Template exec context, redone

Bump i18next-browser-languagedetector from 6.1.8 to 8.2.1 in /web

.github/workflows/build.yaml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.26.x'
+          go-version-file: '.go-version'
       - name: Install node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.github/workflows/docs.yaml

@@ -9,10 +9,10 @@ jobs:
     steps:
       -
         name: Checkout ntfy code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       -
         name: Checkout docs pages code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: binwiederhier/ntfy-docs.github.io
           path: build/ntfy-docs.github.io

.github/workflows/release.yaml

@@ -25,11 +25,11 @@ jobs:
       NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.26.x'
+          go-version-file: '.go-version'
       - name: Install node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.github/workflows/test.yaml

@@ -25,11 +25,11 @@ jobs:
       NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.26.x'
+          go-version-file: '.go-version'
       - name: Install node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.go-version

@@ -0,0 +1 @@
+1.26.5

Makefile

@@ -92,7 +92,7 @@ clean: FORCE
 
 build: web docs cli
 
-update: web-deps-update cli-deps-update docs-deps-update
+update: web-deps-update cli-deps-update docs-deps-update go-check
 	docker pull alpine
 
 docker-dev:
@@ -273,9 +273,9 @@ cli-build-results:
 
 # Test/check targets
 
-check: test web-fmt-check fmt-check vet web-lint lint staticcheck
+check: test web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
 
-checkv: testv web-fmt-check fmt-check vet web-lint lint staticcheck
+checkv: testv web-fmt-check fmt-check vet web-lint lint staticcheck template-check go-check
 
 test: cli-test web-test
 
@@ -317,17 +317,73 @@ vet:
 
 lint:
 	which golint || go install golang.org/x/lint/golint@latest
-	go list ./... | grep -v /vendor/ | xargs -L1 golint -set_exit_status
+	go list ./... | grep -v /vendor/ | grep -vE 'ntfy/v2/template/gotext' | xargs -L1 golint -set_exit_status
 
 staticcheck: FORCE
 	rm -rf build/staticcheck
 	which staticcheck || go install honnef.co/go/tools/cmd/staticcheck@latest
 	mkdir -p build/staticcheck
 	ln -s "go" build/staticcheck/go
-	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck ./...
+	PATH="$(PWD)/build/staticcheck:$(PATH)" staticcheck $$(go list ./... | grep -vE 'ntfy/v2/template/gotext')
 	rm -rf build/staticcheck
 
 
+# Vendored template targets (see template/README.md)
+
+TEMPLATE_GO_VERSION := go$(shell cat .go-version 2>/dev/null)
+
+update-template:
+	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
+		echo "ERROR: local Go $$(go env GOVERSION) != $(TEMPLATE_GO_VERSION) pinned in .go-version."; \
+		echo "Bump .go-version and install that toolchain first: go install golang.org/dl/$(TEMPLATE_GO_VERSION)@latest && $(TEMPLATE_GO_VERSION) download"; \
+		exit 1; \
+	fi
+	src="$$(go env GOROOT)/src"; \
+	rm -f template/gotext/*.go template/gotext/fmtsort/*.go; \
+	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" template/gotext/; done; \
+	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" template/gotext/fmtsort/; done; \
+	sed -i 's/^package template$$/package gotext/' template/gotext/*.go; \
+	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' template/gotext/*.go; \
+	( cd template/gotext && for p in patches/*.patch; do echo "Applying $$p"; git apply "$$p" || exit 1; done )
+	go env GOVERSION > template/gotext/GENERATED_FROM
+	@echo "Regenerated template/gotext/ from $(TEMPLATE_GO_VERSION) (files enumerated via 'go list'); review with 'git diff'."
+
+template-check: FORCE
+	@if [ "$$(cat template/gotext/GENERATED_FROM)" != "$(TEMPLATE_GO_VERSION)" ]; then \
+		echo "ERROR: template/gotext was generated from $$(cat template/gotext/GENERATED_FROM), but .go-version pins $(TEMPLATE_GO_VERSION). Run 'make update-template' on the pinned Go."; \
+		exit 1; \
+	fi
+	@if [ "$$(go env GOVERSION)" != "$(TEMPLATE_GO_VERSION)" ]; then \
+		echo "SKIP: local Go $$(go env GOVERSION) != pinned $(TEMPLATE_GO_VERSION); skipping vendored template content check (version marker already verified)."; \
+		exit 0; \
+	fi
+	@tmp=$$(mktemp -d); src="$$(go env GOROOT)/src"; \
+	mkdir -p "$$tmp/gotext/fmtsort"; \
+	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' text/template); do cp "$$src/text/template/$$f" "$$tmp/gotext/"; done; \
+	for f in $$(go list -f '{{range .GoFiles}}{{.}} {{end}}' internal/fmtsort); do cp "$$src/internal/fmtsort/$$f" "$$tmp/gotext/fmtsort/"; done; \
+	sed -i 's/^package template$$/package gotext/' "$$tmp/gotext/"*.go; \
+	sed -i 's#"internal/fmtsort"#"heckel.io/ntfy/v2/template/gotext/fmtsort"#' "$$tmp/gotext/"*.go; \
+	cp template/gotext/patches/*.patch "$$tmp/"; \
+	( cd "$$tmp/gotext" && for p in "$$tmp"/*.patch; do git apply "$$p" || exit 1; done ); \
+	if diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext >/dev/null 2>&1; then \
+		rm -rf "$$tmp"; \
+	else \
+		echo "ERROR: template/gotext/ drifted from GOROOT+patches (or its file set changed). Run 'make update-template' on Go $(TEMPLATE_GO_VERSION):"; \
+		diff -rq -x 'README.md' -x 'GENERATED_FROM' -x 'patches' "$$tmp/gotext" template/gotext; \
+		rm -rf "$$tmp"; exit 1; \
+	fi
+
+# go-check is advisory only (never fails): it warns when the pinned Go (.go-version) is behind the
+# latest upstream release, so template/gotext doesn't silently fall behind on text/template fixes.
+go-check: FORCE
+	@latest=$$(curl -s --max-time 10 'https://go.dev/VERSION?m=text' 2>/dev/null | head -1); \
+	if [ -n "$$latest" ] && [ "$$latest" != "$(TEMPLATE_GO_VERSION)" ]; then \
+		echo ""; \
+		echo "note: latest Go is $$latest, but template/gotext is pinned to $(TEMPLATE_GO_VERSION) (.go-version)."; \
+		echo "      to bump: install $$latest, set .go-version to $${latest#go}, then run 'make update-template'."; \
+	fi
+
+
 # Releasing targets
 
 release: clean cli-deps release-checks docs web check
@@ -338,6 +394,10 @@ release-snapshot: clean cli-deps docs web check
 
 release-checks:
 	$(eval LATEST_TAG := $(shell git describe --abbrev=0 --tags | cut -c2-))
+	if [ "$$(go env GOVERSION)" != "go$$(cat .go-version)" ]; then\
+		echo "ERROR: releases must use the pinned Go toolchain (go$$(cat .go-version) from .go-version), but this is $$(go env GOVERSION). This also ensures 'make check' enforces (not skips) the template/gotext drift check.";\
+		exit 1;\
+	fi
 	if ! grep -q $(LATEST_TAG) docs/install.md; then\
 	 	echo "ERROR: Must update docs/install.md with latest tag first.";\
 	 	exit 1;\

