Merge pull request #1551 from mshafer1/dev/update_link_to_ntfysh-windows

Update link to ntfysh-windows client

README.md

@@ -1,3 +1,16 @@
+<div align="center" markdown="1">
+<sup>Special thanks to:</sup>
+<br>
+<br>
+<a href="https://go.warp.dev/ntfy">
+  <img alt="Warp sponsorship" width="400" src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-02.png">
+</a>
+
+### [Warp, built for coding with multiple AI agents.](https://go.warp.dev/ntfy)
+[Available for MacOS, Linux, & Windows](https://go.warp.dev/ntfy)<br>
+</div>
+<hr>
+
 ![ntfy](web/public/static/images/ntfy.png)
 
 # ntfy.sh | Send push notifications to your phone or desktop via PUT/POST
@@ -67,6 +80,8 @@ Thank you to our commercial sponsors, who help keep the service running and the
 
 <a href="https://www.magicbell.com/?utm_source=ntfy"><img src="assets/sponsors/magicbell.png" width="180px"></a>
 
+<a href="https://go.warp.dev/ntfy"><img src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Logos/Warp-Wordmark-Black.png" width="160px"></a>
+
 And a big fat **Thank You** to the individuals who have sponsored ntfy in the past, or are still sponsoring ntfy:
 
 <a href="https://github.com/neutralinsomniac"><img src="https://github.com/neutralinsomniac.png" width="40px" /></a>

SECURITY.md

@@ -6,5 +6,7 @@ As of today, I only support the latest version of ntfy. Please make sure you sta
 
 ## Reporting a Vulnerability
 
-Please report severe security issues privately via ntfy@heckel.io, [Discord](https://discord.gg/cT7ECsZj9w),
-or [Matrix](https://matrix.to/#/#ntfy:matrix.org) (my username is `binwiederhier`).
+Please report security vulnerabilities privately via email to [security@mail.ntfy.sh](mailto:security@mail.ntfy.sh).
+
+You can also reach me on [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org) 
+(my username is `binwiederhier`).

client/client.yml

@@ -21,7 +21,7 @@
 # default-command:
 
 # Subscriptions to topics and their actions. This option is primarily used by the systemd service,
-# or if you cann "ntfy subscribe --from-config" directly.
+# or if you can "ntfy subscribe --from-config" directly.
 #
 # Example:
 #     subscribe:

client/options.go

@@ -88,6 +88,11 @@ func WithFilename(filename string) PublishOption {
 	return WithHeader("X-Filename", filename)
 }
 
+// WithSequenceID sets a sequence ID for the message, allowing updates to existing notifications
+func WithSequenceID(sequenceID string) PublishOption {
+	return WithHeader("X-Sequence-ID", sequenceID)
+}
+
 // WithEmail instructs the server to also send the message to the given e-mail address
 func WithEmail(email string) PublishOption {
 	return WithHeader("X-Email", email)

cmd/publish.go

@@ -34,6 +34,7 @@ var flagsPublish = append(
 	&cli.BoolFlag{Name: "markdown", Aliases: []string{"md"}, EnvVars: []string{"NTFY_MARKDOWN"}, Usage: "Message is formatted as Markdown"},
 	&cli.StringFlag{Name: "template", Aliases: []string{"tpl"}, EnvVars: []string{"NTFY_TEMPLATE"}, Usage: "use templates to transform JSON message body"},
 	&cli.StringFlag{Name: "filename", Aliases: []string{"name", "n"}, EnvVars: []string{"NTFY_FILENAME"}, Usage: "filename for the attachment"},
+	&cli.StringFlag{Name: "sequence-id", Aliases: []string{"sequence_id", "sid", "S"}, EnvVars: []string{"NTFY_SEQUENCE_ID"}, Usage: "sequence ID for updating notifications"},
 	&cli.StringFlag{Name: "file", Aliases: []string{"f"}, EnvVars: []string{"NTFY_FILE"}, Usage: "file to upload as an attachment"},
 	&cli.StringFlag{Name: "email", Aliases: []string{"mail", "e"}, EnvVars: []string{"NTFY_EMAIL"}, Usage: "also send to e-mail address"},
 	&cli.StringFlag{Name: "user", Aliases: []string{"u"}, EnvVars: []string{"NTFY_USER"}, Usage: "username[:password] used to auth against the server"},
@@ -70,6 +71,7 @@ Examples:
   ntfy pub --icon="http://some.tld/icon.png" 'Icon!'      # Send notification with custom icon
   ntfy pub --attach="http://some.tld/file.zip" files      # Send ZIP archive from URL as attachment
   ntfy pub --file=flower.jpg flowers 'Nice!'              # Send image.jpg as attachment
+  ntfy pub -S my-id mytopic 'Update me'                   # Send with sequence ID for updates
   echo 'message' | ntfy publish mytopic                   # Send message from stdin
   ntfy pub -u phil:mypass secret Psst                     # Publish with username/password
   ntfy pub --wait-pid 1234 mytopic                        # Wait for process 1234 to exit before publishing
@@ -101,6 +103,7 @@ func execPublish(c *cli.Context) error {
 	markdown := c.Bool("markdown")
 	template := c.String("template")
 	filename := c.String("filename")
+	sequenceID := c.String("sequence-id")
 	file := c.String("file")
 	email := c.String("email")
 	user := c.String("user")
@@ -154,6 +157,9 @@ func execPublish(c *cli.Context) error {
 	if filename != "" {
 		options = append(options, client.WithFilename(filename))
 	}
+	if sequenceID != "" {
+		options = append(options, client.WithSequenceID(sequenceID))
+	}
 	if email != "" {
 		options = append(options, client.WithEmail(email))
 	}

cmd/publish_unix.go

@@ -1,5 +1,4 @@
 //go:build darwin || linux || dragonfly || freebsd || netbsd || openbsd
-// +build darwin linux dragonfly freebsd netbsd openbsd
 
 package cmd
 

cmd/serve.go

@@ -14,6 +14,7 @@ import (
 	"os/signal"
 	"strings"
 	"syscall"
+	"text/template"
 	"time"
 
 	"github.com/urfave/cli/v2"
@@ -63,6 +64,7 @@ var flagsServe = append(
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-signup", Aliases: []string{"enable_signup"}, EnvVars: []string{"NTFY_ENABLE_SIGNUP"}, Value: false, Usage: "allows users to sign up via the web app, or API"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-login", Aliases: []string{"enable_login"}, EnvVars: []string{"NTFY_ENABLE_LOGIN"}, Value: false, Usage: "allows users to log in via the web app, or API"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "enable-reservations", Aliases: []string{"enable_reservations"}, EnvVars: []string{"NTFY_ENABLE_RESERVATIONS"}, Value: false, Usage: "allows users to reserve topics (if their tier allows it)"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "require-login", Aliases: []string{"require_login"}, EnvVars: []string{"NTFY_REQUIRE_LOGIN"}, Value: false, Usage: "all actions via the web app requires a login"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-base-url", Aliases: []string{"upstream_base_url"}, EnvVars: []string{"NTFY_UPSTREAM_BASE_URL"}, Value: "", Usage: "forward poll request to an upstream server, this is needed for iOS push notifications for self-hosted servers"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "upstream-access-token", Aliases: []string{"upstream_access_token"}, EnvVars: []string{"NTFY_UPSTREAM_ACCESS_TOKEN"}, Value: "", Usage: "access token to use for the upstream server; needed only if upstream rate limits are exceeded or upstream server requires auth"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-addr", Aliases: []string{"smtp_sender_addr"}, EnvVars: []string{"NTFY_SMTP_SENDER_ADDR"}, Usage: "SMTP server address (host:port) for outgoing emails"}),
@@ -76,6 +78,7 @@ var flagsServe = append(
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-auth-token", Aliases: []string{"twilio_auth_token"}, EnvVars: []string{"NTFY_TWILIO_AUTH_TOKEN"}, Usage: "Twilio auth token"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-phone-number", Aliases: []string{"twilio_phone_number"}, EnvVars: []string{"NTFY_TWILIO_PHONE_NUMBER"}, Usage: "Twilio number to use for outgoing calls"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-verify-service", Aliases: []string{"twilio_verify_service"}, EnvVars: []string{"NTFY_TWILIO_VERIFY_SERVICE"}, Usage: "Twilio Verify service ID, used for phone number verification"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "twilio-call-format", Aliases: []string{"twilio_call_format"}, EnvVars: []string{"NTFY_TWILIO_CALL_FORMAT"}, Usage: "Twilio/TwiML format string for phone calls"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-size-limit", Aliases: []string{"message_size_limit"}, EnvVars: []string{"NTFY_MESSAGE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultMessageSizeLimit), Usage: "size limit for the message (see docs for limitations)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "message-delay-limit", Aliases: []string{"message_delay_limit"}, EnvVars: []string{"NTFY_MESSAGE_DELAY_LIMIT"}, Value: util.FormatDuration(server.DefaultMessageDelayMax), Usage: "max duration a message can be scheduled into the future"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "global-topic-limit", Aliases: []string{"global_topic_limit", "T"}, EnvVars: []string{"NTFY_GLOBAL_TOPIC_LIMIT"}, Value: server.DefaultTotalTopicLimit, Usage: "total number of topics allowed"}),
@@ -171,6 +174,7 @@ func execServe(c *cli.Context) error {
 	webRoot := c.String("web-root")
 	enableSignup := c.Bool("enable-signup")
 	enableLogin := c.Bool("enable-login")
+	requireLogin := c.Bool("require-login")
 	enableReservations := c.Bool("enable-reservations")
 	upstreamBaseURL := c.String("upstream-base-url")
 	upstreamAccessToken := c.String("upstream-access-token")
@@ -185,6 +189,7 @@ func execServe(c *cli.Context) error {
 	twilioAuthToken := c.String("twilio-auth-token")
 	twilioPhoneNumber := c.String("twilio-phone-number")
 	twilioVerifyService := c.String("twilio-verify-service")
+	twilioCallFormat := c.String("twilio-call-format")
 	messageSizeLimitStr := c.String("message-size-limit")
 	messageDelayLimitStr := c.String("message-delay-limit")
 	totalTopicLimit := c.Int("global-topic-limit")
@@ -318,10 +323,12 @@ func execServe(c *cli.Context) error {
 		return errors.New("if upstream-base-url is set, base-url must also be set")
 	} else if upstreamBaseURL != "" && baseURL != "" && baseURL == upstreamBaseURL {
 		return errors.New("base-url and upstream-base-url cannot be identical, you'll likely want to set upstream-base-url to https://ntfy.sh, see https://ntfy.sh/docs/config/#ios-instant-notifications")
-	} else if authFile == "" && (enableSignup || enableLogin || enableReservations || stripeSecretKey != "") {
-		return errors.New("cannot set enable-signup, enable-login, enable-reserve-topics, or stripe-secret-key if auth-file is not set")
+	} else if authFile == "" && (enableSignup || enableLogin || requireLogin || enableReservations || stripeSecretKey != "") {
+		return errors.New("cannot set enable-signup, enable-login, require-login, enable-reserve-topics, or stripe-secret-key if auth-file is not set")
 	} else if enableSignup && !enableLogin {
 		return errors.New("cannot set enable-signup without also setting enable-login")
+	} else if requireLogin && !enableLogin {
+		return errors.New("cannot set require-login without also setting enable-login")
 	} else if !payments.Available && (stripeSecretKey != "" || stripeWebhookKey != "") {
 		return errors.New("cannot set stripe-secret-key or stripe-webhook-key, support for payments is not available in this build (nopayments)")
 	} else if stripeSecretKey != "" && (stripeWebhookKey == "" || baseURL == "") {
@@ -452,6 +459,13 @@ func execServe(c *cli.Context) error {
 	conf.TwilioAuthToken = twilioAuthToken
 	conf.TwilioPhoneNumber = twilioPhoneNumber
 	conf.TwilioVerifyService = twilioVerifyService
+	if twilioCallFormat != "" {
+		tmpl, err := template.New("twiml").Parse(twilioCallFormat)
+		if err != nil {
+			return fmt.Errorf("failed to parse twilio-call-format template: %w", err)
+		}
+		conf.TwilioCallFormat = tmpl
+	}
 	conf.MessageSizeLimit = int(messageSizeLimit)
 	conf.MessageDelayMax = messageDelayLimit
 	conf.TotalTopicLimit = totalTopicLimit
@@ -475,6 +489,7 @@ func execServe(c *cli.Context) error {
 	conf.BillingContact = billingContact
 	conf.EnableSignup = enableSignup
 	conf.EnableLogin = enableLogin
+	conf.RequireLogin = requireLogin
 	conf.EnableReservations = enableReservations
 	conf.EnableMetrics = enableMetrics
 	conf.MetricsListenHTTP = metricsListenHTTP
@@ -555,8 +570,8 @@ func parseUsers(usersRaw []string) ([]*user.User, error) {
 		role := user.Role(strings.TrimSpace(parts[2]))
 		if !user.AllowedUsername(username) {
 			return nil, fmt.Errorf("invalid auth-users: %s, username invalid", userLine)
-		} else if err := user.ValidPasswordHash(passwordHash); err != nil {
-			return nil, fmt.Errorf("invalid auth-users: %s, %s", userLine, err.Error())
+		} else if err := user.ValidPasswordHash(passwordHash, user.DefaultUserPasswordBcryptCost); err != nil {
+			return nil, fmt.Errorf("invalid auth-users: %s, password hash invalid, %s", userLine, err.Error())
 		} else if !user.AllowedRole(role) {
 			return nil, fmt.Errorf("invalid auth-users: %s, role %s is not allowed, allowed roles are 'admin' or 'user'", userLine, role)
 		}

cmd/serve_test.go

@@ -26,11 +26,11 @@ func TestParseUsers_Success(t *testing.T) {
 	}{
 		{
 			name:  "single user",
-			input: []string{"alice:$2a$10$abcdefghijklmnopqrstuvwxyz:user"},
+			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
 			expected: []*user.User{
 				{
 					Name:        "alice",
-					Hash:        "$2a$10$abcdefghijklmnopqrstuvwxyz",
+					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
 					Role:        user.RoleUser,
 					Provisioned: true,
 				},
@@ -39,19 +39,19 @@ func TestParseUsers_Success(t *testing.T) {
 		{
 			name: "multiple users with different roles",
 			input: []string{
-				"alice:$2a$10$abcdefghijklmnopqrstuvwxyz:user",
-				"bob:$2b$10$abcdefghijklmnopqrstuvwxyz:admin",
+				"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user",
+				"bob:$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq:admin",
 			},
 			expected: []*user.User{
 				{
 					Name:        "alice",
-					Hash:        "$2a$10$abcdefghijklmnopqrstuvwxyz",
+					Hash:        "$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S",
 					Role:        user.RoleUser,
 					Provisioned: true,
 				},
 				{
 					Name:        "bob",
-					Hash:        "$2b$10$abcdefghijklmnopqrstuvwxyz",
+					Hash:        "$2a$10$jIcuBWcbxd6oW1aPvoJ5iOShzu3/UJ2kSxKbTZtDypG06nBflQagq",
 					Role:        user.RoleAdmin,
 					Provisioned: true,
 				},
@@ -64,11 +64,11 @@ func TestParseUsers_Success(t *testing.T) {
 		},
 		{
 			name:  "user with special characters in name",
-			input: []string{"alice.test+123@example.com:$2y$10$abcdefghijklmnopqrstuvwxyz:user"},
+			input: []string{"alice.test+123@example.com:$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe:user"},
 			expected: []*user.User{
 				{
 					Name:        "alice.test+123@example.com",
-					Hash:        "$2y$10$abcdefghijklmnopqrstuvwxyz",
+					Hash:        "$2a$10$RYUYAsl5zOnAIp6fH7BPX.Eug0rUfEUk92r8WiVusb0VK.vGojWBe",
 					Role:        user.RoleUser,
 					Provisioned: true,
 				},
@@ -110,23 +110,23 @@ func TestParseUsers_Errors(t *testing.T) {
 		},
 		{
 			name:  "invalid username",
-			input: []string{"alice@#$%:$2a$10$abcdefghijklmnopqrstuvwxyz:user"},
-			error: "invalid auth-users: alice@#$%:$2a$10$abcdefghijklmnopqrstuvwxyz:user, username invalid",
+			input: []string{"alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
+			error: "invalid auth-users: alice@#$%:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
 		},
 		{
 			name:  "invalid password hash - wrong prefix",
 			input: []string{"alice:plaintext:user"},
-			error: "invalid auth-users: alice:plaintext:user, password hash but be a bcrypt hash, use 'ntfy user hash' to generate",
+			error: "invalid auth-users: alice:plaintext:user, password hash invalid, password hash must be a bcrypt hash, use 'ntfy user hash' to generate",
 		},
 		{
 			name:  "invalid role",
-			input: []string{"alice:$2a$10$abcdefghijklmnopqrstuvwxyz:invalid"},
-			error: "invalid auth-users: alice:$2a$10$abcdefghijklmnopqrstuvwxyz:invalid, role invalid is not allowed, allowed roles are 'admin' or 'user'",
+			input: []string{"alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid"},
+			error: "invalid auth-users: alice:$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:invalid, role invalid is not allowed, allowed roles are 'admin' or 'user'",
 		},
 		{
 			name:  "empty username",
-			input: []string{":$2a$10$abcdefghijklmnopqrstuvwxyz:user"},
-			error: "invalid auth-users: :$2a$10$abcdefghijklmnopqrstuvwxyz:user, username invalid",
+			input: []string{":$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user"},
+			error: "invalid auth-users: :$2a$10$320YlQeaMghYZsvtu9jzfOQZS32FysWY/T9qu5NWqcIh.DN.u5P5S:user, username invalid",
 		},
 	}
 

docs/config.md

@@ -88,7 +88,7 @@ using Docker Compose (i.e. `docker-compose.yml`):
 	      NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
 	      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
 	      NTFY_AUTH_DEFAULT_ACCESS: deny-all
-	      NTFY_AUTH_USERS: 'phil:$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C:admin'
+	      NTFY_AUTH_USERS: 'phil:$$2a$$10$$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C:admin' # Must escape '$' as '$$'
 	      NTFY_BEHIND_PROXY: true
 	      NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
 	      NTFY_ENABLE_LOGIN: true
@@ -1013,7 +1013,7 @@ or the root domain:
 === "caddy"
     ```
     # Note that this config is most certainly incomplete. Please help out and let me know what's missing
-    # via Discord/Matrix or in a GitHub issue.
+    # via the contact page (https://ntfy.sh/docs/contact/) or in a GitHub issue.
     # Note: Caddy automatically handles both HTTP and WebSockets with reverse_proxy 
 
     ntfy.sh, http://nfty.sh {
@@ -1029,6 +1029,36 @@ or the root domain:
         redir @httpget https://{host}{uri}
     }
     ```
+	
+=== "ferron"
+    ``` kdl
+    // /etc/ferron.kdl	
+    // Note that this config is most certainly incomplete. Please help out and let me know what's missing
+    // via the contact page (https://ntfy.sh/docs/contact/) or in a GitHub issue.
+    // Note: Ferron automatically handles both HTTP and WebSockets with proxy 
+
+    ntfy.sh {
+        auto_tls
+        auto_tls_letsencrypt_production
+        protocols "h1" "h2" "h3"
+
+        proxy "http://127.0.0.1:2586"
+
+        // Redirect HTTP to HTTPS, but only for GET topic addresses, since we want
+        // it to work with curl without the annoying https:// prefix
+
+        no_redirect_to_https #true
+
+        condition "is_get_topic" {
+            is_equal "{method}" "GET"
+            is_regex "{path}" "^/([-_a-z0-9]{0,64}$|docs/|static/)"
+        }
+
+        if "is_get_topic" {
+              no_redirect_to_https #false
+        }
+    }
+    ```
 
 ## Firebase (FCM)
 !!! info
@@ -1231,10 +1261,85 @@ are the easiest), and then configure the following options:
 * `twilio-auth-token` is the Twilio auth token, e.g. affebeef258625862586258625862586
 * `twilio-phone-number` is the outgoing phone number you purchased, e.g. +18775132586 
 * `twilio-verify-service` is the Twilio Verify service SID, e.g. VA12345beefbeef67890beefbeef122586
+* `twilio-call-format` is the custom Twilio markup ([TwiML](https://www.twilio.com/docs/voice/twiml)) to use for phone calls (optional)
 
 After you have configured phone calls, create a [tier](#tiers) with a call limit (e.g. `ntfy tier create --call-limit=10 ...`),
 and then assign it to a user. Users may then use the `X-Call` header to receive a phone call when publishing a message.
 
+To customize the message that is spoken out loud, set the `twilio-call-format` option with [TwiML](https://www.twilio.com/docs/voice/twiml). The format is
+rendered as a [Go template](https://pkg.go.dev/text/template), so you can use the following fields from the message:
+
+* `{{.Topic}}` is the topic name
+* `{{.Message}}` is the message body
+* `{{.Title}}` is the message title
+* `{{.Tags}}` is a list of tags
+* `{{.Priority}}` is the message priority
+* `{{.Sender}}` is the IP address or username of the sender
+
+Here's an example:
+
+=== "Custom TwiML (English)"
+    ``` yaml
+    twilio-account: "AC12345beefbeef67890beefbeef122586"
+    twilio-auth-token: "affebeef258625862586258625862586"
+    twilio-phone-number: "+18775132586"
+    twilio-verify-service: "VA12345beefbeef67890beefbeef122586"
+    twilio-call-format: |
+      <Response>
+        <Pause length="1"/>
+        <Say loop="3">
+          Yo yo yo, you should totally check out this message for {{.Topic}}.
+          {{ if eq .Priority 5 }}
+            It's really really important, dude. So listen up!
+          {{ end }}
+          <break time="1s"/>
+          {{ if neq .Title "" }}
+            Bro, it's titled: {{.Title}}.
+          {{ end }}
+          <break time="1s"/>
+          {{.Message}}
+          <break time="1s"/>
+          That is all.
+          <break time="1s"/>
+          You know who this message is from? It is from {{.Sender}}.
+          <break time="3s"/>
+        </Say>
+        <Say>See ya!</Say>
+      </Response>
+    ```
+
+=== "Custom TwiML (German)"
+    ``` yaml
+    twilio-account: "AC12345beefbeef67890beefbeef122586"
+    twilio-auth-token: "affebeef258625862586258625862586"
+    twilio-phone-number: "+18775132586"
+    twilio-verify-service: "VA12345beefbeef67890beefbeef122586"
+    twilio-call-format: |
+      <Response>
+        <Pause length="1"/>
+        <Say loop="3" voice="alice" language="de-DE">
+          Du hast eine Nachricht zum Thema {{.Topic}}.
+          {{ if eq .Priority 5 }}
+            Achtung. Die Nachricht ist sehr wichtig.
+          {{ end }}
+          <break time="1s"/>
+          {{ if neq .Title "" }}
+            Titel der Nachricht: {{.Title}}.
+          {{ end }}
+          <break time="1s"/>
+          Nachricht:
+          <break time="1s"/>
+          {{.Message}}
+          <break time="1s"/>
+          Ende der Nachricht.
+          <break time="1s"/>
+          Diese Nachricht wurde vom Benutzer {{.Sender}} gesendet. Sie wird drei Mal wiederholt.
+          <break time="3s"/>
+        </Say>
+        <Say voice="alice" language="de-DE">Alla mol!</Say>
+      </Response>
+    ```
+
 ## Message limits
 There are a few message limits that you can configure:
 
@@ -1531,7 +1636,7 @@ See [Installation for Docker](install.md#docker) for an example of how this coul
 If configured, ntfy can expose a `/metrics` endpoint for [Prometheus](https://prometheus.io/), which can then be used to
 create dashboards and alerts (e.g. via [Grafana](https://grafana.com/)).
 
-To configure the metrics endpoint, either set `enable-metrics` and/or set the `listen-metrics-http` option to a dedicated
+To configure the metrics endpoint, either set `enable-metrics` and/or set the `metrics-listen-http` option to a dedicated
 listen address. Metrics may be considered sensitive information, so before you enable them, be sure you know what you are
 doing, and/or secure access to the endpoint in your reverse proxy.
 
@@ -1698,6 +1803,7 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`).
 | `enable-signup`                            | `NTFY_ENABLE_SIGNUP`                            | *boolean* (`true` or `false`)                       | `false`           | Allows users to sign up via the web app, or API                                                                                                                                                                                 |
 | `enable-login`                             | `NTFY_ENABLE_LOGIN`                             | *boolean* (`true` or `false`)                       | `false`           | Allows users to log in via the web app, or API                                                                                                                                                                                  |
 | `enable-reservations`                      | `NTFY_ENABLE_RESERVATIONS`                      | *boolean* (`true` or `false`)                       | `false`           | Allows users to reserve topics (if their tier allows it)                                                                                                                                                                        |
+| `require-login`                            | `NTFY_REQUIRE_LOGIN`                            | *boolean* (`true` or `false`)                       | `false`           | All actions via the web app require a login                                                                                                                                                                        |
 | `stripe-secret-key`                        | `NTFY_STRIPE_SECRET_KEY`                        | *string*                                            | -                 | Payments: Key used for the Stripe API communication, this enables payments                                                                                                                                                      |
 | `stripe-webhook-key`                       | `NTFY_STRIPE_WEBHOOK_KEY`                       | *string*                                            | -                 | Payments: Key required to validate the authenticity of incoming webhooks from Stripe                                                                                                                                            |
 | `billing-contact`                          | `NTFY_BILLING_CONTACT`                          | *email address* or *website*                        | -                 | Payments: Email or website displayed in Upgrade dialog as a billing contact                                                                                                                                                     |

docs/contact.md

@@ -0,0 +1,46 @@
+# Contact
+
+This service is run by [Philipp C. Heckel](https://heckel.io). There are several ways to get in touch with me and the 
+ntfy community. Please choose the appropriate channel based on your needs.
+
+## Support
+
+### Community support
+
+For general questions, feature discussions, and community help, please use one of these public channels:
+
+| Channel           | Link                                                                                 | Description                                                |
+|-------------------|--------------------------------------------------------------------------------------|------------------------------------------------------------|
+| **Discord**       | [discord.gg/cT7ECsZj9w](https://discord.gg/cT7ECsZj9w)                               | Real-time chat with the community (I'm `binwiederhier`)    |
+| **Matrix**        | [#ntfy:matrix.org](https://matrix.to/#/#ntfy:matrix.org)                             | Bridged from Discord, same community (I'm `binwiederhier`) |
+| **Matrix Space**  | [#ntfy-space:matrix.org](https://matrix.to/#/#ntfy-space:matrix.org)                 | Matrix space with all ntfy rooms                           |
+| **GitHub Issues** | [github.com/binwiederhier/ntfy/issues](https://github.com/binwiederhier/ntfy/issues) | Bug reports and feature requests                           |
+
+!!! info "Why public channels?"
+    Answering questions in public channels benefits the entire community. Other users can learn from the 
+    discussion, and answers can be referenced later. This is much more scalable than 1-on-1 support.
+
+### Paid support
+
+If you are subscribed to a [ntfy Pro](https://ntfy.sh/#pricing) plan, you are entitled to priority support 
+via the following channels:
+
+| Channel               | Contact                                             | Description                              |
+|-----------------------|-----------------------------------------------------|------------------------------------------|
+| **General Support**   | [support@mail.ntfy.sh](mailto:support@mail.ntfy.sh) | Direct email support for Pro subscribers |
+| **Billing Inquiries** | [billing@mail.ntfy.sh](mailto:support@mail.ntfy.sh) | Inquire about billing issues             |
+| **Discord/Matrix**    | Mention your Pro status                             | Priority responses in community channels |
+
+Please include your ntfy.sh username when contacting support so we can verify your subscription status.
+
+## Security issues
+
+If you discover a security vulnerability, please report it responsibly via [security@mail.ntfy.sh](mailto:security@mail.ntfy.sh). See also: [SECURITY.md](https://github.com/binwiederhier/ntfy/blob/main/SECURITY.md).
+
+## Other inquiries
+
+For questions about our [privacy policy](privacy.md), data handling, or to exercise your data rights 
+(access, deletion, etc.), please email [privacy@mail.ntfy.sh](mailto:privacy@mail.ntfy.sh).
+
+For business inquiries, partnerships, press, or other general questions that don't fit the categories above, please
+use [contact@mail.ntfy.sh](mailto:contact@mail.ntfy.sh).

docs/contributing.md

@@ -0,0 +1,43 @@
+# Contributing
+
+Thank you for your interest in contributing to ntfy! There are many ways to help, whether you're a developer,
+translator, or just an enthusiastic user.
+
+## Code contributions
+
+If you'd like to contribute code to ntfy:
+
+1. Check out the [development guide](develop.md) to set up your environment
+2. Look at [open issues](https://github.com/binwiederhier/ntfy/issues) for ideas, or propose your own
+3. For larger features or architectural changes, please reach out on [Discord/Matrix](contact.md) first to discuss 
+   before investing significant time
+4. Submit a pull request on GitHub
+
+All contributions are welcome, from small bug fixes to major features.
+
+## Translations
+
+Help make ntfy accessible to users around the world! We use Hosted Weblate for translations:
+
+- **Weblate**: [hosted.weblate.org/projects/ntfy](https://hosted.weblate.org/projects/ntfy/)
+
+You can start translating immediately without any coding knowledge.
+
+## Documentation
+
+Found a typo? Want to improve the docs? Documentation contributions are very welcome:
+
+- Edit any page directly on GitHub using the edit button
+- Submit a pull request with your improvements
+
+## Bug reports and feature requests
+
+- **GitHub Issues**: [github.com/binwiederhier/ntfy/issues](https://github.com/binwiederhier/ntfy/issues)
+
+Please search existing issues before creating a new one to avoid duplicates.
+
+## Code of Conduct
+
+Please be respectful and constructive in all interactions. See the 
+[Code of Conduct](https://github.com/binwiederhier/ntfy/blob/main/CODE_OF_CONDUCT.md) for details.
+

docs/develop.md

@@ -2,7 +2,7 @@
 Hurray 🥳 🎉, you are interested in writing code for ntfy! **That's awesome.** 😎
 
 I tried my very best to write up detailed instructions, but if at any point in time you run into issues, don't 
-hesitate to **contact me on [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org)**.
+hesitate to reach out via one of the channels listed on the [contact page](contact.md).
 
 ## ntfy server
 The ntfy server source code is available [on GitHub](https://github.com/binwiederhier/ntfy). The codebase for the
@@ -441,6 +441,6 @@ To have instant notifications/better notification delivery when using firebase,
 1. In XCode, find the NTFY app target. **Not** the NSE app target.
 1. Find the Asset/ folder in the project navigator
 1. Drag the `GoogleService-Info.plist` file into the Asset/ folder that you get from the firebase console. It can be 
-   found in the "Project settings" > "General" > "Your apps"  with a button labled "GoogleService-Info.plist"
+   found in the "Project settings" > "General" > "Your apps"  with a button labeled "GoogleService-Info.plist"
 
 After that, you should be all set!

docs/faq.md

@@ -94,11 +94,11 @@ I would be humbled if you helped me carry the server and developer account costs
 appreciated.
 
 ## Can I email you? Can I DM you on Discord/Matrix?
-While I love chatting on [Discord](https://discord.gg/cT7ECsZj9w), [Matrix](https://matrix.to/#/#ntfy-space:matrix.org), 
-[Lemmy](https://discuss.ntfy.sh/c/ntfy), or [GitHub](https://github.com/binwiederhier/ntfy/issues), I generally 
-**do not respond to emails about ntfy or direct messages** about ntfy, unless you are paying for a 
-[ntfy Pro](https://ntfy.sh/#pricing) plan, or you are inquiring about business opportunities. 
+For community support, please use the public channels listed on the [contact page](contact.md). I generally 
+**do not respond to direct messages** about ntfy, unless you are paying for a [ntfy Pro](https://ntfy.sh/#pricing) 
+plan (see [paid support](contact.md#paid-support)), or you are inquiring about business 
+opportunities (see [other inquiries](contact.md#other-inquiries)).
 
 I am sorry, but answering individual questions about ntfy on a 1-on-1 basis is not scalable. Answering your questions 
-in the above-mentioned forums benefits others, since I can link to the discussion at a later point in time, or other users
+in public forums benefits others, since I can link to the discussion at a later point in time, or other users
 may be able to help out. I hope you understand.

docs/install.md

@@ -30,50 +30,56 @@ deb/rpm packages.
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_amd64.tar.gz
-    tar zxvf ntfy_2.14.0_linux_amd64.tar.gz
-    sudo cp -a ntfy_2.14.0_linux_amd64/ntfy /usr/local/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.14.0_linux_amd64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_amd64.tar.gz
+    tar zxvf ntfy_2.15.0_linux_amd64.tar.gz
+    sudo cp -a ntfy_2.15.0_linux_amd64/ntfy /usr/local/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.15.0_linux_amd64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv6.tar.gz
-    tar zxvf ntfy_2.14.0_linux_armv6.tar.gz
-    sudo cp -a ntfy_2.14.0_linux_armv6/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.14.0_linux_armv6/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv6.tar.gz
+    tar zxvf ntfy_2.15.0_linux_armv6.tar.gz
+    sudo cp -a ntfy_2.15.0_linux_armv6/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.15.0_linux_armv6/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv7.tar.gz
-    tar zxvf ntfy_2.14.0_linux_armv7.tar.gz
-    sudo cp -a ntfy_2.14.0_linux_armv7/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.14.0_linux_armv7/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv7.tar.gz
+    tar zxvf ntfy_2.15.0_linux_armv7.tar.gz
+    sudo cp -a ntfy_2.15.0_linux_armv7/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.15.0_linux_armv7/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_arm64.tar.gz
-    tar zxvf ntfy_2.14.0_linux_arm64.tar.gz
-    sudo cp -a ntfy_2.14.0_linux_arm64/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.14.0_linux_arm64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_arm64.tar.gz
+    tar zxvf ntfy_2.15.0_linux_arm64.tar.gz
+    sudo cp -a ntfy_2.15.0_linux_arm64/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.15.0_linux_arm64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 ## Debian/Ubuntu repository
-Installation via Debian repository:
+
+!!! info
+    As of September 2025, **the official ntfy.sh Debian/Ubuntu repository has moved to [archive.ntfy.sh](https://archive.ntfy.sh/apt)**.
+    The old repository [archive.heckel.io](https://archive.heckel.io/apt) is still available for now, but will likely
+    go away soon. I suspect I will phase it out some time in early 2026.
+
+Installation via Debian/Ubuntu repository (fingerprint `55BA 774A 6F5E E674 31E4  6B7C CFDB 962D 4F1E C4AF`):
 
 === "x86_64/amd64"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
+    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
     sudo apt install apt-transport-https
-    sudo sh -c "echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
-        > /etc/apt/sources.list.d/archive.heckel.io.list"  
+    echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
+        | sudo tee /etc/apt/sources.list.d/ntfy.list
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -83,10 +89,10 @@ Installation via Debian repository:
 === "armv7/armhf"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
+    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
     sudo apt install apt-transport-https
-    sudo sh -c "echo 'deb [arch=armhf signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
-        > /etc/apt/sources.list.d/archive.heckel.io.list"
+    echo "deb [arch=armhf signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
+        | sudo tee /etc/apt/sources.list.d/ntfy.list
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -96,10 +102,10 @@ Installation via Debian repository:
 === "arm64"
     ```bash
     sudo mkdir -p /etc/apt/keyrings
-    curl -fsSL https://archive.heckel.io/apt/pubkey.txt | sudo gpg --dearmor -o /etc/apt/keyrings/archive.heckel.io.gpg
+    sudo curl -L -o /etc/apt/keyrings/ntfy.gpg https://archive.ntfy.sh/apt/keyring.gpg
     sudo apt install apt-transport-https
-    sudo sh -c "echo 'deb [arch=arm64 signed-by=/etc/apt/keyrings/archive.heckel.io.gpg] https://archive.heckel.io/apt debian main' \
-        > /etc/apt/sources.list.d/archive.heckel.io.list"
+    echo "deb [arch=arm64 signed-by=/etc/apt/keyrings/ntfy.gpg] https://archive.ntfy.sh/apt stable main" \
+        | sudo tee /etc/apt/sources.list.d/ntfy.list
     sudo apt update
     sudo apt install ntfy
     sudo systemctl enable ntfy
@@ -110,7 +116,7 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_amd64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_amd64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -118,7 +124,7 @@ Manually installing the .deb file:
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv6.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv6.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -126,7 +132,7 @@ Manually installing the .deb file:
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv7.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv7.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -134,7 +140,7 @@ Manually installing the .deb file:
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_arm64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_arm64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -144,28 +150,28 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_amd64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_amd64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "armv6"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv6.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv6.rpm
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_armv7.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_armv7.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "arm64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_linux_arm64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_linux_arm64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
@@ -195,18 +201,18 @@ NixOS also supports [declarative setup of the ntfy server](https://search.nixos.
 
 ## macOS
 The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on macOS as well. 
-To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_darwin_all.tar.gz), 
+To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_darwin_all.tar.gz), 
 extract it and place it somewhere in your `PATH` (e.g. `/usr/local/bin/ntfy`). 
 
 If run as `root`, ntfy will look for its config at `/etc/ntfy/client.yml`. For all other users, it'll look for it at 
 `~/Library/Application Support/ntfy/client.yml` (sample included in the tarball).
 
 ```bash
-curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_darwin_all.tar.gz > ntfy_2.14.0_darwin_all.tar.gz
-tar zxvf ntfy_2.14.0_darwin_all.tar.gz
-sudo cp -a ntfy_2.14.0_darwin_all/ntfy /usr/local/bin/ntfy
+curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_darwin_all.tar.gz > ntfy_2.15.0_darwin_all.tar.gz
+tar zxvf ntfy_2.15.0_darwin_all.tar.gz
+sudo cp -a ntfy_2.15.0_darwin_all/ntfy /usr/local/bin/ntfy
 mkdir ~/Library/Application\ Support/ntfy 
-cp ntfy_2.14.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
+cp ntfy_2.15.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
 ntfy --help
 ```
 
@@ -221,10 +227,9 @@ simply run:
 brew install ntfy
 ```
 
-
 ## Windows
 The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on Windows as well.
-To install, please [download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.14.0/ntfy_2.14.0_windows_amd64.zip),
+To install, please [download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.15.0/ntfy_2.15.0_windows_amd64.zip),
 extract it and place the `ntfy.exe` binary somewhere in your `%Path%`. 
 
 The default path for the client config file is at `%AppData%\ntfy\client.yml` (not created automatically, sample in the ZIP file).
@@ -301,6 +306,7 @@ services:
         retries: 3
         start_period: 40s
     restart: unless-stopped
+    init: true # needed, if healthcheck is used. Prevents zombie processes
 ```
 
 If using a non-root user when running the docker version, be sure to chown the server.yml, user.db, and cache.db files and attachments directory to the same uid/gid.
@@ -319,7 +325,6 @@ The setup for Kubernetes is very similar to that for Docker, and requires a fair
 are a few options to mix and match, including a deployment without a cache file, a stateful set with a persistent cache, and a standalone
 unmanned pod.
 
