ceiling on check intervals, and a change to how the project pulls in its own dependencies that’s aimed squarely at supply-chain risk. The tool is still MIT licensed, still runs from a single Docker container or straight from Node.js, and still watches websites, TCP ports, DNS records, Docker containers, even Steam game servers, firing off an alert the moment one stops answering. Nearly 90,000 stars and over 8,000 forks on GitHub later, it’s become something close to the default pick for homelabbers who want a status page they actually control.
A new monitor type: NTP
Uptime Kuma 2.5.0 adds a dedicated NTP (Network Time Protocol) monitor, so you can watch a time server directly instead of just the machine it happens to run on. That’s a real gap closed. When a time source drifts or drops off, TLS certificate checks start failing and log timestamps across your hosts quietly stop lining up, and neither problem tends to announce itself until something else breaks because of it. Before this release, the closest you could get was monitoring the host running the NTP service, not the protocol.
No more 24-day ceiling on check intervals
Check intervals used to top out around 24 days. That limit is gone in 2.5.0. If you only need to check something once a quarter, a certificate expiry date, a domain renewal, whatever, you no longer have to fake a shorter interval just to stay inside the old cap.
New notification channels
The notification list grows again this release: Plivo (SMS and voice calls), Ooredoo (SMS, for Maldives numbers), WxPusher SPT, and Flowtriq for DDoS detection, plus rybbit analytics on public status pages and a few extra SMTP headers for email alerts. Uptime Kuma already had somewhere around 90 integrations before this, so there’s a decent chance your preferred alerting channel was covered already.
The security change: a 14-day cooldown on npm updates
The change with the widest reach in 2.5.0 never touches the interface at all. Uptime Kuma now waits 14 days before adopting a new npm package version, something the project’s own changelog files under Security Fixes rather than features. The reasoning holds up: when someone slips a malicious version of a dependency onto npm, it usually gets caught and pulled within days, so the software that suffers most is whatever grabbed the update the moment it landed. Uptime Kuma runs inside home and small-business networks and holds credentials for dozens of notification services, which makes its dependency tree worth attacking. A two-week delay means most builds simply never touch the packages that get yanked. Help Net Security called this the standout item in the release, ahead of even the NTP monitor and the interval change.
Also in this release
Version 2.5.0 adds a PM2 or platform selector for system-service installs and a next-rootless Docker tag, for anyone who would rather the container not run as root. There is also a run of bug fixes: a badge-generator URL that was breaking because of a doubled slash, MQTT monitors that now accept mqtts:// addresses, Steam game server monitors that resolve hostnames instead of demanding a raw IP, a DNS monitor that stopped tacking the resolver port onto the service URL, and Discord notifications that finally show timestamps in the right timezone. One database fix is easy to miss but worth knowing about: the up and down counter columns in the stat_daily table went from a signed SMALLINT, which caps out at 32,767, to an unsigned integer. Busy setups checking a lot of hosts at short intervals could push a daily counter past that old cap, which the project flags as a possible explanation if your uptime history has ever shown gaps or odd values on busy days.
Should you update?
For anyone already running Uptime Kuma, 2.5.0 is about as low-risk as updates get: a new monitor type, new notification providers, a higher interval ceiling, and a stack of bug fixes, with nothing in the release notes flagged as breaking. If you have not set up a self-hosted uptime monitor yet, our Uptime Kuma guide walks through the Docker install, HTTP/TCP/ping monitoring, and public status pages from a blank slate. And if you are trying to figure out where Uptime Kuma fits next to metrics-heavy tools, our self-hosted monitoring comparison puts it side by side with Netdata and Prometheus/Grafana.
Sources: the Uptime Kuma 2.5.0 release notes on GitHub, and Help Net Security’s coverage of the npm cooldown change.