README.md

@@ -84,8 +84,6 @@ Thank you to our commercial sponsors, who help keep the service running and the
 
 <a href="https://m.do.co/c/442b929528db"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a>
 
-<a href="https://www.magicbell.com/?utm_source=ntfy"><img src="assets/sponsors/magicbell.png" width="180px"></a>
-
 <a href="https://go.warp.dev/ntfy"><img src="https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Logos/Warp-Wordmark-Black.png" width="160px"></a>
 
 And a big fat **Thank You** to the individuals who have sponsored ntfy in the past, or are still sponsoring ntfy:
@@ -268,6 +266,7 @@ Third-party libraries and resources:
 * [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) (MIT) is used to provide the persistent message cache
 * [Firebase Admin SDK](https://github.com/firebase/firebase-admin-go) (Apache 2.0) is used to send FCM messages
 * [github/gemoji](https://github.com/github/gemoji) (MIT) is used for emoji support (specifically the [emoji.json](https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json) file)
+* Go's [text/template](https://pkg.go.dev/text/template) (BSD-3-Clause) is vendored under [template/gotext/](template/gotext/) with a small patch adding an execution deadline (see [template/gotext/README.md](template/gotext/README.md))
 * [Lightbox with vanilla JS](https://yossiabramov.com/blog/vanilla-js-lightbox) as a lightbox on the landing page 
 * [HTTP middleware for gzip compression](https://gist.github.com/CJEnright/bc2d8b8dc0c1389a9feeddb110f822d7) (MIT) is used for serving static files
 * [Regex for auto-linking](https://github.com/bryanwoods/autolink-js) (MIT) is used to highlight links (the library is not used)

action/action.go

@@ -1,4 +1,6 @@
-package server
+// Package action parses the "action buttons" that can be attached to a notification, in both the
+// JSON and the human-readable "simple" format described at https://ntfy.sh/docs/publish/#action-buttons.
+package action
 
 import (
 	"encoding/json"
@@ -37,10 +39,10 @@ type actionParser struct {
 	pos   int
 }
 
-// parseActions parses the actions string as described in https://ntfy.sh/docs/publish/#action-buttons.
+// Parse parses the actions string as described in https://ntfy.sh/docs/publish/#action-buttons.
 // It supports both a JSON representation (if the string begins with "[", see parseActionsFromJSON),
 // and the "simple" format, which is more human-readable, but harder to parse (see parseActionsFromSimple).
-func parseActions(s string) (actions []*model.Action, err error) {
+func Parse(s string) (actions []*model.Action, err error) {
 	// Parse JSON or simple format
 	s = strings.TrimSpace(s)
 	if strings.HasPrefix(s, "[") {

action/action_test.go

@@ -1,4 +1,4 @@
-package server
+package action
 
 import (
 	"testing"
@@ -7,12 +7,12 @@ import (
 )
 
 func TestParseActions(t *testing.T) {
-	actions, err := parseActions("[]")
+	actions, err := Parse("[]")
 	require.Nil(t, err)
 	require.Empty(t, actions)
 
 	// Basic test
-	actions, err = parseActions("action=http, label=Open door, url=https://door.lan/open; view, Show portal, https://door.lan")
+	actions, err = Parse("action=http, label=Open door, url=https://door.lan/open; view, Show portal, https://door.lan")
 	require.Nil(t, err)
 	require.Equal(t, 2, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -23,7 +23,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "https://door.lan", actions[1].URL)
 
 	// JSON
-	actions, err = parseActions(`[{"action":"http","label":"Open door","url":"https://door.lan/open"}, {"action":"view","label":"Show portal","url":"https://door.lan"}]`)
+	actions, err = Parse(`[{"action":"http","label":"Open door","url":"https://door.lan/open"}, {"action":"view","label":"Show portal","url":"https://door.lan"}]`)
 	require.Nil(t, err)
 	require.Equal(t, 2, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -34,7 +34,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "https://door.lan", actions[1].URL)
 
 	// Other params
-	actions, err = parseActions("action=http, label=Open door, url=https://door.lan/open, body=this is a body, method=PUT")
+	actions, err = Parse("action=http, label=Open door, url=https://door.lan/open, body=this is a body, method=PUT")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -44,7 +44,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "this is a body", actions[0].Body)
 
 	// Extras with underscores
-	actions, err = parseActions("action=broadcast, label=Do a thing, extras.command=some command, extras.some_param=a parameter")
+	actions, err = Parse("action=broadcast, label=Do a thing, extras.command=some command, extras.some_param=a parameter")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "broadcast", actions[0].Action)
@@ -54,7 +54,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "a parameter", actions[0].Extras["some_param"])
 
 	// Broadcast action with intent
-	actions, err = parseActions("action=broadcast, label=Do a thing, intent=io.heckel.ntfy.TEST_INTENT")
+	actions, err = Parse("action=broadcast, label=Do a thing, intent=io.heckel.ntfy.TEST_INTENT")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "broadcast", actions[0].Action)
@@ -62,7 +62,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "io.heckel.ntfy.TEST_INTENT", actions[0].Intent)
 
 	// Headers with dashes
-	actions, err = parseActions("action=http, label=Send request, url=http://example.com, method=GET, headers.Content-Type=application/json, headers.Authorization=Basic sdasffsf")
+	actions, err = Parse("action=http, label=Send request, url=http://example.com, method=GET, headers.Content-Type=application/json, headers.Authorization=Basic sdasffsf")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -72,7 +72,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "Basic sdasffsf", actions[0].Headers["Authorization"])
 
 	// Quotes
-	actions, err = parseActions(`action=http, "Look ma, \"quotes\"; and semicolons", url=http://example.com`)
+	actions, err = Parse(`action=http, "Look ma, \"quotes\"; and semicolons", url=http://example.com`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -80,7 +80,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `http://example.com`, actions[0].URL)
 
 	// Single quotes
-	actions, err = parseActions(`action=http, '"quotes" and \'single quotes\'', url=http://example.com`)
+	actions, err = Parse(`action=http, '"quotes" and \'single quotes\'', url=http://example.com`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -88,7 +88,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `http://example.com`, actions[0].URL)
 