-
 === "deployment"
     ```yaml
     apiVersion: apps/v1

docs/integrations.md

@@ -42,6 +42,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Monibot](https://monibot.io/) - Monibot monitors your websites, servers and applications and notifies you if something goes wrong.
 - [Miniflux](https://miniflux.app/docs/ntfy.html) - Minimalist and opinionated feed reader
 - [Beszel](https://beszel.dev/guide/notifications/ntfy) - Server monitoring platform
+- [Simple Observability](https://simpleobservability.com/docs/alerts/ntfy) - Server monitoring and observability platform
 
 ## Integration via HTTP/SMTP/etc.
 
@@ -89,7 +90,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy-desktop](https://github.com/Aetherinox/ntfy-desktop) - Desktop client for Windows, Linux, and MacOS with push notifications
 - [ntfy svelte front-end](https://github.com/novatorem/Ntfy) - Front-end built with svelte
 - [wio-ntfy-ticker](https://github.com/nachotp/wio-ntfy-ticker) - Ticker display for a ntfy.sh topic
-- [ntfysh-windows](https://github.com/lucas-bortoli/ntfysh-windows) - A ntfy client for Windows Desktop
+- [ntfysh-windows](https://github.com/mshafer1/ntfysh-windows) - A ntfy client for Windows Desktop
 - [ntfyr](https://github.com/haxwithaxe/ntfyr) - A simple commandline tool to send notifications to ntfy
 - [ntfy.py](https://github.com/ioqy/ntfy-client-python) - ntfy.py is a simple nfty.sh client for sending notifications
 - [wlzntfy](https://github.com/Walzen-Group/ntfy-toaster) - A minimalistic, receive-only toast notification client for Windows 11
@@ -175,7 +176,12 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy-me-mcp](https://github.com/gitmotion/ntfy-me-mcp) - An ntfy MCP server for sending/fetching ntfy notifications to your self-hosted ntfy server from AI Agents (supports secure token auth & more - use with npx or docker!) (Node/Typescript)
 - [InvaderInformant](https://github.com/patricksthannon/InvaderInformant) - Script for Mac OS systems that monitors new or dropped connections to your network using ntfy (Shell)
 - [NtfyPwsh](https://github.com/ptmorris1/NtfyPwsh) - PowerShell module to help send messages to ntfy (PowerShell)
-- [ntfyrr](https://github.com/leukosaima/ntfyrr) - Currently an Overseerr webhook notification to ntfy helper service.
+- [ntfyrr](https://github.com/leukosaima/ntfyrr) - Overseerr and Maintainerr webhook notification to ntfy helper service (C#)
+- [ntfy for Sandstorm](https://apps.sandstorm.io/app/c6rk81r4qk6dm3k04x1kxmyccqewhh4npuxeyg1xrpfypn2ddy0h) - ntfy app for the Sandstorm platform
+- [ntfy-heartbeat-monitor](https://codeberg.org/RockWolf/ntfy-heartbeat-monitor) - Application for implementing heartbeat monitoring/alerting by utilizing ntfy
+- [ntfy-bridge](https://github.com/AlexGaudon/ntfy-bridge) - An application to bridge Discord messages (or webhooks) to ntfy.
+- [ntailfy](https://github.com/leukosaima/ntailfy) - ntfy notifications when Tailscale devices connect/disconnect (Go)
+- [BRun](https://github.com/cbrake/brun) - Native Linux automation platform connecting triggers to actions without containers (Go)
 
 ## Blog + forum posts
 

docs/privacy.md

@@ -1,12 +1,194 @@
 # Privacy policy
 
-I love free software, and I'm doing this because it's fun. I have no bad intentions, and **I will
-never monetize or sell your information, and this service and software will always stay free and open.**
+**Last updated:** January 2, 2026
 
-Neither the server nor the app record any personal information, or share any of the messages and topics with
-any outside service. All data is exclusively used to make the service function properly. The only external service
-I use is Firebase Cloud Messaging (FCM) service, which is required to provide instant Android notifications (see
-[FAQ](faq.md) for details). To avoid FCM altogether, download the F-Droid version.
+This privacy policy describes how ntfy ("we", "us", or "our") collects, uses, and handles your information
+when you use the ntfy.sh service, web app, and mobile applications (Android and iOS).
 
-For debugging purposes, the ntfy server may temporarily log request paths, remote IP addresses or even topics 
-or messages, though typically this is turned off.
+## Our commitment to privacy
+
+We love free software, and we're doing this because it's fun. We have no bad intentions, and **we will
+never monetize or sell your information**. The ntfy service and software will always stay free and open source.
+If you don't trust us or your messages are sensitive, you can [self-host your own ntfy server](install.md).
+
+## Information we collect
+
+### Account information (optional)
+
+If you create an account on ntfy.sh, we collect:
+
+- **Username** - A unique identifier you choose
+- **Password** - Stored as a secure bcrypt hash (we never store your plaintext password)
+- **Email address** - Only if you subscribe to a paid plan (for billing purposes)
+- **Phone number** - Only if you enable the phone call notification feature (verified via SMS/call)
+
+You can use ntfy without creating an account. Anonymous usage is fully supported.
+
+### Messages and notifications
+
+- **Message content** - Messages you publish are temporarily cached on our servers (default: 12 hours) to support 
+  message polling and to overcome client network disruptions. Messages are deleted after the cache duration expires.
+- **Attachments** - File attachments are temporarily stored (default: 3 hours) and then automatically deleted.
+- **Topic names** - The topic names you publish to or subscribe to are processed by our servers.
+
+### Technical information
+
+- **IP addresses** - Used for rate limiting to prevent abuse. May be temporarily logged for debugging purposes,
+  though this is typically turned off.
+- **Access tokens** - If you create access tokens, we store the token value, an optional label, last access time, 
+  and the IP address of the last access.
+- **Web push subscriptions** - If you enable browser notifications, we store your browser's push subscription 
+  endpoint to deliver notifications.
+
+### Billing information (paid plans only)
+
+If you subscribe to a paid plan, payment processing is handled by Stripe. We store:
+
+- Stripe customer ID
+- Subscription status and billing period
+
+We do not store your credit card numbers or payment details directly. These are handled entirely by Stripe.
+
+## Third-party services
+
+To provide the ntfy.sh service, we use the following third-party services:
+
+### Firebase Cloud Messaging (FCM)
+
+We use Google's Firebase Cloud Messaging to deliver push notifications to Android and iOS devices. When you 
+receive a notification through the mobile apps (Google Play or App Store versions):
+
+- Message metadata and content may be transmitted through Google's FCM infrastructure
+- Google's [privacy policy](https://policies.google.com/privacy) applies to their handling of this data
+
+**To avoid FCM entirely:** Download the [F-Droid version](https://f-droid.org/en/packages/io.heckel.ntfy/) of 
+the Android app and use a self-hosted server, or use the instant delivery feature with your own server.
+
+### Twilio (phone calls)
+
+If you use the phone call notification feature (`X-Call` header), we use Twilio to:
+
+- Make voice calls to your verified phone number
+- Send SMS or voice calls for phone number verification
+
+Your phone number is shared with Twilio to deliver these services. Twilio's 
+[privacy policy](https://www.twilio.com/legal/privacy) applies.
+
+### Amazon SES (email delivery)
+
+If you use the email notification feature (`X-Email` header), we use Amazon Simple Email Service (SES) to 
+deliver emails. The recipient email address and message content are transmitted through Amazon's infrastructure. 
+Amazon's [privacy policy](https://aws.amazon.com/privacy/) applies.
+
+### Stripe (payments)
+
+If you subscribe to a paid plan, payments are processed by Stripe. Your payment information is handled directly 
+by Stripe and is subject to Stripe's [privacy policy](https://stripe.com/privacy).
+
+Note: We have explicitly disabled Stripe's telemetry features in our integration.
+
+### Web push providers
+
+If you enable browser notifications in the ntfy web app, push messages are delivered through your browser 
+vendor's push service:
+
+- Google (Chrome)
+- Mozilla (Firefox)
+- Apple (Safari)
+- Microsoft (Edge)
+
+Your browser's push subscription endpoint is shared with these providers to deliver notifications.
+
+## Mobile applications
+
+### Android app
+
+The Android app is available from two sources:
+
+- **Google Play Store** - Uses Firebase Cloud Messaging for push notifications. Firebase Analytics is 
+  **explicitly disabled** in our app.
+- **F-Droid** - Does not include any Google services or Firebase. Uses a foreground service to maintain 
+  a direct connection to the server.
+
+The Android app stores the following data locally on your device:
+
+- Subscribed topics and their settings
+- Cached notifications
+- User credentials (if you add a server with authentication)
+- Application logs (for debugging, stored locally only)
+
+### iOS app
+
+The iOS app uses Firebase Cloud Messaging (via Apple Push Notification service) to deliver notifications. 
+The app stores the following data locally on your device:
+
+- Subscribed topics
+- Cached notifications
+- User credentials (if configured)
+
+## Web application
+
+The ntfy web app is a static website that stores all data locally in your browser:
+
+- **IndexedDB** - Stores your subscriptions and cached notifications
+- **Local Storage** - Stores your preferences and session information
+
+No cookies are used for tracking. The web app does not have a backend beyond the ntfy API.
+
+## Data retention
+
+| Data type              | Retention period                                  |
+|------------------------|---------------------------------------------------|
+| Messages               | 12 hours (configurable by server operators)       |
+| Attachments            | 3 hours (configurable by server operators)        |
+| User accounts          | Until you delete your account                     |
+| Access tokens          | Until you revoke them or delete your account      |
+| Phone numbers          | Until you remove them or delete your account      |
+| Web push subscriptions | 60 days of inactivity, then automatically removed |
+| Server logs            | Varies; debugging logs are typically temporary    |
+
+## Self-hosting
+
+If you prefer complete control over your data, you can [self-host your own ntfy server](install.md). 
+When self-hosting:
+
+- You control all data storage and retention
+- You can choose whether to use Firebase, Twilio, email delivery, or any other integrations
+- No data is shared with ntfy.sh or any third party (unless you configure those integrations)
+
+The server and all apps are fully open source:
+
+- Server: [github.com/binwiederhier/ntfy](https://github.com/binwiederhier/ntfy)
+- Android app: [github.com/binwiederhier/ntfy-android](https://github.com/binwiederhier/ntfy-android)
+- iOS app: [github.com/binwiederhier/ntfy-ios](https://github.com/binwiederhier/ntfy-ios)
+
+## Data security
+
+- All connections to ntfy.sh are encrypted using TLS/HTTPS
+- Passwords are hashed using bcrypt before storage
+- Access tokens are generated using cryptographically secure random values
+- The server does not log message content by default
+
+## Your rights
+
+You have the right to:
+
+- **Access** - View your account information and data
+- **Delete** - Delete your account and associated data via the web app
+- **Export** - Your messages are available via the API while cached
+
+To delete your account, use the account settings in the web app or contact us.
+
+## Changes to this policy
+
+We may update this privacy policy from time to time. Changes will be posted on this page with an updated 
+"Last updated" date. You may also review all changes in the [Git history](https://github.com/binwiederhier/ntfy/commits/main/docs/privacy.md). 
+
+For significant changes, we may provide additional notice on Discord/Matrix or through the
+[announcements](https://ntfy.sh/announcements) ntfy topic.
+
+## Contact
+
+For privacy-related inquiries, please email [privacy@mail.ntfy.sh](mailto:privacy@mail.ntfy.sh).
+
+For all other contact options, see the [contact page](contact.md).

docs/publish.md

@@ -625,7 +625,7 @@ them with a comma, e.g. `tag1,tag2,tag3`.
     or `=?UTF-8?Q?=C3=84pfel?=,tag2` ([quoted-printable](https://en.wikipedia.org/wiki/Quoted-printable)).
 
 ## Markdown formatting
-_Supported on:_ :material-firefox:
+_Supported on:_ :material-android: :material-firefox:
 
 You can format messages using [Markdown](https://www.markdownguide.org/basic-syntax/) 🤩. That means you can use 
 **bold text**, *italicized text*, links, images, and more. Supported Markdown features (web app only for now):
@@ -705,8 +705,8 @@ As of today, **Markdown is only supported in the web app.** Here's an example of
 === "Python"
     ``` python
     requests.post("https://ntfy.sh/mytopic", 
-        data="Look ma, **bold text**, *italics*, ..."
-        headers={ "Markdown": "yes" }))
+        data="Look ma, **bold text**, *italics*, ...",
+        headers={ "Markdown": "yes" })
     ```
 
 === "PHP"
@@ -937,6 +937,445 @@ Here's an example with a custom message, tags and a priority:
     file_get_contents('https://ntfy.sh/mywebhook/publish?message=Webhook+triggered&priority=high&tags=warning,skull');
     ```
 
+## Updating + deleting notifications
+_Supported on:_ :material-android: :material-firefox:
+
+!!! info
+    **This feature is not yet released.** It will be available in ntfy v2.16.x and later and ntfy Android v1.22.x and later.
+
+You can **update, clear (mark as read and dismiss), or delete notifications** that have already been delivered. This is useful for scenarios
+like download progress updates, replacing outdated information, or dismissing notifications that are no longer relevant.
+
+* [Updating notifications](#updating-notifications) will alter the content of an existing notification.
+* [Clearing notifications](#clearing-notifications) will mark them as read and dismiss them from the notification drawer.
+* [Deleting notifications](#deleting-notifications) will remove them from the notification drawer and remove them in the clients as well (if supported).
+
+Here's an example of a download progress notification being updated over time on Android:
+
+<div id="updating-notifications-screenshots" class="screenshots">
+    <a href="../../static/img/android-screenshot-notification-update-1.png"><img src="../../static/img/android-screenshot-notification-update-1.png"/></a>
+    <a href="../../static/img/android-screenshot-notification-update-2.png"><img src="../../static/img/android-screenshot-notification-update-2.png"/></a>
+</div>
+
+To facilitate updating notifications and altering existing notifications, ntfy messages are linked together in a sequence,
+using a **sequence ID**. When a notification is meant to be updated, cleared, or deleted, you publish a new message with the
+same sequence ID and the clients will perform the appropriate action on the existing notification.
+
+Existing ntfy messages will not be updated on the server or in the message cache. Instead, a new message is created that indicates
+the update, clear, or delete action. This append-only behavior ensures that message history remains intact.
+
+### Updating notifications
+To update an existing notification, publish a new message with the same sequence ID. Clients will replace the previous
+notification with the new one. You can either:
+
+1. **Use the message ID**: First publish like normal to `POST /<topic>` without a sequence ID, then use the returned message `id` as the sequence ID for updates
+2. **Use a custom sequence ID**: Publish directly to `POST /<topic>/<sequence_id>` with your own identifier, or use `POST /<topic>` with the 
+   `X-Sequence-ID` header (or any of its aliases: `Sequence-ID` or`SID`)
+
+If you don't know the sequence ID ahead of time, you can publish a message first and then use the returned 
+message `id` to update it. Here's an example:
+
+=== "Command line (curl)"
+    ```bash
+    # First, publish a message and capture the message ID
+    curl -d "Downloading file..." ntfy.sh/mytopic
+    # Returns: {"id":"xE73Iyuabi","time":1673542291,...}
+
+    # Then use the message ID to update it (via URL path)
+    curl -d "Download 50% ..." ntfy.sh/mytopic/xE73Iyuabi
+
+    # Or update using the X-Sequence-ID header
+    curl -H "X-Sequence-ID: xE73Iyuabi" -d "Download complete" ntfy.sh/mytopic
+    ```
+
+=== "ntfy CLI"
+    ```bash
+    # First, publish a message and capture the message ID
+    ntfy pub mytopic "Downloading file..."
+    # Returns: {"id":"xE73Iyuabi","time":1673542291,...}
+
+    # Then use the message ID to update it
+    ntfy pub --sequence-id=xE73Iyuabi mytopic "Download 50% ..."
+
+    # Update again with the same sequence ID
+    ntfy pub -S xE73Iyuabi mytopic "Download complete"
+    ```
+
+=== "HTTP"
+    ``` http
+    # First, publish a message and capture the message ID
+    POST /mytopic HTTP/1.1
+    Host: ntfy.sh
+
+    Downloading file...
+
+    # Returns: {"id":"xE73Iyuabi","time":1673542291,...}
+
+    # Then use the message ID to update it
+    POST /mytopic/xE73Iyuabi HTTP/1.1
+    Host: ntfy.sh
+
+    Download 50% ...
+
+    # Update again with the same sequence ID, this time using the header
+    POST /mytopic HTTP/1.1
+    Host: ntfy.sh
+    X-Sequence-ID: xE73Iyuabi
+
+    Download complete
+    ```
+
+=== "JavaScript"
+    ``` javascript
+    // First, publish and get the message ID
+    const response = await fetch('https://ntfy.sh/mytopic', {
+      method: 'POST',
+      body: 'Downloading file...'
+    });
+    const { id } = await response.json();
+
+    // Update via URL path
+    await fetch(`https://ntfy.sh/mytopic/${id}`, {
+      method: 'POST',
+      body: 'Download 50% ...'
+    });
+
+    // Or update using the X-Sequence-ID header
+    await fetch('https://ntfy.sh/mytopic', {
+      method: 'POST',
+      headers: { 'X-Sequence-ID': id },
+      body: 'Download complete'
+    });
+    ```
+
+=== "Go"
+    ``` go
+    // Publish and parse the response to get the message ID
+    resp, _ := http.Post("https://ntfy.sh/mytopic", "text/plain",
+        strings.NewReader("Downloading file..."))
+    var msg struct { ID string `json:"id"` }
+    json.NewDecoder(resp.Body).Decode(&msg)
+    
+    // Update via URL path
+    http.Post("https://ntfy.sh/mytopic/"+msg.ID, "text/plain",
+        strings.NewReader("Download 50% ..."))
+
+    // Or update using the X-Sequence-ID header
+    req, _ := http.NewRequest("POST", "https://ntfy.sh/mytopic",
+        strings.NewReader("Download complete"))
+    req.Header.Set("X-Sequence-ID", msg.ID)
+    http.DefaultClient.Do(req)
+    ```
+
+=== "PowerShell"
+    ``` powershell
+    # Publish and get the message ID
+    $response = Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic" -Body "Downloading file..."
+    $messageId = $response.id
+    
+    # Update via URL path
+    Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic/$messageId" -Body "Download 50% ..."
+
+    # Or update using the X-Sequence-ID header
+    Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic" `
+        -Headers @{"X-Sequence-ID"=$messageId} -Body "Download complete"
+    ```
+
+=== "Python"
+    ``` python
+    import requests
+    
+    # Publish and get the message ID
+    response = requests.post("https://ntfy.sh/mytopic", data="Downloading file...")
+    message_id = response.json()["id"]
+    
+    # Update via URL path
+    requests.post(f"https://ntfy.sh/mytopic/{message_id}", data="Download 50% ...")
+
+    # Or update using the X-Sequence-ID header
+    requests.post("https://ntfy.sh/mytopic",
+        headers={"X-Sequence-ID": message_id}, data="Download complete")
+    ```
+
+=== "PHP"
+    ``` php-inline
+    // Publish and get the message ID
+    $response = file_get_contents('https://ntfy.sh/mytopic', false, stream_context_create([
+        'http' => ['method' => 'POST', 'content' => 'Downloading file...']
+    ]));
+    $messageId = json_decode($response)->id;
+    
+    // Update via URL path
+    file_get_contents("https://ntfy.sh/mytopic/$messageId", false, stream_context_create([
+        'http' => ['method' => 'POST', 'content' => 'Download 50% ...']
+    ]));
+
+    // Or update using the X-Sequence-ID header
+    file_get_contents('https://ntfy.sh/mytopic', false, stream_context_create([
+        'http' => [
+            'method' => 'POST',
+            'header' => "X-Sequence-ID: $messageId",
+            'content' => 'Download complete'
+        ]
+    ]));
+    ```
+
+You can also use a **custom sequence ID** (e.g., a download ID, job ID, etc.) when publishing the first message. 
+**This is less cumbersome**, since you don't need to capture the message ID first. Just publish directly to
+`/<topic>/<sequence_id>`:
+
+=== "Command line (curl)"
+    ```bash
+    # Publish with a custom sequence ID
+    curl -d "Downloading file..." ntfy.sh/mytopic/my-download-123
+
+    # Update using the same sequence ID (via URL path)
+    curl -d "Download 50% ..." ntfy.sh/mytopic/my-download-123
+
+    # Or update using the X-Sequence-ID header
+    curl -H "X-Sequence-ID: my-download-123" -d "Download complete" ntfy.sh/mytopic
+    ```
+
+=== "ntfy CLI"
+    ```bash
+    # Publish with a sequence ID
+    ntfy pub --sequence-id=my-download-123 mytopic "Downloading file..."
+
+    # Update using the same sequence ID
+    ntfy pub --sequence-id=my-download-123 mytopic "Download 50% ..."
+
+    # Update again
+    ntfy pub -S my-download-123 mytopic "Download complete"
+    ```
+
+=== "HTTP"
+    ``` http
+    # Publish a message with a custom sequence ID
+    POST /mytopic/my-download-123 HTTP/1.1
+    Host: ntfy.sh
+
+    Downloading file...
+
+    # Update again using the X-Sequence-ID header
+    POST /mytopic HTTP/1.1
+    Host: ntfy.sh
+    X-Sequence-ID: my-download-123
+
+    Download complete
+    ```
+
+=== "JavaScript"
+    ``` javascript
+    // First message
+    await fetch('https://ntfy.sh/mytopic/my-download-123', {
+      method: 'POST',
+      body: 'Downloading file...'
+    });
+
+    // Update via URL path
+    await fetch('https://ntfy.sh/mytopic/my-download-123', {
+      method: 'POST',
+      body: 'Download 50% ...'
+    });
+
+    // Or update using the X-Sequence-ID header
+    await fetch('https://ntfy.sh/mytopic', {
+      method: 'POST',
+      headers: { 'X-Sequence-ID': 'my-download-123' },
+      body: 'Download complete'
+    });
+    ```
+
+=== "Go"
+    ``` go
+    // Publish with sequence ID in URL path
+    http.Post("https://ntfy.sh/mytopic/my-download-123", "text/plain",
+        strings.NewReader("Downloading file..."))
+    
+    // Update via URL path
+    http.Post("https://ntfy.sh/mytopic/my-download-123", "text/plain",
+        strings.NewReader("Download 50% ..."))
+
+    // Or update using the X-Sequence-ID header
+    req, _ := http.NewRequest("POST", "https://ntfy.sh/mytopic",
+        strings.NewReader("Download complete"))
+    req.Header.Set("X-Sequence-ID", "my-download-123")
+    http.DefaultClient.Do(req)
+    ```
+
+=== "PowerShell"
+    ``` powershell
+    # Publish with sequence ID
+    Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic/my-download-123" -Body "Downloading file..."
+    
+    # Update via URL path
+    Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic/my-download-123" -Body "Download 50% ..."
+
+    # Or update using the X-Sequence-ID header
+    Invoke-RestMethod -Method POST -Uri "https://ntfy.sh/mytopic" `
+        -Headers @{"X-Sequence-ID"="my-download-123"} -Body "Download complete"
+    ```
+
+=== "Python"
+    ``` python
+    import requests
+    
+    # Publish with sequence ID
+    requests.post("https://ntfy.sh/mytopic/my-download-123", data="Downloading file...")
+    
+    # Update via URL path
+    requests.post("https://ntfy.sh/mytopic/my-download-123", data="Download 50% ...")
+
+    # Or update using the X-Sequence-ID header
+    requests.post("https://ntfy.sh/mytopic",
+        headers={"X-Sequence-ID": "my-download-123"}, data="Download complete")
+    ```
+
+=== "PHP"
+    ``` php-inline
+    // Publish with sequence ID
+    file_get_contents('https://ntfy.sh/mytopic/my-download-123', false, stream_context_create([
+        'http' => ['method' => 'POST', 'content' => 'Downloading file...']
+    ]));
+    
+    // Update via URL path
+    file_get_contents('https://ntfy.sh/mytopic/my-download-123', false, stream_context_create([
+        'http' => ['method' => 'POST', 'content' => 'Download 50% ...']
+    ]));
+
+    // Or update using the X-Sequence-ID header
+    file_get_contents('https://ntfy.sh/mytopic', false, stream_context_create([
+        'http' => [
+            'method' => 'POST',
+            'header' => 'X-Sequence-ID: my-download-123',
+            'content' => 'Download complete'
+        ]
+    ]));
+    ```
+
+You can also set the sequence ID via the `sequence-id` [query parameter](#list-of-all-parameters), or when
+[publishing as JSON](#publish-as-json) using the `sequence_id` field.
+
+If the message ID (`id`) and the sequence ID (`sequence_id`) are different, the ntfy server will include the `sequence_id`
+field the response. A sequence of updates may look like this (first example from above):
+
+```json
+{"id":"xE73Iyuabi","time":1673542291,"event":"message","topic":"mytopic","message":"Downloading file..."}
+{"id":"yF84Jzvbcj","time":1673542295,"event":"message","topic":"mytopic","sequence_id":"xE73Iyuabi","message":"Download 50% ..."}
+{"id":"zG95Kawdde","time":1673542300,"event":"message","topic":"mytopic","sequence_id":"xE73Iyuabi","message":"Download complete"}
+```
+
+### Clearing notifications
+Clearing a notification means **marking it as read and dismissing it from the notification drawer**. 
+
+To do this, send a PUT request to the `/<topic>/<sequence_id>/clear` endpoint (or `/<topic>/<sequence_id>/read` as an alias). 
+This will then emit a `message_clear` event that is used by the clients (web app and Android app) to update the read status
+and dismiss the notification.
+
+=== "Command line (curl)"
+    ```bash
+    curl -X PUT ntfy.sh/mytopic/my-download-123/clear
+    ```
+
+=== "HTTP"
+    ``` http
+    PUT /mytopic/my-download-123/clear HTTP/1.1
+    Host: ntfy.sh
+    ```
+
+=== "JavaScript"
+    ``` javascript
+    await fetch('https://ntfy.sh/mytopic/my-download-123/clear', {
+      method: 'PUT'
+    });
+    ```
+
+=== "Go"
+    ``` go
+    req, _ := http.NewRequest("PUT", "https://ntfy.sh/mytopic/my-download-123/clear", nil)
+    http.DefaultClient.Do(req)
+    ```
+
+=== "PowerShell"
+    ``` powershell
+    Invoke-RestMethod -Method PUT -Uri "https://ntfy.sh/mytopic/my-download-123/clear"
+    ```
+
+=== "Python"
+    ``` python
+    requests.put("https://ntfy.sh/mytopic/my-download-123/clear")
+    ```
+
+=== "PHP"
+    ``` php-inline
+    file_get_contents('https://ntfy.sh/mytopic/my-download-123/clear', false, stream_context_create([
+        'http' => ['method' => 'PUT']
+    ]));
+    ```
+
+An example response from the server with the `message_clear` event may look like this:
+
+```json
+{"id":"jkl012","time":1673542305,"event":"message_clear","topic":"mytopic","sequence_id":"my-download-123"}
+```
+
+### Deleting notifications
+Deleting a notification means **removing it from the notification drawer and from the client's database**.
+
+To do this, send a DELETE request to the `/<topic>/<sequence_id>` endpoint. This will emit a `message_delete` event
+that is used by the clients (web app and Android app) to remove the notification entirely.
+
+=== "Command line (curl)"
+    ```bash
+    curl -X DELETE ntfy.sh/mytopic/my-download-123
+    ```
+
+=== "HTTP"
+    ``` http
+    DELETE /mytopic/my-download-123 HTTP/1.1
+    Host: ntfy.sh
+    ```
+
+=== "JavaScript"
+    ``` javascript
+    await fetch('https://ntfy.sh/mytopic/my-download-123', {
+      method: 'DELETE'
+    });
+    ```
+
+=== "Go"
+    ``` go
+    req, _ := http.NewRequest("DELETE", "https://ntfy.sh/mytopic/my-download-123", nil)
+    http.DefaultClient.Do(req)
+    ```
+
+=== "PowerShell"
+    ``` powershell
+    Invoke-RestMethod -Method DELETE -Uri "https://ntfy.sh/mytopic/my-download-123"
+    ```
+
+=== "Python"
+    ``` python
+    requests.delete("https://ntfy.sh/mytopic/my-download-123")
+    ```
+
+=== "PHP"
+    ``` php-inline
+    file_get_contents('https://ntfy.sh/mytopic/my-download-123', false, stream_context_create([
+        'http' => ['method' => 'DELETE']
+    ]));
+    ```
+
+An example response from the server with the `message_delete` event may look like this:
+
+```json
+{"id":"mno345","time":1673542400,"event":"message_delete","topic":"mytopic","sequence_id":"my-download-123"}
+```
+
+!!! info
+    Deleted sequences can be revived by publishing a new message with the same sequence ID. The notification will
+    reappear as a new message.
+
 ## Message templating
 _Supported on:_ :material-android: :material-apple: :material-firefox:
 
@@ -1418,22 +1857,23 @@ The JSON message format closely mirrors the format of the message you can consum
 (see [JSON message format](subscribe/api.md#json-message-format) for details), but is not exactly identical. Here's an overview of
 all the supported fields:
 
-| Field      | Required | Type                             | Example                                   | Description                                                           |
-|------------|----------|----------------------------------|-------------------------------------------|-----------------------------------------------------------------------|
-| `topic`    | ✔️       | *string*                         | `topic1`                                  | Target topic name                                                     |
-| `message`  | -        | *string*                         | `Some message`                            | Message body; set to `triggered` if empty or not passed               |
-| `title`    | -        | *string*                         | `Some title`                              | Message [title](#message-title)                                       |
-| `tags`     | -        | *string array*                   | `["tag1","tag2"]`                         | List of [tags](#tags-emojis) that may or not map to emojis            |
-| `priority` | -        | *int (one of: 1, 2, 3, 4, or 5)* | `4`                                       | Message [priority](#message-priority) with 1=min, 3=default and 5=max |
-| `actions`  | -        | *JSON array*                     | *(see [action buttons](#action-buttons))* | Custom [user action buttons](#action-buttons) for notifications       |
-| `click`    | -        | *URL*                            | `https://example.com`                     | Website opened when notification is [clicked](#click-action)          |
-| `attach`   | -        | *URL*                            | `https://example.com/file.jpg`            | URL of an attachment, see [attach via URL](#attach-file-from-a-url)   |
-| `markdown` | -        | *bool*                           | `true`                                    | Set to true if the `message` is Markdown-formatted                    |
-| `icon`     | -        | *string*                         | `https://example.com/icon.png`            | URL to use as notification [icon](#icons)                             |
-| `filename` | -        | *string*                         | `file.jpg`                                | File name of the attachment                                           |
-| `delay`    | -        | *string*                         | `30min`, `9am`                            | Timestamp or duration for delayed delivery                            |
-| `email`    | -        | *e-mail address*                 | `phil@example.com`                        | E-mail address for e-mail notifications                               |
-| `call`     | -        | *phone number or 'yes'*          | `+1222334444` or `yes`                    | Phone number to use for [voice call](#phone-calls)                    |
+| Field         | Required | Type                             | Example                                   | Description                                                                               |
+|---------------|----------|----------------------------------|-------------------------------------------|-------------------------------------------------------------------------------------------|
+| `topic`       | ✔️       | *string*                         | `topic1`                                  | Target topic name                                                                         |
+| `message`     | -        | *string*                         | `Some message`                            | Message body; set to `triggered` if empty or not passed                                   |
+| `title`       | -        | *string*                         | `Some title`                              | Message [title](#message-title)                                                           |
+| `tags`        | -        | *string array*                   | `["tag1","tag2"]`                         | List of [tags](#tags-emojis) that may or not map to emojis                                |
+| `priority`    | -        | *int (one of: 1, 2, 3, 4, or 5)* | `4`                                       | Message [priority](#message-priority) with 1=min, 3=default and 5=max                     |
+| `actions`     | -        | *JSON array*                     | *(see [action buttons](#action-buttons))* | Custom [user action buttons](#action-buttons) for notifications                           |
+| `click`       | -        | *URL*                            | `https://example.com`                     | Website opened when notification is [clicked](#click-action)                              |
+| `attach`      | -        | *URL*                            | `https://example.com/file.jpg`            | URL of an attachment, see [attach via URL](#attach-file-from-a-url)                       |
+| `markdown`    | -        | *bool*                           | `true`                                    | Set to true if the `message` is Markdown-formatted                                        |
+| `icon`        | -        | *string*                         | `https://example.com/icon.png`            | URL to use as notification [icon](#icons)                                                 |
+| `filename`    | -        | *string*                         | `file.jpg`                                | File name of the attachment                                                               |
+| `delay`       | -        | *string*                         | `30min`, `9am`                            | Timestamp or duration for delayed delivery                                                |
+| `email`       | -        | *e-mail address*                 | `phil@example.com`                        | E-mail address for e-mail notifications                                                   |
+| `call`        | -        | *phone number or 'yes'*          | `+1222334444` or `yes`                    | Phone number to use for [voice call](#phone-calls)                                        |
+| `sequence_id` | -        | *string*                         | `my-sequence-123`                         | Sequence ID for [updating/deleting notifications](#updating-deleting-notifications)   |
 
 ## Action buttons
 _Supported on:_ :material-android: :material-apple: :material-firefox:
@@ -3679,13 +4119,13 @@ authParam  = base64_raw(authHeader) // -> QmFzaWMgZEdWemRIVnpaWEk2Wm1GclpYQmhjM0
 The following command will generate the appropriate value for you on *nix systems:
 
 ```
-echo -n "Basic `echo -n 'testuser:fakepassword' | base64`" | base64 | tr -d '='
+echo -n "Basic `echo -n 'testuser:fakepassword' | base64 -w0`" | base64 -w0 | tr -d '='
 ```
 
 For access tokens, you can use this instead:
 
 ```
-echo -n "Bearer faketoken" | base64 | tr -d '='
+echo -n "Bearer faketoken" | base64 -w0 | tr -d '='
 ```
 
 ## Advanced features
@@ -3931,6 +4371,7 @@ table in their canonical form.
 |-----------------|--------------------------------------------|-----------------------------------------------------------------------------------------------|
 | `X-Message`     | `Message`, `m`                             | Main body of the message as shown in the notification                                         |
 | `X-Title`       | `Title`, `t`                               | [Message title](#message-title)                                                               |
+| `X-Sequence-ID` | `Sequence-ID`, `SID`                       | [Sequence ID](#updating-deleting-notifications) for updating/clearing/deleting notifications  |
 | `X-Priority`    | `Priority`, `prio`, `p`                    | [Message priority](#message-priority)                                                         |
 | `X-Tags`        | `Tags`, `Tag`, `ta`                        | [Tags and emojis](#tags-emojis)                                                               |
 | `X-Delay`       | `Delay`, `X-At`, `At`, `X-In`, `In`        | Timestamp or duration for [delayed delivery](#scheduled-delivery)                             |

docs/publish/template-functions.md

@@ -1174,7 +1174,7 @@ keys $myDict | sortAlpha
 ```
 
 When supplying multiple dictionaries, the keys will be concatenated. Use the `uniq`
-function along with `sortAlpha` to get a unqiue, sorted list of keys.
+function along with `sortAlpha` to get a unique, sorted list of keys.
 
 ```
 keys $myDict $myOtherDict | uniq | sortAlpha

docs/releases.md

@@ -2,7 +2,138 @@
 Binaries for all releases can be found on the GitHub releases pages for the [ntfy server](https://github.com/binwiederhier/ntfy/releases)
 and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/releases).
 
