Version 2.5.0

• Add application icons to sidebar (#405 via #602) by @mateuscelio
• Add listen on unix sockets (#237 via #621) by @LaurenceJJones
• Log x-forwarded-for in request log (#554 via #624) by @LaurenceJJones
• Don't disable the refresh button when there are no messages (#636 via #637) by @iarp
• Show loading animation when loading messages (#658 via #660) by @MexHigh
• Update backend dependencies (#661)

Version 2.4.0

• Add "last used" time to clients and applications (#400 via #582 by @eternal-flame-AD)
• Update to go 1.21.1 & update dependencies

Version 2.3.0

• Add default priority for applications (#312 via #578 by @chrispruitt)

---

• (this is only relevant if you package gotify yourself, or are a package maintainer): Change static file embedding. Gotify now uses go:embed, so you'll need to remove the make embed-static or go run hack/packr/packr.go when building gotify/server. by @eternal-flame-AD

Version 2.2.5

• Add copy application/client secret button
• Suppress /health logging from 127.0.0.1 in logs
• Disallow specifying the client id when creating a new client
• Change time format in logs
• Add endpoint to delete an application image

Version 2.2.4

Fix swagger-ui style

Version 2.2.3

• Update swagger (Fix XSS in swagger-ui) -> GHSA-3244-8mff-w398
• Unify display of app icon

Version 2.2.2

This release is an addition to the previous release, it prevents the XSS if it was already exploited. The previous release prevented uploading new malicious files, and this release will prevent opening the malicious files if they already exist.

Version 2.2.1

Fix an XSS vulnerability in the application file upload. It allowed
authenticated users to upload .html files. With that, an attacker could
execute client side scripts if another user opened a link such as: (#534)

https://push.gotify.net/image/ViaxrjzNowdgL-xnEfVV-Ggv5.html

Version 2.2.0

• Add delete all messages confirmation dialog
• Add priority colors to messages
• Add linux/riscv64 support
• Add authorization bearer token auth method
• Fix redirect to https with default http port

Version 2.1.7

Re-release of version 2.1.6 with lower glibc requirements (>=2.28) for pre-built binaries.