 	// Single quotes (JSON)
-	actions, err = parseActions(`action=http, Post it, url=http://example.com, body='{"temperature": 65}'`)
+	actions, err = Parse(`action=http, Post it, url=http://example.com, body='{"temperature": 65}'`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -97,7 +97,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `{"temperature": 65}`, actions[0].Body)
 
 	// Out of order
-	actions, err = parseActions(`label="Out of order!" , action="http", url=http://example.com`)
+	actions, err = Parse(`label="Out of order!" , action="http", url=http://example.com`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -105,7 +105,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `http://example.com`, actions[0].URL)
 
 	// Spaces
-	actions, err = parseActions(`action = http, label = 'this is a label', url = "http://google.com"`)
+	actions, err = Parse(`action = http, label = 'this is a label', url = "http://google.com"`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -113,7 +113,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `http://google.com`, actions[0].URL)
 
 	// Non-ASCII
-	actions, err = parseActions(`action = http, 'Кохайтеся а не воюйте, 💙🫤', url = "http://google.com"`)
+	actions, err = Parse(`action = http, 'Кохайтеся а не воюйте, 💙🫤', url = "http://google.com"`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -121,7 +121,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, `http://google.com`, actions[0].URL)
 
 	// Multiple actions, awkward spacing
-	actions, err = parseActions(`http , 'Make love, not war 💙🫤' , https://ntfy.sh ; view, " yo ", https://x.org, clear=true`)
+	actions, err = Parse(`http , 'Make love, not war 💙🫤' , https://ntfy.sh ; view, " yo ", https://x.org, clear=true`)
 	require.Nil(t, err)
 	require.Equal(t, 2, len(actions))
 	require.Equal(t, "http", actions[0].Action)
@@ -134,7 +134,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, true, actions[1].Clear)
 
 	// Copy action (simple format)
-	actions, err = parseActions("copy, Copy code, 1234")
+	actions, err = Parse("copy, Copy code, 1234")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "copy", actions[0].Action)
@@ -142,7 +142,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "1234", actions[0].Value)
 
 	// Copy action (JSON)
-	actions, err = parseActions(`[{"action":"copy","label":"Copy OTP","value":"567890"}]`)
+	actions, err = Parse(`[{"action":"copy","label":"Copy OTP","value":"567890"}]`)
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "copy", actions[0].Action)
@@ -150,7 +150,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, "567890", actions[0].Value)
 
 	// Copy action with clear
-	actions, err = parseActions("copy, Copy code, 1234, clear=true")
+	actions, err = Parse("copy, Copy code, 1234, clear=true")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "copy", actions[0].Action)
@@ -159,7 +159,7 @@ func TestParseActions(t *testing.T) {
 	require.Equal(t, true, actions[0].Clear)
 
 	// Copy action with explicit value key
-	actions, err = parseActions("action=copy, label=Copy token, clear=true, value=abc-123-def")
+	actions, err = Parse("action=copy, label=Copy token, clear=true, value=abc-123-def")
 	require.Nil(t, err)
 	require.Equal(t, 1, len(actions))
 	require.Equal(t, "copy", actions[0].Action)
@@ -168,56 +168,56 @@ func TestParseActions(t *testing.T) {
 	require.True(t, actions[0].Clear)
 
 	// Copy action without value (error)
-	_, err = parseActions("copy, Copy code")
+	_, err = Parse("copy, Copy code")
 	require.EqualError(t, err, "parameter 'value' is required for action 'copy'")
 
 	// Invalid syntax
-	_, err = parseActions(`label="Out of order!" x, action="http", url=http://example.com`)
+	_, err = Parse(`label="Out of order!" x, action="http", url=http://example.com`)
 	require.EqualError(t, err, "unexpected character 'x' at position 22")
 
-	_, err = parseActions(`label="", action="http", url=http://example.com`)
+	_, err = Parse(`label="", action="http", url=http://example.com`)
 	require.EqualError(t, err, "parameter 'label' is required")
 
-	_, err = parseActions(`label=, action="http", url=http://example.com`)
+	_, err = Parse(`label=, action="http", url=http://example.com`)
 	require.EqualError(t, err, "parameter 'label' is required")
 
-	_, err = parseActions(`label="xx", action="http", url=http://example.com, what is this anyway`)
+	_, err = Parse(`label="xx", action="http", url=http://example.com, what is this anyway`)
 	require.EqualError(t, err, "term 'what is this anyway' unknown")
 
-	_, err = parseActions(`fdsfdsf`)
+	_, err = Parse(`fdsfdsf`)
 	require.EqualError(t, err, "parameter 'action' cannot be 'fdsfdsf', valid values are 'view', 'broadcast', 'http' and 'copy'")
 
-	_, err = parseActions(`aaa=a, "bbb, 'ccc, ddd, eee "`)
+	_, err = Parse(`aaa=a, "bbb, 'ccc, ddd, eee "`)
 	require.EqualError(t, err, "key 'aaa' unknown")
 
-	_, err = parseActions(`action=http, label="omg the end quote is missing`)
+	_, err = Parse(`action=http, label="omg the end quote is missing`)
 	require.EqualError(t, err, "unexpected end of input, quote started at position 20")
 
-	_, err = parseActions(`;;;;`)
+	_, err = Parse(`;;;;`)
 	require.EqualError(t, err, "only 3 actions allowed")
 
-	_, err = parseActions(`,,,,,,;;`)
+	_, err = Parse(`,,,,,,;;`)
 	require.EqualError(t, err, "term '' unknown")
 
-	_, err = parseActions(`''";,;"`)
+	_, err = Parse(`''";,;"`)
 	require.EqualError(t, err, "unexpected character '\"' at position 2")
 
-	_, err = parseActions(`action=http, label=a label, body=somebody`)
+	_, err = Parse(`action=http, label=a label, body=somebody`)
 	require.EqualError(t, err, "parameter 'url' is required for action 'http'")
 
-	_, err = parseActions(`action=http, label=a label, url=http://ntfy.sh, method=HEAD, body=somebody`)
+	_, err = Parse(`action=http, label=a label, url=http://ntfy.sh, method=HEAD, body=somebody`)
 	require.EqualError(t, err, "parameter 'body' cannot be set if method is HEAD")
 
-	_, err = parseActions(`[ invalid json ]`)
+	_, err = Parse(`[ invalid json ]`)
 	require.EqualError(t, err, "JSON error: invalid character 'i' looking for beginning of value")
 
-	_, err = parseActions(`[ { "some": "object" } ]`)
+	_, err = Parse(`[ { "some": "object" } ]`)
 	require.EqualError(t, err, "parameter 'action' cannot be '', valid values are 'view', 'broadcast', 'http' and 'copy'")
 
-	_, err = parseActions("\x00\x01\xFFx\xFE")
+	_, err = Parse("\x00\x01\xFFx\xFE")
 	require.EqualError(t, err, "invalid utf-8 string")
 
-	_, err = parseActions(`http, label, http://x.org, clear=x`)
+	_, err = Parse(`http, label, http://x.org, clear=x`)
 	require.EqualError(t, err, "parameter 'clear' cannot be 'x', only boolean values are allowed (true/yes/1/false/no/0)")
 
 }

docs/develop.md

@@ -65,8 +65,8 @@ These steps **assume Ubuntu**. Steps may vary on different Linux distributions.
 