-### ntfy server v2.14.0
+## Current stable releases
+
+| Component        | Version | Release date |
+|------------------|---------|--------------|
+| ntfy server      | v2.15.0 | Nov 16, 2025 |
+| ntfy Android app | v1.21.1 | Jan 6, 2025  |
+| ntfy iOS app     | v1.3    | Nov 26, 2023 |
+
+Please check out the release notes for [upcoming releases](#not-released-yet) below.
+
+## ntfy Android app v1.21.1
+Released January 6, 2026
+
+This is the first feature release in a long time. After all the SDK updates, fixes to comply with the Google Play policies
+and the framework updates, this release ships a lot of highly requested features: Sending messages through the app (WhatsApp-style),
+support for passing headers to your proxy, an in-app language switcher, and more.
+
+If you are waiting for a feature, please 👍 the corresponding [GitHub issue](https://github.com/binwiederhier/ntfy/issues?q=is%3Aissue%20state%3Aopen%20sort%3Areactions-%2B1-desc).
+If you like ntfy, please consider purchasing [ntfy Pro](https://ntfy.sh/app) to support us.
+
+**Features:**
+
+* Allow publishing messages through the message bar and publish dialog ([#98](https://github.com/binwiederhier/ntfy/issues/98), [ntfy-android#144](https://github.com/binwiederhier/ntfy-android/pull/144))
+* Define custom HTTP headers to support authenticated proxies, tunnels and SSO ([ntfy-android#116](https://github.com/binwiederhier/ntfy-android/issues/116), [#1018](https://github.com/binwiederhier/ntfy/issues/1018), [ntfy-android#132](https://github.com/binwiederhier/ntfy-android/pull/132), [ntfy-android#146](https://github.com/binwiederhier/ntfy-android/pull/146), thanks to [@CrazyWolf13](https://github.com/CrazyWolf13))
+* Implement UnifiedPush "raise to foreground" requirement ([ntfy-android#98](https://github.com/binwiederhier/ntfy-android/pull/98), [ntfy-android#148](https://github.com/binwiederhier/ntfy-android/pull/148), thanks to [@p1gp1g](https://github.com/p1gp1g))
+* Language selector to allow overriding the system language ([#1508](https://github.com/binwiederhier/ntfy/issues/1508), [ntfy-android#145](https://github.com/binwiederhier/ntfy-android/pull/145), thanks to [@hudsonm62](https://github.com/hudsonm62) for reporting)
+* Highlight phone numbers and email addresses in notifications ([#957](https://github.com/binwiederhier/ntfy/issues/957), [ntfy-android#71](https://github.com/binwiederhier/ntfy-android/pull/71), thanks to [@brennenputh](https://github.com/brennenputh), and [@XylenSky](https://github.com/XylenSky) for reporting)
+* Support for port and display name in [ntfy://](subscribe/phone.md#ntfy-links) links ([ntfy-android#130](https://github.com/binwiederhier/ntfy-android/pull/130), thanks to [@godovski](https://github.com/godovski))
+
+**Bug fixes + maintenance:**
+
+* Add support for (technically incorrect) 'image/jpg' MIME type ([ntfy-android#142](https://github.com/binwiederhier/ntfy-android/pull/142), thanks to [@Murilobeluco](https://github.com/Murilobeluco))
+* Unify "copy to clipboard" notifications, use Android 13 style ([ntfy-android#61](https://github.com/binwiederhier/ntfy-android/pull/61), thanks to [@thgoebel](https://github.com/thgoebel))
+* Fix crash in user add dialog (onAddUser)
+* Fix ForegroundServiceDidNotStartInTimeException (attempt 2, see [#1520](https://github.com/binwiederhier/ntfy/issues/1520))
+* Hide "Exact alarms" setting if battery optimization exemption has been granted ([#1456](https://github.com/binwiederhier/ntfy/issues/1456), thanks for reporting [@HappyLer](https://github.com/HappyLer))
+
+## ntfy Android app v1.20.0
+Released December 28, 2025
+
+This is the last pure maintenance release for now. It'll bring all dependencies and library version to the latest version,
+and fixes some crashes. I had to drop support for about 4,000 devices (only ~200 installations), because the libraries
+themselves do not support SDK 21 anymore, which was the previous minimum SDK version (Android 5, 2014). Now the minimum
+SDK version is 26 (Android 8, 2017).
+
+**Bug fixes + maintenance:**
+
+* Updated dependencies, minimum SDK version to 26, clean up legacy code, upgrade Gradle ([ntfy-android#140](https://github.com/binwiederhier/ntfy-android/pull/140),
+  thanks to [@cyb3rko](https://github.com/cyb3rko) for the implementation)
+* Updated target SDK version to 36 (Android 8, 2017)
+* Fixed ForegroundServiceDidNotStartInTimeException ([#1520](https://github.com/binwiederhier/ntfy/issues/1520))
+* Fixed crashes with redrawing the list when temporarily muted topics expire
+
+## ntfy Android app v1.19.4
+Released December 21, 2025
+
+This release upgrades the Android app to use [Material 3](https://m3.material.io/) design components and adds the
+ability to use [dynamic colors](https://developer.android.com/develop/ui/views/theming/dynamic-colors).
+**This was a lot of work** and I want to thank [@Bnyro](https://github.com/Bnyro) and [@cyb3rko](https://github.com/cyb3rko) for implementing this. You guys rock!
+
+**Features:**
+
+* Moved the user interface to Material 3 and added dynamic color support ([#580](https://github.com/binwiederhier/ntfy/issues/580),
+  [ntfy-android#56](https://github.com/binwiederhier/ntfy-android/pull/56), [ntfy-android#126](https://github.com/binwiederhier/ntfy-android/pull/126),
+  [ntfy-android#135](https://github.com/binwiederhier/ntfy-android/pull/135), thanks to [@Bnyro](https://github.com/Bnyro)
+  and [@cyb3rko](https://github.com/cyb3rko) for the implementation, and to [@RokeJulianLockhart](https://github.com/RokeJulianLockhart) for reporting)
+
+## ntfy Android app v1.18.0
+Released December 4, 2025
+
+**Features:**
+
+* Added GIF support for preview images ([ntfy-android#76](https://github.com/binwiederhier/ntfy-android/pull/76)/[#532](https://github.com/binwiederhier/ntfy/issues/532), thanks to [@MichaelArkh](https://github.com/MichaelArkh) and [@dimatx](https://github.com/dimatx) for reporting)
+* Added WebP support for preview images ([ntfy-android#81](https://github.com/binwiederhier/ntfy-android/pull/81)/[ntfy-android#80](https://github.com/binwiederhier/ntfy-android/issues/80), thanks to [@jokakilla](https://github.com/jokakilla))
+* Added UnifiedPush distributor selection support ([#137](https://github.com/binwiederhier/ntfy-android/pull/137), thanks to [@p1gp1g](https://github.com/p1gp1g))
+
+**Bug fixes + maintenance:**
+
+* Remove REQUEST_INSTALL_PACKAGES permission ([#684](https://github.com/binwiederhier/ntfy/issues/684))
+* Request to ignore battery optimizations before receiving subscription ([ntfy-android#97](https://github.com/binwiederhier/ntfy-android/pull/97), thanks to [@p1gp1g](https://github.com/p1gp1g))
+
+## ntfy server v2.15.0
+Released Nov 16, 2025
+
+This release adds a `require-login` flag to topics, which forces users to log in before they can
+use the web app. This is useful for self-hosters and will obviously not be enabled on ntfy.sh.
+
+**Features:**
+
+* Add `require-login` flag to redirect to login page if not logged in ([#1434](https://github.com/binwiederhier/ntfy/pull/1434)/[#238](https://github.com/binwiederhier/ntfy/issues/238)/[#1329](https://github.com/binwiederhier/ntfy/pull/1329), thanks to [@theatischbein](https://github.com/theatischbein) for implementing most of this)
+
+**Bug fixes + maintenance:**
+
+* The official ntfy.sh Debian/Ubuntu repository has moved to [archive.ntfy.sh](https://archive.ntfy.sh) ([#1357](https://github.com/binwiederhier/ntfy/issues/1357)/[#1401](https://github.com/binwiederhier/ntfy/issues/1401), thanks to [@skibbipl](https://github.com/skibbipl) and [@lduesing](https://github.com/lduesing) for reporting)
+* Add mutex around message cache writes to avoid `database locked` errors ([#1397](https://github.com/binwiederhier/ntfy/pull/1397), [#1391](https://github.com/binwiederhier/ntfy/issues/1391), thanks to [@timofej673](https://github.com/timofej673))
+* Add build tags `nopayments`, `nofirebase` and `nowebpush` to allow excluding external dependencies, useful for
+  packaging in Debian ([#1420](https://github.com/binwiederhier/ntfy/pull/1420), discussion in [#1258](https://github.com/binwiederhier/ntfy/issues/1258), thanks to [@thekhalifa](https://github.com/thekhalifa) for packaging ntfy for Debian/Ubuntu)
+* Make copying tokens, phone numbers, etc. possible on HTTP ([#1432](https://github.com/binwiederhier/ntfy/pull/1432)/[#1408](https://github.com/binwiederhier/ntfy/issues/1408)/[#1295](https://github.com/binwiederhier/ntfy/issues/1295), thanks to [@EdwinKM](https://github.com/EdwinKM), [@xxl6097](https://github.com/xxl6097) for reporting)
+
+## ntfy Android app v1.17.13
+Released October 21, 2025
+
+This release makes changes to comply with the Google Play policies. See [#1463](https://github.com/binwiederhier/ntfy/issues/1463)
+or [ef57cd1](https://github.com/binwiederhier/ntfy-android/commit/ef57cd1374118b3e4d7a7ab496afe337e714fff7) for details.
+
+The policies do not allow directly or indirectly linking to paid plans or donation links that do not go through Google Play.
+
+**Changes:**
+
+* Remove the "Donate" button from menu (all variants)
+* Change default display name from "ntfy.sh/mytopic" to "mytopic" (all variants)
+* Remove links to ntfy docs and issue tracker (Play variant only)
+* Remove how-to links to ntfy.sh in a few places (Play variant only)
+* Remove "Copy topic address" from subscription menu (Play variant only)
+
+## ntfy Android app v1.17.8
+Released September 23, 2025
+
+This is largely a maintenance update to ensure the SDK is up-to-date.
+
+**Features:**
+
+* Markdown is now rendered if "Markdown: yes" was passed ([#310](https://github.com/binwiederhier/ntfy/issues/310), thanks to [@NiNiyas](https://github.com/NiNiyas) for reporting)
+* You can now disable UnifiedPush so ntfy does not act as a UnifiedPush distributor ([#646](https://github.com/binwiederhier/ntfy/issues/646), thanks to [@ollien](https://github.com/ollien) for reporting and to [@wunter8](https://github.com/wunter8) for implementing)
+
+**Bug fixes + maintenance:**
+
+* UnifiedPush subscriptions now include the `Rate-Topics` header to facilitate subscriber-based billing ([#652](https://github.com/binwiederhier/ntfy/issues/652), thanks to [@wunter8](https://github.com/wunter8))
+* Subscriptions without icons no longer appear to use another subscription's icon ([#634](https://github.com/binwiederhier/ntfy/issues/634), thanks to [@topcaser](https://github.com/topcaser) for reporting and to [@wunter8](https://github.com/wunter8) for fixing)
+* Bumped all dependencies to the latest versions (no ticket)
+
+## ntfy server v2.14.0
 Released August 5, 2025
 
 This release adds support for [declarative users](config.md#users-via-the-config), [declarative ACL entries](config.md#acl-entries-via-the-config) and [declarative tokens](config.md#tokens-via-the-config). This allows you to define users, ACL entries and tokens in the config file, which is useful for static deployments or deployments that use a configuration management system.
@@ -18,7 +149,7 @@ will always remain open source.
 * [Pre-defined templates](publish.md#pre-defined-templates) and [custom templates](publish.md#custom-templates) for enhanced JSON webhook support ([#1390](https://github.com/binwiederhier/ntfy/pull/1390))
 * Support of advanced [template functions](publish.md#template-functions) based on the [Sprig](https://github.com/Masterminds/sprig) library ([#1121](https://github.com/binwiederhier/ntfy/issues/1121), thanks to [@davidatkinsondoyle](https://github.com/davidatkinsondoyle) for reporting, to [@wunter8](https://github.com/wunter8) for implementing, and to the Sprig team for their work)
 
-### ntfy server v2.13.0
+## ntfy server v2.13.0
 Released July 10, 2025
 
 This is a relatively small release, mainly to support IPv6 and to add more sophisticated
@@ -37,7 +168,7 @@ ntfy will always remain open source.
 * Update new languages from Weblate. Thanks to all the contributors!
 * Added Estonian (Esti), Galician (Galego), Romanian (Română), Slovak (Slovenčina) as new languages to the web app
 
-### ntfy server v2.12.0
+## ntfy server v2.12.0
 Released May 29, 2025
 
 This is mainly a maintenance release that updates dependencies, though since it's been over a year, there are a few
@@ -97,7 +228,7 @@ user support in Discord/Matrix/GitHub! You rock, man!
 * Update new languages from Weblate. Thanks to all the contributors!
 * Added Tamil (தமிழ்) as a new language to the web app
 
-### ntfy server v2.11.0
+## ntfy server v2.11.0
 Released May 13, 2024
 
 This is a tiny release that fixes a database index issue that caused performance issues on ntfy.sh. It also fixes a bug
@@ -112,7 +243,7 @@ and [Liberapay](https://en.liberapay.com/ntfy/), or buying a [paid plan via the
 * Do not set rate visitor for non-eligible topics (no ticket)
 * Do not cache `config.js` ([#1098](https://github.com/binwiederhier/ntfy/pull/1098), thanks to [@wunter8](https://github.com/wunter8))
 
-### ntfy server v2.10.0
+## ntfy server v2.10.0
 Released Mar 27, 2024
 
 This release adds support for **message templating** in the ntfy server, which allows you to include a message and/or
@@ -123,7 +254,7 @@ This is great for services that let you specify a webhook URL but do not let you
 
 * [Message templating](publish.md#message-templating): You can now include a message and/or title template that will be filled with values from a JSON body ([#724](https://github.com/binwiederhier/ntfy/issues/724), thanks to [@wunter8](https://github.com/wunter8) for implementing)
 
-### ntfy server v2.9.0
+## ntfy server v2.9.0
 Released Mar 7, 2024
 
 A small release after a long pause (lots of day job work). This release adds for **larger messages** and **longer
@@ -1468,26 +1599,31 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release
 
 ## Not released yet
 
-### ntfy server v2.15.0 (UNRELEASED)
-
-**Bug fixes + maintenance:**
-
-* Add mutex around message cache writes to avoid `database locked` errors ([#1397](https://github.com/binwiederhier/ntfy/pull/1397), [#1391](https://github.com/binwiederhier/ntfy/issues/1391), thanks to [@timofej673](https://github.com/timofej673))
-* Add build tags `nopayments`, `nofirebase` and `nowebpush` to allow excluding external dependencies, useful for 
-  packaging in Debian ([#1420](https://github.com/binwiederhier/ntfy/pull/1420), discussion in [#1258](https://github.com/binwiederhier/ntfy/issues/1258), thanks to [@thekhalifa](https://github.com/thekhalifa) for packaging ntfy for Debian/Ubuntu)
-
-### ntfy Android app v1.16.1 (UNRELEASED)
+### ntfy server v2.16.x (UNRELEASED)
 
 **Features:**
 
-* You can now disable UnifiedPush so ntfy does not act as a UnifiedPush distributor ([#646](https://github.com/binwiederhier/ntfy/issues/646), thanks to [@ollien](https://github.com/ollien) for reporting and to [@wunter8](https://github.com/wunter8) for implementing) 
+* Support for [updating and deleting notifications](publish.md#updating-deleting-notifications) ([#303](https://github.com/binwiederhier/ntfy/issues/303), [#1536](https://github.com/binwiederhier/ntfy/pull/1536),
+  [ntfy-android#151](https://github.com/binwiederhier/ntfy-android/pull/151), thanks to [@wunter8](https://github.com/wunter8) for the initial implementation)
+* Support for a [custom Twilio call format](config.md#phone-calls) ([#1289](https://github.com/binwiederhier/ntfy/pull/1289), thanks to [@mmichaa](https://github.com/mmichaa) for the initial implementation) 
+
+### ntfy Android app v1.22.x (UNRELEASED)
+
+**Features:**
+
+* Support for [updating and deleting notifications](publish.md#updating-deleting-notifications)
+  ([#303](https://github.com/binwiederhier/ntfy/issues/303), [#1536](https://github.com/binwiederhier/ntfy/pull/1536),
+  [ntfy-android#151](https://github.com/binwiederhier/ntfy-android/pull/151), thanks to [@wunter8](https://github.com/wunter8)
+  for the initial implementation)
+* Support for self-signed certs and client certs for mTLS ([#215](https://github.com/binwiederhier/ntfy/issues/215),
+  [#530](https://github.com/binwiederhier/ntfy/issues/530), [ntfy-android#149](https://github.com/binwiederhier/ntfy-android/pull/149),
+  thanks to [@cyb3rko](https://github.com/cyb3rko) for reviewing)
+* Connection error dialog to help diagnose connection issues
 
 **Bug fixes + maintenance:**
 
-* UnifiedPush subscriptions now include the `Rate-Topics` header to facilitate subscriber-based billing ([#652](https://github.com/binwiederhier/ntfy/issues/652), thanks to [@wunter8](https://github.com/wunter8))
-* Subscriptions without icons no longer appear to use another subscription's icon ([#634](https://github.com/binwiederhier/ntfy/issues/634), thanks to [@topcaser](https://github.com/topcaser) for reporting and to [@wunter8](https://github.com/wunter8) for fixing)
-* Bumped all dependencies to the latest versions (no ticket)
-
-**Additional languages:**
-
-* Swedish (thanks to [@hellbown](https://hosted.weblate.org/user/hellbown/))
+* Use server-specific user for attachment downloads ([#1529](https://github.com/binwiederhier/ntfy/issues/1529),
+  thanks to [@ManInDark](https://github.com/ManInDark) for reporting and testing)
+* Fix crash in sharing dialog (thanks to [@rogeliodh](https://github.com/rogeliodh))
+* Fix crash when exiting multi-delete in detail view
+* Fix potential crashes with icon downloader and backuper

docs/static/css/extra.css

@@ -1,10 +1,10 @@
 :root > * {
-    --md-primary-fg-color:        #338574;
+    --md-primary-fg-color: #338574;
     --md-primary-fg-color--light: #338574;
-    --md-primary-fg-color--dark:  #338574;
-    --md-footer-bg-color:         #353744;
-    --md-text-font:               "Roboto";
-    --md-code-font:               "Roboto Mono";
+    --md-primary-fg-color--dark: #338574;
+    --md-footer-bg-color: #353744;
+    --md-text-font: "Roboto";
+    --md-code-font: "Roboto Mono";
 }
 
 .md-header__button.md-logo :is(img, svg) {
@@ -34,7 +34,7 @@ figure img, figure video {
 }
 
 header {
-    background: linear-gradient(150deg, rgba(51,133,116,1) 0%, rgba(86,189,168,1) 100%);
+    background: linear-gradient(150deg, rgba(51, 133, 116, 1) 0%, rgba(86, 189, 168, 1) 100%);
 }
 
 body[data-md-color-scheme="default"] header {
@@ -93,7 +93,7 @@ figure video {
 
 .screenshots img {
     max-height: 230px;
-    max-width: 300px;
+    max-width: 350px;
     margin: 3px;
     border-radius: 5px;
     filter: drop-shadow(2px 2px 2px #ddd);
@@ -107,7 +107,7 @@ figure video {
     opacity: 0;
     visibility: hidden;
     position: fixed;
-    left:0;
+    left: 0;
     right: 0;
     top: 0;
     bottom: 0;
@@ -119,7 +119,7 @@ figure video {
 }
 
 .lightbox.show {
-    background-color: rgba(0,0,0, 0.75);
+    background-color: rgba(0, 0, 0, 0.75);
     opacity: 1;
     visibility: visible;
     z-index: 1000;

docs/subscribe/api.md

@@ -295,7 +295,7 @@ Available filters (all case-insensitive):
 | `message`       | `X-Message`, `m`          | `ntfy.sh/mytopic/json?message=lalala`         | Only return messages that match this exact message string               |
 | `title`         | `X-Title`, `t`            | `ntfy.sh/mytopic/json?title=some+title`       | Only return messages that match this exact title string                 |
 | `priority`      | `X-Priority`, `prio`, `p` | `ntfy.sh/mytopic/json?p=high,urgent`          | Only return messages that match *any priority listed* (comma-separated) |
-| `tags`          | `X-Tags`, `tag`, `ta`     | `ntfy.sh/mytopic?/jsontags=error,alert`       | Only return messages that match *all listed tags* (comma-separated)     |
+| `tags`          | `X-Tags`, `tag`, `ta`     | `ntfy.sh/mytopic/json?tags=error,alert`       | Only return messages that match *all listed tags* (comma-separated)     |
 
 ### Subscribe to multiple topics
 It's possible to subscribe to multiple topics in one HTTP call by providing a comma-separated list of topics 
@@ -324,20 +324,21 @@ format of the message. It's very straight forward:
 
 **Message**:
 
-| Field        | Required | Type                                              | Example                                               | Description                                                                                                                          |
-|--------------|----------|---------------------------------------------------|-------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
-| `id`         | ✔️       | *string*                                          | `hwQ2YpKdmg`                                          | Randomly chosen message identifier                                                                                                   |
-| `time`       | ✔️       | *number*                                          | `1635528741`                                          | Message date time, as Unix time stamp                                                                                                |  
-| `expires`    | (✔)️     | *number*                                          | `1673542291`                                          | Unix time stamp indicating when the message will be deleted, not set if `Cache: no` is sent                                          |  
-| `event`      | ✔️       | `open`, `keepalive`, `message`, or `poll_request` | `message`                                             | Message type, typically you'd be only interested in `message`                                                                        |
-| `topic`      | ✔️       | *string*                                          | `topic1,topic2`                                       | Comma-separated list of topics the message is associated with; only one for all `message` events, but may be a list in `open` events |
-| `message`    | -        | *string*                                          | `Some message`                                        | Message body; always present in `message` events                                                                                     |
-| `title`      | -        | *string*                                          | `Some title`                                          | Message [title](../publish.md#message-title); if not set defaults to `ntfy.sh/<topic>`                                               |
-| `tags`       | -        | *string array*                                    | `["tag1","tag2"]`                                     | List of [tags](../publish.md#tags-emojis) that may or not map to emojis                                                              |
-| `priority`   | -        | *1, 2, 3, 4, or 5*                                | `4`                                                   | Message [priority](../publish.md#message-priority) with 1=min, 3=default and 5=max                                                   |
-| `click`      | -        | *URL*                                             | `https://example.com`                                 | Website opened when notification is [clicked](../publish.md#click-action)                                                            |
-| `actions`    | -        | *JSON array*                                      | *see [actions buttons](../publish.md#action-buttons)* | [Action buttons](../publish.md#action-buttons) that can be displayed in the notification                                             |
-| `attachment` | -        | *JSON object*                                     | *see below*                                           | Details about an attachment (name, URL, size, ...)                                                                                   |
+| Field         | Required | Type                                                                            | Example                                               | Description                                                                                                                          |
+|---------------|----------|---------------------------------------------------------------------------------|-------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
+| `id`          | ✔️       | *string*                                                                        | `hwQ2YpKdmg`                                          | Randomly chosen message identifier                                                                                                   |
+| `time`        | ✔️       | *number*                                                                        | `1635528741`                                          | Message date time, as Unix time stamp                                                                                                |  
+| `expires`     | (✔)️     | *number*                                                                        | `1673542291`                                          | Unix time stamp indicating when the message will be deleted, not set if `Cache: no` is sent                                          |  
+| `event`       | ✔️       | `open`, `keepalive`, `message`, `message_delete`, `message_clear`, `poll_request` | `message`                                             | Message type, typically you'd be only interested in `message`                                                                        |
+| `topic`       | ✔️       | *string*                                                                        | `topic1,topic2`                                       | Comma-separated list of topics the message is associated with; only one for all `message` events, but may be a list in `open` events |
+| `sequence_id` | -        | *string*                                                                        | `my-sequence-123`                                     | Sequence ID for [updating/deleting notifications](../publish.md#updating-deleting-notifications)                                 |
+| `message`     | -        | *string*                                                                        | `Some message`                                        | Message body; always present in `message` events                                                                                     |
+| `title`       | -        | *string*                                                                        | `Some title`                                          | Message [title](../publish.md#message-title); if not set defaults to `ntfy.sh/<topic>`                                               |
+| `tags`        | -        | *string array*                                                                  | `["tag1","tag2"]`                                     | List of [tags](../publish.md#tags-emojis) that may or not map to emojis                                                              |
+| `priority`    | -        | *1, 2, 3, 4, or 5*                                                              | `4`                                                   | Message [priority](../publish.md#message-priority) with 1=min, 3=default and 5=max                                                   |
+| `click`       | -        | *URL*                                                                           | `https://example.com`                                 | Website opened when notification is [clicked](../publish.md#click-action)                                                            |
+| `actions`     | -        | *JSON array*                                                                    | *see [actions buttons](../publish.md#action-buttons)* | [Action buttons](../publish.md#action-buttons) that can be displayed in the notification                                             |
+| `attachment`  | -        | *JSON object*                                                                   | *see below*                                           | Details about an attachment (name, URL, size, ...)                                                                                   |
 
 **Attachment** (part of the message, see [attachments](../publish.md#attachments) for details):
 

docs/subscribe/phone.md

@@ -8,13 +8,18 @@ contribute, or [build your own](../develop.md).
 <a href="https://f-droid.org/en/packages/io.heckel.ntfy/"><img width="170" src="../../static/img/badge-fdroid.png"></a>
 <a href="https://apps.apple.com/us/app/ntfy/id1625396347"><img width="150" src="../../static/img/badge-appstore.png"></a>
 
-You can get the Android app from both [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy) and 
-from [F-Droid](https://f-droid.org/en/packages/io.heckel.ntfy/). Both are largely identical, with the one exception that
-the F-Droid flavor does not use Firebase. The iOS app can be downloaded from the [App Store](https://apps.apple.com/us/app/ntfy/id1625396347).
+You can get the Android app from [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy), 
+[F-Droid](https://f-droid.org/en/packages/io.heckel.ntfy/), or via the APKs from [GitHub Releases](https://github.com/binwiederhier/ntfy-android/releases).
+The Google Play and F-Droid releases are largely identical, with the one exception that the F-Droid flavor does not use Firebase. 
+The iOS app can be downloaded from the [App Store](https://apps.apple.com/us/app/ntfy/id1625396347).
 
 Alternatively, you may also want to consider using the **[progressive web app (PWA)](pwa.md)** instead of the native app.
 The PWA is a website that you can add to your home screen, and it will behave just like a native app.
 
+If you're downloading the APKs from [GitHub](https://github.com/binwiederhier/ntfy-android/releases), they are signed with
+a certificate with the following SHA-256 fingerprint: `6e145d7ae685eff75468e5067e03a6c3645453343e4e181dac8b6b17ff67489d`.
+You can also query the DNS TXT records for `ntfy.sh` to find this fingerprint.
+
 ## Overview
 A picture is worth a thousand words. Here are a few screenshots showing what the app looks like. It's all pretty
 straight forward. You can add topics and as soon as you add them, you can [publish messages](../publish.md) to them.
@@ -95,7 +100,7 @@ The reason for this is [Firebase Cloud Messaging (FCM)](https://firebase.google.
 notifications. Firebase is overall pretty bad at delivering messages in time, but on Android, most apps are stuck with it.
 
 The ntfy Android app uses Firebase only for the main host `ntfy.sh`, and only in the Google Play flavor of the app.
-It won't use Firebase for any self-hosted servers, and not at all in the the F-Droid flavor.
+It won't use Firebase for any self-hosted servers, and not at all in the F-Droid flavor.
 
 ## Share to topic
 _Supported on:_ :material-android:
@@ -124,10 +129,11 @@ or to simply directly link to a topic from a mobile website.
 
 **Supported link formats:**
 
-| Link format                                                                   | Example                                   | Description                                                                                                                                                                                         |
-|-------------------------------------------------------------------------------|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| <span style="white-space: nowrap">`ntfy://<host>/<topic>`</span>              | `ntfy://ntfy.sh/mytopic`                  | Directly opens the Android app detail view for the given topic and server. Subscribes to the topic if not already subscribed. This is equivalent to the web view `https://ntfy.sh/mytopic` (HTTPS!) |
-| <span style="white-space: nowrap">`ntfy://<host>/<topic>?secure=false`</span> | `ntfy://example.com/mytopic?secure=false` | Same as above, except that this will use HTTP instead of HTTPS as topic URL. This is equivalent to the web view `http://example.com/mytopic` (HTTP!)                                                |
+| Link format                                                                     | Example                                   | Description                                                                                                                                                                                         |
+|---------------------------------------------------------------------------------|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| <span style="white-space: nowrap">`ntfy://<host>/<topic>`</span>                | `ntfy://ntfy.sh/mytopic`                  | Directly opens the Android app detail view for the given topic and server. Subscribes to the topic if not already subscribed. This is equivalent to the web view `https://ntfy.sh/mytopic` (HTTPS!) |
+| <span style="white-space: nowrap">`ntfy://<host>/<topic>?display=<name>`</span> | `ntfy://ntfy.sh/mytopic?display=My+Topic` | Same as above, but also defines a display name for the topic.                                                                                                                                       |
+| <span style="white-space: nowrap">`ntfy://<host>/<topic>?secure=false`</span>   | `ntfy://example.com/mytopic?secure=false` | Same as above, except that this will use HTTP instead of HTTPS as topic URL. This is equivalent to the web view `http://example.com/mytopic` (HTTP!)                                                |
 
 ## Integrations
 

docs/troubleshooting.md

@@ -1,7 +1,7 @@
 # Troubleshooting
 This page lists a few suggestions of what to do when things don't work as expected. This is not a complete list. 
-If this page does not help, feel free to drop by the [Discord](https://discord.gg/cT7ECsZj9w) or [Matrix](https://matrix.to/#/#ntfy:matrix.org)
-and ask there. We're happy to help.
+If this page does not help, feel free to reach out via one of the channels listed on the [contact page](contact.md).
+We're happy to help.
 
 ## ntfy server
 If you host your own ntfy server, and you're having issues with any component, it is always helpful to enable debugging/tracing
@@ -129,3 +129,15 @@ keyboard.
 
 ## iOS app
 Sorry, there is no way to debug or get the logs from the iOS app (yet), outside of running the app in Xcode.
+
+## Other
+
+### "Reconnecting..." / Late notifications on mobile (self-hosted)
+
+If all of your topics are showing as "Reconnecting" and notifications are taking a long time (30+ minutes) to come in, or if you're only getting new pushes with a manual refresh, double-check your configuration:
+
+* If ntfy is behind a reverse proxy (such as Nginx):
+    * Make sure `behind-proxy` is enabled in ntfy's config.
+    * Make sure WebSockets are enabled in the reverse proxy config.
+* Make sure you have granted permission to access all of your topics, either to a logged-in user account or to `everyone`. All subscribed topics are joined into a single WebSocket/JSON request, so a single topic that receives `403 Forbidden` will prevent the entire request from going through.
+    * In particular, double-check that `everyone` has permission to write to `up*` and your user has permission to read `up*` if you are using UnifiedPush.

go.mod

@@ -1,27 +1,27 @@
 module heckel.io/ntfy/v2
 
-go 1.24
+go 1.24.0
 
-toolchain go1.24.0
+toolchain go1.24.5
 
 require (
-	cloud.google.com/go/firestore v1.18.0 // indirect
-	cloud.google.com/go/storage v1.56.0 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	cloud.google.com/go/firestore v1.21.0 // indirect
+	cloud.google.com/go/storage v1.59.1 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/emersion/go-smtp v0.18.0
-	github.com/gabriel-vasile/mimetype v1.4.9
+	github.com/gabriel-vasile/mimetype v1.4.12
 	github.com/gorilla/websocket v1.5.3
-	github.com/mattn/go-sqlite3 v1.14.30
+	github.com/mattn/go-sqlite3 v1.14.33
 	github.com/olebedev/when v1.1.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/urfave/cli/v2 v2.27.7
-	golang.org/x/crypto v0.40.0
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.16.0
-	golang.org/x/term v0.33.0
-	golang.org/x/time v0.12.0
-	google.golang.org/api v0.244.0
+	golang.org/x/crypto v0.47.0
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sync v0.19.0
+	golang.org/x/term v0.39.0
+	golang.org/x/time v0.14.0
+	google.golang.org/api v0.260.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -33,35 +33,35 @@ require (
 	firebase.google.com/go/v4 v4.18.0
 	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/prometheus/client_golang v1.23.0
+	github.com/prometheus/client_golang v1.23.2
 	github.com/stripe/stripe-go/v74 v74.30.0
-	golang.org/x/text v0.27.0
+	golang.org/x/text v0.33.0
 )
 
 require (
-	cel.dev/expr v0.24.0 // indirect
-	cloud.google.com/go v0.121.4 // indirect
-	cloud.google.com/go/auth v0.16.3 // indirect
+	cel.dev/expr v0.25.1 // indirect
+	cloud.google.com/go v0.123.0 // indirect
+	cloud.google.com/go/auth v0.18.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
-	cloud.google.com/go/iam v1.5.2 // indirect
-	cloud.google.com/go/longrunning v0.6.7 // indirect
-	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/iam v1.5.3 // indirect
+	cloud.google.com/go/longrunning v0.8.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
 	github.com/MicahParks/keyfunc v1.9.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
@@ -69,36 +69,36 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
-	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
-	github.com/zeebo/errs v1.4.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.37.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
-	google.golang.org/genproto v0.0.0-20250804133106-a7a43d27e69b // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto v0.0.0-20260114163908-3f89685c29c3 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260114163908-3f89685c29c3 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260114163908-3f89685c29c3 // indirect
+	google.golang.org/grpc v1.78.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,41 +1,41 @@
-cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
-cloud.google.com/go v0.121.4 h1:cVvUiY0sX0xwyxPwdSU2KsF9knOVmtRyAMt8xou0iTs=
-cloud.google.com/go v0.121.4/go.mod h1:XEBchUiHFJbz4lKBZwYBDHV/rSyfFktk737TLDU089s=
-cloud.google.com/go/auth v0.16.3 h1:kabzoQ9/bobUmnseYnBO6qQG7q4a/CffFRlJSxv2wCc=
-cloud.google.com/go/auth v0.16.3/go.mod h1:NucRGjaXfzP1ltpcQ7On/VTZ0H4kWB5Jy+Y9Dnm76fA=
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
+cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
+cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
+cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
-cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
-cloud.google.com/go/firestore v1.18.0 h1:cuydCaLS7Vl2SatAeivXyhbhDEIR8BDmtn4egDhIn2s=
-cloud.google.com/go/firestore v1.18.0/go.mod h1:5ye0v48PhseZBdcl0qbl3uttu7FIEwEYVaWm0UIEOEU=
-cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
-cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
-cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
-cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
-cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
-cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
-cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
-cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
-cloud.google.com/go/storage v1.56.0 h1:iixmq2Fse2tqxMbWhLWC9HfBj1qdxqAmiK8/eqtsLxI=
-cloud.google.com/go/storage v1.56.0/go.mod h1:Tpuj6t4NweCLzlNbw9Z9iwxEkrSem20AetIeH/shgVU=
-cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
-cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+cloud.google.com/go/firestore v1.21.0 h1:BhopUsx7kh6NFx77ccRsHhrtkbJUmDAxNY3uapWdjcM=
+cloud.google.com/go/firestore v1.21.0/go.mod h1:1xH6HNcnkf/gGyR8udd6pFO4Z7GWJSwLKQMx/u6UrP4=
+cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
+cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
+cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
+cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
+cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
+cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
+cloud.google.com/go/storage v1.59.1 h1:DXAZLcTimtiXdGqDSnebROVPd9QvRsFVVlptz02Wk58=
+cloud.google.com/go/storage v1.59.1/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
+cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
+cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 firebase.google.com/go/v4 v4.18.0 h1:S+g0P72oDGqOaG4wlLErX3zQmU9plVdu7j+Bc3R1qFw=
 firebase.google.com/go/v4 v4.18.0/go.mod h1:P7UfBpzc8+Z3MckX79+zsWzKVfpGryr6HLbAe7gCWfs=
 github.com/AlekSi/pointer v1.2.0 h1:glcy/gc4h8HnG2Z3ZECSzZ1IX1x2JxRVuDzaJwQE0+w=
 github.com/AlekSi/pointer v1.2.0/go.mod h1:gZGfd3dpW4vEc/UlyfKKi1roIqcCgwOIvb0tSNSBle0=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 h1:lhhYARPUu3LmHysQ/igznQphfzynnqI3D75oUyw1HXk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0 h1:xfK3bbi6F2RDtaZFtUdKO3osOBIhNb+xTs8lFW6yx9o=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 h1:s0WlVbf9qpvkh1c/uDAPElam0WrL7fHRIidgZJ7UqZI=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
 github.com/MicahParks/keyfunc v1.9.0 h1:lhKd5xrFHLNOWrDc4Tyb/Q1AJ4LCzQ48GVJyVIID3+o=
 github.com/MicahParks/keyfunc v1.9.0/go.mod h1:IdnCilugA0O/99dW+/MkvlyrsX8+L8+x95xuVNtM5jw=
 github.com/SherClockHolmes/webpush-go v1.4.0 h1:ocnzNKWN23T9nvHi6IfyrQjkIc0oJWv1B1pULsf9i3s=
@@ -46,8 +46,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
-github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -58,20 +58,20 @@ github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3
 github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
 github.com/emersion/go-smtp v0.17.0 h1:tq90evlrcyqRfE6DSXaWVH54oX6OuZOQECEmhWBMEtI=
 github.com/emersion/go-smtp v0.17.0/go.mod h1:qm27SGYgoIPRot6ubfQ/GpiPy/g3PaZAVRxiO/sDUgQ=
-github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
-github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
-github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
-github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
-github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
-github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
+github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
+github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
-github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
-github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
-github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -96,10 +96,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
-github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
-github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
-github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
+github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
+github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -112,8 +112,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mattn/go-sqlite3 v1.14.30 h1:bVreufq3EAIG1Quvws73du3/QgdeZ3myglJlrzSYYCY=
-github.com/mattn/go-sqlite3 v1.14.30/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
+github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -127,26 +127,26 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
-github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
-github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
-github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
-github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
+github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
+github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stripe/stripe-go/v74 v74.30.0 h1:0Kf0KkeFnY7iRhOwvTerX0Ia1BRw+eV1CVJ51mGYAUY=
 github.com/stripe/stripe-go/v74 v74.30.0/go.mod h1:f9L6LvaXa35ja7eyvP6GQswoaIPaBRvGAimAO+udbBw=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
@@ -154,38 +154,38 @@ github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AO
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
-github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/detectors/gcp v1.37.0 h1:B+WbN9RPsvobe6q4vP6KgM8/9plR/HNjgGBrfcOlweA=
-go.opentelemetry.io/contrib/detectors/gcp v1.37.0/go.mod h1:K5zQ3TT7p2ru9Qkzk0bKtCql0RGkPj9pRjpXgZJZ+rU=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 h1:rbRJ8BBoVMsQShESYZ0FkvcITu8X8QNwJogcLUmDNNw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0/go.mod h1:ru6KHrNtNHxM4nD/vd6QrLVWgKhxPYgblq4VAtNawTQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
-go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
+go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0 h1:RN3ifU8y4prNWeEnQp2kRRHz8UwonAEYZl8tUzHEXAk=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0/go.mod h1:habDz3tEWiFANTo6oUE99EmaFUrCNYAAg3wiVmusm70=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -200,10 +200,10 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -211,8 +211,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -225,8 +225,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -236,8 +236,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -249,10 +249,10 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
@@ -261,22 +261,24 @@ golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.244.0 h1:lpkP8wVibSKr++NCD36XzTk/IzeKJ3klj7vbj+XU5pE=
-google.golang.org/api v0.244.0/go.mod h1:dMVhVcylamkirHdzEBAIQWUCgqY885ivNeZYd7VAVr8=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.260.0 h1:XbNi5E6bOVEj/uLXQRlt6TKuEzMD7zvW/6tNwltE4P4=
+google.golang.org/api v0.260.0/go.mod h1:Shj1j0Phr/9sloYrKomICzdYgsSDImpTxME8rGLaZ/o=
 google.golang.org/appengine/v2 v2.0.6 h1:LvPZLGuchSBslPBp+LAhihBeGSiRh1myRoYK4NtuBIw=
 google.golang.org/appengine/v2 v2.0.6/go.mod h1:WoEXGoXNfa0mLvaH5sV3ZSGXwVmy8yf7Z1JKf3J3wLI=
-google.golang.org/genproto v0.0.0-20250804133106-a7a43d27e69b h1:eZTgydvqZO44zyTZAvMaSyAxccZZdraiSAGvqOczVvk=
-google.golang.org/genproto v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:suyz2QBHQKlGIF92HEEsCfO1SwxXdk7PFLz+Zd9Uah4=
-google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b h1:ULiyYQ0FdsJhwwZUwbaXpZF5yUE3h+RA+gxvBu37ucc=
-google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:oDOGiMSXHL4sDTJvFvIB9nRQCGdLP1o/iVaqQK8zB+M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b h1:zPKJod4w6F1+nRGDI9ubnXYhU9NSWoFAijkHkUXeTK8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/genproto v0.0.0-20260114163908-3f89685c29c3 h1:rUamZFBwsWVWg4Yb7iTbwYp81XVHUvOXNdrFCoYRRNE=
+google.golang.org/genproto v0.0.0-20260114163908-3f89685c29c3/go.mod h1:wE6SUYr3iNtF/D0GxVAjT+0CbDFktQNssYs9PVptCt4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260114163908-3f89685c29c3 h1:X9z6obt+cWRX8XjDVOn+SZWhWe5kZHm46TThU9j+jss=
+google.golang.org/genproto/googleapis/api v0.0.0-20260114163908-3f89685c29c3/go.mod h1:dd646eSK+Dk9kxVBl1nChEOhJPtMXriCcVb4x3o6J+E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260114163908-3f89685c29c3 h1:C4WAdL+FbjnGlpp2S+HMVhBeCq2Lcib4xZqfPNF6OoQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260114163908-3f89685c29c3/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
+google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

mkdocs.yml

@@ -99,6 +99,8 @@ nav:
       - "Known issues": known-issues.md
       - "Deprecation notices": deprecations.md
       - "Development": develop.md
+      - "Contributing": contributing.md
       - "Privacy policy": privacy.md
+      - "Contact": contact.md
 