 First, install [Go](https://go.dev/) (see [official instructions](https://go.dev/doc/install)):
 ``` shell
-wget https://go.dev/dl/go1.19.1.linux-amd64.tar.gz
-sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.19.1.linux-amd64.tar.gz
+wget https://go.dev/dl/go1.25.8.linux-amd64.tar.gz
+sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.25.8.linux-amd64.tar.gz
 export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
 go version   # verifies that it worked
 ```
@@ -77,9 +77,11 @@ go install github.com/goreleaser/goreleaser@latest
 goreleaser -v   # verifies that it worked
 ```
 
-Install [nodejs](https://nodejs.org/en/) (see [official instructions](https://nodejs.org/en/download/package-manager/)):
+Install [nodejs](https://nodejs.org/en/) (see [official instructions](https://nodejs.org/en/download/package-manager/)).
+Use a current LTS release (Node 24 is what CI builds with; anything older than Node 20 will not work
+with the current Vite-based web build):
 ``` shell
-curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
+curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
 sudo apt-get install -y nodejs
 npm -v   # verifies that it worked
 ```

docs/examples.md

@@ -641,6 +641,32 @@ or by simply providing traccar with a valid username/password combination.
         <entry key='sms.http.password'>mypass</entry>
 ```
 
+## Flowtriq DDoS detection
+[Flowtriq](https://flowtriq.com) is a real-time DDoS detection and mitigation platform. Its Linux agent, ftagent,
+supports webhook alerts that can POST directly to an ntfy topic, so you get push notifications on your phone
+whenever an attack is detected.
+
+Configure the webhook URL in your ftagent configuration to point to your ntfy topic:
+
+```yaml
+# /etc/ftagent/ftagent.yml
+alerts:
+  webhooks:
+    - url: https://ntfy.sh/flowtriq-attacks
+      method: POST
+```
+
+You can also use curl to test the integration manually with a sample attack alert:
+
+```bash
+curl \
+  -H "Title: DDoS Attack Detected" \
+  -H "Priority: urgent" \
+  -H "Tags: rotating_light" \
+  -d "Attack detected on 203.0.113.5: 14.2 Gbps UDP flood from 3,482 sources" \
+  ntfy.sh/flowtriq-attacks
+```
+
 ## Terminal Notifications for Long-Running Commands
 
 This example provides a simple way to send notifications using [ntfy.sh](https://ntfy.sh) when a terminal command completes. It includes success or failure indicators based on the command's exit status.

docs/install.md

@@ -34,37 +34,37 @@ as a service starting at boot time.
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_amd64.tar.gz
-    tar zxvf ntfy_2.25.0_linux_amd64.tar.gz
-    sudo cp -a ntfy_2.25.0_linux_amd64/ntfy /usr/local/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.25.0_linux_amd64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_amd64.tar.gz
+    tar zxvf ntfy_2.26.0_linux_amd64.tar.gz
+    sudo cp -a ntfy_2.26.0_linux_amd64/ntfy /usr/local/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.26.0_linux_amd64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv6.tar.gz
-    tar zxvf ntfy_2.25.0_linux_armv6.tar.gz
-    sudo cp -a ntfy_2.25.0_linux_armv6/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.25.0_linux_armv6/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv6.tar.gz
+    tar zxvf ntfy_2.26.0_linux_armv6.tar.gz
+    sudo cp -a ntfy_2.26.0_linux_armv6/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.26.0_linux_armv6/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv7.tar.gz
-    tar zxvf ntfy_2.25.0_linux_armv7.tar.gz
-    sudo cp -a ntfy_2.25.0_linux_armv7/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.25.0_linux_armv7/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv7.tar.gz
+    tar zxvf ntfy_2.26.0_linux_armv7.tar.gz
+    sudo cp -a ntfy_2.26.0_linux_armv7/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.26.0_linux_armv7/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_arm64.tar.gz
-    tar zxvf ntfy_2.25.0_linux_arm64.tar.gz
-    sudo cp -a ntfy_2.25.0_linux_arm64/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.25.0_linux_arm64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_arm64.tar.gz
+    tar zxvf ntfy_2.26.0_linux_arm64.tar.gz
+    sudo cp -a ntfy_2.26.0_linux_arm64/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.26.0_linux_arm64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
@@ -84,25 +84,25 @@ Install the ntfy server unit file (which contains parameters to start the servic
 
 === "x86_64/amd64"
     ```bash
-    sudo mv ntfy_2.25.0_linux_amd64/server/ntfy.service /etc/systemd/system/
+    sudo mv ntfy_2.26.0_linux_amd64/server/ntfy.service /etc/systemd/system/
     sudo chmod 644 /etc/systemd/system/ntfy.service
     ```
 
 === "armv6"
     ```bash
-    sudo mv ntfy_2.25.0_linux_armv6/server/ntfy.service /etc/systemd/system/
+    sudo mv ntfy_2.26.0_linux_armv6/server/ntfy.service /etc/systemd/system/
     sudo chmod 644 /etc/systemd/system/ntfy.service
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo mv ntfy_2.25.0_linux_armv7/server/ntfy.service /etc/systemd/system/
+    sudo mv ntfy_2.26.0_linux_armv7/server/ntfy.service /etc/systemd/system/
     sudo chmod 644 /etc/systemd/system/ntfy.service
     ```
 
 === "arm64"
     ```bash
-    sudo mv ntfy_2.25.0_linux_arm64/server/ntfy.service /etc/systemd/system/
+    sudo mv ntfy_2.26.0_linux_arm64/server/ntfy.service /etc/systemd/system/
     sudo chmod 644 /etc/systemd/system/ntfy.service
     ```
 
@@ -118,25 +118,25 @@ Install the ntfy server service script:
 
 === "x86_64/amd64"
     ```bash
-    sudo mv ntfy_2.25.0_linux_amd64/server/ntfy.openrc /etc/init.d/ntfy
+    sudo mv ntfy_2.26.0_linux_amd64/server/ntfy.openrc /etc/init.d/ntfy
     sudo chmod 755 /etc/init.d/ntfy
     ```
 
 === "armv6"
     ```bash
-    sudo mv ntfy_2.25.0_linux_armv6/server/ntfy.openrc /etc/init.d/ntfy
+    sudo mv ntfy_2.26.0_linux_armv6/server/ntfy.openrc /etc/init.d/ntfy
     sudo chmod 755 /etc/init.d/ntfy
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo mv ntfy_2.25.0_linux_armv7/server/ntfy.openrc /etc/init.d/ntfy
+    sudo mv ntfy_2.26.0_linux_armv7/server/ntfy.openrc /etc/init.d/ntfy
     sudo chmod 755 /etc/init.d/ntfy
     ```
 
 === "arm64"
     ```bash
-    sudo mv ntfy_2.25.0_linux_arm64/server/ntfy.openrc /etc/init.d/ntfy
+    sudo mv ntfy_2.26.0_linux_arm64/server/ntfy.openrc /etc/init.d/ntfy
     sudo chmod 755 /etc/init.d/ntfy
     ```
 
@@ -204,7 +204,7 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_amd64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_amd64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -212,7 +212,7 @@ Manually installing the .deb file:
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv6.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv6.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -220,7 +220,7 @@ Manually installing the .deb file:
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv7.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv7.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -228,7 +228,7 @@ Manually installing the .deb file:
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_arm64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_arm64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -238,28 +238,28 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_amd64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_amd64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "armv6"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv6.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv6.rpm
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_armv7.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_armv7.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "arm64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_linux_arm64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_linux_arm64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
@@ -301,18 +301,18 @@ pkg install go-ntfy
 
 ## macOS
 The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on macOS as well. 
-To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_darwin_all.tar.gz), 
+To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_darwin_all.tar.gz), 
 extract it and place it somewhere in your `PATH` (e.g. `/usr/local/bin/ntfy`). 
 
 If run as `root`, ntfy will look for its config at `/etc/ntfy/client.yml`. For all other users, it'll look for it at 
 `~/Library/Application Support/ntfy/client.yml` (sample included in the tarball).
 
 ```bash
-curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_darwin_all.tar.gz > ntfy_2.25.0_darwin_all.tar.gz
-tar zxvf ntfy_2.25.0_darwin_all.tar.gz
-sudo cp -a ntfy_2.25.0_darwin_all/ntfy /usr/local/bin/ntfy
+curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_darwin_all.tar.gz > ntfy_2.26.0_darwin_all.tar.gz
+tar zxvf ntfy_2.26.0_darwin_all.tar.gz
+sudo cp -a ntfy_2.26.0_darwin_all/ntfy /usr/local/bin/ntfy
 mkdir ~/Library/Application\ Support/ntfy 
-cp ntfy_2.25.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
+cp ntfy_2.26.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
 ntfy --help
 ```
 
@@ -333,7 +333,7 @@ brew install ntfy
 The ntfy server and CLI are fully supported on Windows. You can run the ntfy server directly or as a Windows service.
 To install, you can either
 
-* [Download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.25.0/ntfy_2.25.0_windows_amd64.zip),
+* [Download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.26.0/ntfy_2.26.0_windows_amd64.zip),
 extract it and place the `ntfy.exe` binary somewhere in your `%Path%`. 
 * Or install ntfy from the [Scoop](https://scoop.sh) main repository via `scoop install ntfy`
 
@@ -726,3 +726,31 @@ kubectl apply -k /ntfy
     cache-file: "/var/cache/ntfy/cache.db"
     attachment-cache-dir: "/var/cache/ntfy/attachments"
     ```
+
+## Helm
+<span class="community-badge" title="This package is maintained by the community, not the ntfy developers"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 7h2v2h-2zm0 4h2v6h-2zm1-9C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8z"/></svg> Community maintained</span>
+
+If you prefer [Helm](https://helm.sh/), ntfy can be deployed using the third-party
+[HelmForge chart](https://helmforge.dev/docs/charts/ntfy), which packages the official
+`binwiederhier/ntfy` image with persistent storage, Service, Ingress, optional Prometheus metrics, and more.
+This chart is **not** maintained by the ntfy developers.
+
+!!! warning
+    The HelmForge project is young and maintained by a small community. Review the chart before deploying it,
+    and use it at your own risk.
+
+```bash
+helm repo add helmforge https://repo.helmforge.dev
+helm repo update
+helm install ntfy helmforge/ntfy
+```
+
+Alternatively, install it directly from the OCI registry:
+
+```bash
+helm install ntfy oci://ghcr.io/helmforgedev/helm/ntfy
+```
+
+Because ntfy's default SQLite storage is single-writer, run the chart as a single instance rather than
+treating it as a horizontally scalable deployment. See the [chart documentation](https://helmforge.dev/docs/charts/ntfy)
+for the full list of configurable values.

docs/integrations.md

@@ -43,6 +43,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Miniflux](https://miniflux.app/docs/ntfy.html) - Minimalist and opinionated feed reader
 - [Beszel](https://beszel.dev/guide/notifications/ntfy) - Server monitoring platform
 - [Simple Observability](https://simpleobservability.com/docs/alerts/ntfy) - Server monitoring and observability platform
+- [Sifio](https://sifio.net) - Aggregate updates from RSS, social media, and other sources, then deliver them to ntfy, Slack, Notion and more
 
 ## Integration via HTTP/SMTP/etc.
 
@@ -54,6 +55,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Proxmox-Ntfy](https://github.com/qtsone/proxmox-ntfy) - Python script that monitors Proxmox tasks and sends notifications using the Ntfy service.
 - [Scrutiny](https://github.com/AnalogJ/scrutiny) - WebUI for smartd S.M.A.R.T monitoring. Scrutiny includes shoutrrr/ntfy integration ([see integration README](https://github.com/AnalogJ/scrutiny?tab=readme-ov-file#notifications))
 - [UptimeObserver](https://uptimeobserver.com) - Uptime Monitoring tool for Websites, APIs, SSL Certificates, DNS, Domain Names and Ports. [Integration Guide](https://support.uptimeobserver.com/integrations/ntfy/)
+- [Flowtriq](https://flowtriq.com) - Real-time DDoS detection and mitigation platform (integration via [webhook alerts](https://flowtriq.com))
 