 

server/config.go

@@ -3,6 +3,7 @@ package server
 import (
 	"io/fs"
 	"net/netip"
+	"text/template"
 	"time"
 
 	"heckel.io/ntfy/v2/user"
@@ -128,6 +129,7 @@ type Config struct {
 	TwilioCallsBaseURL                   string
 	TwilioVerifyBaseURL                  string
 	TwilioVerifyService                  string
+	TwilioCallFormat                     *template.Template
 	MetricsEnable                        bool
 	MetricsListenHTTP                    string
 	ProfileListenHTTP                    string
@@ -162,6 +164,7 @@ type Config struct {
 	BillingContact                       string
 	EnableSignup                         bool // Enable creation of accounts via API and UI
 	EnableLogin                          bool
+	RequireLogin                         bool
 	EnableReservations                   bool // Allow users with role "user" to own/reserve topics
 	EnableMetrics                        bool
 	AccessControlAllowOrigin             string // CORS header field to restrict access from web clients
@@ -225,6 +228,7 @@ func NewConfig() *Config {
 		TwilioPhoneNumber:                    "",
 		TwilioVerifyBaseURL:                  "https://verify.twilio.com", // Override for tests
 		TwilioVerifyService:                  "",
+		TwilioCallFormat:                     nil,
 		MessageSizeLimit:                     DefaultMessageSizeLimit,
 		MessageDelayMin:                      DefaultMessageDelayMin,
 		MessageDelayMax:                      DefaultMessageDelayMax,
@@ -256,6 +260,7 @@ func NewConfig() *Config {
 		EnableSignup:                         false,
 		EnableLogin:                          false,
 		EnableReservations:                   false,
+		RequireLogin:                         false,
 		AccessControlAllowOrigin:             "*",
 		Version:                              "",
 		WebPushPrivateKey:                    "",

server/errors.go

@@ -3,8 +3,9 @@ package server
 import (
 	"encoding/json"
 	"fmt"
-	"heckel.io/ntfy/v2/log"
 	"net/http"
+
+	"heckel.io/ntfy/v2/log"
 )
 
 // errHTTP is a generic HTTP error for any non-200 HTTP error
@@ -125,6 +126,7 @@ var (
 	errHTTPBadRequestInvalidUsername                 = &errHTTP{40046, http.StatusBadRequest, "invalid request: invalid username", "", nil}
 	errHTTPBadRequestTemplateFileNotFound            = &errHTTP{40047, http.StatusBadRequest, "invalid request: template file not found", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestTemplateFileInvalid             = &errHTTP{40048, http.StatusBadRequest, "invalid request: template file invalid", "https://ntfy.sh/docs/publish/#message-templating", nil}
+	errHTTPBadRequestSequenceIDInvalid               = &errHTTP{40049, http.StatusBadRequest, "invalid request: sequence ID invalid", "https://ntfy.sh/docs/publish/#updating-deleting-notifications", nil}
 	errHTTPNotFound                                  = &errHTTP{40401, http.StatusNotFound, "page not found", "", nil}
 	errHTTPUnauthorized                              = &errHTTP{40101, http.StatusUnauthorized, "unauthorized", "https://ntfy.sh/docs/publish/#authentication", nil}
 	errHTTPForbidden                                 = &errHTTP{40301, http.StatusForbidden, "forbidden", "https://ntfy.sh/docs/publish/#authentication", nil}

server/message_cache.go

@@ -29,7 +29,9 @@ const (
 		CREATE TABLE IF NOT EXISTS messages (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			mid TEXT NOT NULL,
+			sequence_id TEXT NOT NULL,
 			time INT NOT NULL,
+			event TEXT NOT NULL,
 			expires INT NOT NULL,
 			topic TEXT NOT NULL,
 			message TEXT NOT NULL,
@@ -52,6 +54,7 @@ const (
 			published INT NOT NULL
 		);
 		CREATE INDEX IF NOT EXISTS idx_mid ON messages (mid);
+		CREATE INDEX IF NOT EXISTS idx_sequence_id ON messages (sequence_id);
 		CREATE INDEX IF NOT EXISTS idx_time ON messages (time);
 		CREATE INDEX IF NOT EXISTS idx_topic ON messages (topic);
 		CREATE INDEX IF NOT EXISTS idx_expires ON messages (expires);
@@ -66,50 +69,50 @@ const (
 		COMMIT;
 	`
 	insertMessageQuery = `
-		INSERT INTO messages (mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, attachment_deleted, sender, user, content_type, encoding, published)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		INSERT INTO messages (mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, attachment_deleted, sender, user, content_type, encoding, published)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`
 	deleteMessageQuery                = `DELETE FROM messages WHERE mid = ?`
 	updateMessagesForTopicExpiryQuery = `UPDATE messages SET expires = ? WHERE topic = ?`
 	selectRowIDFromMessageID          = `SELECT id FROM messages WHERE mid = ?` // Do not include topic, see #336 and TestServer_PollSinceID_MultipleTopics
 	selectMessagesByIDQuery           = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE mid = ?
 	`
 	selectMessagesSinceTimeQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE topic = ? AND time >= ? AND published = 1
 		ORDER BY time, id
 	`
 	selectMessagesSinceTimeIncludeScheduledQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE topic = ? AND time >= ?
 		ORDER BY time, id
 	`
 	selectMessagesSinceIDQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
-		WHERE topic = ? AND id > ? AND published = 1 
+		WHERE topic = ? AND id > ? AND published = 1
 		ORDER BY time, id
 	`
 	selectMessagesSinceIDIncludeScheduledQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE topic = ? AND (id > ? OR published = 0)
 		ORDER BY time, id
 	`
 	selectMessagesLatestQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE topic = ? AND published = 1
 		ORDER BY time DESC, id DESC
 		LIMIT 1
 	`
 	selectMessagesDueQuery = `
-		SELECT mid, time, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
+		SELECT mid, sequence_id, time, event, expires, topic, message, title, priority, tags, click, icon, actions, attachment_name, attachment_type, attachment_size, attachment_expires, attachment_url, sender, user, content_type, encoding
 		FROM messages
 		WHERE time <= ? AND published = 0
 		ORDER BY time, id
@@ -131,7 +134,7 @@ const (
 
 // Schema management queries
 const (
-	currentSchemaVersion          = 13
+	currentSchemaVersion          = 14
 	createSchemaVersionTableQuery = `
 		CREATE TABLE IF NOT EXISTS schemaVersion (
 			id INT PRIMARY KEY,
@@ -260,6 +263,13 @@ const (
 	migrate12To13AlterMessagesTableQuery = `
 		CREATE INDEX IF NOT EXISTS idx_topic ON messages (topic);
 	`
+
+	//13 -> 14
+	migrate13To14AlterMessagesTableQuery = `
+		ALTER TABLE messages ADD COLUMN sequence_id TEXT NOT NULL DEFAULT('');
+		ALTER TABLE messages ADD COLUMN event TEXT NOT NULL DEFAULT('message');
+		CREATE INDEX IF NOT EXISTS idx_sequence_id ON messages (sequence_id);
+	`
 )
 
 var (
@@ -277,6 +287,7 @@ var (
 		10: migrateFrom10,
 		11: migrateFrom11,
 		12: migrateFrom12,
+		13: migrateFrom13,
 	}
 )
 
@@ -369,7 +380,7 @@ func (c *messageCache) addMessages(ms []*message) error {
 	}
 	defer stmt.Close()
 	for _, m := range ms {
-		if m.Event != messageEvent {
+		if m.Event != messageEvent && m.Event != messageDeleteEvent && m.Event != messageClearEvent {
 			return errUnexpectedMessageType
 		}
 		published := m.Time <= time.Now().Unix()
@@ -397,7 +408,9 @@ func (c *messageCache) addMessages(ms []*message) error {
 		}
 		_, err := stmt.Exec(
 			m.ID,
+			m.SequenceID,
 			m.Time,
+			m.Event,
 			m.Expires,
 			m.Topic,
 			m.Message,
@@ -706,10 +719,12 @@ func readMessages(rows *sql.Rows) ([]*message, error) {
 func readMessage(rows *sql.Rows) (*message, error) {
 	var timestamp, expires, attachmentSize, attachmentExpires int64
 	var priority int
-	var id, topic, msg, title, tagsStr, click, icon, actionsStr, attachmentName, attachmentType, attachmentURL, sender, user, contentType, encoding string
+	var id, sequenceID, event, topic, msg, title, tagsStr, click, icon, actionsStr, attachmentName, attachmentType, attachmentURL, sender, user, contentType, encoding string
 	err := rows.Scan(
 		&id,
+		&sequenceID,
 		&timestamp,
+		&event,
 		&expires,
 		&topic,
 		&msg,
@@ -758,9 +773,10 @@ func readMessage(rows *sql.Rows) (*message, error) {
 	}
 	return &message{
 		ID:          id,
+		SequenceID:  sequenceID,
 		Time:        timestamp,
 		Expires:     expires,
-		Event:       messageEvent,
+		Event:       event,
 		Topic:       topic,
 		Message:     msg,
 		Title:       title,
@@ -1030,3 +1046,19 @@ func migrateFrom12(db *sql.DB, _ time.Duration) error {
 	}
 	return tx.Commit()
 }
+
+func migrateFrom13(db *sql.DB, _ time.Duration) error {
+	log.Tag(tagMessageCache).Info("Migrating cache database schema: from 13 to 14")
+	tx, err := db.Begin()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if _, err := tx.Exec(migrate13To14AlterMessagesTableQuery); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(updateSchemaVersion, 14); err != nil {
+		return err
+	}
+	return tx.Commit()
+}

server/message_cache_test.go

@@ -319,6 +319,7 @@ func testCacheAttachments(t *testing.T, c *messageCache) {
 	expires1 := time.Now().Add(-4 * time.Hour).Unix() // Expired
 	m := newDefaultMessage("mytopic", "flower for you")
 	m.ID = "m1"
+	m.SequenceID = "m1"
 	m.Sender = netip.MustParseAddr("1.2.3.4")
 	m.Attachment = &attachment{
 		Name:    "flower.jpg",
@@ -332,6 +333,7 @@ func testCacheAttachments(t *testing.T, c *messageCache) {
 	expires2 := time.Now().Add(2 * time.Hour).Unix() // Future
 	m = newDefaultMessage("mytopic", "sending you a car")
 	m.ID = "m2"
+	m.SequenceID = "m2"
 	m.Sender = netip.MustParseAddr("1.2.3.4")
 	m.Attachment = &attachment{
 		Name:    "car.jpg",
@@ -345,6 +347,7 @@ func testCacheAttachments(t *testing.T, c *messageCache) {
 	expires3 := time.Now().Add(1 * time.Hour).Unix() // Future
 	m = newDefaultMessage("another-topic", "sending you another car")
 	m.ID = "m3"
+	m.SequenceID = "m3"
 	m.User = "u_BAsbaAa"
 	m.Sender = netip.MustParseAddr("5.6.7.8")
 	m.Attachment = &attachment{
@@ -400,11 +403,13 @@ func TestMemCache_Attachments_Expired(t *testing.T) {
 func testCacheAttachmentsExpired(t *testing.T, c *messageCache) {
 	m := newDefaultMessage("mytopic", "flower for you")
 	m.ID = "m1"
+	m.SequenceID = "m1"
 	m.Expires = time.Now().Add(time.Hour).Unix()
 	require.Nil(t, c.AddMessage(m))
 
 	m = newDefaultMessage("mytopic", "message with attachment")
 	m.ID = "m2"
+	m.SequenceID = "m2"
 	m.Expires = time.Now().Add(2 * time.Hour).Unix()
 	m.Attachment = &attachment{
 		Name:    "car.jpg",
@@ -417,6 +422,7 @@ func testCacheAttachmentsExpired(t *testing.T, c *messageCache) {
 
 	m = newDefaultMessage("mytopic", "message with external attachment")
 	m.ID = "m3"
+	m.SequenceID = "m3"
 	m.Expires = time.Now().Add(2 * time.Hour).Unix()
 	m.Attachment = &attachment{
 		Name:    "car.jpg",
@@ -428,6 +434,7 @@ func testCacheAttachmentsExpired(t *testing.T, c *messageCache) {
 
 	m = newDefaultMessage("mytopic2", "message with expired attachment")
 	m.ID = "m4"
+	m.SequenceID = "m4"
 	m.Expires = time.Now().Add(2 * time.Hour).Unix()
 	m.Attachment = &attachment{
 		Name:    "expired-car.jpg",

server/server.go

@@ -9,8 +9,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"gopkg.in/yaml.v2"
-	"heckel.io/ntfy/v2/payments"
 	"io"
 	"net"
 	"net/http"
@@ -33,7 +31,9 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"golang.org/x/sync/errgroup"
+	"gopkg.in/yaml.v2"
 	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/payments"
 	"heckel.io/ntfy/v2/user"
 	"heckel.io/ntfy/v2/util"
 	"heckel.io/ntfy/v2/util/sprig"
@@ -80,11 +80,12 @@ var (
 	wsPathRegex            = regexp.MustCompile(`^/[-_A-Za-z0-9]{1,64}(,[-_A-Za-z0-9]{1,64})*/ws$`)
 	authPathRegex          = regexp.MustCompile(`^/[-_A-Za-z0-9]{1,64}(,[-_A-Za-z0-9]{1,64})*/auth$`)
 	publishPathRegex       = regexp.MustCompile(`^/[-_A-Za-z0-9]{1,64}/(publish|send|trigger)$`)
+	updatePathRegex        = regexp.MustCompile(`^/[-_A-Za-z0-9]{1,64}/[-_A-Za-z0-9]{1,64}$`)
+	clearPathRegex         = regexp.MustCompile(`^/[-_A-Za-z0-9]{1,64}/[-_A-Za-z0-9]{1,64}/(read|clear)$`)
+	sequenceIDRegex        = topicRegex
 
 	webConfigPath                                        = "/config.js"
 	webManifestPath                                      = "/manifest.webmanifest"
-	webRootHTMLPath                                      = "/app.html"
-	webServiceWorkerPath                                 = "/sw.js"
 	accountPath                                          = "/account"
 	matrixPushPath                                       = "/_matrix/push/v1/notify"
 	metricsPath                                          = "/metrics"
@@ -108,7 +109,7 @@ var (
 	apiAccountBillingSubscriptionCheckoutSuccessTemplate = "/v1/account/billing/subscription/success/{CHECKOUT_SESSION_ID}"
 	apiAccountBillingSubscriptionCheckoutSuccessRegex    = regexp.MustCompile(`/v1/account/billing/subscription/success/(.+)$`)
 	apiAccountReservationSingleRegex                     = regexp.MustCompile(`/v1/account/reservation/([-_A-Za-z0-9]{1,64})$`)
-	staticRegex                                          = regexp.MustCompile(`^/static/.+`)
+	staticRegex                                          = regexp.MustCompile(`^/(static/.+|app.html|sw.js|sw.js.map)$`)
 	docsRegex                                            = regexp.MustCompile(`^/docs(|/.*)$`)
 	fileRegex                                            = regexp.MustCompile(`^/file/([-_A-Za-z0-9]{1,64})(?:\.[A-Za-z0-9]{1,16})?$`)
 	urlRegex                                             = regexp.MustCompile(`^https?://`)
@@ -137,7 +138,7 @@ var (
 const (
 	firebaseControlTopic     = "~control"                // See Android if changed
 	firebasePollTopic        = "~poll"                   // See iOS if changed (DISABLED for now)
-	emptyMessageBody         = "triggered"               // Used if message body is empty
+	emptyMessageBody         = "triggered"               // Used when a message body is empty
 	newMessageBody           = "New message"             // Used in poll requests as generic message
 	defaultAttachmentMessage = "You received a file: %s" // Used if message body is empty, and there is an attachment
 	encodingBase64           = "base64"                  // Used mainly for binary UnifiedPush messages
@@ -531,7 +532,7 @@ func (s *Server) handleInternal(w http.ResponseWriter, r *http.Request, v *visit
 		return s.handleMatrixDiscovery(w)
 	} else if r.Method == http.MethodGet && r.URL.Path == metricsPath && s.metricsHandler != nil {
 		return s.handleMetrics(w, r, v)
-	} else if r.Method == http.MethodGet && (staticRegex.MatchString(r.URL.Path) || r.URL.Path == webServiceWorkerPath || r.URL.Path == webRootHTMLPath) {
+	} else if r.Method == http.MethodGet && staticRegex.MatchString(r.URL.Path) {
 		return s.ensureWebEnabled(s.handleStatic)(w, r, v)
 	} else if r.Method == http.MethodGet && docsRegex.MatchString(r.URL.Path) {
 		return s.ensureWebEnabled(s.handleDocs)(w, r, v)
@@ -543,8 +544,12 @@ func (s *Server) handleInternal(w http.ResponseWriter, r *http.Request, v *visit
 		return s.transformBodyJSON(s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handlePublish)))(w, r, v)
 	} else if r.Method == http.MethodPost && r.URL.Path == matrixPushPath {
 		return s.transformMatrixJSON(s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handlePublishMatrix)))(w, r, v)
-	} else if (r.Method == http.MethodPut || r.Method == http.MethodPost) && topicPathRegex.MatchString(r.URL.Path) {
+	} else if (r.Method == http.MethodPut || r.Method == http.MethodPost) && (topicPathRegex.MatchString(r.URL.Path) || updatePathRegex.MatchString(r.URL.Path)) {
 		return s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handlePublish))(w, r, v)
+	} else if r.Method == http.MethodDelete && updatePathRegex.MatchString(r.URL.Path) {
+		return s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handleDelete))(w, r, v)
+	} else if r.Method == http.MethodPut && clearPathRegex.MatchString(r.URL.Path) {
+		return s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handleClear))(w, r, v)
 	} else if r.Method == http.MethodGet && publishPathRegex.MatchString(r.URL.Path) {
 		return s.limitRequestsWithTopic(s.authorizeTopicWrite(s.handlePublish))(w, r, v)
 	} else if r.Method == http.MethodGet && jsonPathRegex.MatchString(r.URL.Path) {
@@ -600,6 +605,7 @@ func (s *Server) handleWebConfig(w http.ResponseWriter, _ *http.Request, _ *visi
 		BaseURL:            "", // Will translate to window.location.origin
 		AppRoot:            s.config.WebRoot,
 		EnableLogin:        s.config.EnableLogin,
+		RequireLogin:       s.config.RequireLogin,
 		EnableSignup:       s.config.EnableSignup,
 		EnablePayments:     s.config.StripeSecretKey != "",
 		EnableCalls:        s.config.TwilioAccount != "",
@@ -871,7 +877,7 @@ func (s *Server) handlePublish(w http.ResponseWriter, r *http.Request, v *visito
 		return err
 	}
 	minc(metricMessagesPublishedSuccess)
-	return s.writeJSON(w, m)
+	return s.writeJSON(w, m.forJSON())
 }
 
 func (s *Server) handlePublishMatrix(w http.ResponseWriter, r *http.Request, v *visitor) error {
@@ -899,6 +905,58 @@ func (s *Server) handlePublishMatrix(w http.ResponseWriter, r *http.Request, v *
 	return writeMatrixSuccess(w)
 }
 
+func (s *Server) handleDelete(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	return s.handleActionMessage(w, r, v, messageDeleteEvent)
+}
+
+func (s *Server) handleClear(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	return s.handleActionMessage(w, r, v, messageClearEvent)
+}
+
+func (s *Server) handleActionMessage(w http.ResponseWriter, r *http.Request, v *visitor, event string) error {
+	t, err := fromContext[*topic](r, contextTopic)
+	if err != nil {
+		return err
+	}
+	vrate, err := fromContext[*visitor](r, contextRateVisitor)
+	if err != nil {
+		return err
+	}
+	if !util.ContainsIP(s.config.VisitorRequestExemptPrefixes, v.ip) && !vrate.MessageAllowed() {
+		return errHTTPTooManyRequestsLimitMessages.With(t)
+	}
+	sequenceID, e := s.sequenceIDFromPath(r.URL.Path)
+	if e != nil {
+		return e.With(t)
+	}
+	// Create an action message with the given event type
+	m := newActionMessage(event, t.ID, sequenceID)
+	m.Sender = v.IP()
+	m.User = v.MaybeUserID()
+	m.Expires = time.Unix(m.Time, 0).Add(v.Limits().MessageExpiryDuration).Unix()
+	// Publish to subscribers
+	if err := t.Publish(v, m); err != nil {
+		return err
+	}
+	// Send to Firebase for Android clients
+	if s.firebaseClient != nil {
+		go s.sendToFirebase(v, m)
+	}
+	// Send to web push endpoints
+	if s.config.WebPushPublicKey != "" {
+		go s.publishToWebPushEndpoints(v, m)
+	}
+	// Add to message cache
+	if err := s.messageCache.AddMessage(m); err != nil {
+		return err
+	}
+	logvrm(v, r, m).Tag(tagPublish).Debug("Published %s for sequence ID %s", event, sequenceID)
+	s.mu.Lock()
+	s.messages++
+	s.mu.Unlock()
+	return s.writeJSON(w, m.forJSON())
+}
+
 func (s *Server) sendToFirebase(v *visitor, m *message) {
 	logvm(v, m).Tag(tagFirebase).Debug("Publishing to Firebase")
 	if err := s.firebaseClient.Send(v, m); err != nil {
@@ -956,6 +1014,24 @@ func (s *Server) forwardPollRequest(v *visitor, m *message) {
 }
 
 func (s *Server) parsePublishParams(r *http.Request, m *message) (cache bool, firebase bool, email, call string, template templateMode, unifiedpush bool, err *errHTTP) {
+	if r.Method != http.MethodGet && updatePathRegex.MatchString(r.URL.Path) {
+		pathSequenceID, err := s.sequenceIDFromPath(r.URL.Path)
+		if err != nil {
+			return false, false, "", "", "", false, err
+		}
+		m.SequenceID = pathSequenceID
+	} else {
+		sequenceID := readParam(r, "x-sequence-id", "sequence-id", "sid")
+		if sequenceID != "" {
+			if sequenceIDRegex.MatchString(sequenceID) {
+				m.SequenceID = sequenceID
+			} else {
+				return false, false, "", "", "", false, errHTTPBadRequestSequenceIDInvalid
+			}
+		} else {
+			m.SequenceID = m.ID
+		}
+	}
 	cache = readBoolParam(r, true, "x-cache", "cache")
 	firebase = readBoolParam(r, true, "x-firebase", "firebase")
 	m.Title = readParam(r, "x-title", "title", "t")
@@ -1270,7 +1346,7 @@ func (s *Server) handleBodyAsAttachment(r *http.Request, v *visitor, m *message,
 func (s *Server) handleSubscribeJSON(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	encoder := func(msg *message) (string, error) {
 		var buf bytes.Buffer
-		if err := json.NewEncoder(&buf).Encode(&msg); err != nil {
+		if err := json.NewEncoder(&buf).Encode(msg.forJSON()); err != nil {
 			return "", err
 		}
 		return buf.String(), nil
@@ -1281,10 +1357,10 @@ func (s *Server) handleSubscribeJSON(w http.ResponseWriter, r *http.Request, v *
 func (s *Server) handleSubscribeSSE(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	encoder := func(msg *message) (string, error) {
 		var buf bytes.Buffer
-		if err := json.NewEncoder(&buf).Encode(&msg); err != nil {
+		if err := json.NewEncoder(&buf).Encode(msg.forJSON()); err != nil {
 			return "", err
 		}
-		if msg.Event != messageEvent {
+		if msg.Event != messageEvent && msg.Event != messageDeleteEvent && msg.Event != messageClearEvent {
 			return fmt.Sprintf("event: %s\ndata: %s\n", msg.Event, buf.String()), nil // Browser's .onmessage() does not fire on this!
 		}
 		return fmt.Sprintf("data: %s\n", buf.String()), nil
@@ -1694,6 +1770,15 @@ func (s *Server) topicsFromPath(path string) ([]*topic, string, error) {
 	return topics, parts[1], nil
 }
 
+// sequenceIDFromPath returns the sequence ID from a path like /mytopic/sequenceIdHere
+func (s *Server) sequenceIDFromPath(path string) (string, *errHTTP) {
+	parts := strings.Split(path, "/")
+	if len(parts) < 3 {
+		return "", errHTTPBadRequestSequenceIDInvalid
+	}
+	return parts[2], nil
+}
+
 // topicsFromIDs returns the topics with the given IDs, creating them if they don't exist.
 func (s *Server) topicsFromIDs(ids ...string) ([]*topic, error) {
 	s.mu.Lock()
@@ -1948,6 +2033,9 @@ func (s *Server) transformBodyJSON(next handleFunc) handleFunc {
 		if m.Firebase != "" {
 			r.Header.Set("X-Firebase", m.Firebase)
 		}
+		if m.SequenceID != "" {
+			r.Header.Set("X-Sequence-ID", m.SequenceID)
+		}
 		return next(w, r, v)
 	}
 }

server/server.yml

@@ -216,11 +216,13 @@
 # - twilio-auth-token is the Twilio auth token, e.g. affebeef258625862586258625862586
 # - twilio-phone-number is the outgoing phone number you purchased, e.g. +18775132586
 # - twilio-verify-service is the Twilio Verify service SID, e.g. VA12345beefbeef67890beefbeef122586
+# - twilio-call-format is the custom TwiML send to the Call API (optional, see https://www.twilio.com/docs/voice/twiml)
 #
 # twilio-account:
 # twilio-auth-token:
 # twilio-phone-number:
 # twilio-verify-service:
+# twilio-call-format:
 
 # Interval in which keepalive messages are sent to the client. This is to prevent
 # intermediaries closing the connection for inactivity.
@@ -258,9 +260,11 @@
 #
 # - enable-signup allows users to sign up via the web app, or API
 # - enable-login allows users to log in via the web app, or API
+# - require-login redirects users to the login page if they are not logged in (disallows web app access without login)
 # - enable-reservations allows users to reserve topics (if their tier allows it)
 #
 # enable-signup: false
+# require-login: false
 # enable-login: false
 # enable-reservations: false
 

server/server_firebase.go

@@ -80,7 +80,7 @@ type firebaseSenderImpl struct {
 }
 
 func newFirebaseSender(credentialsFile string) (firebaseSender, error) {
-	fb, err := firebase.NewApp(context.Background(), nil, option.WithCredentialsFile(credentialsFile))
+	fb, err := firebase.NewApp(context.Background(), nil, option.WithAuthCredentialsFile(option.ServiceAccount, credentialsFile))
 	if err != nil {
 		return nil, err
 	}
@@ -143,6 +143,15 @@ func toFirebaseMessage(m *message, auther user.Auther) (*messaging.Message, erro
 			"poll_id": m.PollID,
 		}
 		apnsConfig = createAPNSAlertConfig(m, data)
+	case messageDeleteEvent, messageClearEvent:
+		data = map[string]string{
+			"id":          m.ID,
+			"time":        fmt.Sprintf("%d", m.Time),
+			"event":       m.Event,
+			"topic":       m.Topic,
+			"sequence_id": m.SequenceID,
+		}
+		apnsConfig = createAPNSBackgroundConfig(data)
 	case messageEvent:
 		if auther != nil {
 			// If "anonymous read" for a topic is not allowed, we cannot send the message along
@@ -161,6 +170,7 @@ func toFirebaseMessage(m *message, auther user.Auther) (*messaging.Message, erro
 			"time":         fmt.Sprintf("%d", m.Time),
 			"event":        m.Event,
 			"topic":        m.Topic,
+			"sequence_id":  m.SequenceID,
 			"priority":     fmt.Sprintf("%d", m.Priority),
 			"tags":         strings.Join(m.Tags, ","),
 			"click":        m.Click,

server/server_firebase_test.go

@@ -177,6 +177,7 @@ func TestToFirebaseMessage_Message_Normal_Allowed(t *testing.T) {
 				"time":               fmt.Sprintf("%d", m.Time),
 				"event":              "message",
 				"topic":              "mytopic",
+				"sequence_id":        "",
 				"priority":           "4",
 				"tags":               strings.Join(m.Tags, ","),
 				"click":              "https://google.com",
@@ -199,6 +200,7 @@ func TestToFirebaseMessage_Message_Normal_Allowed(t *testing.T) {
 		"time":               fmt.Sprintf("%d", m.Time),
 		"event":              "message",
 		"topic":              "mytopic",
+		"sequence_id":        "",
 		"priority":           "4",
 		"tags":               strings.Join(m.Tags, ","),
 		"click":              "https://google.com",
@@ -232,6 +234,7 @@ func TestToFirebaseMessage_Message_Normal_Not_Allowed(t *testing.T) {
 		"time":         fmt.Sprintf("%d", m.Time),
 		"event":        "poll_request",
 		"topic":        "mytopic",
+		"sequence_id":  "",
 		"message":      "New message",
 		"title":        "",
 		"tags":         "",

server/server_test.go

@@ -8,8 +8,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"golang.org/x/crypto/bcrypt"
-	"heckel.io/ntfy/v2/user"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -24,7 +22,9 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
 	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/user"
 	"heckel.io/ntfy/v2/util"
 )
 
@@ -678,6 +678,86 @@ func TestServer_PublishInvalidTopic(t *testing.T) {
 	require.Equal(t, 40010, toHTTPError(t, response.Body.String()).Code)
 }
 
+func TestServer_PublishWithSIDInPath(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "POST", "/mytopic/sid", "message", nil)
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "sid", msg.SequenceID)
+}
+
+func TestServer_PublishWithSIDInHeader(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "POST", "/mytopic", "message", map[string]string{
+		"sid": "sid",
+	})
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "sid", msg.SequenceID)
+}
+
+func TestServer_PublishWithSIDInPathAndHeader(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "PUT", "/mytopic/sid1", "message", map[string]string{
+		"sid": "sid2",
+	})
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "sid1", msg.SequenceID) // Sequence ID in path has priority over header
+}
+
+func TestServer_PublishWithSIDInQuery(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "PUT", "/mytopic?sid=sid1", "message", nil)
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "sid1", msg.SequenceID)
+}
+
+func TestServer_PublishWithSIDViaGet(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "GET", "/mytopic/publish?sid=sid1", "message", nil)
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "sid1", msg.SequenceID)
+}
+
+func TestServer_PublishAsJSON_WithSequenceID(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	body := `{"topic":"mytopic","message":"A message","sequence_id":"my-sequence-123"}`
+	response := request(t, s, "PUT", "/", body, nil)
+	require.Equal(t, 200, response.Code)
+
+	msg := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg.ID)
+	require.Equal(t, "my-sequence-123", msg.SequenceID)
+}
+
+func TestServer_PublishWithInvalidSIDInPath(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "POST", "/mytopic/.", "message", nil)
+
+	require.Equal(t, 404, response.Code)
+}
+
+func TestServer_PublishWithInvalidSIDInHeader(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t))
+
+	response := request(t, s, "POST", "/mytopic", "message", map[string]string{
+		"X-Sequence-ID": "*&?",
+	})
+
+	require.Equal(t, 400, response.Code)
+	require.Equal(t, 40049, toHTTPError(t, response.Body.String()).Code)
+}
+
 func TestServer_PollWithQueryFilters(t *testing.T) {
 	s := newTestServer(t, newTestConfig(t))
 
@@ -3209,6 +3289,212 @@ func TestServer_MessageTemplate_Until100_000(t *testing.T) {
 	require.Contains(t, toHTTPError(t, response.Body.String()).Message, "too many iterations")
 }
 
+func TestServer_DeleteMessage(t *testing.T) {
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Publish a message with a sequence ID
+	response := request(t, s, "PUT", "/mytopic/seq123", "original message", nil)
+	require.Equal(t, 200, response.Code)
+	msg := toMessage(t, response.Body.String())
+	require.Equal(t, "seq123", msg.SequenceID)
+	require.Equal(t, "message", msg.Event)
+
+	// Delete the message using DELETE method
+	response = request(t, s, "DELETE", "/mytopic/seq123", "", nil)
+	require.Equal(t, 200, response.Code)
+	deleteMsg := toMessage(t, response.Body.String())
+	require.Equal(t, "seq123", deleteMsg.SequenceID)
+	require.Equal(t, "message_delete", deleteMsg.Event)
+
+	// Poll and verify both messages are returned
+	response = request(t, s, "GET", "/mytopic/json?poll=1", "", nil)
+	require.Equal(t, 200, response.Code)
+	lines := strings.Split(strings.TrimSpace(response.Body.String()), "\n")
+	require.Equal(t, 2, len(lines))
+
+	msg1 := toMessage(t, lines[0])
+	msg2 := toMessage(t, lines[1])
+	require.Equal(t, "message", msg1.Event)
+	require.Equal(t, "message_delete", msg2.Event)
+	require.Equal(t, "seq123", msg1.SequenceID)
+	require.Equal(t, "seq123", msg2.SequenceID)
+}
+
+func TestServer_ClearMessage(t *testing.T) {
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Publish a message with a sequence ID
+	response := request(t, s, "PUT", "/mytopic/seq456", "original message", nil)
+	require.Equal(t, 200, response.Code)
+	msg := toMessage(t, response.Body.String())
+	require.Equal(t, "seq456", msg.SequenceID)
+	require.Equal(t, "message", msg.Event)
+
+	// Clear the message using PUT /topic/seq/clear
+	response = request(t, s, "PUT", "/mytopic/seq456/clear", "", nil)
+	require.Equal(t, 200, response.Code)
+	clearMsg := toMessage(t, response.Body.String())
+	require.Equal(t, "seq456", clearMsg.SequenceID)
+	require.Equal(t, "message_clear", clearMsg.Event)
+
+	// Poll and verify both messages are returned
+	response = request(t, s, "GET", "/mytopic/json?poll=1", "", nil)
+	require.Equal(t, 200, response.Code)
+	lines := strings.Split(strings.TrimSpace(response.Body.String()), "\n")
+	require.Equal(t, 2, len(lines))
+
+	msg1 := toMessage(t, lines[0])
+	msg2 := toMessage(t, lines[1])
+	require.Equal(t, "message", msg1.Event)
+	require.Equal(t, "message_clear", msg2.Event)
+	require.Equal(t, "seq456", msg1.SequenceID)
+	require.Equal(t, "seq456", msg2.SequenceID)
+}
+
+func TestServer_ClearMessage_ReadEndpoint(t *testing.T) {
+	// Test that /topic/seq/read also works
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Publish a message
+	response := request(t, s, "PUT", "/mytopic/seq789", "original message", nil)
+	require.Equal(t, 200, response.Code)
+
+	// Clear using /read endpoint
+	response = request(t, s, "PUT", "/mytopic/seq789/read", "", nil)
+	require.Equal(t, 200, response.Code)
+	clearMsg := toMessage(t, response.Body.String())
+	require.Equal(t, "seq789", clearMsg.SequenceID)
+	require.Equal(t, "message_clear", clearMsg.Event)
+}
+
+func TestServer_UpdateMessage(t *testing.T) {
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Publish original message
+	response := request(t, s, "PUT", "/mytopic/update-seq", "original message", nil)
+	require.Equal(t, 200, response.Code)
+	msg1 := toMessage(t, response.Body.String())
+	require.Equal(t, "update-seq", msg1.SequenceID)
+	require.Equal(t, "original message", msg1.Message)
+
+	// Update the message (same sequence ID, new content)
+	response = request(t, s, "PUT", "/mytopic/update-seq", "updated message", nil)
+	require.Equal(t, 200, response.Code)
+	msg2 := toMessage(t, response.Body.String())
+	require.Equal(t, "update-seq", msg2.SequenceID)
+	require.Equal(t, "updated message", msg2.Message)
+	require.NotEqual(t, msg1.ID, msg2.ID) // Different message IDs
+
+	// Poll and verify both versions are returned
+	response = request(t, s, "GET", "/mytopic/json?poll=1", "", nil)
+	require.Equal(t, 200, response.Code)
+	lines := strings.Split(strings.TrimSpace(response.Body.String()), "\n")
+	require.Equal(t, 2, len(lines))
+
+	polledMsg1 := toMessage(t, lines[0])
+	polledMsg2 := toMessage(t, lines[1])
+	require.Equal(t, "original message", polledMsg1.Message)
+	require.Equal(t, "updated message", polledMsg2.Message)
+	require.Equal(t, "update-seq", polledMsg1.SequenceID)
+	require.Equal(t, "update-seq", polledMsg2.SequenceID)
+}
+
+func TestServer_UpdateMessage_UsingMessageID(t *testing.T) {
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Publish original message without a sequence ID
+	response := request(t, s, "PUT", "/mytopic", "original message", nil)
+	require.Equal(t, 200, response.Code)
+	msg1 := toMessage(t, response.Body.String())
+	require.NotEmpty(t, msg1.ID)
+	require.Empty(t, msg1.SequenceID) // No sequence ID provided
+	require.Equal(t, "original message", msg1.Message)
+
+	// Update the message using the message ID as the sequence ID
+	response = request(t, s, "PUT", "/mytopic/"+msg1.ID, "updated message", nil)
+	require.Equal(t, 200, response.Code)
+	msg2 := toMessage(t, response.Body.String())
+	require.Equal(t, msg1.ID, msg2.SequenceID) // Message ID is now used as sequence ID
+	require.Equal(t, "updated message", msg2.Message)
+	require.NotEqual(t, msg1.ID, msg2.ID) // Different message IDs
+
+	// Poll and verify both versions are returned
+	response = request(t, s, "GET", "/mytopic/json?poll=1", "", nil)
+	require.Equal(t, 200, response.Code)
+	lines := strings.Split(strings.TrimSpace(response.Body.String()), "\n")
+	require.Equal(t, 2, len(lines))
+
+	polledMsg1 := toMessage(t, lines[0])
+	polledMsg2 := toMessage(t, lines[1])
+	require.Equal(t, "original message", polledMsg1.Message)
+	require.Equal(t, "updated message", polledMsg2.Message)
+	require.Empty(t, polledMsg1.SequenceID)          // Original has no sequence ID
+	require.Equal(t, msg1.ID, polledMsg2.SequenceID) // Update uses original message ID as sequence ID
+}
+
+func TestServer_DeleteAndClear_InvalidSequenceID(t *testing.T) {
+	t.Parallel()
+	s := newTestServer(t, newTestConfig(t))
+
+	// Test invalid sequence ID for delete (returns 404 because route doesn't match)
+	response := request(t, s, "DELETE", "/mytopic/invalid*seq", "", nil)
+	require.Equal(t, 404, response.Code)
+
+	// Test invalid sequence ID for clear (returns 404 because route doesn't match)
+	response = request(t, s, "PUT", "/mytopic/invalid*seq/clear", "", nil)
+	require.Equal(t, 404, response.Code)
+}
+
+func TestServer_DeleteMessage_WithFirebase(t *testing.T) {
+	sender := newTestFirebaseSender(10)
+	s := newTestServer(t, newTestConfig(t))
+	s.firebaseClient = newFirebaseClient(sender, &testAuther{Allow: true})
+
+	// Publish a message
+	response := request(t, s, "PUT", "/mytopic/firebase-seq", "test message", nil)
+	require.Equal(t, 200, response.Code)
+
+	time.Sleep(100 * time.Millisecond) // Firebase publishing happens
+	require.Equal(t, 1, len(sender.Messages()))
+	require.Equal(t, "message", sender.Messages()[0].Data["event"])
+
+	// Delete the message
+	response = request(t, s, "DELETE", "/mytopic/firebase-seq", "", nil)
+	require.Equal(t, 200, response.Code)
+
+	time.Sleep(100 * time.Millisecond) // Firebase publishing happens
+	require.Equal(t, 2, len(sender.Messages()))
+	require.Equal(t, "message_delete", sender.Messages()[1].Data["event"])
+	require.Equal(t, "firebase-seq", sender.Messages()[1].Data["sequence_id"])
+}
+
+func TestServer_ClearMessage_WithFirebase(t *testing.T) {
+	sender := newTestFirebaseSender(10)
+	s := newTestServer(t, newTestConfig(t))
+	s.firebaseClient = newFirebaseClient(sender, &testAuther{Allow: true})
+
+	// Publish a message
+	response := request(t, s, "PUT", "/mytopic/firebase-clear-seq", "test message", nil)
+	require.Equal(t, 200, response.Code)
+
+	time.Sleep(100 * time.Millisecond)
+	require.Equal(t, 1, len(sender.Messages()))
+
+	// Clear the message
+	response = request(t, s, "PUT", "/mytopic/firebase-clear-seq/clear", "", nil)
+	require.Equal(t, 200, response.Code)
+
+	time.Sleep(100 * time.Millisecond)
+	require.Equal(t, 2, len(sender.Messages()))
+	require.Equal(t, "message_clear", sender.Messages()[1].Data["event"])
+	require.Equal(t, "firebase-clear-seq", sender.Messages()[1].Data["sequence_id"])
+}
+
 func newTestConfig(t *testing.T) *Config {
 	conf := NewConfig()
 	conf.BaseURL = "http://127.0.0.1:12345"

server/server_twilio.go

@@ -4,33 +4,49 @@ import (
 	"bytes"
 	"encoding/xml"
 	"fmt"
-	"heckel.io/ntfy/v2/log"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/http"
 	"net/url"
 	"strings"
+	"text/template"
+
+	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/user"
+	"heckel.io/ntfy/v2/util"
 )
 