 ## [UnifiedPush](https://unifiedpush.org/users/apps/) integrations
 

docs/publish.md

@@ -3224,6 +3224,11 @@ You can use the following features in your templates:
 A good way to experiment with Go templates is the **[Go Template Playground](https://repeatit.io)**. It is _highly recommended_ to test
 your templates there first ([example for Grafana alert](https://repeatit.io/#/share/eyJ0ZW1wbGF0ZSI6InRpdGxlPUdyYWZhbmErYWxlcnQ6K3t7LnRpdGxlfX0mbWVzc2FnZT17ey5tZXNzYWdlfX0iLCJpbnB1dCI6IntcbiAgXCJyZWNlaXZlclwiOiBcIm50ZnlcXFxcLmV4YW1wbGVcXFxcLmNvbS9hbGVydHNcIixcbiAgXCJzdGF0dXNcIjogXCJyZXNvbHZlZFwiLFxuICBcImFsZXJ0c1wiOiBbXG4gICAge1xuICAgICAgXCJzdGF0dXNcIjogXCJyZXNvbHZlZFwiLFxuICAgICAgXCJsYWJlbHNcIjoge1xuICAgICAgICBcImFsZXJ0bmFtZVwiOiBcIkxvYWQgYXZnIDE1bSB0b28gaGlnaFwiLFxuICAgICAgICBcImdyYWZhbmFfZm9sZGVyXCI6IFwiTm9kZSBhbGVydHNcIixcbiAgICAgICAgXCJpbnN0YW5jZVwiOiBcIjEwLjEwOC4wLjI6OTEwMFwiLFxuICAgICAgICBcImpvYlwiOiBcIm5vZGUtZXhwb3J0ZXJcIlxuICAgICAgfSxcbiAgICAgIFwiYW5ub3RhdGlvbnNcIjoge1xuICAgICAgICBcInN1bW1hcnlcIjogXCIxNW0gbG9hZCBhdmVyYWdlIHRvbyBoaWdoXCJcbiAgICAgIH0sXG4gICAgICBcInN0YXJ0c0F0XCI6IFwiMjAyNC0wMy0xNVQwMjoyODowMFpcIixcbiAgICAgIFwiZW5kc0F0XCI6IFwiMjAyNC0wMy0xNVQwMjo0MjowMFpcIixcbiAgICAgIFwiZ2VuZXJhdG9yVVJMXCI6IFwibG9jYWxob3N0OjMwMDAvYWxlcnRpbmcvZ3JhZmFuYS9OVzlvRHctNHovdmlld1wiLFxuICAgICAgXCJmaW5nZXJwcmludFwiOiBcImJlY2JmYjk0YmQ4MWVmNDhcIixcbiAgICAgIFwic2lsZW5jZVVSTFwiOiBcImxvY2FsaG9zdDozMDAwL2FsZXJ0aW5nL3NpbGVuY2UvbmV3P2FsZXJ0bWFuYWdlcj1ncmFmYW5hJm1hdGNoZXI9YWxlcnRuYW1lJTNETG9hZCthdmcrMTVtK3RvbytoaWdoJm1hdGNoZXI9Z3JhZmFuYV9mb2xkZXIlM0ROb2RlK2FsZXJ0cyZtYXRjaGVyPWluc3RhbmNlJTNEMTAuMTA4LjAuMiUzQTkxMDAmbWF0Y2hlcj1qb2IlM0Rub2RlLWV4cG9ydGVyXCIsXG4gICAgICBcImRhc2hib2FyZFVSTFwiOiBcIlwiLFxuICAgICAgXCJwYW5lbFVSTFwiOiBcIlwiLFxuICAgICAgXCJ2YWx1ZXNcIjoge1xuICAgICAgICBcIkJcIjogMTguOTgyMTEzMTQ0NzU4NzYsXG4gICAgICAgIFwiQ1wiOiAwXG4gICAgICB9LFxuICAgICAgXCJ2YWx1ZVN0cmluZ1wiOiBcIlsgdmFyPSdCJyBsYWJlbHM9e19fbmFtZV9fPW5vZGVfbG9hZDE1LCBpbnN0YW5jZT0xMC4xMDguMC4yOjkxMDAsIGpvYj1ub2RlLWV4cG9ydGVyfSB2YWx1ZT0xOC45ODIxMTMxNDQ3NTg3NiBdLCBbIHZhcj0nQycgbGFiZWxzPXtfX25hbWVfXz1ub2RlX2xvYWQxNSwgaW5zdGFuY2U9MTAuMTA4LjAuMjo5MTAwLCBqb2I9bm9kZS1leHBvcnRlcn0gdmFsdWU9MCBdXCJcbiAgICB9XG4gIF0sXG4gIFwiZ3JvdXBMYWJlbHNcIjoge1xuICAgIFwiYWxlcnRuYW1lXCI6IFwiTG9hZCBhdmcgMTVtIHRvbyBoaWdoXCIsXG4gICAgXCJncmFmYW5hX2ZvbGRlclwiOiBcIk5vZGUgYWxlcnRzXCJcbiAgfSxcbiAgXCJjb21tb25MYWJlbHNcIjoge1xuICAgIFwiYWxlcnRuYW1lXCI6IFwiTG9hZCBhdmcgMTVtIHRvbyBoaWdoXCIsXG4gICAgXCJncmFmYW5hX2ZvbGRlclwiOiBcIk5vZGUgYWxlcnRzXCIsXG4gICAgXCJpbnN0YW5jZVwiOiBcIjEwLjEwOC4wLjI6OTEwMFwiLFxuICAgIFwiam9iXCI6IFwibm9kZS1leHBvcnRlclwiXG4gIH0sXG4gIFwiY29tbW9uQW5ub3RhdGlvbnNcIjoge1xuICAgIFwic3VtbWFyeVwiOiBcIjE1bSBsb2FkIGF2ZXJhZ2UgdG9vIGhpZ2hcIlxuICB9LFxuICBcImV4dGVybmFsVVJMXCI6IFwibG9jYWxob3N0OjMwMDAvXCIsXG4gIFwidmVyc2lvblwiOiBcIjFcIixcbiAgXCJncm91cEtleVwiOiBcInt9OnthbGVydG5hbWU9XFxcIkxvYWQgYXZnIDE1bSB0b28gaGlnaFxcXCIsIGdyYWZhbmFfZm9sZGVyPVxcXCJOb2RlIGFsZXJ0c1xcXCJ9XCIsXG4gIFwidHJ1bmNhdGVkQWxlcnRzXCI6IDAsXG4gIFwib3JnSWRcIjogMSxcbiAgXCJ0aXRsZVwiOiBcIltSRVNPTFZFRF0gTG9hZCBhdmcgMTVtIHRvbyBoaWdoIE5vZGUgYWxlcnRzICgxMC4xMDguMC4yOjkxMDAgbm9kZS1leHBvcnRlcilcIixcbiAgXCJzdGF0ZVwiOiBcIm9rXCIsXG4gIFwibWVzc2FnZVwiOiBcIioqUmVzb2x2ZWQqKlxcblxcblZhbHVlOiBCPTE4Ljk4MjExMzE0NDc1ODc2LCBDPTBcXG5MYWJlbHM6XFxuIC0gYWxlcnRuYW1lID0gTG9hZCBhdmcgMTVtIHRvbyBoaWdoXFxuIC0gZ3JhZmFuYV9mb2xkZXIgPSBOb2RlIGFsZXJ0c1xcbiAtIGluc3RhbmNlID0gMTAuMTA4LjAuMjo5MTAwXFxuIC0gam9iID0gbm9kZS1leHBvcnRlclxcbkFubm90YXRpb25zOlxcbiAtIHN1bW1hcnkgPSAxNW0gbG9hZCBhdmVyYWdlIHRvbyBoaWdoXFxuU291cmNlOiBsb2NhbGhvc3Q6MzAwMC9hbGVydGluZy9ncmFmYW5hL05XOW9Edy00ei92aWV3XFxuU2lsZW5jZTogbG9jYWxob3N0OjMwMDAvYWxlcnRpbmcvc2lsZW5jZS9uZXc/YWxlcnRtYW5hZ2VyPWdyYWZhbmEmbWF0Y2hlcj1hbGVydG5hbWUlM0RMb2FkK2F2ZysxNW0rdG9vK2hpZ2gmbWF0Y2hlcj1ncmFmYW5hX2ZvbGRlciUzRE5vZGUrYWxlcnRzJm1hdGNoZXI9aW5zdGFuY2UlM0QxMC4xMDguMC4yJTNBOTEwMCZtYXRjaGVyPWpvYiUzRG5vZGUtZXhwb3J0ZXJcXG5cIlxufVxuIiwiY29uZmlnIjp7InRlbXBsYXRlIjoidGV4dCIsImZ1bGxTY3JlZW5IVE1MIjpmYWxzZSwiZnVuY3Rpb25zIjpbInNwcmlnIl0sIm9wdGlvbnMiOlsibGl2ZSJdLCJpbnB1dFR5cGUiOiJ5YW1sIn19)).
 