-const (
-	twilioCallFormat = `
+// defaultTwilioCallFormatTemplate is the default TwiML template used for Twilio calls.
+// It can be overridden in the server configuration's twilio-call-format field.
+//
+// The format uses Go template syntax with the following fields:
+// {{.Topic}}, {{.Title}}, {{.Message}}, {{.Priority}}, {{.Tags}}, {{.Sender}}
+// String fields are automatically XML-escaped.
+var defaultTwilioCallFormatTemplate = template.Must(template.New("twiml").Parse(`
 <Response>
 	<Pause length="1"/>
 	<Say loop="3">
-		You have a message from notify on topic %s. Message:
+		You have a message from notify on topic {{.Topic}}. Message:
 		<break time="1s"/>
-		%s
+		{{.Message}}
 		<break time="1s"/>
 		End of message.
 		<break time="1s"/>
-		This message was sent by user %s. It will be repeated three times.
+		This message was sent by user {{.Sender}}. It will be repeated three times.
 		To unsubscribe from calls like this, remove your phone number in the notify web app.
 		<break time="3s"/>
 	</Say>
 	<Say>Goodbye.</Say>
-</Response>`
-)
+</Response>`))
+
+// twilioCallData holds the data passed to the Twilio call format template
+type twilioCallData struct {
+	Topic    string
+	Title    string
+	Message  string
+	Priority int
+	Tags     []string
+	Sender   string
+}
 
 // convertPhoneNumber checks if the given phone number is verified for the given user, and if so, returns the verified
 // phone number. It also converts a boolean string ("yes", "1", "true") to the first verified phone number.
@@ -65,7 +81,29 @@ func (s *Server) callPhone(v *visitor, r *http.Request, m *message, to string) {
 	if u != nil {
 		sender = u.Name
 	}
-	body := fmt.Sprintf(twilioCallFormat, xmlEscapeText(m.Topic), xmlEscapeText(m.Message), xmlEscapeText(sender))
+	tmpl := defaultTwilioCallFormatTemplate
+	if s.config.TwilioCallFormat != nil {
+		tmpl = s.config.TwilioCallFormat
+	}
+	tags := make([]string, len(m.Tags))
+	for i, tag := range m.Tags {
+		tags[i] = xmlEscapeText(tag)
+	}
+	templateData := &twilioCallData{
+		Topic:    xmlEscapeText(m.Topic),
+		Title:    xmlEscapeText(m.Title),
+		Message:  xmlEscapeText(m.Message),
+		Priority: m.Priority,
+		Tags:     tags,
+		Sender:   xmlEscapeText(sender),
+	}
+	var bodyBuf bytes.Buffer
+	if err := tmpl.Execute(&bodyBuf, templateData); err != nil {
+		logvrm(v, r, m).Tag(tagTwilio).Err(err).Warn("Error executing Twilio call format template")
+		minc(metricCallsMadeFailure)
+		return
+	}
+	body := bodyBuf.String()
 	data := url.Values{}
 	data.Set("From", s.config.TwilioPhoneNumber)
 	data.Set("To", to)

server/server_twilio_test.go

@@ -1,14 +1,16 @@
 package server
 
 import (
-	"github.com/stretchr/testify/require"
-	"heckel.io/ntfy/v2/user"
-	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"sync/atomic"
 	"testing"
+	"text/template"
+
+	"github.com/stretchr/testify/require"
+	"heckel.io/ntfy/v2/user"
+	"heckel.io/ntfy/v2/util"
 )
 
 func TestServer_Twilio_Call_Add_Verify_Call_Delete_Success(t *testing.T) {
@@ -202,6 +204,67 @@ func TestServer_Twilio_Call_Success_With_Yes(t *testing.T) {
 	})
 }
 
+func TestServer_Twilio_Call_Success_with_custom_twiml(t *testing.T) {
+	var called atomic.Bool
+	twilioServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if called.Load() {
+			t.Fatal("Should be only called once")
+		}
+		body, err := io.ReadAll(r.Body)
+		require.Nil(t, err)
+		require.Equal(t, "/2010-04-01/Accounts/AC1234567890/Calls.json", r.URL.Path)
+		require.Equal(t, "Basic QUMxMjM0NTY3ODkwOkFBRUFBMTIzNDU2Nzg5MA==", r.Header.Get("Authorization"))
+		require.Equal(t, "From=%2B1234567890&To=%2B11122233344&Twiml=%0A%3CResponse%3E%0A%09%3CPause+length%3D%221%22%2F%3E%0A%09%3CSay+language%3D%22de-DE%22+loop%3D%223%22%3E%0A%09%09Du+hast+eine+Nachricht+von+notify+im+Thema+mytopic.+Nachricht%3A%0A%09%09%3Cbreak+time%3D%221s%22%2F%3E%0A%09%09hi+there%0A%09%09%3Cbreak+time%3D%221s%22%2F%3E%0A%09%09Ende+der+Nachricht.%0A%09%09%3Cbreak+time%3D%221s%22%2F%3E%0A%09%09Diese+Nachricht+wurde+von+Benutzer+phil+gesendet.+Sie+wird+drei+Mal+wiederholt.%0A%09%09Um+dich+von+Anrufen+wie+diesen+abzumelden%2C+entferne+deine+Telefonnummer+in+der+notify+web+app.%0A%09%09%3Cbreak+time%3D%223s%22%2F%3E%0A%09%3C%2FSay%3E%0A%09%3CSay+language%3D%22de-DE%22%3EAuf+Wiederh%C3%B6ren.%3C%2FSay%3E%0A%3C%2FResponse%3E", string(body))
+		called.Store(true)
+	}))
+	defer twilioServer.Close()
+
+	c := newTestConfigWithAuthFile(t)
+	c.TwilioCallsBaseURL = twilioServer.URL
+	c.TwilioAccount = "AC1234567890"
+	c.TwilioAuthToken = "AAEAA1234567890"
+	c.TwilioPhoneNumber = "+1234567890"
+	c.TwilioCallFormat = template.Must(template.New("twiml").Parse(`
+<Response>
+	<Pause length="1"/>
+	<Say language="de-DE" loop="3">
+		Du hast eine Nachricht von notify im Thema {{.Topic}}. Nachricht:
+		<break time="1s"/>
+		{{.Message}}
+		<break time="1s"/>
+		Ende der Nachricht.
+		<break time="1s"/>
+		Diese Nachricht wurde von Benutzer {{.Sender}} gesendet. Sie wird drei Mal wiederholt.
+		Um dich von Anrufen wie diesen abzumelden, entferne deine Telefonnummer in der notify web app.
+		<break time="3s"/>
+	</Say>
+	<Say language="de-DE">Auf Wiederhören.</Say>
+</Response>`))
+	s := newTestServer(t, c)
+
+	// Add tier and user
+	require.Nil(t, s.userManager.AddTier(&user.Tier{
+		Code:         "pro",
+		MessageLimit: 10,
+		CallLimit:    1,
+	}))
+	require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+	require.Nil(t, s.userManager.ChangeTier("phil", "pro"))
+	u, err := s.userManager.User("phil")
+	require.Nil(t, err)
+	require.Nil(t, s.userManager.AddPhoneNumber(u.ID, "+11122233344"))
+
+	// Do the thing
+	response := request(t, s, "POST", "/mytopic", "hi there", map[string]string{
+		"authorization": util.BasicAuth("phil", "phil"),
+		"x-call":        "+11122233344",
+	})
+	require.Equal(t, "hi there", toMessage(t, response.Body.String()).Message)
+	waitFor(t, func() bool {
+		return called.Load()
+	})
+}
+
 func TestServer_Twilio_Call_UnverifiedNumber(t *testing.T) {
 	c := newTestConfigWithAuthFile(t)
 	c.TwilioCallsBaseURL = "http://dummy.invalid"

server/server_webpush.go

@@ -89,7 +89,7 @@ func (s *Server) publishToWebPushEndpoints(v *visitor, m *message) {
 		return
 	}
 	log.Tag(tagWebPush).With(v, m).Debug("Publishing web push message to %d subscribers", len(subscriptions))
-	payload, err := json.Marshal(newWebPushPayload(fmt.Sprintf("%s/%s", s.config.BaseURL, m.Topic), m))
+	payload, err := json.Marshal(newWebPushPayload(fmt.Sprintf("%s/%s", s.config.BaseURL, m.Topic), m.forJSON()))
 	if err != nil {
 		log.Tag(tagWebPush).Err(err).With(v, m).Warn("Unable to marshal expiring payload")
 		return

server/types.go

@@ -12,10 +12,12 @@ import (
 
 // List of possible events
 const (
-	openEvent        = "open"
-	keepaliveEvent   = "keepalive"
-	messageEvent     = "message"
-	pollRequestEvent = "poll_request"
+	openEvent          = "open"
+	keepaliveEvent     = "keepalive"
+	messageEvent       = "message"
+	messageDeleteEvent = "message_delete"
+	messageClearEvent  = "message_clear"
+	pollRequestEvent   = "poll_request"
 )
 
 const (
@@ -24,10 +26,11 @@ const (
 
 // message represents a message published to a topic
 type message struct {
-	ID          string      `json:"id"`                // Random message ID
-	Time        int64       `json:"time"`              // Unix time in seconds
-	Expires     int64       `json:"expires,omitempty"` // Unix time in seconds (not required for open/keepalive)
-	Event       string      `json:"event"`             // One of the above
+	ID          string      `json:"id"`                    // Random message ID
+	SequenceID  string      `json:"sequence_id,omitempty"` // Message sequence ID for updating message contents (omitted if same as ID)
+	Time        int64       `json:"time"`                  // Unix time in seconds
+	Expires     int64       `json:"expires,omitempty"`     // Unix time in seconds (not required for open/keepalive)
+	Event       string      `json:"event"`                 // One of the above
 	Topic       string      `json:"topic"`
 	Title       string      `json:"title,omitempty"`
 	Message     string      `json:"message,omitempty"`
@@ -39,18 +42,19 @@ type message struct {
 	Attachment  *attachment `json:"attachment,omitempty"`
 	PollID      string      `json:"poll_id,omitempty"`
 	ContentType string      `json:"content_type,omitempty"` // text/plain by default (if empty), or text/markdown
-	Encoding    string      `json:"encoding,omitempty"`     // empty for raw UTF-8, or "base64" for encoded bytes
+	Encoding    string      `json:"encoding,omitempty"`     // Empty for raw UTF-8, or "base64" for encoded bytes
 	Sender      netip.Addr  `json:"-"`                      // IP address of uploader, used for rate limiting
 	User        string      `json:"-"`                      // UserID of the uploader, used to associated attachments
 }
 
 func (m *message) Context() log.Context {
 	fields := map[string]any{
-		"topic":             m.Topic,
-		"message_id":        m.ID,
-		"message_time":      m.Time,
-		"message_event":     m.Event,
-		"message_body_size": len(m.Message),
+		"topic":               m.Topic,
+		"message_id":          m.ID,
+		"message_sequence_id": m.SequenceID,
+		"message_time":        m.Time,
+		"message_event":       m.Event,
+		"message_body_size":   len(m.Message),
 	}
 	if m.Sender.IsValid() {
 		fields["message_sender"] = m.Sender.String()
@@ -61,6 +65,17 @@ func (m *message) Context() log.Context {
 	return fields
 }
 
+// forJSON returns a copy of the message suitable for JSON output.
+// It clears the SequenceID if it equals the ID to reduce redundancy.
+func (m *message) forJSON() *message {
+	if m.SequenceID == m.ID {
+		clone := *m
+		clone.SequenceID = ""
+		return &clone
+	}
+	return m
+}
+
 type attachment struct {
 	Name    string `json:"name"`
 	Type    string `json:"type,omitempty"`
@@ -91,22 +106,23 @@ func newAction() *action {
 
 // publishMessage is used as input when publishing as JSON
 type publishMessage struct {
-	Topic    string   `json:"topic"`
-	Title    string   `json:"title"`
-	Message  string   `json:"message"`
-	Priority int      `json:"priority"`
-	Tags     []string `json:"tags"`
-	Click    string   `json:"click"`
-	Icon     string   `json:"icon"`
-	Actions  []action `json:"actions"`
-	Attach   string   `json:"attach"`
-	Markdown bool     `json:"markdown"`
-	Filename string   `json:"filename"`
-	Email    string   `json:"email"`
-	Call     string   `json:"call"`
-	Cache    string   `json:"cache"`    // use string as it defaults to true (or use &bool instead)
-	Firebase string   `json:"firebase"` // use string as it defaults to true (or use &bool instead)
-	Delay    string   `json:"delay"`
+	Topic      string   `json:"topic"`
+	SequenceID string   `json:"sequence_id"`
+	Title      string   `json:"title"`
+	Message    string   `json:"message"`
+	Priority   int      `json:"priority"`
+	Tags       []string `json:"tags"`
+	Click      string   `json:"click"`
+	Icon       string   `json:"icon"`
+	Actions    []action `json:"actions"`
+	Attach     string   `json:"attach"`
+	Markdown   bool     `json:"markdown"`
+	Filename   string   `json:"filename"`
+	Email      string   `json:"email"`
+	Call       string   `json:"call"`
+	Cache      string   `json:"cache"`    // use string as it defaults to true (or use &bool instead)
+	Firebase   string   `json:"firebase"` // use string as it defaults to true (or use &bool instead)
+	Delay      string   `json:"delay"`
 }
 
 // messageEncoder is a function that knows how to encode a message
@@ -145,6 +161,13 @@ func newPollRequestMessage(topic, pollID string) *message {
 	return m
 }
 
+// newActionMessage creates a new action message (message_delete or message_clear)
+func newActionMessage(event, topic, sequenceID string) *message {
+	m := newMessage(event, topic, "")
+	m.SequenceID = sequenceID
+	return m
+}
+
 func validMessageID(s string) bool {
 	return util.ValidRandomString(s, messageIDLength)
 }
@@ -223,7 +246,7 @@ func parseQueryFilters(r *http.Request) (*queryFilter, error) {
 }
 
 func (q *queryFilter) Pass(msg *message) bool {
-	if msg.Event != messageEvent {
+	if msg.Event != messageEvent && msg.Event != messageDeleteEvent && msg.Event != messageClearEvent {
 		return true // filters only apply to messages
 	} else if q.ID != "" && msg.ID != q.ID {
 		return false
@@ -449,6 +472,7 @@ type apiConfigResponse struct {
 	BaseURL            string   `json:"base_url"`
 	AppRoot            string   `json:"app_root"`
 	EnableLogin        bool     `json:"enable_login"`
+	RequireLogin       bool     `json:"require_login"`
 	EnableSignup       bool     `json:"enable_signup"`
 	EnablePayments     bool     `json:"enable_payments"`
 	EnableCalls        bool     `json:"enable_calls"`

tools/fbsend/main.go

@@ -1,3 +1,5 @@
+//go:build !nofirebase
+
 package main
 
 import (
@@ -26,7 +28,7 @@ func main() {
 		}
 		data[kv[0]] = kv[1]
 	}
-	fb, err := firebase.NewApp(context.Background(), nil, option.WithCredentialsFile(*conffile))
+	fb, err := firebase.NewApp(context.Background(), nil, option.WithAuthCredentialsFile(option.ServiceAccount, *conffile))
 	if err != nil {
 		fail(err.Error())
 	}

user/manager.go

@@ -1066,7 +1066,7 @@ func (a *Manager) addUserTx(tx *sql.Tx, username, password string, role Role, ha
 	var err error = nil
 	if hashed {
 		hash = password
-		if err := ValidPasswordHash(hash); err != nil {
+		if err := ValidPasswordHash(hash, a.config.BcryptCost); err != nil {
 			return err
 		}
 	} else {
@@ -1434,7 +1434,7 @@ func (a *Manager) changePasswordTx(tx *sql.Tx, username, password string, hashed
 	var err error
 	if hashed {
 		hash = password
-		if err := ValidPasswordHash(hash); err != nil {
+		if err := ValidPasswordHash(hash, a.config.BcryptCost); err != nil {
 			return err
 		}
 	} else {

user/manager_test.go

@@ -1162,7 +1162,7 @@ func TestManager_WithProvisionedUsers(t *testing.T) {
 	// Re-open the DB (second app start)
 	require.Nil(t, a.db.Close())
 	conf.Users = []*User{
-		{Name: "philuser", Hash: "$2a$10$AAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
+		{Name: "philuser", Hash: "$2a$10$AAAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
 	}
 	conf.Access = map[string][]*Grant{
 		"philuser": {
@@ -1292,7 +1292,7 @@ func TestManager_UpdateNonProvisionedUsersToProvisionedUsers(t *testing.T) {
 	// Re-open the DB (second app start)
 	require.Nil(t, a.db.Close())
 	conf.Users = []*User{
-		{Name: "philuser", Hash: "$2a$10$AAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
+		{Name: "philuser", Hash: "$2a$10$AAAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
 	}
 	conf.Access = map[string][]*Grant{
 		"philuser": {
@@ -1308,7 +1308,7 @@ func TestManager_UpdateNonProvisionedUsersToProvisionedUsers(t *testing.T) {
 	require.Len(t, users, 2)
 	require.Equal(t, "philuser", users[0].Name)
 	require.Equal(t, RoleUser, users[0].Role)
-	require.Equal(t, "$2a$10$AAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", users[0].Hash)
+	require.Equal(t, "$2a$10$AAAAU21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", users[0].Hash)
 	require.True(t, users[0].Provisioned) // Updated to provisioned!
 
 	grants, err = a.Grants("philuser")

user/types.go

@@ -249,7 +249,8 @@ var (
 	ErrInvalidArgument        = errors.New("invalid argument")
 	ErrUserNotFound           = errors.New("user not found")
 	ErrUserExists             = errors.New("user already exists")
-	ErrPasswordHashInvalid    = errors.New("password hash but be a bcrypt hash, use 'ntfy user hash' to generate")
+	ErrPasswordHashInvalid    = errors.New("password hash must be a bcrypt hash, use 'ntfy user hash' to generate")
+	ErrPasswordHashWeak       = errors.New("password hash too weak, use 'ntfy user hash' to generate")
 	ErrTierNotFound           = errors.New("tier not found")
 	ErrTokenNotFound          = errors.New("token not found")
 	ErrPhoneNumberNotFound    = errors.New("phone number not found")

user/util.go

@@ -41,10 +41,16 @@ func AllowedTier(tier string) bool {
 }
 
 // ValidPasswordHash checks if the given password hash is a valid bcrypt hash
-func ValidPasswordHash(hash string) error {
+func ValidPasswordHash(hash string, minCost int) error {
 	if !strings.HasPrefix(hash, "$2a$") && !strings.HasPrefix(hash, "$2b$") && !strings.HasPrefix(hash, "$2y$") {
 		return ErrPasswordHashInvalid
 	}
+	cost, err := bcrypt.Cost([]byte(hash))
+	if err != nil { // Check if the hash is valid (length, format, etc.)
+		return err
+	} else if cost < minCost {
+		return ErrPasswordHashWeak
+	}
 	return nil
 }
 

web/public/config.js

@@ -9,6 +9,7 @@ var config = {
   base_url: window.location.origin, // Change to test against a different server
   app_root: "/",
   enable_login: true,
+  require_login: false,
   enable_signup: true,
   enable_payments: false,
   enable_reservations: true,

web/public/static/langs/bg.json

@@ -22,7 +22,7 @@
     "publish_dialog_chip_email_label": "Препращане към ел. поща",
     "publish_dialog_chip_attach_url_label": "Прикачване на файл от адрес",
     "publish_dialog_chip_attach_file_label": "Прикачване местен файл",
-    "publish_dialog_chip_delay_label": "Отлагане на изпращането",
+    "publish_dialog_chip_delay_label": "Отложено изпращане",
     "publish_dialog_chip_topic_label": "Промяна на темата",
     "publish_dialog_button_cancel_sending": "Отменяне на изпращането",
     "publish_dialog_button_cancel": "Отказ",
@@ -121,7 +121,7 @@
     "subscribe_dialog_login_button_login": "Вход",
     "subscribe_dialog_error_user_not_authorized": "Потребителят {{username}} няма достъп",
     "prefs_appearance_title": "Външен вид",
-    "publish_dialog_delay_placeholder": "Отлагане на изпращането, {{unixTimestamp}}, {{relativeTime}} или „{{naturalLanguage}}“ (на английски)",
+    "publish_dialog_delay_placeholder": "Отложено изпращане, {{unixTimestamp}}, {{relativeTime}} или „{{naturalLanguage}}“ (на английски)",
     "prefs_notifications_delete_after_one_week": "След една седмица",
     "prefs_users_title": "Управление на потребители",
     "prefs_users_table_base_url_header": "Адрес на услугата",
@@ -177,7 +177,7 @@
     "publish_dialog_topic_reset": "Нулиране на тема",
     "publish_dialog_click_reset": "Премахване на адрес",
     "publish_dialog_email_reset": "Премахване на препращането към ел. поща",
-    "publish_dialog_delay_reset": "Премахва отлагането на изпращането",
+    "publish_dialog_delay_reset": "Премахва отложеното на изпращане",
     "publish_dialog_attached_file_remove": "Премахване на прикачения файл",
     "emoji_picker_search_clear": "Изчистване на търсенето",
     "subscribe_dialog_subscribe_base_url_label": "Адрес на услугата",
@@ -253,7 +253,7 @@
     "account_delete_dialog_button_cancel": "Отказ",
     "account_upgrade_dialog_interval_monthly": "Месечно",
     "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} резервирани теми",
-    "account_upgrade_dialog_tier_features_no_reservations": "Няма резервирани теми",
+    "account_upgrade_dialog_tier_features_no_reservations": "Без резервирани теми",
     "account_tokens_dialog_button_cancel": "Отказ",
     "account_delete_title": "Премахване на профила",
     "account_upgrade_dialog_title": "Промяна нивото на профила",
@@ -403,5 +403,7 @@
     "prefs_appearance_theme_system": "Системна (подразбирана)",
     "web_push_subscription_expiring_title": "Известията временно ще бъдат спрени",
     "web_push_subscription_expiring_body": "За да продължите да получавате известия, отворете ntfy",
-    "action_bar_unmute_notifications": "Включване звука на известията"
+    "action_bar_unmute_notifications": "Включване звука на известията",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Кодът за защита от външна система не може да бъде променян или премахван",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Потребител от външна система не може да бъде променян или премахван"
 }

web/public/static/langs/ca.json

@@ -3,5 +3,14 @@
     "action_bar_profile_title": "Perfil",
     "action_bar_settings": "Configuració",
     "action_bar_account": "Compte",
-    "common_add": "Afegir"
+    "common_add": "Afegir",
+    "common_cancel": "Cancel·la",
+    "common_save": "Desa",
+    "common_back": "Enrere",
+    "common_copy_to_clipboard": "Copia al portaretalls",
+    "signup_title": "Crea un compte ntfy",
+    "signup_form_username": "Nom d'usuari",
+    "signup_form_password": "Contrasenya",
+    "signup_form_confirm_password": "Confirma la contrasenya",
+    "signup_form_button_submit": "Dona't d'alta"
 }

web/public/static/langs/cs.json

@@ -403,5 +403,7 @@
     "prefs_appearance_theme_light": "Světlý režim",
     "web_push_subscription_expiring_title": "Oznámení budou pozastavena",
     "web_push_unknown_notification_title": "Neznámé oznámení přijaté ze serveru",
-    "web_push_unknown_notification_body": "Možná bude nutné aktualizovat ntfy otevřením webové aplikace"
+    "web_push_unknown_notification_body": "Možná bude nutné aktualizovat ntfy otevřením webové aplikace",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Přiděleného uživatele nelze upravovat ani odstranit",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Nelze upravit ani odstranit přidělený token"
 }

web/public/static/langs/cu.json

@@ -0,0 +1,8 @@
+{
+    "common_cancel": "Отмѣнити",
+    "common_save": "Сохрани",
+    "common_add": "Приложити",
+    "common_back": "Назадъ",
+    "login_form_button_submit": "Въниди",
+    "signup_form_password": "Таино слово"
+}

web/public/static/langs/de.json

@@ -403,5 +403,7 @@
     "web_push_subscription_expiring_body": "Öffne ntfy um weiterhin Benachrichtigungen zu erhalten",
     "web_push_unknown_notification_title": "Unbekannte Benachrichtigung vom Server empfangen",
     "web_push_unknown_notification_body": "Du musst möglicherweise ntfy aktualisieren, indem du die Web App öffnest",
-    "prefs_notifications_web_push_enabled_description": "Benachrichtigungen werden empfangen, auch wenn die Web App nicht geöffnet ist (via Web Push)"
+    "prefs_notifications_web_push_enabled_description": "Benachrichtigungen werden empfangen, auch wenn die Web App nicht geöffnet ist (via Web Push)",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Bereitgestelltes Token kann nicht bearbeitet oder gelöscht werden",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Ein bereitgestellter Benutzer kann nicht bearbeitet oder gelöscht werden"
 }

web/public/static/langs/eo.json

@@ -1 +1,5 @@
-{}
+{
+    "common_cancel": "Nuligi",
+    "common_save": "Konservi",
+    "common_add": "Aldoni"
+}

web/public/static/langs/es.json

@@ -404,5 +404,7 @@
     "prefs_appearance_theme_dark": "Oscuro",
     "web_push_subscription_expiring_body": "Abrir ntfy para seguir recibiendo notificaciones",
     "web_push_unknown_notification_title": "Notificación desconocida recibida del servidor",
-    "web_push_unknown_notification_body": "Puede que necesites actualizar ntfy abriendo la aplicación web"
+    "web_push_unknown_notification_body": "Puede que necesites actualizar ntfy abriendo la aplicación web",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Un usuario provisionado no se puede editar o eliminar",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "No se puede editar o eliminar un token provisionado"
 }

web/public/static/langs/et.json

@@ -24,7 +24,7 @@
     "signup_form_toggle_password_visibility": "Vaheta salasõna nähtavust",
     "action_bar_account": "Kasutajakonto",
     "action_bar_sign_in": "Logi sisse",
-    "nav_button_documentation": "Dokumentatsioon",
+    "nav_button_documentation": "Juhendid ja teave",
     "action_bar_profile_title": "Profiil",
     "action_bar_profile_settings": "Seadistused",
     "action_bar_sign_up": "Liitu",
@@ -53,8 +53,8 @@
     "account_tokens_table_token_header": "Tunnusluba",
     "account_tokens_table_last_origin_tooltip": "IP-aadressilt {{ip}}, klõpsi täpsema teabe nägemiseks",
     "action_bar_reservation_add": "Reserveeri teema",
-    "action_bar_reservation_edit": "Muuda reserveeringut",
-    "action_bar_reservation_delete": "Eemalda reserveering",
+    "action_bar_reservation_edit": "Muuda reserveerimist",
+    "action_bar_reservation_delete": "Eemalda reserveerimine",
     "action_bar_reservation_limit_reached": "Ülempiir on käes",
     "action_bar_send_test_notification": "Saata testteavitus",
     "action_bar_clear_notifications": "Kustuta kõik teavitused",
@@ -126,7 +126,7 @@
     "account_usage_unlimited": "Piiramatu",
     "prefs_notifications_delete_after_never": "Mitte kunagi",
     "account_upgrade_dialog_interval_monthly": "Iga kuu",
-    "account_upgrade_dialog_tier_price_per_month": "kuu",
+    "account_upgrade_dialog_tier_price_per_month": "kuus",
     "prefs_notifications_web_push_disabled": "Pole kasutusel",
     "prefs_appearance_title": "Välimus",
     "prefs_appearance_language_title": "Keel",
@@ -139,7 +139,7 @@
     "display_name_dialog_placeholder": "Kuvatav nimi",
     "publish_dialog_title_no_topic": "Avalda teavitus",
     "publish_dialog_progress_uploading": "Laadin üles…",
-    "publish_dialog_message_published": "Teavitus on saadetud",
+    "publish_dialog_message_published": "Teavitus on avaldatud",
     "publish_dialog_emoji_picker_show": "Vali emoji",
     "publish_dialog_priority_low": "Vähetähtis",
     "publish_dialog_priority_default": "Vaikimisi tähtsus",
@@ -185,7 +185,7 @@
     "notifications_loading": "Laadin teavitusi…",
     "publish_dialog_title_topic": "Avalda teemas {{topic}}",
     "publish_dialog_progress_uploading_detail": "Üleslaadimisel {{loaded}}/{{total}} ({{percent}}%) …",
-    "publish_dialog_topic_placeholder": "Teema nimi, nt. kati_teavitused",
+    "publish_dialog_topic_placeholder": "Teema nimi, nt. kadri_kiirteated",
     "publish_dialog_title_placeholder": "Teavituse pealkiri, nt. Andmeruumi teavitus",
     "publish_dialog_message_placeholder": "Siia sisesta sõnum",
     "notifications_none_for_any_title": "Sa pole veel saanud ühtegi teavitust.",
@@ -270,5 +270,140 @@
     "account_basics_phone_numbers_dialog_number_label": "Telefoninumber",
     "prefs_notifications_delete_after_one_week": "Ühe nädala möödumisel",
     "prefs_notifications_delete_after_one_day": "Ühe päeva möödumisel",
-    "prefs_notifications_delete_after_one_month": "Ühe kuu möödumisel"
+    "prefs_notifications_delete_after_one_month": "Ühe kuu möödumisel",
+    "publish_dialog_attached_file_title": "Manustatud fail:",
+    "publish_dialog_attached_file_filename_placeholder": "Manuse faili nimi",
+    "publish_dialog_attached_file_remove": "Eemalda manustatud fail",
+    "publish_dialog_drop_file_here": "Lohista fail siia",
+    "emoji_picker_search_placeholder": "Otsi emojit",
+    "publish_dialog_checkbox_publish_another": "Avalda veel midagi",
+    "emoji_picker_search_clear": "Tühjenda otsing",
+    "account_usage_reservations_title": "Reserveeritud teemad",
+    "account_usage_reservations_none": "Sellel kasutajakontol pole reserveeritud teemasid",
+    "account_usage_attachment_storage_title": "Manuste andmeruum",
+    "account_usage_calls_none": "Selle kasutajakontoga ei saa helistada",
+    "account_usage_calls_title": "Helistatud kõnesid",
+    "account_usage_messages_title": "Avaldatud sõnumeid",
+    "account_usage_emails_title": "Saadetud e-kirju",
+    "account_basics_tier_manage_billing_button": "Halda arveldust",
+    "account_basics_tier_canceled_subscription": "Sinu teenusetellimus on katkestatud ja muutub tasuta {{date}} kontoks.",
+    "account_basics_tier_paid_until": "Tellimus on tasutud kuni {{date}} ja kuulub automaatselt uuendamisele",
+    "account_basics_tier_upgrade_button": "Hakka kasutama Pro-teenust",
+    "account_basics_tier_payment_overdue": "Sinu arve(d) on tasumata. Palun uuenda oma maksmisviisi või vastasel juhul peame varsti sinu kasutajakonto taseme muutma madalamaks.",
+    "account_upgrade_dialog_tier_features_no_reservations": "Reserveeritud teemasid pole",
+    "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} reserveeritud teemat",
+    "account_upgrade_dialog_tier_features_reservations_one": "{{reservations}} reserveeritud teema",
+    "prefs_notifications_sound_title": "Teavituse heli",
+    "account_tokens_delete_dialog_submit_button": "Kustuta tunnusluba jäädavalt",
+    "account_tokens_delete_dialog_description": "Enne tunnusloa kustutamist palun kontrolli, et ükski rakendus ei kasutaks seda. <strong>Seda tegevust ei saa tagasi pöörata</strong>.",
+    "account_tokens_delete_dialog_title": "Kustuta ligipääsu tunnusluba",
+    "account_tokens_dialog_expires_never": "Tunnusluba ei aegu iialgi",
+    "account_tokens_dialog_expires_x_days": "Tunnusluba aegub {{days}} päeva pärast",
+    "account_tokens_dialog_expires_x_hours": "Tunnusluba aegub {{hours}} tunni pärast",
+    "account_tokens_dialog_expires_unchanged": "Jäta aegumise kuupäev muutmata",
+    "account_tokens_dialog_expires_label": "Tunnusluba aegub",
+    "account_tokens_dialog_button_update": "Uuenda tunnusluba",
+    "account_tokens_dialog_button_create": "Loo tunnusluba",
+    "prefs_users_title": "Halda kasutajaid",
+    "subscribe_dialog_subscribe_use_another_label": "Kasuta muud serverit",
+    "subscribe_dialog_subscribe_use_another_background_info": "Teavitused muudest serveritest ei toimi, kui veebirakendus pole avatud",
+    "subscribe_dialog_login_description": "See teema on kaitstud salasõnaga. Tellimiseks sisesta palun kasutajanimi ja salasõna.",
+    "subscribe_dialog_error_topic_already_reserved": "Teema on juba reserveeritud",
+    "account_delete_title": "Kustuta kasutajakonto",
+    "account_delete_description": "Kustuta oma kasutajakonto jäädavalt",
+    "account_delete_dialog_description": "Järgnevaga kustutad serverist lõplikult oma kasutajakonto ning kõik temaga seotud andmed. Peale kustutamist pole kasutajanimi saadaval 7 päeva jooksul. Kui sa tõesti soovid kustutamisega jätkata, siis palun sisesta alljärgnevasse kasti oma salasõna.",
+    "web_push_unknown_notification_title": "Serverist saabus tundmatu teavitus",
+    "web_push_subscription_expiring_body": "Kui soovid, et jätkuvalt saabuks teavitused, siis ava ntfy",
+    "web_push_subscription_expiring_title": "Teavitused on ajutiselt peatatud",
+    "error_boundary_unsupported_indexeddb_title": "Veebibrauseri privaatne režiim pole toetatud",
+    "error_boundary_button_reload_ntfy": "Laadi ntfy uuesti",
+    "error_boundary_button_copy_stack_trace": "Kopeeri pinujälg",
+    "error_boundary_stack_trace": "Pinujälg",
+    "error_boundary_gathering_info": "Kogu täiendavat teavet…",
+    "notifications_none_for_any_description": "Teemakohaste teavituste saatmiseks tee PUT või POST meetodiga päring teema võrguaadressile. Siin on üks näide ühe sinu teemaga.",
+    "notifications_no_subscriptions_title": "Tundub, et sul pole veel ühtegi tellimust.",
+    "notifications_no_subscriptions_description": "Olemasoleva teema tellimiseks või uue loomiseks klõpsa „{{linktext}}“. Peale seda saad PUT või POST meetodiga päringuga saata sõnumeid ning neid siin vastu võtta.",
+    "notifications_more_details": "Lisateavet leiad <websiteLink>veebisaidist</websiteLink> või <docsLink>juhendist</docsLink>.",
+    "publish_dialog_details_examples_description": "Näited ja saatmisvõimaluste üksikasjaliku kirjelduse leiad <docsLink>juhendist</docsLink>.",
+    "account_tokens_description": "Selleks, et ei peaks ntfy API abil avaldamise ja tellimuse päringusse lisama kasutajanime ja salasõna, kasuta tunnuslubasid. Lisateavet leiad <Link>juhendist</Link>.",
+    "subscribe_dialog_subscribe_title": "Telli teema",
+    "subscribe_dialog_subscribe_description": "Teemasid ei saa salasõnaga kaitsta, seega vali teema nimi, mida pole väga lihtne ära arvata. Peale tellimuse tegemist võide kohe hakata PUT või POST päringutega sõnumeid saatma.",
+    "subscribe_dialog_subscribe_topic_placeholder": "Teema nimi, näiteks kadri_kiirteated",
+    "subscribe_dialog_error_user_not_authorized": "Kasutajal {{username}} puudub volitus",
+    "account_usage_of_limit": "piirangust {{limit}}",
+    "account_usage_limits_reset_daily": "Kasutuspiirangud lähtestatakse keskööl (UTC järgi)",
+    "account_basics_tier_admin_suffix_with_tier": "(tasemega {{tier}})",
+    "account_basics_tier_admin_suffix_no_tier": "(tase puudub)",
+    "account_upgrade_dialog_title": "Muuda kasutajakonto taset",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} faili kohta",
+    "account_upgrade_dialog_tier_features_calls_other": "{{calls}} kõnet päevas",
+    "account_upgrade_dialog_tier_features_calls_one": "{{calls}} kõne päevas",
+    "account_upgrade_dialog_tier_features_no_calls": "Ilma telefonikõnedeta",
+    "account_upgrade_dialog_tier_features_attachment_total_size": "andmeruum kokku {{totalsize}}",
+    "account_upgrade_dialog_tier_price_billed_monthly": "{{price}}aastas. Arveldatuna kord kuus.",
+    "account_upgrade_dialog_tier_price_billed_yearly": "{{price}} arveldatuna kord aastas. Sa säästad {{save}}.",
+    "account_upgrade_dialog_button_pay_now": "Maksa nüüd ja telli",
+    "account_upgrade_dialog_button_cancel_subscription": "Katkesta tellimus",
+    "account_upgrade_dialog_interval_yearly_discount_save": "säästa {{discount}}%",
+    "account_upgrade_dialog_interval_yearly_discount_save_up_to": "säästa kuni {{discount}}%",
+    "account_upgrade_dialog_billing_contact_email": "Küsimuste puhul arvelduste kohta, palun <Link>kontakteeru meiega otse</Link>.",
+    "account_upgrade_dialog_billing_contact_website": "Küsimuste puhul arvelduste kohta, palun <Link>vaata meie veebisaiti</Link>.",
+    "account_delete_dialog_billing_warning": "Sinu kasutajakonto kustutamisel katkeb koheselt ka tellimus. Muu hulgas ei saa sa enam ligi arvelduste haldusvaatele.",
+    "account_upgrade_dialog_button_update_subscription": "Uuenda tellimust",
+    "account_tokens_title": "Tunnusload ligipääsuks",
+    "account_tokens_dialog_label": "Silt, näiteks „Salaradari teavitused“",
+    "account_usage_attachment_storage_description": "{{filesize}} faili kohta, kustutatud peale {{expiry}}",
+    "account_usage_cannot_create_portal_session": "Arvelduste vaate avamine ei õnnestu",
+    "prefs_notifications_min_priority_any": "Kõik prioriteedid",
+    "prefs_notifications_min_priority_low_and_higher": "Vähetähtsad ja kõrgemad",
+    "prefs_notifications_min_priority_default_and_higher": "Vaikimisi tähtsusega ja kõrgemad",
+    "prefs_notifications_min_priority_high_and_higher": "Väga tähtsad ja kõrgemad",
+    "prefs_notifications_min_priority_max_only": "Vaid kõrgeim prioriteet",
+    "prefs_reservations_table_everyone_deny_all": "Vaid mina saan avaldada ja tellida",
+    "prefs_reservations_table_everyone_read_only": "Mina saan avaldada ja tellida, kõik saavad tellida",
+    "prefs_reservations_table_everyone_write_only": "Mina saan avaldada ja tellida, kõik saavad avaldada",
+    "prefs_reservations_table_everyone_read_write": "Kõik saavad avaldada ja tellida",
+    "prefs_reservations_table_not_subscribed": "Pole tellitud",
+    "prefs_reservations_table_click_to_subscribe": "Tellimiseks klõpsi",
+    "prefs_reservations_dialog_title_add": "Reserveeri teema",
+    "prefs_reservations_dialog_title_edit": "Muuda reserveeritud teemat",
+    "prefs_reservations_dialog_title_delete": "Kustuta teema reserveering",
+    "prefs_reservations_dialog_description": "Teema reserveerimisega muutud selle omanikuks ja saad teiste jaoks määrata ligipääsuõigusi teemale.",
+    "reservation_delete_dialog_description": "Teema reserveerimisest loobudes annad teistele võimaluse seda reserveerida ja muutuda selle omanikuks. Sina saad otsustada, kas vanad sõnumid jäävad alles või kustutatakse.",
+    "reservation_delete_dialog_action_keep_title": "Säilita puhverdatud sõnumid ja manused",
+    "reservation_delete_dialog_action_keep_description": "Serveris puhverdatud sõnumid ja manused muutuvad avalikult nähtavaks neile, kes teavad teema nime.",
+    "reservation_delete_dialog_action_delete_title": "Kustuta puhverdatud sõnumid ja manused",
+    "reservation_delete_dialog_action_delete_description": "Puhverdatud sõnumid ja manused kustuvad jäädavalt. Seda tegevust ei saa hiljem tagasi pöörata.",
+    "reservation_delete_dialog_submit_button": "Kustuta reserveerimine",
+    "prefs_reservations_description": "Sa võid teemade nimesid reserveerida isiklikuks kasutuseks. Sellega muutud teema omanikuks ja saad määrata, kes ning mis viisil teemale ligi saab.",
+    "prefs_reservations_limit_reached": "Oled jõudnud reserveeritud teemade arvu ülempiirini.",
+    "prefs_reservations_add_button": "Lisa reserveeritud teema",
+    "prefs_reservations_edit_button": "Muuda ligipääsu teemale",
+    "prefs_reservations_delete_button": "Lähtesta ligipääs teemale",
+    "prefs_reservations_table": "Reserveeritud teemade tabel",
+    "web_push_unknown_notification_body": "Avades veebirakenduse peaksid vist tegema ntfy uuenduse",
+    "prefs_users_description_no_sync": "Kasutajad ja nende salasõnad pole sinu kontoga sünkroonitud.",
+    "error_boundary_title": "Vaat, kus lops - ntfy jooksis kokku",
+    "error_boundary_description": "Ilmselgelt ei peaks niimoodi juhtuma. Vabandust.<br/>Kui sul on mõni hetk aega, siis palun <githubLink>seate sellest GitHubis</githubLink> või kirjuta <discordLink>Discordis</discordLink> või <matrixLink>Matrixis</matrixLink>.",
+    "error_boundary_unsupported_indexeddb_description": "Meie ntfy veebirakendus vajab korralikuks toimimiseks brauseri IndexedDB funktsionaalsust, aga sinu veebibrauser seda privaatses režiimis ei toeta.<br/><br/>See on nüüd õnnetu lugu küll, aga olemuslikult pole ntfy veebirakenduse kasutamisel privaatses režiimis eriti mõtet - kõike hoitakse ju brauseri hallatavas andmekogus. Lisateavet selle kohta leiad <githubLink>GitHubist siit</githubLink>, aga saad ka teema üle meiega arutleda <discordLink>Discordis</discordLink> või <matrixLink>Matrixis</matrixLink>.",
+    "account_usage_basis_ip_description": "Selle kasutajakonto statistika ja kasutuspiirangud põhinevad sinu IP-aadressil ja seega võivad nad olla teistega jagatud. Siin näidatud piirangud on hinnangulised ja põhinevad üldistel päringupiirangutel.",
+    "prefs_notifications_web_push_enabled": "Kasutusel serveris {{server}}",
+    "prefs_notifications_web_push_disabled_description": "Saad teavitusi siis, kui rakendus on töös (WebSocketi abil)",
+    "prefs_notifications_web_push_enabled_description": "Saad teavitusi siis, kui rakendus pole töös (Web Pushi abil)",
+    "prefs_notifications_web_push_title": "Teavitused taustal",
+    "prefs_notifications_min_priority_description_max": "Näita teavitusi siis, kui prioriteet on 5 (maksimaalne)",
+    "prefs_notifications_min_priority_description_x_or_higher": "Näita teavitusi siis, kui prioriteet on {{number}} ({{name}}) või kõrgem",
+    "prefs_notifications_sound_description_none": "Teavitused ei kasuta saabumisel helimärguannet",
+    "prefs_notifications_sound_description_some": "Teavitused kasutavad saabumisel helimärguannet {{sound}}",
+    "prefs_notifications_sound_no_sound": "Helimärguanne puudub",
+    "prefs_notifications_sound_play": "Esita valitud helimärguannet",
+    "prefs_notifications_min_priority_title": "Väikseim prioriteet",
+    "prefs_notifications_min_priority_description_any": "Näitan kõiki teavitusi ja seejuures ei arvesta prioriteetidega",
+    "account_upgrade_dialog_cancel_warning": "Sellega <strong>katkestad oma tellimuse</strong> ja {{date}} muutub sinu kasutajakonto tase madalamaks. Sel kuupäeval teemade reserveeringud tühistuvad ja puhverdatud sõnumid <strong>kustutatakse serverist</strong>.",
+    "account_upgrade_dialog_proration_info": "<strong>Summade jagamine</strong>: Kui muudad teenusepaketti paremaks, siis pead hinnavahe <strong>maksma kohe</strong>. Kui muudad teenusepaketti madalamaks, siis hinnavahe arvelt hüvituvad mõned järgmised maksed.",
+    "account_upgrade_dialog_reservations_warning_one": "Sinu praegune teenusepakett võimaldab senise paketiga võrreldes reserveerida vähem teemasid. Enne paketi muutmist <strong>palun esmalt kustuta vähemalt üks reserveering</strong>. Seda saad <Link>teha siin</Link>.",
+    "account_upgrade_dialog_reservations_warning_other": "Sinu praegune teenusepakett võimaldab senise paketiga võrreldes reserveerida vähem teemasid. Enne paketi muutmist <strong>palun esmalt kustuta vähemalt {{count}} reserveeringut</strong>. Seda saad <Link>teha siin</Link>.",
+    "prefs_users_description": "Oma kaitstud teemade kasutajaid saad lisada ja eemaldada siin. Palun arvesta, et kasutajanimi ja salasõna on salvestatud veebibrauseri kohalikus andmeruumis.",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Eelsisestatud kasutajat ei saa muuta ega kustutada",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Eelsisestatud tunnusluba ei saa muuta ega kustutada"
 }

web/public/static/langs/fr.json

@@ -15,7 +15,7 @@
     "notifications_attachment_copy_url_title": "Copier l'URL de la pièce jointe dans le presse-papiers",
     "notifications_attachment_open_title": "Aller à {{url}}",
     "notifications_attachment_link_expired": "lien de téléchargement expiré",
-    "nav_button_publish_message": "Publier la notification",
+    "nav_button_publish_message": "Publier une notification",
     "notifications_copied_to_clipboard": "Copié dans le presse-papiers",
     "alert_not_supported_title": "Notifications non prises en charge",
     "notifications_tags": "Étiquettes",
@@ -64,7 +64,7 @@
     "notifications_actions_not_supported": "Cette action n'est pas supportée dans l'application web",
     "notifications_actions_http_request_title": "Envoyer une requête HTTP {{method}} à {{url}}",
     "publish_dialog_attachment_limits_quota_reached": "quota dépassé, {{remainingBytes}} restants",
-    "publish_dialog_tags_placeholder": "Liste séparée par des virgules d'étiquettes, par ex. avertissement,backup-srv1",
+    "publish_dialog_tags_placeholder": "Liste d'étiquettes séparée par des virgules, par ex. avertissement,backup-srv1",
     "publish_dialog_priority_label": "Priorité",
     "publish_dialog_click_label": "URL du clic",
     "publish_dialog_click_placeholder": "URL ouverte lors d'un clic sur la notification",
@@ -272,7 +272,7 @@
     "account_delete_dialog_button_submit": "Supprimer définitivement le compte",
     "account_delete_dialog_billing_warning": "Supprimer votre compte annule aussi immédiatement votre facturation. Vous n'aurez plus accès à votre tableau de bord de facturation.",
     "account_upgrade_dialog_title": "Changer le tarif du compte",
-    "account_upgrade_dialog_proration_info": "<strong>Facturation</strong> : Lors d'un changement vers un tiers payant, la différence de prix sera débitée <strong>immédiatement</strong>. En passant d'un tiers payant a gratuit, votre solde sera utilisé pour payer de futur factures.",
+    "account_upgrade_dialog_proration_info": "<strong>Proratisation</strong> : Lors d'un changement vers le haut entre plans payants, la différence de prix sera <strong>facturée immédiatement</strong>. En cas de diminutions vers un plan plus économique, la balance sera utilisée pour le paiement des factures suivantes.",
     "account_upgrade_dialog_reservations_warning_other": "Le tarif sélectionné autorise moins de sujets réservés que votre tarif actuel. Avant de changer de tarif, <strong>veuillez supprimer au moins {{count}} sujets réservés</strong>. Vous pouvez supprimer des sujets réservés dans les <Link>Paramètres</Link>.",
     "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} sujets réservés",
     "account_upgrade_dialog_tier_features_messages_other": "{{messages}} messages journaliers",
@@ -403,5 +403,7 @@
     "web_push_subscription_expiring_title": "Les notifications seront suspendues",
     "web_push_subscription_expiring_body": "Ouvrez ntfy pour continuer à recevoir les notifications",
     "web_push_unknown_notification_title": "Notification inconnue reçue du serveur",
-    "web_push_unknown_notification_body": "Il est possible que vous deviez mettre à jour ntfy en ouvrant l'application web"
+    "web_push_unknown_notification_body": "Il est possible que vous deviez mettre à jour ntfy en ouvrant l'application web",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Un utilisateur provisionné ne peut pas être modifié ou supprimé",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossible de modifier ou de supprimer le jeton provisionné"
 }

web/public/static/langs/gl.json

@@ -406,5 +406,7 @@
     "web_push_subscription_expiring_body": "Abrir ntfy para seguir recibindo notificacións",
     "web_push_unknown_notification_title": "Recibida unha notificación descoñecida desde o servidor",
     "web_push_unknown_notification_body": "Poderías ter que actualizar ntfy abrindo a app web",
-    "subscribe_dialog_subscribe_use_another_background_info": "As notificacións procedentes doutros servidores non se van recibir cando a app web estea pechada"
+    "subscribe_dialog_subscribe_use_another_background_info": "As notificacións procedentes doutros servidores non se van recibir cando a app web estea pechada",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Unha usuaria predefinida non se pode editar ou eliminar",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Non se pode editar un token de usuaria predefinida"
 }

web/public/static/langs/id.json

@@ -23,7 +23,7 @@
     "nav_topics_title": "Topik yang dilanggani",
     "nav_button_subscribe": "Berlangganan ke topik",
     "alert_notification_permission_required_title": "Notifikasi dinonaktifkan",
-    "alert_notification_permission_required_description": "Berikan izin ke peramban untuk menampilkan notifikasi desktop.",
+    "alert_notification_permission_required_description": "Berikan izin ke peramban web Anda untuk menampilkan notifikasi desktop",
     "alert_not_supported_description": "Notifikasi tidak didukung dalam peramban Anda",
     "notifications_attachment_open_title": "Pergi ke {{url}}",
     "notifications_attachment_open_button": "Buka lampiran",
@@ -50,10 +50,10 @@
     "publish_dialog_progress_uploading": "Mengunggah …",
     "notifications_more_details": "Untuk informasi lanjut, lihat <websiteLink>situs web</websiteLink> atau <docsLink>dokumentasi</docsLink>.",
     "publish_dialog_progress_uploading_detail": "Mengunggah {{loaded}}/{{total}} ({{percent}}%) …",
-    "publish_dialog_message_published": "Notifikasi terpublikasi",
+    "publish_dialog_message_published": "Notifikasi dipublikasikan",
     "notifications_loading": "Memuat notifikasi …",
     "publish_dialog_base_url_label": "URL Layanan",
-    "publish_dialog_title_placeholder": "Judul notifikasi, mis. Peringatan ruang disk",
+    "publish_dialog_title_placeholder": "Judul notifikasi, contoh: Peringatan ruang penyimpanan disk",
     "publish_dialog_tags_label": "Tanda",
     "publish_dialog_priority_label": "Prioritas",
     "publish_dialog_base_url_placeholder": "URL Layanan, mis. https://contoh.com",
@@ -65,18 +65,18 @@
     "publish_dialog_attachment_limits_file_reached": "melebihi batasan file {{fileSizeLimit}",
     "publish_dialog_attachment_limits_file_and_quota_reached": "melebihi batasan file dan kuota {{fileSizeLimit}}, hanya {{remainingBytes}}",
     "publish_dialog_attachment_limits_quota_reached": "melebihi kuota, hanya {{remainingBytes}}",
-    "publish_dialog_priority_min": "Prioritas min.",
+    "publish_dialog_priority_min": "Prioritas minimal",
     "publish_dialog_priority_low": "Prioritas rendah",
     "publish_dialog_priority_default": "Prioritas bawaan",
     "publish_dialog_priority_high": "Prioritas tinggi",
-    "publish_dialog_priority_max": "Prioritas maks.",
+    "publish_dialog_priority_max": "Prioritas maksimal",
     "publish_dialog_topic_label": "Nama topik",
-    "publish_dialog_message_placeholder": "Ketik sebuah pesan di sini",
+    "publish_dialog_message_placeholder": "Tulis pesan di sini",
     "publish_dialog_click_label": "Klik URL",
-    "publish_dialog_tags_placeholder": "Daftar tanda yang dipisah dengan koma, mis. peringatan, cadangan-srv1",
+    "publish_dialog_tags_placeholder": "Daftar label yang dipisahkan koma, contoh: peringatan, cadangan-srv1",
     "publish_dialog_click_placeholder": "URL yang dibuka ketika notifikasi diklik",
     "publish_dialog_email_label": "Email",
-    "publish_dialog_email_placeholder": "Alamat untuk meneruskan notifikasi, mis. andi@contoh.com",
+    "publish_dialog_email_placeholder": "Alamat untuk meneruskan notifikasi, contoh: phil@example.com",
     "publish_dialog_attach_label": "URL Lampiran",
     "publish_dialog_filename_label": "Nama File",
     "publish_dialog_filename_placeholder": "Nama file lampiran",
@@ -404,5 +404,7 @@
     "web_push_subscription_expiring_title": "Notifikasi akan dijeda",
     "web_push_subscription_expiring_body": "Buka ntfy untuk terus menerima notifikasi",
     "web_push_unknown_notification_title": "Notifikasi yang tidak diketahui diterima dari server",
-    "web_push_unknown_notification_body": "Anda mungkin harus memperbarui ntfy dengan membuka aplikasi web"
+    "web_push_unknown_notification_body": "Anda mungkin harus memperbarui ntfy dengan membuka aplikasi web",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Pengguna yang telah ditetapkan tidak dapat diedit atau dihapus",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Tidak dapat mengedit atau menghapus token yang disediakan"
 }

web/public/static/langs/it.json

@@ -8,11 +8,11 @@
     "message_bar_error_publishing": "Errore durante la pubblicazione della notifica",
     "message_bar_show_dialog": "Mostra la finestra di dialogo di pubblicazione",
     "message_bar_publish": "Pubblica messaggio",
-    "nav_topics_title": "Topic a cui si è iscritti",
+    "nav_topics_title": "Argomenti a cui si è iscritti",
     "nav_button_all_notifications": "Tutte le notifiche",
     "nav_button_settings": "Impostazioni",
     "nav_button_publish_message": "Pubblica notifica",
-    "nav_button_subscribe": "Iscriviti al topic",
+    "nav_button_subscribe": "Iscriviti all'argomento",
     "nav_button_muted": "Notifiche disattivate",
     "nav_button_connecting": "connessione",
     "alert_notification_permission_required_title": "Le notifiche sono disabilitate",
@@ -31,17 +31,17 @@
     "notifications_attachment_open_title": "Vai a {{url}}",
     "notifications_attachment_open_button": "Apri allegato",
     "notifications_attachment_link_expires": "Il collegamento scade il {{date}}",
-    "notifications_attachment_link_expired": "link per il download scaduto",
+    "notifications_attachment_link_expired": "collegamento per il download scaduto",
     "notifications_attachment_file_image": "file immagine",
     "notifications_attachment_file_video": "file video",
     "action_bar_toggle_mute": "Abilita/disabilita le notifiche",
     "notifications_attachment_file_document": "altro documento",
-    "notifications_click_copy_url_button": "Copia link",
-    "notifications_click_open_button": "Apri link",
+    "notifications_click_copy_url_button": "Copia collegamento",
+    "notifications_click_open_button": "Apri collegamento",
     "notifications_actions_open_url_title": "Vai a {{url}}",
     "notifications_actions_not_supported": "Azione non supportata nell'app Web",
-    "notifications_none_for_topic_title": "Non hai ancora ricevuto alcuna notifica per questo topic.",
-    "notifications_none_for_topic_description": "Per inviare notifiche a questo argomento, è sufficiente PUT o POST all'URL del topic.",
+    "notifications_none_for_topic_title": "Non hai ancora ricevuto alcuna notifica per questo argomento.",
+    "notifications_none_for_topic_description": "Per inviare notifiche a questo argomento, è sufficiente PUT o POST all'URL dell'argomento.",
     "notifications_none_for_any_title": "Non hai ricevuto alcuna notifica.",
     "notifications_no_subscriptions_title": "Sembra che tu non abbia ancora abbonamenti.",
     "notifications_example": "Esempio",
@@ -63,9 +63,9 @@
     "publish_dialog_priority_max": "Max. priorità",
     "publish_dialog_base_url_label": "URL del servizio",
     "publish_dialog_base_url_placeholder": "URL del servizio, ad es. https://esempio.com",
-    "publish_dialog_topic_label": "Nome topic",
-    "publish_dialog_topic_placeholder": "Nome topic, ad es. avvisi_di_phil",
-    "publish_dialog_topic_reset": "Reset topic",
+    "publish_dialog_topic_label": "Nome argomento",
+    "publish_dialog_topic_placeholder": "Nome argomento, ad es. avvisi_di_phil",
+    "publish_dialog_topic_reset": "Reimposta argomento",
     "publish_dialog_title_label": "Titolo",
     "publish_dialog_title_placeholder": "Titolo della notifica, ad es. Avviso di spazio su disco",
     "publish_dialog_message_label": "Messaggio",
@@ -97,13 +97,13 @@
     "publish_dialog_attached_file_remove": "Rimuovi il file allegato",
     "publish_dialog_drop_file_here": "Trascina il file qui",
     "emoji_picker_search_clear": "Cancella ricerca",
-    "subscribe_dialog_subscribe_title": "Iscriviti al topic",
+    "subscribe_dialog_subscribe_title": "Iscriviti all'argomento",
     "subscribe_dialog_subscribe_topic_placeholder": "Nome dell'argomento, ad es. avvisi_di_phil",
     "subscribe_dialog_subscribe_base_url_label": "URL del servizio",
     "subscribe_dialog_subscribe_button_cancel": "Annulla",
     "subscribe_dialog_login_title": "Accesso richiesto",
     "subscribe_dialog_login_username_label": "Nome utente, ad es. phil",
-    "subscribe_dialog_login_button_login": "Login",
+    "subscribe_dialog_login_button_login": "Accesso",
     "subscribe_dialog_error_user_anonymous": "anonimo",
     "prefs_notifications_sound_title": "Suono di notifica",
     "prefs_notifications_sound_description_some": "Le notifiche riproducono il suono {{sound}} quando arrivano",
@@ -122,7 +122,7 @@
     "prefs_notifications_delete_after_one_week_description": "Le notifiche vengono eliminate automaticamente dopo una settimana",
     "prefs_notifications_delete_after_one_month_description": "Le notifiche vengono eliminate automaticamente dopo un mese",
     "prefs_users_title": "Gestisci gli utenti",
-    "prefs_users_description": "Aggiungi/rimuovi utenti per i tuoi topic protetti qui. Tieni presente che nome utente e password sono memorizzati nella memoria locale del browser.",
+    "prefs_users_description": "Aggiungi/rimuovi utenti per i tuoi argomenti protetti qui. Tieni presente che nome utente e password sono memorizzati nella memoria locale del browser.",
     "prefs_users_table": "Tabella utenti",
     "prefs_users_add_button": "Aggiungi utente",
     "prefs_users_edit_button": "Modifica utente",
@@ -158,16 +158,16 @@
     "alert_notification_permission_required_description": "Concedi al tuo browser l'autorizzazione a visualizzare le notifiche sul desktop",
     "alert_not_supported_title": "Notifiche non supportate",
     "notifications_attachment_file_app": "file app Android",
-    "notifications_no_subscriptions_description": "Fai clic sul link \"{{linktext}}\" per creare o iscriverti a un topic. Successivamente, puoi inviare messaggi tramite PUT o POST e riceverai le notifiche qui.",
+    "notifications_no_subscriptions_description": "Fai clic sul collegamento \"{{linktext}}\" per creare o iscriverti a un argomento. Successivamente, puoi inviare messaggi tramite PUT o POST e riceverai le notifiche qui.",
     "notifications_attachment_file_audio": "file audio",
-    "notifications_none_for_any_description": "Per inviare notifiche a un topic, è sufficiente PUT o POST all'URL del topic. Ecco un esempio utilizzando uno dei tuoi topic.",
+    "notifications_none_for_any_description": "Per inviare notifiche a un argomento, è sufficiente PUT o POST all'URL dell'argomento. Ecco un esempio utilizzando uno dei tuoi argomenti.",
     "notifications_click_copy_url_title": "Copia l'URL del collegamento negli appunti",
     "prefs_notifications_sound_description_none": "Le notifiche non emettono alcun suono quando arrivano",
     "publish_dialog_delay_label": "Ritardo",
     "publish_dialog_tags_placeholder": "Elenco di tag separato da virgole, ad es. avviso, backup-srv1",
     "publish_dialog_click_placeholder": "URL che viene aperto quando si fa clic sulla notifica",
     "publish_dialog_attach_placeholder": "Allega file tramite URL, ad es. https://f-droid.org/F-Droid.apk",
-    "publish_dialog_chip_topic_label": "Cambia topic",
+    "publish_dialog_chip_topic_label": "Cambia argomento",
     "publish_dialog_details_examples_description": "Per esempi e una descrizione dettagliata di tutte le funzioni di invio, fare riferimento alla <docsLink>documentazione</docsLink>.",
     "publish_dialog_attached_file_filename_placeholder": "Nome file allegato",
     "emoji_picker_search_placeholder": "Cerca emoji",
@@ -177,7 +177,7 @@
     "subscribe_dialog_subscribe_button_subscribe": "Iscriviti",
     "prefs_notifications_sound_play": "Riproduci il suono selezionato",
     "prefs_notifications_min_priority_title": "Priorità minima",
-    "subscribe_dialog_login_description": "Questo argomento è protetto da password. Per favore inserisci username e password per iscriverti.",
+    "subscribe_dialog_login_description": "Questo argomento è protetto da password. Per favore inserisci nome utente e password per iscriverti.",
     "common_back": "Indietro",
     "subscribe_dialog_error_user_not_authorized": "Utente {{username}} non autorizzato",
     "prefs_notifications_title": "Notifiche",
@@ -268,7 +268,7 @@
     "publish_dialog_chip_call_no_verified_numbers_tooltip": "Nessun numero verificato",
     "account_basics_phone_numbers_title": "Numeri di telefono",
     "account_basics_phone_numbers_dialog_description": "Per usare la funzionalità di notifica tramite chiamata telefonica, devi aggiungere e verificare almeno un numero di telefono. La verifica può essere fatta tramite SMS o chiamata telefonica.",
-    "account_upgrade_dialog_tier_features_reservations_one": "{{reservations}} topic riservato",
+    "account_upgrade_dialog_tier_features_reservations_one": "{{reservations}} argomento riservato",
     "account_upgrade_dialog_billing_contact_email": "Per domande di fatturazione, <Link>contattaci</Link> direttamente.",
     "account_upgrade_dialog_tier_current_label": "Attuale",
     "account_basics_phone_numbers_dialog_number_label": "Numero di telefono",
@@ -276,13 +276,13 @@
     "account_basics_phone_numbers_dialog_verify_button_sms": "Invia SMS",
     "account_basics_phone_numbers_no_phone_numbers_yet": "Ancora nessun numero di telefono",
     "account_basics_phone_numbers_dialog_title": "Aggiungi un numero di telefono",
-    "account_upgrade_dialog_button_cancel": "Cancella",
+    "account_upgrade_dialog_button_cancel": "Annulla",
     "account_upgrade_dialog_billing_contact_website": "Per domande di fatturazione, visita per favore in nostro <Link>sito</Link>.",
-    "account_upgrade_dialog_button_cancel_subscription": "Cancella iscrizione",
+    "account_upgrade_dialog_button_cancel_subscription": "Annulla iscrizione",
     "account_basics_phone_numbers_description": "Per notifiche via chiamata",
     "account_basics_phone_numbers_copied_to_clipboard": "Numero di telefono copiato negli appunti",
-    "account_basics_phone_numbers_dialog_number_placeholder": "p. e. +391234567890",
-    "account_basics_phone_numbers_dialog_code_placeholder": "p. e. 123456",
+    "account_basics_phone_numbers_dialog_number_placeholder": "es. +391234567890",
+    "account_basics_phone_numbers_dialog_code_placeholder": "es. 123456",
     "account_tokens_title": "Token d'accesso",
     "account_upgrade_dialog_tier_price_billed_monthly": "{{price}} all'anno. Addebitato annualmente.",
     "account_basics_phone_numbers_dialog_channel_call": "Chiama",
@@ -296,7 +296,7 @@
     "account_upgrade_dialog_tier_selected_label": "Selezionato",
     "account_upgrade_dialog_button_update_subscription": "Aggiorna iscrizione",
     "account_usage_attachment_storage_title": "Archivio allegati",
-    "account_delete_dialog_description": "Il tuo account sarà permanentemente cancellato assieme a tutti i tuoi dati presenti sul server. Dopo la cancellazione, la tua username non sarà disponibile per 7 giorni. Se desideri davvero procedere, inserisci la tua password nella seguente casella.",
+    "account_delete_dialog_description": "Il tuo account sarà permanentemente eliminato insieme a tutti i tuoi dati presenti sul server. Dopo l'eliminazione, il tuo nome utente non sarà disponibile per 7 giorni. Se desideri davvero procedere, inserisci la tua password nella seguente casella.",
     "account_delete_dialog_button_cancel": "Annulla",
     "account_usage_calls_title": "Chiamate effettuate",
     "account_delete_description": "Elimina permanentemente il tuo account",
@@ -326,7 +326,7 @@
     "account_tokens_dialog_title_edit": "Modifica token di accesso",
     "account_tokens_dialog_button_create": "Crea token",
     "account_tokens_dialog_button_update": "Aggiorna token",
-    "account_upgrade_dialog_tier_features_emails_one": "{{emails}} e-mails giornaliere",
+    "account_upgrade_dialog_tier_features_emails_one": "{{emails}} email giornaliere",
     "account_upgrade_dialog_tier_features_messages_other": "{{messages}} messaggi giornalieri",
     "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} per file",
     "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} spazio di archiviazione totale",
@@ -348,7 +348,7 @@
     "account_tokens_dialog_title_create": "Crea token di accesso",
     "account_tokens_dialog_button_cancel": "Annulla",
     "web_push_unknown_notification_body": "Potrebbe essere necessario aggiornare ntfy aprendo l'app web",
-    "account_upgrade_dialog_proration_info": "<strong>Prorata</strong>: quando si esegue l'upgrade tra piani a pagamento, la differenza di prezzo verrà <strong>addebitata immediatamente</strong>. Quando si esegue il downgrade a un livello inferiore, il saldo verrà utilizzato per pagare i periodi di fatturazione futuri.",
+    "account_upgrade_dialog_proration_info": "<strong>Prorata</strong>: quando si esegue l'aggiornamento tra piani a pagamento, la differenza di prezzo verrà <strong>addebitata immediatamente</strong>. Quando si esegue il ritorna ad un livello inferiore, il saldo verrà utilizzato per pagare i periodi di fatturazione futuri.",
     "account_tokens_table_last_access_header": "Ultimo accesso",
     "account_tokens_table_expires_header": "Scade",
     "account_tokens_table_never_expires": "Non scade mai",

web/public/static/langs/ja.json

@@ -14,7 +14,7 @@
     "publish_dialog_title_no_topic": "通知を送信",
     "publish_dialog_progress_uploading": "アップロード中…",
     "publish_dialog_progress_uploading_detail": "アップロード中 {{loaded}}/{{total}} ({{percent}}%) …",
-    "publish_dialog_message_published": "通知を送信しました",
+    "publish_dialog_message_published": "通知送信済み",
     "publish_dialog_title_label": "タイトル",
     "publish_dialog_filename_label": "ファイル名",
     "subscribe_dialog_login_description": "このトピックはログインする必要があります。ユーザー名とパスワードを入力してください。",
@@ -69,10 +69,10 @@
     "publish_dialog_attachment_limits_quota_reached": "クォータを超過しました、残り{{remainingBytes}}",
     "publish_dialog_priority_high": "優先度 高",
     "publish_dialog_topic_placeholder": "トピック名の例 phil_alerts",
-    "publish_dialog_title_placeholder": "通知タイトル 例: ディスクスペース警告",
+    "publish_dialog_title_placeholder": "通知タイトル、例: ディスクスペース警告",
     "publish_dialog_message_placeholder": "メッセージ本文を入力してください",
     "publish_dialog_tags_label": "タグ",
-    "publish_dialog_tags_placeholder": "コンマ区切りでタグを列挙してください 例: warning, srv1-backup",
+    "publish_dialog_tags_placeholder": "コンマ区切りでタグを列挙してください、例: warning, srv1-backup",
     "publish_dialog_topic_label": "トピック名",
     "publish_dialog_delay_label": "遅延",
     "publish_dialog_click_placeholder": "通知をクリックしたときに開くURL",
@@ -403,5 +403,7 @@
     "prefs_appearance_theme_system": "システム (既定)",
     "prefs_appearance_theme_dark": "ダークモード",
     "web_push_unknown_notification_title": "不明な通知を受信しました",
-    "web_push_unknown_notification_body": "ウェブアプリを開いてntfyをアップデートする必要があります"
+    "web_push_unknown_notification_body": "ウェブアプリを開いてntfyをアップデートする必要があります",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "自動作成されたユーザーの編集や削除はできません",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "自動作成されたトークンは編集や削除はできません"
 }

web/public/static/langs/ko.json

@@ -187,5 +187,6 @@
     "prefs_users_dialog_username_label": "사용자 이름, 예를 들면 phil",
     "prefs_users_dialog_password_label": "비밀번호",
     "priority_max": "최상",
-    "error_boundary_description": "이것은 당연히 발생되어서는 안됩니다. 굉장히 죄송합니다.<br/>가능하시다면 <githubLink>이 문제를 깃허브에 제보</githubLink>해 주시거나, <discordLink>디스코드 서버</discordLink>나 <matrixLink>Matrix</matrixLink>를 통해 알려주세요."
+    "error_boundary_description": "이것은 당연히 발생되어서는 안됩니다. 굉장히 죄송합니다.<br/>가능하시다면 <githubLink>이 문제를 깃허브에 제보</githubLink>해 주시거나, <discordLink>디스코드 서버</discordLink>나 <matrixLink>Matrix</matrixLink>를 통해 알려주세요.",
+    "common_copy_to_clipboard": "클립보드에 복사"
 }

web/public/static/langs/mk.json

@@ -0,0 +1,96 @@
+{
+    "common_cancel": "Откажи",
+    "common_save": "Зачувај",
+    "common_add": "Додади",
+    "common_back": "Назад",
+    "common_copy_to_clipboard": "Копирај",
+    "action_bar_profile_logout": "Одјави се",
+    "action_bar_sign_in": "Најави се",
+    "action_bar_sign_up": "Регистрирај се",
+    "message_bar_type_message": "Пишете порака тука",
+    "action_bar_profile_title": "Профил",
+    "action_bar_profile_settings": "Подесувања",
+    "signup_form_username": "Корисничко име",
+    "signup_form_password": "Лозинка",
+    "signup_form_confirm_password": "Повтори лозинка",
+    "login_form_button_submit": "Најави се",
+    "login_link_signup": "Регистрирај се",
+    "signup_form_button_submit": "Регистрирај се",
+    "action_bar_settings": "Подесувања",
+    "signup_title": "Создади ntfy профил",
+    "signup_form_toggle_password_visibility": "Покажи/сокриј лозинка",
+    "signup_already_have_account": "Имате профил? Најавете се!",
+    "signup_disabled": "Регистрирање е исклучено",
+    "signup_error_username_taken": "Корисничкото име {{username}} е веќе земено",
+    "signup_error_creation_limit_reached": "Лимитот на создадени профили е надминат",
+    "login_title": "Најавете се на вашиот ntfy профил",
+    "login_disabled": "Најавувањето е исклучено",
+    "action_bar_show_menu": "Покажи мени",
+    "action_bar_logo_alt": "ntfy лого",
+    "action_bar_account": "Профил",
+    "action_bar_change_display_name": "Промени покажано име",
+    "action_bar_reservation_add": "Резервирај тема",
+    "action_bar_reservation_edit": "Промени резервација",
+    "account_basics_title": "Профил",
+    "account_basics_username_title": "Корисничко име",
+    "nav_button_account": "Профил",
+    "nav_button_settings": "Подесувања",
+    "nav_button_documentation": "Документација",
+    "notifications_attachment_copy_url_button": "Копирај URL",
+    "publish_dialog_message_label": "Порака",
+    "action_bar_reservation_delete": "Отстрани резервација",
+    "action_bar_reservation_limit_reached": "Достигната е границата",
+    "action_bar_send_test_notification": "Испрати тест нотификација",
+    "action_bar_clear_notifications": "Исчисти ги сите нотификации",
+    "action_bar_mute_notifications": "Загуши ги нотификациите",
+    "action_bar_unsubscribe": "Отпиши се",
+    "action_bar_toggle_action_menu": "Отвори/затвори мени за акција",
+    "message_bar_error_publishing": "Грешки при публикација на нотификацијата",
+    "message_bar_show_dialog": "Покажи дијалог за публикација",
+    "nav_topics_title": "Претплатени теми",
+    "nav_button_all_notifications": "Сите нотификации",
+    "nav_button_publish_message": "Објави нотификација",
+    "nav_button_subscribe": "Претплати се на тема",
+    "action_bar_unmute_notifications": "Одглуши ги нотификациите",
+    "action_bar_toggle_mute": "Заглуши/Загуши ги нотификациите",
+    "message_bar_publish": "Објави порака",
+    "nav_button_connecting": "се конектира",
+    "nav_upgrade_banner_label": "Надградете на ntfy Pro",
+    "nav_upgrade_banner_description": "Резервирајте теми, повеќе пораки и е-пораки и поголеми прилози",
+    "alert_notification_permission_required_title": "Известувањата се исклучени",
+    "alert_notification_permission_required_description": "Дајте му дозвола на вашиот прелистувач да прикажува известувања",
+    "nav_button_muted": "Известувањата се загушени",
+    "alert_not_supported_title": "Известувањата не се поддржани",
+    "alert_not_supported_description": "Известувањата не се поддржани во вашиот прелистувач",
+    "alert_not_supported_context_description": "Известувањата се поддржани само преку HTTPS. Ова е ограничување на <mdnLink>Notifications API </mdnLink>.",
+    "notifications_list": "Список на известувања",
+    "notifications_list_item": "Известување",
+    "notifications_mark_read": "Означи како прочитано",
+    "publish_dialog_attached_file_filename_placeholder": "Име на фајл за прилог",
+    "notifications_attachment_file_app": "Фајл со апликација за Android",
+    "notifications_attachment_file_document": "друг документ",
+    "alert_notification_permission_required_button": "Дајте дозвола сега",
+    "alert_notification_permission_denied_title": "Известувањата се блокирани",
+    "alert_notification_permission_denied_description": "Ве молиме повторно овозможете ги во вашиот пребарувач",
+    "alert_notification_ios_install_required_title": "Потребна е инсталација на iOS",
+    "alert_notification_ios_install_required_description": "Кликнете на иконата Сподели и Додај на почетниот екран за да овозможите известувања на iOS",
+    "notifications_delete": "Избриши",
+    "notifications_copied_to_clipboard": "Копирано во таблата со исечоци",
+    "notifications_tags": "Ознаки",
+    "notifications_priority_x": "Приоритет {{приоритет}}",
+    "notifications_new_indicator": "Ново известување",
+    "notifications_attachment_image": "Слика од прилог",
+    "notifications_attachment_copy_url_title": "Копирај URL-адресата на прилогот во таблата со исечоци",
+    "notifications_attachment_open_title": "Оди на {{url}}",
+    "notifications_attachment_open_button": "Отвори го прилогот",
+    "notifications_attachment_link_expires": "линкот истекува {{date}}",
+    "notifications_attachment_link_expired": "линкот за преземање е истечен",
+    "notifications_attachment_file_image": "слика фајл",
+    "notifications_attachment_file_video": "видео фајл",
+    "notifications_attachment_file_audio": "аудио фајл",
+    "notifications_click_copy_url_button": "Копирај линк",
+    "notifications_click_open_button": "Отвори линк",
+    "notifications_actions_open_url_title": "Оди на {{url}}",
+    "notifications_actions_not_supported": "Дејството не е поддржано во веб-апликацијата",
+    "notifications_actions_http_request_title": "Испрати HTTP {{method}} на {{url}}"
+}