+!!! info
+    A few Go template features are disabled for user-supplied templates: `{{define}}`, `{{template}}`,
+    `{{block}}`, and `{{call}}` are not allowed. Templates also run with a short execution time limit --
+    a template that loops too long is stopped and rejected with an HTTP 400 error.
+
 ### Template functions
 ntfy supports a subset of the **[Sprig template functions](publish/template-functions.md)** (originally copied from [Sprig](https://github.com/Masterminds/sprig),
 thank you to the Sprig developers 🙏). This is useful for advanced message templating and for transforming the data provided through the JSON payload.

docs/releases.md

@@ -6,12 +6,36 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release
 
 | Component        | Version | Release date  |
 |------------------|---------|---------------|
-| ntfy server      | v2.25.0 | June 24, 2026 |
+| ntfy server      | v2.26.0 | July 9, 2026  |
 | ntfy Android app | v1.24.0 | Mar 5, 2026   |
 | ntfy iOS app     | v1.7.0  | May 30, 2026  |
 
 Please check out the release notes for [upcoming releases](#not-released-yet) below.
 
+### ntfy server v2.26.0
+Released July 9, 2026
+
+This release hardens **message templates**, which are now executed with a hard-capped execution timeout. This closes
+a denial-of-service hole.
+
+On the web app side, it adds configurable **date and time formats**, a smoother loading and page-transition experience,
+and a fix that strips unsafe URL protocols from rendered Markdown.
+
+**Security:**
+
+* Prevent a CPU denial of service via message templates (`Template: yes`) ([#1826](https://github.com/binwiederhier/ntfy/pull/1826), thanks to [@alanturing881](https://github.com/alanturing881) for reporting)
+
+**Features:**
+
+* Web app: Add "Date format" and "Time format" settings (Settings -> Appearance), with ISO 8601, day/month/year (slash or dot) and month/day/year date options and a 12-/24-hour clock option, and base the default format on your browser/system locale rather than the selected display language. When logged in, both settings sync across devices via your account ([#1647](https://github.com/binwiederhier/ntfy/issues/1647), thanks to [@wsw70](https://github.com/wsw70) for reporting)
+
+**Bug fixes + maintenance:**
+
+* Web app: Smooth transitions and loading animation, remove flickering
+* Web app: `GET /account` now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
+* Docs: Document the third-party HelmForge Helm chart as a Kubernetes installation option ([#1727](https://github.com/binwiederhier/ntfy/issues/1727), thanks to [@mberlofa](https://github.com/mberlofa))
+* Web app: Strip unsafe URL protocols (`javascript:`, `data:`, ...) from links and images in Markdown-rendered messages, so they no longer trigger an uncaught "React has blocked a javascript: URL" error (thanks to [@jvoisin](https://github.com/jvoisin) for reporting)
+
 ## ntfy server v2.25.0
 Released June 24, 2026
 
@@ -32,7 +56,7 @@ since I do have to reset accounts on a regular basis.
 * Add password reset via emailed magic link, with a "Forgot password" link on the login page and a `ntfy user reset-pass` CLI command for admins
 * Rework email verification to use durable, single-use, expiring magic links instead of in-memory 6-digit codes, and add a "primary" email (used for account recovery and as the `X-Email: yes` target) with verified/unverified state in the account UI
 * You can now clear/read messages and delete messages with a GET request ([#1771](https://github.com/binwiederhier/ntfy/issues/1771), thanks to [@lemmi](https://github.com/lemmi) for reporting and to [@wunter8](https://github.com/wunter8) for implementing)
-* Add a reload button to the web app's action bar when running as an installed PWA, which clears the service worker caches and hard-refreshes the app
+* Add a reload button to the web app's action bar when running as an installed PWA, which clears the service worker caches and hard-refreshes the app ([#1281](https://github.com/binwiederhier/ntfy/issues/1281), thanks to [@leanza](https://github.com/leanza) for reporting)
 * Add a "Back to app" link to the web app's login, signup, and password-reset pages (alongside the existing links), which previously had no way back to the app
 
 **Bug fixes + maintenance:**
@@ -1983,20 +2007,14 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release
 
 ## Not released yet
 
-### ntfy server v2.26.x (UNRELEASED)
-
-**Bug fixes + maintenance:**
-
-* Web app: Smooth transitions and loading animation, remove flickering
-* Web app: `GET /account` now reads from the primary database instead of a read replica, so the account view no longer shows stale data right after a change when replicas lag behind
-
-### ntfy Android v1.25.x (UNRELEASED)
+### ntfy Android v1.25.2 (UNRELEASED)
 
 This release makes the "connection lost" alert configurable and turns it off by default. Folks did not like it and many reached out
 or even gave ntfy bad reviews. I heard you! You can re-enable the alert in the advanced settings.
 
 The release also tries to be smarter about not retrying the connection at all if the app is in flight mode, or has no network. If there
-is no network, ntfy will now stop the foreground service entirely.
+is no network, ntfy now keeps the foreground service alive and shows a "Waiting for network" notification, then resumes automatically
+once connectivity returns.
 