web/public/static/langs/pt.json

@@ -309,5 +309,100 @@
     "account_delete_dialog_button_cancel": "Cancelar",
     "account_upgrade_dialog_cancel_warning": "Isto irá <strong>cancelar a sua assinatura</strong>, e fazer downgrade da sua conta em {{date}}. Nessa data, tópicos reservados bem como mensagens guardadas no servidor <strong>serão eliminados</strong>.",
     "account_upgrade_dialog_proration_info": "<strong>Proporção</strong>: Quando atualizar entre planos pagos, a diferença de preço será <strong>debitada imediatamente</strong>. Quando efetuar um downgrade para um escalão inferior, o saldo disponível será usado para futuros períodos de faturação.",
-    "prefs_users_description_no_sync": "Utilizadores e palavras-passe não estão sincronizados com a sua conta."
+    "prefs_users_description_no_sync": "Utilizadores e palavras-passe não estão sincronizados com a sua conta.",
+    "account_upgrade_dialog_reservations_warning_one": "O nível selecionado permite menos tópicos reservados do que o nível atual. Antes de alterar o seu nível, <strong>apague pelo menos uma reserva</strong>. Pode remover reservas nas <Link>Configurações</Link>.",
+    "account_upgrade_dialog_reservations_warning_other": "O nível selecionado permite menos tópicos reservados do que o seu nível atual. Antes de mudar o seu nível, <strong>por favor apague ao menos {{count}} reservas</strong>. Pode remover reservas nas <Link>Configurações</Link>.",
+    "account_upgrade_dialog_tier_features_reservations_one": "{{reservations}} tópico reservado",
+    "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} tópicos reservados",
+    "account_upgrade_dialog_tier_features_no_reservations": "Sem tópicos reservados",
+    "account_upgrade_dialog_tier_features_messages_one": "{{messages}} mensagen diária",
+    "account_upgrade_dialog_tier_features_messages_other": "{{messages}} mensagens diárias",
+    "account_upgrade_dialog_tier_features_emails_one": "{{emails}} email diário",
+    "account_upgrade_dialog_tier_features_emails_other": "{{emails}} emails diários",
+    "account_upgrade_dialog_tier_features_calls_one": "{{calls}} chamadas diárias",
+    "account_upgrade_dialog_tier_features_calls_other": "{{calls}} chamadas telefônicas diárias",
+    "account_upgrade_dialog_tier_features_no_calls": "Nenhuma chamada",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} por ficheiro",
+    "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} armazenamento total",
+    "account_upgrade_dialog_tier_price_per_month": "mês",
+    "account_upgrade_dialog_tier_price_billed_monthly": "{{price}} por ano. Cobrado mensalmente.",
+    "account_upgrade_dialog_tier_price_billed_yearly": "{{price}} cobrado anualmente. Gravar {{save}}.",
+    "account_upgrade_dialog_tier_selected_label": "Selecionado",
+    "account_upgrade_dialog_tier_current_label": "Atual",
+    "account_upgrade_dialog_billing_contact_email": "Para questões de cobrança, <Link>entre em contacto conosco</Link> diretamente.",
+    "account_upgrade_dialog_billing_contact_website": "Para perguntas sobre o faturamento, consulte o nosso <Link>website</Link>.",
+    "account_upgrade_dialog_button_cancel": "Cancelar",
+    "account_upgrade_dialog_button_redirect_signup": "Cadastre-se agora",
+    "account_upgrade_dialog_button_pay_now": "Pague agora para assinar",
+    "account_upgrade_dialog_button_cancel_subscription": "Cancelar assinatura",
+    "account_upgrade_dialog_button_update_subscription": "Atualizar assinatura",
+    "account_tokens_title": "Tokens de Acesso",
+    "account_tokens_description": "Use tokens de acesso ao publicar e assinar por meio da API ntfy, para que não precise enviar as credenciais da sua conta. Consulte a <Link>documentação</Link> para saber mais.",
+    "account_tokens_table_token_header": "Token",
+    "account_tokens_table_label_header": "Rótulo",
+    "account_tokens_table_last_access_header": "Último acesso",
+    "account_tokens_table_expires_header": "Expira",
+    "account_tokens_table_never_expires": "Nunca expira",
+    "account_tokens_table_current_session": "Sessão atual do navegador",
+    "account_tokens_table_copied_to_clipboard": "Token de acesso copiado",
+    "account_tokens_table_cannot_delete_or_edit": "Não é possível editar ou apagar o token da sessão atual",
+    "account_tokens_table_create_token_button": "Criar token de acesso",
+    "account_tokens_table_last_origin_tooltip": "Do endereço IP {{ip}}, clique para pesquisar",
+    "account_tokens_dialog_title_create": "Criar token de acesso",
+    "account_tokens_dialog_title_edit": "Editar token de acesso",
+    "account_tokens_dialog_title_delete": "Apagar token de acesso",
+    "account_tokens_dialog_label": "Rótulo, por exemplo, notificações de Radarr",
+    "account_tokens_dialog_button_create": "Criar token",
+    "account_tokens_dialog_button_update": "Atualizar token",
+    "account_tokens_dialog_button_cancel": "Cancelar",
+    "account_tokens_dialog_expires_label": "O token de acesso expira em",
+    "account_tokens_dialog_expires_unchanged": "Deixar a data de validade inalterada",
+    "account_tokens_dialog_expires_x_hours": "O token expira em {{hours}} horas",
+    "account_tokens_dialog_expires_x_days": "O token expira em {{days}} dias",
+    "account_tokens_dialog_expires_never": "O token nunca expira",
+    "account_tokens_delete_dialog_title": "Apagar token de acesso",
+    "account_tokens_delete_dialog_description": "Antes de apagar um token de acesso, certifique-se de que nenhuma aplicação ou script esteja usando-lo ativamente. <strong>Esta ação não pode ser desfeita</strong>.",
+    "account_tokens_delete_dialog_submit_button": "Apagar token permanentemente",
+    "prefs_notifications_web_push_title": "Notificações em segundo plano",
+    "prefs_notifications_web_push_enabled_description": "As notificações são recebidas mesmo quando a aplicação Web não está em execução (via Web Push)",
+    "prefs_notifications_web_push_disabled_description": "As notificações são recebidas quando a aplicação Web está em execução (via WebSocket)",
+    "prefs_notifications_web_push_enabled": "Ativado para {{server}}",
+    "prefs_notifications_web_push_disabled": "Desativado",
+    "prefs_users_table_cannot_delete_or_edit": "Não é possível apagar ou editar o utilizador conectado",
+    "prefs_appearance_theme_title": "Tema",
+    "prefs_appearance_theme_system": "Sistema (padrão)",
+    "prefs_appearance_theme_dark": "Modo escuro",
+    "prefs_appearance_theme_light": "Modo claro",
+    "prefs_reservations_title": "Tópicos reservados",
+    "prefs_reservations_description": "Pode reservar nomes de tópicos para uso pessoal aqui. A reserva de um tópico lhe dá propriedade sobre ele e permite que defina permissões de acesso para outros utilizadores sobre o tópico.",
+    "prefs_reservations_limit_reached": "Atingiu o seu limite de tópicos reservados.",
+    "prefs_reservations_add_button": "Adicionar tópico reservado",
+    "prefs_reservations_edit_button": "Editar o acesso ao tópico",
+    "prefs_reservations_delete_button": "Redefinir o acesso ao tópico",
+    "prefs_reservations_table": "Tabela de tópicos reservados",
+    "prefs_reservations_table_topic_header": "Tópico",
+    "prefs_reservations_table_access_header": "Acesso",
+    "prefs_reservations_table_everyone_deny_all": "Somente eu posso publicar e me inscrever",
+    "prefs_reservations_table_everyone_read_only": "Posso publicar e me inscrever, todos podem se inscrever",
+    "prefs_reservations_table_everyone_write_only": "Posso publicar e me inscrever, todos podem publicar",
+    "prefs_reservations_table_everyone_read_write": "Todos podem publicar e se inscreverem",
+    "prefs_reservations_table_not_subscribed": "Não inscrito",
+    "prefs_reservations_table_click_to_subscribe": "Clique para se inscrever",
+    "prefs_reservations_dialog_title_add": "Reservar tópico",
+    "prefs_reservations_dialog_title_edit": "Editar tópico reservado",
+    "prefs_reservations_dialog_title_delete": "Apagar reserva de tópico",
+    "prefs_reservations_dialog_description": "A reserva de um tópico lhe dá propriedade sobre ele e permite definir permissões de acesso para outros utilizadores sobre o tópico.",
+    "prefs_reservations_dialog_topic_label": "Tópico",
+    "prefs_reservations_dialog_access_label": "Acesso",
+    "reservation_delete_dialog_description": "A remoção de uma reserva abre mão da propriedade sobre o tópico e permite que outros o reservem. Pode manter ou apagar as mensagens e os anexos existentes.",
+    "reservation_delete_dialog_action_keep_title": "Manter mensagens e anexos em cache",
+    "reservation_delete_dialog_action_keep_description": "As mensagens e os anexos armazenados em cache no servidor ficarão visíveis publicamente para as pessoas que souberem o nome do tópico.",
+    "reservation_delete_dialog_action_delete_title": "Apagar mensagens e anexos armazenados em cache",
+    "reservation_delete_dialog_action_delete_description": "As mensagens e os anexos armazenados em cache serão apagados permanentemente. Esta ação não pode ser desfeita.",
+    "reservation_delete_dialog_submit_button": "Apagar reserva",
+    "error_boundary_button_reload_ntfy": "Recarregar ntfy",
+    "web_push_subscription_expiring_title": "As notificações serão pausadas",
+    "web_push_subscription_expiring_body": "Abra o ntfy para continuar recebendo notificações",
+    "web_push_unknown_notification_title": "Notificação desconhecida recebida do servidor",
+    "web_push_unknown_notification_body": "Talvez seja necessário atualizar o ntfy abrindo a aplicação da Web"
 }

web/public/static/langs/pt_BR.json

@@ -301,7 +301,7 @@
     "publish_dialog_checkbox_markdown": "Formatar como Markdown",
     "subscribe_dialog_subscribe_use_another_background_info": "Notificações de outros servidores não serão recebidas quando o web app não estiver aberto",
     "account_usage_basis_ip_description": "As estatísticas e limites de uso desta conta são baseados no seu endereço IP, portanto, podem ser compartilhados com outros usuários. Os limites mostrados acima são aproximados com base nos limites de taxa existentes.",
-    "account_usage_cannot_create_portal_session": "Não foi possível abrir o portal de cobrança",
+    "account_usage_cannot_create_portal_session": "Não é possível abrir o portal de cobrança",
     "account_delete_description": "Deletar sua conta permanentemente",
     "account_delete_dialog_button_cancel": "Cancelar",
     "account_delete_dialog_button_submit": "Deletar conta permanentemente",
@@ -342,7 +342,7 @@
     "account_tokens_table_expires_header": "Expira",
     "prefs_users_description_no_sync": "Usuários e senhas não estão sincronizados com a sua conta.",
     "account_tokens_description": "Use tokens de acesso ao publicar e assinar por meio da API ntfy, para que você não precise enviar as credenciais da sua conta. Consulte a <Link>documentação</Link> para saber mais.",
-    "account_tokens_table_cannot_delete_or_edit": "Não é possível editar ou excluir o token da sessão atual",
+    "account_tokens_table_cannot_delete_or_edit": "Não é possível editar ou apagar o token da sessão atual",
     "account_tokens_dialog_title_edit": "Editar token de acesso",
     "account_tokens_dialog_title_delete": "Excluir token de acesso",
     "prefs_reservations_table_everyone_read_write": "Todos podem publicar e se inscrever",
@@ -369,7 +369,7 @@
     "account_tokens_dialog_button_update": "Atualizar token",
     "prefs_reservations_table": "Tabela de tópicos reservados",
     "prefs_reservations_table_everyone_deny_all": "Somente eu posso publicar e me inscrever",
-    "account_tokens_delete_dialog_description": "Antes de excluir um token de acesso, certifique-se de que nenhum aplicativo ou script o esteja usando ativamente. <strong>Esta ação não pode ser desfeita</strong>.",
+    "account_tokens_delete_dialog_description": "Antes de apagar um token de acesso, certifique-se de que nenhum aplicativo ou script o esteja usando ativamente. <strong>Esta ação não pode ser desfeita</strong>.",
     "account_tokens_delete_dialog_submit_button": "Excluir token permanentemente",
     "account_tokens_dialog_expires_x_hours": "O token expira em {{hours}} horas",
     "account_tokens_dialog_expires_x_days": "O token expira em {{days}} dias",
@@ -383,7 +383,7 @@
     "prefs_notifications_web_push_enabled": "Ativado para {{server}}",
     "prefs_notifications_web_push_disabled": "Desativado",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_users_table_cannot_delete_or_edit": "Não é possível excluir ou editar o usuário conectado",
+    "prefs_users_table_cannot_delete_or_edit": "Não é possível apagar ou editar o usuário conectado",
     "prefs_appearance_theme_system": "Sistema (padrão)",
     "prefs_appearance_theme_dark": "Modo escuro",
     "prefs_appearance_theme_light": "Modo claro",

web/public/static/langs/ro.json

@@ -242,5 +242,123 @@
     "account_usage_attachment_storage_title": "Stocare atașamente",
     "account_usage_basis_ip_description": "Statistica și limitele de utilizare pentru acest cont se bazează pe adresa ta IP, așadar pot fi partajate cu alți utilizatori. Limitele afișate mai sus sunt aproximative, bazate pe limitele de viteză existente.",
     "account_usage_reservations_none": "Nu există subiecte rezervate pentru acest cont",
-    "account_basics_tier_canceled_subscription": "Abonamentul tău a fost anulat și va fi retrogradat la un cont gratuit în data de {{date}}."
+    "account_basics_tier_canceled_subscription": "Abonamentul tău a fost anulat și va fi retrogradat la un cont gratuit în data de {{date}}.",
+    "account_delete_dialog_label": "Parolă",
+    "account_delete_dialog_button_cancel": "Anulează",
+    "account_delete_dialog_button_submit": "Șterge permanent contul",
+    "account_delete_dialog_billing_warning": "Ștergerea contului tău anulează imediat și abonamentul de facturare. Nu vei mai avea acces la tabloul de bord pentru facturare.",
+    "account_upgrade_dialog_title": "Schimbă nivelul contului",
+    "account_upgrade_dialog_interval_monthly": "Lunar",
+    "account_upgrade_dialog_interval_yearly": "Anual",
+    "account_upgrade_dialog_interval_yearly_discount_save": "economisești {{discount}}%",
+    "account_upgrade_dialog_interval_yearly_discount_save_up_to": "economisești până la {{discount}}%",
+    "prefs_notifications_title": "Notificări",
+    "prefs_notifications_sound_description_none": "Notificările nu redau niciun sunet atunci când sosesc",
+    "prefs_notifications_sound_description_some": "Notificările redau sunetul {{sound}} atunci când sosesc",
+    "prefs_notifications_min_priority_description_any": "Se afișează toate notificările, indiferent de prioritate",
+    "prefs_notifications_min_priority_description_x_or_higher": "Afișează notificările dacă prioritatea este {{number}} ({{name}}) sau mai mare",
+    "prefs_notifications_min_priority_description_max": "Afișează notificări dacă prioritatea este 5 (maxim)",
+    "prefs_notifications_delete_after_title": "Șterge notificările",
+    "prefs_notifications_delete_after_never_description": "Notificările nu sunt niciodată șterse automat",
+    "prefs_notifications_delete_after_three_hours_description": "Notificările sunt șterse automat după trei ore",
+    "prefs_notifications_delete_after_one_day_description": "Notificările sunt șterse automat după o zi",
+    "prefs_notifications_delete_after_one_week_description": "Notificările sunt șterse automat după o săptămână",
+    "prefs_notifications_delete_after_one_month_description": "Notificările sunt șterse automat după o lună",
+    "prefs_notifications_web_push_title": "Notificări în fundal",
+    "prefs_notifications_web_push_enabled_description": "Notificările sunt primite chiar și atunci când aplicația web nu rulează (prin Web Push)",
+    "web_push_subscription_expiring_title": "Notificările vor fi suspendate",
+    "web_push_subscription_expiring_body": "Deschide ntfy pentru a continua să primești notificări",
+    "account_upgrade_dialog_tier_features_reservations_one": "subiect rezervat {{reservations}}",
+    "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} subiecte rezervate",
+    "account_upgrade_dialog_tier_features_no_reservations": "Nu există subiecte rezervate",
+    "account_upgrade_dialog_tier_features_messages_one": "{{messages}} mesaj zilnic",
+    "account_upgrade_dialog_tier_features_messages_other": "{{messages}} mesaje zilnice",
+    "account_upgrade_dialog_tier_features_emails_one": "{{emails}} e-mail zilnic",
+    "account_upgrade_dialog_tier_features_emails_other": "{{emails}} e-mailuri zilnice",
+    "account_upgrade_dialog_tier_features_calls_one": "{{calls}} apeluri telefonice zilnice",
+    "account_upgrade_dialog_tier_features_calls_other": "{{calls}} apeluri telefonice zilnice",
+    "account_upgrade_dialog_tier_features_no_calls": "Fără apeluri telefonice",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} per fișier",
+    "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} stocare totală",
+    "account_upgrade_dialog_tier_price_per_month": "lună",
+    "account_upgrade_dialog_tier_price_billed_monthly": "{{price}} pe an. Facturat lunar.",
+    "account_upgrade_dialog_tier_selected_label": "Selectat",
+    "account_upgrade_dialog_tier_current_label": "Actual",
+    "account_upgrade_dialog_button_cancel": "Anulează",
+    "account_upgrade_dialog_button_redirect_signup": "Înscrie-te acum",
+    "account_upgrade_dialog_button_pay_now": "Plătește acum și abonează-te",
+    "account_upgrade_dialog_button_cancel_subscription": "Anulează abonamentul",
+    "account_tokens_table_token_header": "Token",
+    "account_tokens_table_label_header": "Etichetă",
+    "account_tokens_table_last_access_header": "Ultimul acces",
+    "account_tokens_table_expires_header": "Expiră",
+    "account_tokens_table_never_expires": "Nu expiră niciodată",
+    "account_tokens_table_current_session": "Sesiunea curentă a browserului",
+    "account_tokens_table_copied_to_clipboard": "Tokenul de acces a fost copiat",
+    "account_tokens_table_last_origin_tooltip": "De la adresa IP {{ip}}, faceți clic pentru a căuta",
+    "account_tokens_dialog_title_create": "Crează un token de acces",
+    "account_tokens_dialog_title_edit": "Modifică tokenul de acces",
+    "account_tokens_dialog_title_delete": "Șterge tokenul de acces",
+    "account_tokens_dialog_label": "Etichetă, de exemplu, notificări Radarr",
+    "account_tokens_dialog_button_create": "Crează un token",
+    "account_tokens_dialog_button_update": "Actualizare token",
+    "account_tokens_dialog_button_cancel": "Anulează",
+    "account_tokens_dialog_expires_label": "Tokenul de acces expiră în",
+    "account_tokens_dialog_expires_never": "Tokenul nu expiră niciodată",
+    "account_tokens_delete_dialog_title": "Șterge tokenul de acces",
+    "account_tokens_delete_dialog_submit_button": "Șterge definitiv tokenul",
+    "prefs_notifications_sound_title": "Sunet de notificare",
+    "prefs_notifications_sound_no_sound": "Niciun sunet",
+    "prefs_notifications_sound_play": "Redă sunetul selectat",
+    "prefs_notifications_min_priority_title": "Prioritate minimă",
+    "prefs_notifications_min_priority_any": "Orice prioritate",
+    "prefs_notifications_min_priority_low_and_higher": "Prioritate scăzută și mai mare",
+    "prefs_notifications_min_priority_default_and_higher": "Prioritate implicită și mai mare",
+    "prefs_notifications_min_priority_high_and_higher": "Prioritate ridicată și mai mare",
+    "prefs_notifications_min_priority_max_only": "Numai prioritate maximă",
+    "prefs_notifications_delete_after_never": "Niciodată",
+    "prefs_notifications_delete_after_three_hours": "După trei ore",
+    "prefs_notifications_delete_after_one_day": "După o zi",
+    "prefs_notifications_delete_after_one_week": "După o săptămână",
+    "prefs_notifications_delete_after_one_month": "După o lună",
+    "prefs_notifications_web_push_disabled_description": "Notificările sunt primite atunci când aplicația web rulează (prin WebSocket)",
+    "prefs_notifications_web_push_enabled": "Activat pentru {{server}}",
+    "prefs_notifications_web_push_disabled": "Dezactivat",
+    "prefs_users_title": "Gestionează utilizatorii",
+    "prefs_users_description_no_sync": "Utilizatorii și parolele nu sunt sincronizate cu contul tău.",
+    "prefs_users_table": "Tabel utilizatori",
+    "prefs_users_add_button": "Adăugă utilizator",
+    "prefs_users_edit_button": "Modifică utilizatorul",
+    "prefs_users_delete_button": "Șterge utilizatorul",
+    "prefs_users_table_cannot_delete_or_edit": "Nu se poate șterge sau modifica utilizatorul conectat",
+    "prefs_users_table_user_header": "Utilizator",
+    "prefs_users_table_base_url_header": "URL-ul serviciului",
+    "prefs_users_dialog_title_add": "Adaugă utilizator",
+    "prefs_users_dialog_title_edit": "Modifică utilizatorul",
+    "prefs_users_dialog_base_url_label": "URL-ul serviciului, de exemplu https://ntfy.sh",
+    "prefs_users_dialog_username_label": "Nume de utilizator, de ex. ionel",
+    "prefs_users_dialog_password_label": "Parolă",
+    "prefs_appearance_title": "Aspect",
+    "prefs_appearance_language_title": "Limbă",
+    "prefs_appearance_theme_title": "Temă",
+    "prefs_appearance_theme_system": "Sistem (implicit)",
+    "prefs_appearance_theme_dark": "Mod întunecat",
+    "prefs_appearance_theme_light": "Mod luminos",
+    "prefs_reservations_title": "Subiecte rezervate",
+    "prefs_reservations_limit_reached": "Ai atins limita de subiecte rezervate.",
+    "prefs_reservations_add_button": "Adaugă un subiect rezervat",
+    "prefs_reservations_delete_button": "Resetează accesul la topic",
+    "prefs_reservations_table_access_header": "Acces",
+    "prefs_reservations_table_everyone_deny_all": "Numai eu pot publica și mă pot abona",
+    "prefs_reservations_table_not_subscribed": "Neabonat",
+    "prefs_reservations_dialog_access_label": "Acces",
+    "reservation_delete_dialog_action_keep_title": "Păstrează mesajele și atașamentele în cache",
+    "prefs_users_description": "Adaugă/elimină utilizatori pentru subiectele protejate aici. Reține că numele de utilizator și parola sunt stocate în memoria locală a browserului.",
+    "reservation_delete_dialog_submit_button": "Șterge rezervarea",
+    "priority_min": "minim",
+    "priority_low": "scăzut",
+    "priority_default": "implicit",
+    "priority_high": "ridicat",
+    "priority_max": "maxim",
+    "error_boundary_button_reload_ntfy": "Reîncarcă ntfy"
 }

web/public/static/langs/th.json

@@ -0,0 +1,56 @@
+{
+    "common_cancel": "ยกเลิก",
+    "common_save": "บันทึก",
+    "common_add": "เพิ่ม",
+    "common_back": "กลับ",
+    "common_copy_to_clipboard": "คัดลอกไปยังคลิปบอร์ด",
+    "signup_title": "สร้างบัญชี ntfy",
+    "signup_form_username": "ชื่อผู้ใช้",
+    "signup_form_password": "รหัสผ่าน",
+    "signup_form_confirm_password": "ยืนยันรหัสผ่าน",
+    "signup_form_button_submit": "สมัครสมาชิก",
+    "signup_form_toggle_password_visibility": "สลับการมองเห็นรหัสผ่าน",
+    "signup_already_have_account": "มีบัญชีอยู่แล้วใช่ไหม? เข้าสู่ระบบ!",
+    "signup_disabled": "การลงทะเบียนถูกปิดใช้งาน",
+    "signup_error_username_taken": "ชื่อผู้ใช้ {{username}} ถูกใช้ไปแล้ว",
+    "signup_error_creation_limit_reached": "ถึงขีดจำกัดการสร้างบัญชีแล้ว",
+    "login_title": "ลงชื่อเข้าใช้บัญชี ntfy ของคุณ",
+    "login_form_button_submit": "ลงชื่อเข้าใช้",
+    "login_link_signup": "สมัครสมาชิก",
+    "login_disabled": "การเข้าสู่ระบบถูกปิดใช้งาน",
+    "action_bar_show_menu": "แสดงเมนู",
+    "action_bar_logo_alt": "โลโก้ ntfy",
+    "action_bar_settings": "การตั้งค่า",
+    "action_bar_account": "บัญชี",
+    "action_bar_change_display_name": "เปลี่ยนชื่อที่แสดง",
+    "action_bar_reservation_add": "หัวข้อที่สงวนไว้",
+    "action_bar_reservation_edit": "เปลี่ยนแปลงการจอง",
+    "action_bar_reservation_delete": "ลบการจอง",
+    "action_bar_reservation_limit_reached": "ถึงขีดจำกัดแล้ว",
+    "action_bar_send_test_notification": "ทดสอบการส่งการแจ้งเตือน",
+    "action_bar_clear_notifications": "ล้างการแจ้งเตือนทั้งหมด",
+    "action_bar_mute_notifications": "ปิดเสียงการแจ้งเตือนชั่วคราว",
+    "action_bar_unmute_notifications": "เปิดเสียงการแจ้งเตือน",
+    "action_bar_unsubscribe": "ยกเลิกการสมัครรับ",
+    "action_bar_toggle_mute": "ปิดเสียง/เปิดเสียงการแจ้งเตือน",
+    "action_bar_toggle_action_menu": "เปิด/ปิดเมนูการดำเนินการ",
+    "action_bar_profile_title": "โปรไฟล์",
+    "action_bar_profile_settings": "การตั้งค่า",
+    "action_bar_profile_logout": "ออกจากระบบ",
+    "action_bar_sign_in": "ลงชื่อเข้าใช้",
+    "action_bar_sign_up": "สมัครสมาชิก",
+    "message_bar_type_message": "พิมพ์ข้อความที่นี่",
+    "message_bar_publish": "เผยแพร่ข้อความ",
+    "nav_topics_title": "หัวข้อที่สมัครรับข้อมูล",
+    "nav_button_all_notifications": "การแจ้งเตือนทั้งหมด",
+    "nav_button_account": "บัญชี",
+    "nav_button_settings": "การตั้งค่า",
+    "nav_button_documentation": "เอกสารประกอบ",
+    "nav_button_publish_message": "เผยแพร่การแจ้งเตือน",
+    "message_bar_error_publishing": "เกิดข้อผิดพลาดในการเผยแพร่การแจ้งเตือน",
+    "message_bar_show_dialog": "แสดงกล่องโต้ตอบการเผยแพร่",
+    "nav_button_subscribe": "สมัครรับหัวข้อ",
+    "nav_button_muted": "ปิดการแจ้งเตือน",
+    "nav_button_connecting": "การเชื่อมต่อ",
+    "nav_upgrade_banner_label": "อัพเกรดเป็น ntfy Pro"
+}

web/public/static/langs/tr.json

@@ -57,7 +57,7 @@
     "prefs_notifications_delete_after_never": "Hiçbir zaman",
     "notifications_attachment_copy_url_button": "URL'yi kopyala",
     "notifications_attachment_open_button": "Eki aç",
-    "nav_button_documentation": "Belgelendirme",
+    "nav_button_documentation": "Dokümantasyon",
     "nav_button_publish_message": "Bildirim yayınla",
     "alert_notification_permission_required_title": "Bildirimler devre dışı",
     "alert_notification_permission_required_description": "Tarayıcınıza masaüstü bildirimlerini görüntüleme izni verin",
@@ -75,7 +75,7 @@
     "notifications_click_open_button": "Bağlantıyı aç",
     "notifications_no_subscriptions_description": "Bir konu oluşturmak veya bir konuya abone olmak için \"{{linktext}}\" bağlantısına tıklayın. Bundan sonra PUT veya POST yoluyla mesaj gönderebilirsiniz ve buradan bildirimler alırsınız.",
     "notifications_example": "Örnek",
-    "notifications_more_details": "Daha fazla bilgi için <websiteLink>web sitesine</websiteLink> veya <docsLink>belgelendirmeye</docsLink> bakın.",
+    "notifications_more_details": "Daha fazla bilgi için <websiteLink>web sitesini</websiteLink> veya <docsLink>dokümantasyonu</docsLink> inceleyin.",
     "publish_dialog_chip_attach_url_label": "URL ile dosya ekle",
     "prefs_notifications_min_priority_default_and_higher": "Varsayılan öncelik ve üstü",
     "prefs_notifications_delete_after_three_hours": "Üç saat sonra",
@@ -108,7 +108,7 @@
     "publish_dialog_button_cancel_sending": "Göndermeyi iptal et",
     "prefs_notifications_delete_after_one_week": "Bir hafta sonra",
     "prefs_notifications_delete_after_one_month": "Bir ay sonra",
-    "publish_dialog_details_examples_description": "Örnekler ve tüm gönderme özelliklerinin ayrıntılı açıklaması için lütfen <docsLink>belgelendirmeye</docsLink> bakın.",
+    "publish_dialog_details_examples_description": "Tüm gönderme özelliklerinin örnekleri ve ayrıntılı açıklamaları için lütfen <docsLink>dokümantasyona</docsLink> bakın.",
     "emoji_picker_search_placeholder": "Emoji ara",
     "prefs_notifications_delete_after_title": "Bildirimleri sil",
     "prefs_notifications_delete_after_one_day": "Bir gün sonra",

web/public/static/langs/vi.json

@@ -79,5 +79,23 @@
     "notifications_attachment_file_app": "tập tin Android",
     "notifications_attachment_link_expires": "liên kết đã hết hạn {{date}}",
     "alert_not_supported_context_description": "Thông báo chỉ được hỗ trợ qua giao thức HTTPS. Đây là hạn chế của <mdnLink>API thông báo</mdnLink>.",
-    "notifications_attachment_open_button": "Mở đính kèm"
+    "notifications_attachment_open_button": "Mở đính kèm",
+    "message_bar_error_publishing": "Lỗi khi gửi thông báo",
+    "message_bar_show_dialog": "Hiện hộp thoại gửi thông báo",
+    "message_bar_publish": "Gửi thông báo",
+    "nav_topics_title": "Các topic đã đăng ký",
+    "nav_button_publish_message": "Gửi thông báo",
+    "nav_button_subscribe": "Đăng ký topic",
+    "nav_button_muted": "Đã tắt thông báo",
+    "nav_upgrade_banner_description": "Đặt trước topic, nhiều thông báo & email hơn, và tệp đính kèm dung lượng lớn hơn",
+    "action_bar_reservation_add": "Đặt trước topic",
+    "action_bar_reservation_edit": "Thay đổi thông tin đặt trước",
+    "action_bar_reservation_delete": "Huỷ đặt trước",
+    "notifications_none_for_topic_title": "Bạn chưa nhận được thông báo nào cho topic này.",
+    "notifications_none_for_topic_description": "Để gửi thông báo đến topic này, chỉ cần dùng PUT hoặc POST đến URL của topic.",
+    "notifications_none_for_any_title": "Bạn chưa nhận được thông báo nào.",
+    "notifications_none_for_any_description": "Để gửi thông báo đến một topic, bạn chỉ cần dùng PUT hoặc POST đến URL của topic. Dưới đây là một ví dụ với một trong các topic của bạn.",
+    "notifications_no_subscriptions_title": "Có vẻ như bạn chưa đăng ký topic nào.",
+    "notifications_no_subscriptions_description": "Bấm vào liên kết \"{{linktext}}\" để tạo hoặc đăng ký một chủ đề. Sau đó, bạn có thể gửi tin nhắn qua PUT hoặc POST và sẽ nhận thông báo tại đây.",
+    "notifications_example": "Ví dụ"
 }

web/public/static/langs/zh_Hans.json

@@ -182,7 +182,7 @@
     "subscribe_dialog_subscribe_topic_placeholder": "主题名，例如 phil_alerts",
     "notifications_no_subscriptions_description": "单击 \"{{linktext}}\" 链接以创建或订阅主题。之后，您可以使用 PUT 或 POST 发送消息，您将在这里收到通知。",
     "publish_dialog_attachment_limits_file_reached": "超过 {{fileSizeLimit}} 文件限制",
-    "publish_dialog_title_placeholder": "主题标题，例如 磁盘空间告警",
+    "publish_dialog_title_placeholder": "通知标题，如磁盘空间告警",
     "publish_dialog_email_label": "电子邮件",
     "publish_dialog_button_send": "发送",
     "publish_dialog_checkbox_markdown": "格式化为 Markdown",
@@ -203,17 +203,17 @@
     "error_boundary_description": "这显然不应该发生。对此非常抱歉。<br/>如果您有时间，请<githubLink>在GitHub</githubLink>上报告，或通过<discordLink>Discord</discordLink>或<matrixLink>Matrix</matrixLink>告诉我们。",
     "prefs_users_table": "用户表",
     "prefs_users_edit_button": "编辑用户",
-    "publish_dialog_tags_placeholder": "英文逗号分隔标记列表，例如 warning, srv1-backup",
+    "publish_dialog_tags_placeholder": "英文逗号分隔的标签列表，例如 warning, srv1-backup",
     "publish_dialog_details_examples_description": "有关所有发送功能的示例和详细说明，请参阅<docsLink>文档</docsLink>。",
     "subscribe_dialog_subscribe_description": "主题可能不受密码保护，因此请选择一个不容易被猜中的名字。订阅后，您可以使用 PUT/POST 通知。",
-    "publish_dialog_delay_placeholder": "延期投递，例如 {{unixTimestamp}}、{{relativeTime}}或「{{naturalLanguage}}」（仅限英语）",
-    "account_usage_basis_ip_description": "此帐户的使用统计信息和限制基于您的 IP 地址，因此可能会与其他用户共享。上面显示的限制是基于现有速率限制的近似值。",
+    "publish_dialog_delay_placeholder": "延期投递，例如 {{unixTimestamp}}、{{relativeTime}} 或 {{naturalLanguage}} （仅限英语）",
+    "account_usage_basis_ip_description": "此账户的使用统计信息和限制基于您的 IP 地址，因此可能会与其他用户共享。上面显示的限制是基于现有速率限制的近似值。",
     "account_usage_cannot_create_portal_session": "无法打开计费门户",
-    "account_delete_title": "删除帐户",
-    "account_delete_description": "永久删除您的帐户",
+    "account_delete_title": "删除账户",
+    "account_delete_description": "永久删除您的账户",
     "signup_error_username_taken": "用户名 {{username}} 已被占用",
-    "signup_error_creation_limit_reached": "已达到帐户创建限制",
-    "login_title": "请登录你的 ntfy 帐户",
+    "signup_error_creation_limit_reached": "已达到账户创建限制",
+    "login_title": "请登录你的 ntfy 账户",
     "action_bar_change_display_name": "更改显示名称",
     "action_bar_reservation_add": "保留主题",
     "action_bar_reservation_delete": "移除保留",
@@ -223,7 +223,7 @@
     "action_bar_profile_logout": "登出",
     "action_bar_sign_in": "登录",
     "action_bar_sign_up": "注册",
-    "nav_button_account": "帐户",
+    "nav_button_account": "账户",
     "nav_upgrade_banner_label": "升级到 ntfy Pro",
     "nav_upgrade_banner_description": "保留主题，更多消息和邮件，以及更大的附件",
     "alert_not_supported_context_description": "通知仅支持 HTTPS。这是 <mdnLink>Notifications API</mdnLink> 的限制。",
@@ -233,7 +233,7 @@
     "reserve_dialog_checkbox_label": "保留主题并配置访问",
     "subscribe_dialog_subscribe_button_generate_topic_name": "生成名称",
     "account_basics_username_description": "嘿，那是你 ❤",
-    "account_basics_password_description": "更改您的帐户密码",
+    "account_basics_password_description": "更改您的账户密码",
     "account_basics_password_dialog_title": "更改密码",
     "account_basics_password_dialog_current_password_label": "当前密码",
     "account_basics_password_dialog_new_password_label": "新密码",
@@ -244,8 +244,8 @@
     "account_usage_of_limit": "{{limit}} 的",
     "account_usage_unlimited": "无限",
     "account_usage_limits_reset_daily": "使用限制每天午夜 (UTC) 重置",
-    "account_basics_tier_title": "帐户类型",
-    "account_basics_tier_description": "您帐户的权限级别",
+    "account_basics_tier_title": "账户类型",
+    "account_basics_tier_description": "您账户的权限级别",
     "account_basics_tier_admin": "管理员",
     "account_basics_tier_admin_suffix_with_tier": "（有 {{tier}} 等级）",
     "account_basics_tier_admin_suffix_no_tier": "（无等级）",
@@ -258,7 +258,7 @@
     "account_usage_messages_title": "已发布消息",
     "account_usage_emails_title": "已发送电子邮件",
     "account_usage_reservations_title": "保留主题",
-    "account_usage_reservations_none": "此帐户没有保留主题",
+    "account_usage_reservations_none": "此账户没有保留主题",
     "account_usage_attachment_storage_title": "附件存储",
     "account_usage_attachment_storage_description": "每个文件 {{filesize}}，在 {{expiry}} 后删除",
     "account_upgrade_dialog_button_pay_now": "立即付款并订阅",
@@ -276,7 +276,7 @@
     "account_tokens_delete_dialog_title": "删除访问令牌",
     "account_tokens_delete_dialog_description": "在删除访问令牌之前，请确保没有应用程序或脚本正在活跃使用它。 <strong>此操作无法撤消</strong>。",
     "account_tokens_delete_dialog_submit_button": "永久删除令牌",
-    "prefs_users_description_no_sync": "用户和密码不会同步到您的帐户。",
+    "prefs_users_description_no_sync": "用户和密码不会同步到您的账户。",
     "prefs_users_table_cannot_delete_or_edit": "无法删除或编辑已登录用户",
     "prefs_reservations_title": "保留主题",
     "prefs_reservations_description": "您可以在此处保留主题名称供个人使用。保留主题使您拥有该主题的所有权，并允许您为其他用户定义对该主题的访问权限。",
@@ -305,13 +305,13 @@
     "reservation_delete_dialog_action_delete_title": "删除缓存的邮件和附件",
     "reservation_delete_dialog_action_delete_description": "缓存的邮件和附件将被永久删除。此操作无法撤消。",
     "reservation_delete_dialog_submit_button": "删除保留",
-    "account_delete_dialog_description": "这将永久删除您的帐户，包括存储在服务器上的所有数据。删除后，您的用户名将在 7 天内不可用。如果您真的想继续，请在下面的框中使用您的密码进行确认。",
+    "account_delete_dialog_description": "这将永久删除您的账户，包括存储在服务器上的所有数据。删除后，您的用户名将在 7 天内不可用。如果您真的想继续，请在下面的框中使用您的密码进行确认。",
     "account_delete_dialog_label": "密码",
     "account_delete_dialog_button_cancel": "取消",
-    "account_delete_dialog_button_submit": "永久删除帐户",
-    "account_delete_dialog_billing_warning": "删除您的帐户也会立即取消您的计费订阅。您将无法再访问计费仪表板。",
-    "account_upgrade_dialog_title": "更改帐户等级",
-    "account_upgrade_dialog_cancel_warning": "这将<strong>取消您的订阅</strong>，并在 {{date}} 降级您的帐户。在那一天，主题保留以及缓存在服务器上的消息<strong>将被删除</strong>。",
+    "account_delete_dialog_button_submit": "永久删除账户",
+    "account_delete_dialog_billing_warning": "删除您的账户也会立即取消您的计费订阅。您将无法再访问计费仪表板。",
+    "account_upgrade_dialog_title": "更改账户等级",
+    "account_upgrade_dialog_cancel_warning": "这将<strong>取消您的订阅</strong>，并在 {{date}} 降级您的账户。在那一天，主题保留以及缓存在服务器上的消息<strong>将被删除</strong>。",
     "account_upgrade_dialog_proration_info": "<strong>按比例分配</strong>：在付费计划之间升级时，差价将被<strong>立刻收取</strong>。在降级到较低级别时，余额将被用于支付未来的账单周期。",
     "account_upgrade_dialog_reservations_warning_one": "所选等级允许的保留主题少于当前等级。在更改您的等级之前，<strong>请至少删除 1 项保留</strong>。您可以在<Link>设置</Link>中删除保留。",
     "account_upgrade_dialog_reservations_warning_other": "所选等级允许的保留主题少于当前等级。在更改您的等级之前，<strong>请至少删除 {{count}} 项保留</strong>。您可以在<Link>设置</Link>中删除保留。",
@@ -322,30 +322,30 @@
     "signup_form_confirm_password": "确认密码",
     "signup_form_button_submit": "注册",
     "signup_form_toggle_password_visibility": "切换密码可见性",
-    "signup_title": "创建一个 ntfy 帐户",
+    "signup_title": "创建一个 ntfy 账户",
     "signup_form_username": "用户名",
     "signup_form_password": "密码",
-    "signup_already_have_account": "已有帐户？登录！",
+    "signup_already_have_account": "已有账户？登录！",
     "signup_disabled": "注册已禁用",
     "login_form_button_submit": "登录",
     "login_link_signup": "注册",
     "login_disabled": "登录已禁用",
-    "action_bar_account": "帐户",
+    "action_bar_account": "账户",
     "action_bar_reservation_edit": "更改保留",
     "subscribe_dialog_error_topic_already_reserved": "主题已保留",
-    "account_basics_title": "帐户",
+    "account_basics_title": "账户",
     "account_basics_username_title": "用户名",
     "account_basics_username_admin_tooltip": "你是管理员",
     "account_basics_password_title": "密码",
-    "account_basics_tier_payment_overdue": "您的付款已逾期。请更新您的付款方式，否则您的帐户将很快被降级。",
-    "account_basics_tier_canceled_subscription": "您的订阅已取消，并将在 {{date}} 降级为免费帐户。",
+    "account_basics_tier_payment_overdue": "您的付款已逾期。请更新您的付款方式，否则您的账户将很快被降级。",
+    "account_basics_tier_canceled_subscription": "您的订阅已取消，并将在 {{date}} 降级为免费账户。",
     "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} 总存储空间",
     "account_upgrade_dialog_tier_selected_label": "已选",
     "account_upgrade_dialog_tier_current_label": "当前",
     "account_upgrade_dialog_button_cancel": "取消",
     "account_upgrade_dialog_button_redirect_signup": "立即注册",
     "account_tokens_title": "访问令牌",
-    "account_tokens_description": "通过 ntfy API 发布和订阅时使用访问令牌，因此您不必发送您的帐户凭据。查看<Link>文档</Link>以了解更多信息。",
+    "account_tokens_description": "通过 ntfy API 发布和订阅时使用访问令牌，因此您不必发送您的账户凭据。查看<Link>文档</Link>以了解更多信息。",
     "account_tokens_table_token_header": "令牌",
     "account_tokens_table_label_header": "标签",
     "account_tokens_table_last_access_header": "最后访问",
@@ -403,5 +403,7 @@
     "web_push_subscription_expiring_title": "通知将被暂停",
     "web_push_subscription_expiring_body": "打开ntfy以继续接收通知",
     "web_push_unknown_notification_title": "接收到未知通知",
-    "web_push_unknown_notification_body": "你可能需要打开网页来更新ntfy"
+    "web_push_unknown_notification_body": "你可能需要打开网页来更新ntfy",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "已设置的用户无法被编辑或删除",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "无法编辑或删除已设置的令牌"
 }

web/public/static/langs/zh_Hant.json

@@ -91,7 +91,7 @@
     "account_upgrade_dialog_reservations_warning_one": "所選等級允許的保留主題少於當前等級。在更改你的等級之前，<strong>請至少刪除 1 項保留</strong>。你可以在<Link>設置</Link>中刪除保留。",
     "account_upgrade_dialog_reservations_warning_other": "所選等級允許的保留主題少於當前等級。在更改你的等級之前，<strong>請至少刪除 {{count}} 項保留</strong>。你可以在<Link>設置</Link>中刪除保留。",
     "account_upgrade_dialog_tier_current_label": "當前",
-    "account_upgrade_dialog_tier_features_attachment_file_size": "每個文件 {{filesize}} ",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "每個文件 {{filesize}}",
     "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} 總存儲空間",
     "account_upgrade_dialog_tier_features_calls_one": "每日一通電話",
     "account_upgrade_dialog_tier_features_calls_other": "每日{{calls}} 通電話",
@@ -145,13 +145,13 @@
     "action_bar_unsubscribe": "取消訂閱",
     "alert_notification_ios_install_required_description": "要接收通知，請在 iOS 上點擊共享，然後添加到主屏幕",
     "alert_notification_ios_install_required_title": "需要安裝 iOS 應用程式",
-    "alert_notification_permission_denied_description": "你已禁用通知。要重新啟用通知，請在瀏覽器設置中啟用通知。",
+    "alert_notification_permission_denied_description": "你已禁用通知。要重新啟用通知，請在瀏覽器設置中啟用通知",
     "alert_notification_permission_denied_title": "已禁用通知",
     "alert_notification_permission_required_button": "現在授予",
-    "alert_notification_permission_required_description": "授予瀏覽器顯示桌面通知的權限。",
+    "alert_notification_permission_required_description": "授予瀏覽器顯示桌面通知的權限",
     "alert_notification_permission_required_title": "已禁用通知",
     "alert_not_supported_context_description": "通知僅支援 HTTPS。這是 <mdnLink>Notifications API</mdnLink> 的限制。",
-    "alert_not_supported_description": "你的瀏覽器不支援通知。",
+    "alert_not_supported_description": "你的瀏覽器不支援通知",
     "alert_not_supported_title": "不支援通知",
     "common_add": "新增",
     "common_back": "返回",
@@ -223,7 +223,7 @@
     "notifications_none_for_topic_description": "要向此主題發送通知，只需使用 PUT 或 POST 到主題連結即可。",
     "notifications_none_for_topic_title": "你尚未收到有關此主題的任何通知。",
     "notifications_no_subscriptions_description": "點擊 \"{{linktext}}\" 連結以建立或訂閱主題。之後，你可以使用 PUT 或 POST 發送訊息，你將在這裡收到通知。",
-    "notifications_no_subscriptions_title": "看起來你還未有任何訂閱",
+    "notifications_no_subscriptions_title": "看起來你還未有任何訂閱。",
     "notifications_priority_x": "優先級 {{priority}}",
     "notifications_tags": "標記",
     "prefs_appearance_language_title": "語言",
@@ -261,7 +261,7 @@
     "prefs_notifications_web_push_disabled_description": "當網頁程式在運行時將會收到通知 (透過 WebSocket)",
     "prefs_notifications_web_push_disabled": "己暫用",
     "prefs_notifications_web_push_enabled_description": "即使網頁程式未有運街亦會收到通知 (via Web Push)",
-    "prefs_notifications_web_push_enabled": "己為 {{server}}  啟用",
+    "prefs_notifications_web_push_enabled": "己為 {{server}} 啟用",
     "prefs_notifications_web_push_title": "背景通知",
     "prefs_reservations_add_button": "新增保留主題",
     "prefs_reservations_delete_button": "重置主題訪問",
@@ -403,5 +403,7 @@
     "web_push_subscription_expiring_body": "開啟ntfy以繼續接收通知",
     "web_push_subscription_expiring_title": "通知會被暫停",
     "web_push_unknown_notification_body": "你可能需要開啟網頁來更新ntfy",
-    "web_push_unknown_notification_title": "接收到不明通知"
+    "web_push_unknown_notification_title": "接收到不明通知",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "已佈建的使用者無法編輯或刪除",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "無法編輯或刪除已佈建的權杖"
 }

web/public/sw.js

@@ -3,11 +3,16 @@ import { cleanupOutdatedCaches, createHandlerBoundToURL, precacheAndRoute } from
 import { NavigationRoute, registerRoute } from "workbox-routing";
 import { NetworkFirst } from "workbox-strategies";
 import { clientsClaim } from "workbox-core";
-
 import { dbAsync } from "../src/app/db";
-
-import { toNotificationParams, icon, badge } from "../src/app/notificationUtils";
+import { badge, icon, messageWithSequenceId, toNotificationParams } from "../src/app/notificationUtils";
 import initI18n from "../src/app/i18n";
+import {
+  EVENT_MESSAGE,
+  EVENT_MESSAGE_CLEAR,
+  EVENT_MESSAGE_DELETE,
+  WEBPUSH_EVENT_MESSAGE,
+  WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING,
+} from "../src/app/events";
 
 /**
  * General docs for service workers and PWAs:
@@ -21,25 +26,6 @@ import initI18n from "../src/app/i18n";
 
 const broadcastChannel = new BroadcastChannel("web-push-broadcast");
 
-const addNotification = async ({ subscriptionId, message }) => {
-  const db = await dbAsync();
-
-  await db.notifications.add({
-    ...message,
-    subscriptionId,
-    // New marker (used for bubble indicator); cannot be boolean; Dexie index limitation
-    new: 1,
-  });
-
-  await db.subscriptions.update(subscriptionId, {
-    last: message.id,
-  });
-
-  const badgeCount = await db.notifications.where({ new: 1 }).count();
-  console.log("[ServiceWorker] Setting new app badge count", { badgeCount });
-  self.navigator.setAppBadge?.(badgeCount);
-};
-
 /**
  * Handle a received web push message and show notification.
  *
@@ -48,10 +34,35 @@ const addNotification = async ({ subscriptionId, message }) => {
  */
 const handlePushMessage = async (data) => {
   const { subscription_id: subscriptionId, message } = data;
+  const db = await dbAsync();
 
-  broadcastChannel.postMessage(message); // To potentially play sound
+  console.log("[ServiceWorker] Message received", data);
+
+  // Delete existing notification with same sequence ID (if any)
+  const sequenceId = message.sequence_id || message.id;
+  if (sequenceId) {
+    await db.notifications.where({ subscriptionId, sequenceId }).delete();
+  }
+
+  // Add notification to database
+  await db.notifications.add({
+    ...messageWithSequenceId(message),
+    subscriptionId,
+    new: 1, // New marker (used for bubble indicator); cannot be boolean; Dexie index limitation
+  });
+
+  // Update subscription last message id (for ?since=... queries)
+  await db.subscriptions.update(subscriptionId, {
+    last: message.id,
+  });
+
+  // Update badge in PWA
+  const badgeCount = await db.notifications.where({ new: 1 }).count();
+  self.navigator.setAppBadge?.(badgeCount);
+
+  // Broadcast the message to potentially play a sound
+  broadcastChannel.postMessage(message);
 
-  await addNotification({ subscriptionId, message });
   await self.registration.showNotification(
     ...toNotificationParams({
       subscriptionId,
@@ -62,11 +73,70 @@ const handlePushMessage = async (data) => {
   );
 };
 
+/**
+ * Handle a message_delete event: delete the notification from the database.
+ */
+const handlePushMessageDelete = async (data) => {
+  const { subscription_id: subscriptionId, message } = data;
+  const db = await dbAsync();
+  console.log("[ServiceWorker] Deleting notification sequence", data);
+
+  // Delete notification with the same sequence_id
+  const sequenceId = message.sequence_id;
+  if (sequenceId) {
+    await db.notifications.where({ subscriptionId, sequenceId }).delete();
+  }
+
+  // Close browser notification with matching tag
+  const tag = message.sequence_id || message.id;
+  if (tag) {
+    const notifications = await self.registration.getNotifications({ tag });
+    notifications.forEach((notification) => notification.close());
+  }
+
+  // Update subscription last message id (for ?since=... queries)
+  await db.subscriptions.update(subscriptionId, {
+    last: message.id,
+  });
+};
+
+/**
+ * Handle a message_clear event: clear/dismiss the notification.
+ */
+const handlePushMessageClear = async (data) => {
+  const { subscription_id: subscriptionId, message } = data;
+  const db = await dbAsync();
+  console.log("[ServiceWorker] Marking notification as read", data);
+
+  // Mark notification as read (set new = 0)
+  const sequenceId = message.sequence_id;
+  if (sequenceId) {
+    await db.notifications.where({ subscriptionId, sequenceId }).modify({ new: 0 });
+  }
+
+  // Close browser notification with matching tag
+  const tag = message.sequence_id || message.id;
+  if (tag) {
+    const notifications = await self.registration.getNotifications({ tag });
+    notifications.forEach((notification) => notification.close());
+  }
+
+  // Update subscription last message id (for ?since=... queries)
+  await db.subscriptions.update(subscriptionId, {
+    last: message.id,
+  });
+
+  // Update badge count
+  const badgeCount = await db.notifications.where({ new: 1 }).count();
+  self.navigator.setAppBadge?.(badgeCount);
+};
+
 /**
  * Handle a received web push subscription expiring.
  */
 const handlePushSubscriptionExpiring = async (data) => {
   const t = await initI18n();
+  console.log("[ServiceWorker] Handling incoming subscription expiring event", data);
 
   await self.registration.showNotification(t("web_push_subscription_expiring_title"), {
     body: t("web_push_subscription_expiring_body"),
@@ -82,6 +152,7 @@ const handlePushSubscriptionExpiring = async (data) => {
  */
 const handlePushUnknown = async (data) => {
   const t = await initI18n();
+  console.log("[ServiceWorker] Unknown event received", data);
 
   await self.registration.showNotification(t("web_push_unknown_notification_title"), {
     body: t("web_push_unknown_notification_body"),
@@ -96,13 +167,26 @@ const handlePushUnknown = async (data) => {
  * @param {object} data see server/types.go, type webPushPayload
  */
 const handlePush = async (data) => {
-  if (data.event === "message") {
-    await handlePushMessage(data);
-  } else if (data.event === "subscription_expiring") {
-    await handlePushSubscriptionExpiring(data);
-  } else {
-    await handlePushUnknown(data);
+  // This logic is (partially) duplicated in
+  // - Android: SubscriberService::onNotificationReceived()
+  // - Android: FirebaseService::onMessageReceived()
+  // - Web app: hooks.js:handleNotification()
+  // - Web app: sw.js:handleMessage(), sw.js:handleMessageClear(), ...
+
+  if (data.event === WEBPUSH_EVENT_MESSAGE) {
+    const { message } = data;
+    if (message.event === EVENT_MESSAGE) {
+      return await handlePushMessage(data);
+    } else if (message.event === EVENT_MESSAGE_DELETE) {
+      return await handlePushMessageDelete(data);
+    } else if (message.event === EVENT_MESSAGE_CLEAR) {
+      return await handlePushMessageClear(data);
+    }
+  } else if (data.event === WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING) {
+    return await handlePushSubscriptionExpiring(data);
   }
+
+  return await handlePushUnknown(data);
 };
 
 /**
@@ -113,10 +197,8 @@ const handleClick = async (event) => {
   const t = await initI18n();
 
   const clients = await self.clients.matchAll({ type: "window" });
-
   const rootUrl = new URL(self.location.origin);
   const rootClient = clients.find((client) => client.url === rootUrl.toString());
-  // perhaps open on another topic
   const fallbackClient = clients[0];
 
   if (!event.notification.data?.message) {
@@ -232,6 +314,7 @@ precacheAndRoute(
 
 // Claim all open windows
 clientsClaim();
+
 // Delete any cached old dist files from previous service worker versions
 cleanupOutdatedCaches();
 

web/src/app/Connection.js

@@ -1,5 +1,6 @@
 /* eslint-disable max-classes-per-file */
 import { basicAuth, bearerAuth, encodeBase64Url, topicShortUrl, topicUrlWs } from "./utils";
+import { EVENT_OPEN, isNotificationEvent } from "./events";
 
 const retryBackoffSeconds = [5, 10, 20, 30, 60, 120];
 
@@ -48,10 +49,11 @@ class Connection {
       console.log(`[Connection, ${this.shortUrl}, ${this.connectionId}] Message received from server: ${event.data}`);
       try {
         const data = JSON.parse(event.data);
-        if (data.event === "open") {
+        if (data.event === EVENT_OPEN) {
           return;
         }
-        const relevantAndValid = data.event === "message" && "id" in data && "time" in data && "message" in data;
+        // Accept message, message_delete, and message_clear events
+        const relevantAndValid = isNotificationEvent(data.event) && "id" in data && "time" in data;
         if (!relevantAndValid) {
           console.log(`[Connection, ${this.shortUrl}, ${this.connectionId}] Unexpected message. Ignoring.`);
           return;

web/src/app/Notifier.js

@@ -31,6 +31,21 @@ class Notifier {
     );
   }
 
+  async cancel(notification) {
+    if (!this.supported()) {
+      return;
+    }
+    try {
+      const tag = notification.sequence_id || notification.id;
+      console.log(`[Notifier] Cancelling notification with ${tag}`);
+      const registration = await this.serviceWorkerRegistration();
+      const notifications = await registration.getNotifications({ tag });
+      notifications.forEach((n) => n.close());
+    } catch (e) {
+      console.log(`[Notifier] Error cancelling notification`, e);
+    }
+  }
+
   async playSound() {
     // Play sound
     const sound = await prefs.sound();

web/src/app/Poller.js

@@ -1,5 +1,7 @@
 import api from "./Api";
+import prefs from "./Prefs";
 import subscriptionManager from "./SubscriptionManager";
+import { EVENT_MESSAGE, EVENT_MESSAGE_DELETE } from "./events";
 
 const delayMillis = 2000; // 2 seconds
 const intervalMillis = 300000; // 5 minutes
@@ -42,12 +44,35 @@ class Poller {
 
     const since = subscription.last;
     const notifications = await api.poll(subscription.baseUrl, subscription.topic, since);
-    if (!notifications || notifications.length === 0) {
-      console.log(`[Poller] No new notifications found for ${subscription.id}`);
-      return;
+
+    // Filter out notifications older than the prune threshold
+    const deleteAfterSeconds = await prefs.deleteAfter();
+    const pruneThresholdTimestamp = deleteAfterSeconds > 0 ? Math.round(Date.now() / 1000) - deleteAfterSeconds : 0;
+    const recentNotifications =
+      pruneThresholdTimestamp > 0 ? notifications.filter((n) => n.time >= pruneThresholdTimestamp) : notifications;
+
+    // Find the latest notification for each sequence ID
+    const latestBySequenceId = this.latestNotificationsBySequenceId(recentNotifications);
+
+    // Delete all existing notifications for which the latest notification is marked as deleted
+    const deletedSequenceIds = Object.entries(latestBySequenceId)
+      .filter(([, notification]) => notification.event === EVENT_MESSAGE_DELETE)
+      .map(([sequenceId]) => sequenceId);
+    if (deletedSequenceIds.length > 0) {
+      console.log(`[Poller] Deleting notifications with deleted sequence IDs for ${subscription.id}`, deletedSequenceIds);
+      await Promise.all(
+        deletedSequenceIds.map((sequenceId) => subscriptionManager.deleteNotificationBySequenceId(subscription.id, sequenceId))
+      );
+    }
+
+    // Add only the latest notification for each non-deleted sequence
+    const notificationsToAdd = Object.values(latestBySequenceId).filter((n) => n.event === EVENT_MESSAGE);
+    if (notificationsToAdd.length > 0) {
+      console.log(`[Poller] Adding ${notificationsToAdd.length} notification(s) for ${subscription.id}`);
+      await subscriptionManager.addNotifications(subscription.id, notificationsToAdd);
+    } else {
+      console.log(`[Poller] No new notifications found for ${subscription.id}`);
     }
-    console.log(`[Poller] Adding ${notifications.length} notification(s) for ${subscription.id}`);
-    await subscriptionManager.addNotifications(subscription.id, notifications);
   }
 
   pollInBackground(subscription) {
@@ -59,6 +84,21 @@ class Poller {
       }
     })();
   }
+
+  /**
+   * Groups notifications by sequenceId and returns only the latest (highest time) for each sequence.
+   * Returns an object mapping sequenceId -> latest notification.
+   */
+  latestNotificationsBySequenceId(notifications) {
+    const latestBySequenceId = {};
+    notifications.forEach((notification) => {
+      const sequenceId = notification.sequence_id || notification.id;
+      if (!(sequenceId in latestBySequenceId) || notification.time >= latestBySequenceId[sequenceId].time) {
+        latestBySequenceId[sequenceId] = notification;
+      }
+    });
+    return latestBySequenceId;
+  }
 }
 
 const poller = new Poller();

web/src/app/SubscriptionManager.js

@@ -3,6 +3,8 @@ import notifier from "./Notifier";
 import prefs from "./Prefs";
 import db from "./db";
 import { topicUrl } from "./utils";
+import { messageWithSequenceId } from "./notificationUtils";
+import { EVENT_MESSAGE, EVENT_MESSAGE_CLEAR, EVENT_MESSAGE_DELETE } from "./events";
 
 class SubscriptionManager {
   constructor(dbImpl) {
@@ -48,16 +50,17 @@ class SubscriptionManager {
   }
 
   async notify(subscriptionId, notification) {
+    if (notification.event !== EVENT_MESSAGE) {
+      return;
+    }
     const subscription = await this.get(subscriptionId);
     if (subscription.mutedUntil > 0) {
       return;
     }
-
     const priority = notification.priority ?? 3;
     if (priority < (await prefs.minPriority())) {
       return;
     }
-
     await notifier.notify(subscription, notification);
   }
 
@@ -157,7 +160,7 @@ class SubscriptionManager {
     // killing performance. See  https://dexie.org/docs/Collection/Collection.offset()#a-better-paging-approach
 
     return this.db.notifications
-      .orderBy("time") // Sort by time first
+      .orderBy("time") // Sort by time
       .filter((n) => n.subscriptionId === subscriptionId)
       .reverse()
       .toArray();
@@ -173,17 +176,22 @@ class SubscriptionManager {
   /** Adds notification, or returns false if it already exists */
   async addNotification(subscriptionId, notification) {
     const exists = await this.db.notifications.get(notification.id);
-    if (exists) {
+    if (exists || notification.event === EVENT_MESSAGE_DELETE || notification.event === EVENT_MESSAGE_CLEAR) {
       return false;
     }
     try {
-      // sw.js duplicates this logic, so if you change it here, change it there too
+      // Note: Service worker (sw.js) and addNotifications() duplicates this logic,
+      // so if you change it here, change it there too.
+
+      // Add notification to database
       await this.db.notifications.add({
-        ...notification,
+        ...messageWithSequenceId(notification),
         subscriptionId,
-        // New marker (used for bubble indicator); cannot be boolean; Dexie index limitation
-        new: 1,
-      }); // FIXME consider put() for double tab
+        new: 1, // New marker (used for bubble indicator); cannot be boolean; Dexie index limitation
+      });
+
+      // FIXME consider put() for double tab
+      // Update subscription last message id (for ?since=... queries)
       await this.db.subscriptions.update(subscriptionId, {
         last: notification.id,
       });
@@ -195,7 +203,10 @@ class SubscriptionManager {
 
   /** Adds/replaces notifications, will not throw if they exist */
   async addNotifications(subscriptionId, notifications) {
-    const notificationsWithSubscriptionId = notifications.map((notification) => ({ ...notification, subscriptionId }));
+    const notificationsWithSubscriptionId = notifications.map((notification) => ({
+      ...messageWithSequenceId(notification),
+      subscriptionId,
+    }));
     const lastNotificationId = notifications.at(-1).id;
     await this.db.notifications.bulkPut(notificationsWithSubscriptionId);
     await this.db.subscriptions.update(subscriptionId, {
@@ -220,6 +231,10 @@ class SubscriptionManager {
     await this.db.notifications.delete(notificationId);
   }
 
+  async deleteNotificationBySequenceId(subscriptionId, sequenceId) {
+    await this.db.notifications.where({ subscriptionId, sequenceId }).delete();
+  }
+
   async deleteNotifications(subscriptionId) {
     await this.db.notifications.where({ subscriptionId }).delete();
   }
@@ -228,6 +243,10 @@ class SubscriptionManager {
     await this.db.notifications.where({ id: notificationId }).modify({ new: 0 });
   }
 
+  async markNotificationReadBySequenceId(subscriptionId, sequenceId) {
+    await this.db.notifications.where({ subscriptionId, sequenceId }).modify({ new: 0 });
+  }
+
   async markNotificationsRead(subscriptionId) {
     await this.db.notifications.where({ subscriptionId, new: 1 }).modify({ new: 0 });
   }

web/src/app/db.js

@@ -11,13 +11,20 @@ const createDatabase = (username) => {
   const dbName = username ? `ntfy-${username}` : "ntfy"; // IndexedDB database is based on the logged-in user
   const db = new Dexie(dbName);
 
-  db.version(2).stores({
+  db.version(3).stores({
     subscriptions: "&id,baseUrl,[baseUrl+mutedUntil]",
-    notifications: "&id,subscriptionId,time,new,[subscriptionId+new]", // compound key for query performance
+    notifications: "&id,sequenceId,subscriptionId,time,new,[subscriptionId+new],[subscriptionId+sequenceId]",
     users: "&baseUrl,username",
     prefs: "&key",
   });
 
+  // When another connection (e.g., service worker or another tab) wants to upgrade,
+  // close this connection gracefully to allow the upgrade to proceed
+  db.on("versionchange", () => {
+    console.log("[db] versionchange event: closing database");
+    db.close();
+  });
+
   return db;
 };
 

web/src/app/events.js

@@ -0,0 +1,15 @@
+// Event types for ntfy messages
+// These correspond to the server event types in server/types.go
+
+export const EVENT_OPEN = "open";
+export const EVENT_KEEPALIVE = "keepalive";
+export const EVENT_MESSAGE = "message";
+export const EVENT_MESSAGE_DELETE = "message_delete";
+export const EVENT_MESSAGE_CLEAR = "message_clear";
+export const EVENT_POLL_REQUEST = "poll_request";
+
+export const WEBPUSH_EVENT_MESSAGE = "message";
+export const WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING = "subscription_expiring";
+
+// Check if an event is a notification event (message, delete, or read)
+export const isNotificationEvent = (event) => event === EVENT_MESSAGE || event === EVENT_MESSAGE_DELETE || event === EVENT_MESSAGE_CLEAR;

web/src/app/notificationUtils.js

@@ -25,13 +25,13 @@ const formatTitleWithDefault = (m, fallback) => {
 
 export const formatMessage = (m) => {
   if (m.title) {
-    return m.message;
+    return m.message || "";
   }
   const emojiList = toEmojis(m.tags);
   if (emojiList.length > 0) {
-    return `${emojiList.join(" ")} ${m.message}`;
+    return `${emojiList.join(" ")} ${m.message || ""}`;
   }
-  return m.message;
+  return m.message || "";
 };
 
 const imageRegex = /\.(png|jpe?g|gif|webp)$/i;
@@ -50,7 +50,7 @@ export const isImage = (attachment) => {
 export const icon = "/static/images/ntfy.png";
 export const badge = "/static/images/mask-icon.svg";
 
-export const toNotificationParams = ({ subscriptionId, message, defaultTitle, topicRoute }) => {
+export const toNotificationParams = ({ message, defaultTitle, topicRoute }) => {
   const image = isImage(message.attachment) ? message.attachment.url : undefined;
 
   // https://developer.mozilla.org/en-US/docs/Web/API/Notifications_API
@@ -61,8 +61,8 @@ export const toNotificationParams = ({ subscriptionId, message, defaultTitle, to
       badge,
       icon,
       image,
-      timestamp: message.time * 1_000,
-      tag: subscriptionId,
+      timestamp: message.time * 1000,
+      tag: message.sequence_id || message.id, // Update notification if there is a sequence ID
       renotify: true,
       silent: false,
       // This is used by the notification onclick event
@@ -79,3 +79,10 @@ export const toNotificationParams = ({ subscriptionId, message, defaultTitle, to
     },
   ];
 };
+
+export const messageWithSequenceId = (message) => {
+  if (message.sequenceId) {
+    return message;
+  }
+  return { ...message, sequenceId: message.sequence_id || message.id };
+};

web/src/app/utils.js

@@ -77,7 +77,10 @@ export const maybeWithBearerAuth = (headers, token) => {
   return headers;
 };
 
-export const withBasicAuth = (headers, username, password) => ({ ...headers, Authorization: basicAuth(username, password) });
+export const withBasicAuth = (headers, username, password) => ({
+  ...headers,
+  Authorization: basicAuth(username, password),
+});
 
 export const maybeWithAuth = (headers, user) => {
   if (user?.password) {
@@ -270,3 +273,21 @@ export const urlB64ToUint8Array = (base64String) => {
   }
   return outputArray;
 };
+
+export const copyToClipboard = (text) => {
+  if (navigator.clipboard && window.isSecureContext) {
+    return navigator.clipboard.writeText(text);
+  }
+  // Fallback to the older method if clipboard API is not supported (or on HTTP)
+  const textarea = document.createElement("textarea");
+  textarea.value = text;
+  textarea.setAttribute("readonly", ""); // Avoid mobile keyboards from popping up
+  textarea.style.position = "fixed"; // Avoid scroll jump
+  textarea.style.left = "-9999px";
+  document.body.appendChild(textarea);
+  textarea.focus();
+  textarea.select();
+  document.execCommand("copy");
+  document.body.removeChild(textarea);
+  return Promise.resolve();
+};

web/src/components/Account.jsx

@@ -45,7 +45,7 @@ import CloseIcon from "@mui/icons-material/Close";
 import { ContentCopy, Public } from "@mui/icons-material";
 import AddIcon from "@mui/icons-material/Add";
 import routes from "./routes";
-import { formatBytes, formatShortDate, formatShortDateTime, openUrl } from "../app/utils";
+import { copyToClipboard, formatBytes, formatShortDate, formatShortDateTime, openUrl } from "../app/utils";
 import accountApi, { LimitBasis, Role, SubscriptionInterval, SubscriptionStatus } from "../app/AccountApi";
 import { Pref, PrefGroup } from "./Pref";
 import db from "../app/db";
@@ -370,7 +370,7 @@ const PhoneNumbers = () => {
   };
 
   const handleCopy = (phoneNumber) => {
-    navigator.clipboard.writeText(phoneNumber);
+    copyToClipboard(phoneNumber);
     setSnackOpen(true);
   };
 
@@ -841,7 +841,7 @@ const TokensTable = (props) => {
   };
 
   const handleCopy = async (token) => {
-    await navigator.clipboard.writeText(token);
+    copyToClipboard(token);
     setSnackOpen(true);
   };
 

web/src/components/App.jsx

@@ -23,6 +23,7 @@ import Account from "./Account";
 import initI18n from "../app/i18n"; // Translations!
 import prefs, { THEME } from "../app/Prefs";
 import RTLCacheProvider from "./RTLCacheProvider";
+import session from "../app/Session";
 
 initI18n();
 
@@ -45,7 +46,6 @@ const darkModeEnabled = (prefersDarkMode, themePreference) => {
 const App = () => {
   const { i18n } = useTranslation();
   const languageDir = i18n.dir();
-
   const [account, setAccount] = useState(null);
   const accountMemo = useMemo(() => ({ account, setAccount }), [account, setAccount]);
   const prefersDarkMode = useMediaQuery("(prefers-color-scheme: dark)");
@@ -60,6 +60,12 @@ const App = () => {
     document.dir = languageDir;
   }, [i18n.language, languageDir]);
 
+  useEffect(() => {
+    if (!session.exists() && config.require_login && window.location.pathname !== routes.login) {
+      window.location.href = routes.login;
+    }
+  }, []);
+
   return (
     <Suspense fallback={<Loader />}>
       <RTLCacheProvider>

web/src/components/ErrorBoundary.jsx

@@ -2,6 +2,7 @@ import * as React from "react";
 import StackTrace from "stacktrace-js";
 import { CircularProgress, Link, Button } from "@mui/material";
 import { Trans, withTranslation } from "react-i18next";
+import { copyToClipboard } from "../app/utils";
 
 class ErrorBoundaryImpl extends React.Component {
   constructor(props) {
@@ -64,7 +65,7 @@ class ErrorBoundaryImpl extends React.Component {
       stack += `${this.state.niceStack}\n\n`;
     }
     stack += `${this.state.originalStack}\n`;
-    navigator.clipboard.writeText(stack);
+    copyToClipboard(stack);
   }
 
   renderUnsupportedIndexedDB() {

web/src/components/Notifications.jsx

@@ -26,7 +26,16 @@ import { Trans, useTranslation } from "react-i18next";
 import { useOutletContext } from "react-router-dom";
 import { useRemark } from "react-remark";
 import styled from "@emotion/styled";
-import { formatBytes, formatShortDateTime, maybeActionErrors, openUrl, shortUrl, topicShortUrl, unmatchedTags } from "../app/utils";
+import {
+  copyToClipboard,
+  formatBytes,
+  formatShortDateTime,
+  maybeActionErrors,
+  openUrl,
+  shortUrl,
+  topicShortUrl,
+  unmatchedTags,
+} from "../app/utils";
 import { formatMessage, formatTitle, isImage } from "../app/notificationUtils";
 import { LightboxBackdrop, Paragraph, VerticallyCenteredContainer } from "./styles";
 import subscriptionManager from "../app/SubscriptionManager";
@@ -239,7 +248,7 @@ const NotificationItem = (props) => {
     await subscriptionManager.markNotificationRead(notification.id);
   };
   const handleCopy = (s) => {
-    navigator.clipboard.writeText(s);
+    copyToClipboard(s);
     props.onShowSnack();
   };
   const expired = attachment && attachment.expires && attachment.expires < Date.now() / 1000;

web/src/components/hooks.js

@@ -12,6 +12,7 @@ import accountApi from "../app/AccountApi";
 import { UnauthorizedError } from "../app/errors";
 import notifier from "../app/Notifier";
 import prefs from "../app/Prefs";
+import { EVENT_MESSAGE_DELETE, EVENT_MESSAGE_CLEAR } from "../app/events";
 
 /**
  * Wire connectionManager and subscriptionManager so that subscriptions are updated when the connection
@@ -50,9 +51,28 @@ export const useConnectionListeners = (account, subscriptions, users, webPushTop
       };
 
       const handleNotification = async (subscriptionId, notification) => {
-        const added = await subscriptionManager.addNotification(subscriptionId, notification);
-        if (added) {
-          await subscriptionManager.notify(subscriptionId, notification);
+        // This logic is (partially) duplicated in
+        // - Android: SubscriberService::onNotificationReceived()
+        // - Android: FirebaseService::onMessageReceived()
+        // - Web app: hooks.js:handleNotification()
+        // - Web app: sw.js:handleMessage(), sw.js:handleMessageClear(), ...
+
+        if (notification.event === EVENT_MESSAGE_DELETE && notification.sequence_id) {
+          await subscriptionManager.deleteNotificationBySequenceId(subscriptionId, notification.sequence_id);
+          await notifier.cancel(notification);
+        } else if (notification.event === EVENT_MESSAGE_CLEAR && notification.sequence_id) {
+          await subscriptionManager.markNotificationReadBySequenceId(subscriptionId, notification.sequence_id);
+          await notifier.cancel(notification);
+        } else {
+          // Regular message: delete existing and add new
+          const sequenceId = notification.sequence_id || notification.id;
+          if (sequenceId) {
+            await subscriptionManager.deleteNotificationBySequenceId(subscriptionId, sequenceId);
+          }
+          const added = await subscriptionManager.addNotification(subscriptionId, notification);
+          if (added) {
+            await subscriptionManager.notify(subscriptionId, notification);
+          }
         }
       };
 
@@ -231,7 +251,9 @@ export const useIsLaunchedPWA = () => {
 
   useEffect(() => {
     if (isIOSStandalone) {
-      return () => {}; // No need to listen for events on iOS
+      return () => {
+        // No need to listen for events on iOS
+      };
     }
     const handler = (evt) => {
       console.log(`[useIsLaunchedPWA] App is now running ${evt.matches ? "standalone" : "in the browser"}`);

web/src/components/theme.js

@@ -17,6 +17,13 @@ const baseThemeOptions = {
         },
       },
     },
+    MuiCardActions: {
+      styleOverrides: {
+        root: {
+          overflowX: "auto",
+        },
+      },
+    },
   },
 };
 

web/src/registerSW.js

@@ -5,10 +5,19 @@ import { registerSW as viteRegisterSW } from "virtual:pwa-register";
 const intervalMS = 60 * 60 * 1000;
 
 // https://vite-pwa-org.netlify.app/guide/periodic-sw-updates.html
-const registerSW = () =>
+const registerSW = () => {
+  console.log("[ServiceWorker] Registering service worker");
+  if (!("serviceWorker" in navigator)) {
+    console.warn("[ServiceWorker] Service workers not supported");
+    return;
+  }
+
   viteRegisterSW({
     onRegisteredSW(swUrl, registration) {
+      console.log("[ServiceWorker] Registered:", { swUrl, registration });
+
       if (!registration) {
+        console.warn("[ServiceWorker] No registration returned");
         return;
       }
 
@@ -23,9 +32,16 @@ const registerSW = () =>
           },
         });
 
-        if (resp?.status === 200) await registration.update();
+        if (resp?.status === 200) {
+          console.log("[ServiceWorker] Updating service worker");
+          await registration.update();
+        }
       }, intervalMS);
     },
+    onRegisterError(error) {
+      console.error("[ServiceWorker] Registration error:", error);
+    },
   });
+};
 
 export default registerSW;