 Another change related to the networking is that we now force-reconnect when the connection is changed, e.g. during transitions
 from Wi-Fi to cellular network, or vice versa. That should allow for faster transitions during hand-overs.
@@ -2006,16 +2024,19 @@ especially when paired with increaseing the server-side `keepalive-interval` in
 
 **Features:**
 
-* Add configurable "Alert when connection is lost" setting ([#1665](https://github.com/binwiederhier/ntfy/issues/1665), [#1662](https://github.com/binwiederhier/ntfy/issues/1662), [#1652](https://github.com/binwiederhier/ntfy/issues/1652), [#1655](https://github.com/binwiederhier/ntfy/issues/1655), thanks to [@tintamarre](https://github.com/tintamarre), [@sjozs](https://github.com/sjozs), [@TheRealOne78](https://github.com/TheRealOne78), and [@DAE51D](https://github.com/DAE51D) for reporting)
-* Suppress connection alerts and stop foreground service when there is no network ([ntfy-android#165](https://github.com/binwiederhier/ntfy-android/pull/165), thanks to [@tintamarre](https://github.com/tintamarre) for the contribution)
-* Restart the foreground service immediately when network returns, even if the app process was killed while offline
+* Add configurable "Alert when connection is lost" setting, turned off by default ([#1665](https://github.com/binwiederhier/ntfy/issues/1665), [#1662](https://github.com/binwiederhier/ntfy/issues/1662), [#1652](https://github.com/binwiederhier/ntfy/issues/1652), [#1655](https://github.com/binwiederhier/ntfy/issues/1655), thanks to [@tintamarre](https://github.com/tintamarre), [@sjozs](https://github.com/sjozs), [@TheRealOne78](https://github.com/TheRealOne78), and [@DAE51D](https://github.com/DAE51D) for reporting)
+* Handle "no network" gracefully: when the device is offline or in airplane mode, ntfy now stops retrying, suppresses the connection-lost alert, and keeps the foreground service alive with a "Waiting for network" notification, resuming instant delivery automatically when connectivity returns ([ntfy-android#165](https://github.com/binwiederhier/ntfy-android/pull/165), thanks to [@tintamarre](https://github.com/tintamarre) for the contribution, and [#1709](https://github.com/binwiederhier/ntfy/issues/1709), thanks to [@isaitgirl](https://github.com/isaitgirl) for reporting)
 * Improve battery life by increasing WebSocket client ping interval from 1 min to 3 min, and reconnect instantly on Wi-Fi/cellular/VPN transitions ([ntfy-android#113](https://github.com/binwiederhier/ntfy-android/pull/113), thanks to [@ftilde](https://github.com/ftilde) for the investigation)
 * Disable UnifiedPush components when UnifiedPush is disabled in settings ([ntfy-android#168](https://github.com/binwiederhier/ntfy-android/pull/168), thanks to [@p1gp1g](https://github.com/p1gp1g) for the contribution)
 
 **Bug fixes + maintenance:**
 
+* Fix the "connection lost" alert briefly disappearing and re-firing when roaming between networks (e.g. Wi-Fi to cellular), by no longer cancelling it during the transient no-network gap of a handover
+* Fix the "connection lost" alert repeatedly waking the screen while a server stayed unreachable, by no longer re-posting the alert once it is already showing
+* Fix the "connection lost" alert firing late, erratically, or not at all when a connection kept dropping (e.g. a flaky server) rather than being refused outright, by tracking how long the connection has been down independently of whether the drop warrants a UI error
 * Undo automatic phone number linking for numbers in message body ([ntfy-android#170](https://github.com/binwiederhier/ntfy-android/pull/170), thanks to [@acortelyou](https://github.com/acortelyou) for the contribution)
 * Fix subscription icons disappearing after a few days due to Android clearing cache ([#1322](https://github.com/binwiederhier/ntfy/issues/1322), thanks to [@mcanning](https://github.com/mcanning) for reporting)
+* Fix UnifiedPush `failed_reason` being sent as an enum instead of a string, which caused an exception in receiving apps that read it as a string extra ([ntfy-android#182](https://github.com/binwiederhier/ntfy-android/pull/182), thanks to [@p1gp1g](https://github.com/p1gp1g) for the contribution)
 
 ### ntfy iOS app v1.8.0 (UNRELEASED)
 

go.mod

@@ -4,7 +4,7 @@ go 1.25.8
 
 require (
 	cloud.google.com/go/firestore v1.22.0 // indirect
-	cloud.google.com/go/storage v1.62.3 // indirect
+	cloud.google.com/go/storage v1.63.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/emersion/go-smtp v0.24.0
@@ -19,7 +19,7 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/term v0.44.0
 	golang.org/x/time v0.15.0
-	google.golang.org/api v0.286.0
+	google.golang.org/api v0.287.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -35,7 +35,7 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/stripe/stripe-go/v74 v74.30.0
 	golang.org/x/sys v0.46.0
-	golang.org/x/text v0.38.0
+	golang.org/x/text v0.39.0
 )
 
 require (
@@ -45,7 +45,7 @@ require (
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.11.0 // indirect
-	cloud.google.com/go/longrunning v1.0.0 // indirect
+	cloud.google.com/go/longrunning v1.1.0 // indirect
 	cloud.google.com/go/monitoring v1.29.0 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
@@ -69,7 +69,7 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.17 // indirect
 	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
@@ -80,7 +80,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.69.0 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
@@ -96,10 +96,10 @@ require (
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
-	google.golang.org/genproto v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/genproto v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/grpc v1.82.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -14,12 +14,12 @@ cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM=
 cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4=
 cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k=
 cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI=
-cloud.google.com/go/longrunning v1.0.0 h1:lwzWEYD8+NkYV7dhexOz6kmlvajZA70+bW/xMhRVVdY=
-cloud.google.com/go/longrunning v1.0.0/go.mod h1:8nqFBPOO1U/XkhWl0I19AMZEphrHi73VNABIpKYaTwM=
+cloud.google.com/go/longrunning v1.1.0 h1:qJ0R0IA8ONaRCNWTRPAS0iAmt1bj3TVgJ40z7ZGRslE=
+cloud.google.com/go/longrunning v1.1.0/go.mod h1:tH+A/6UvNypiPJWAQaKCsh+xiGbB23wUO8egwUXlD2E=
 cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY=
 cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM=
-cloud.google.com/go/storage v1.62.3 h1:SZq1t23NCI+e96dH77Dg3PEfsNNEjqO8zE5AnD8gVD0=
-cloud.google.com/go/storage v1.62.3/go.mod h1:cpYz/kRVZ+UQAF1uHeea10/9ewcRbxGoGNKsS9daSXA=
+cloud.google.com/go/storage v1.63.0 h1:hvXF2xfg9I32bjujggxgkEZn/Ej6sJ9pieFgeueBLrQ=
+cloud.google.com/go/storage v1.63.0/go.mod h1:tirWVptrFNo5GEX2DQ47JooF7yaweJdAJ1hYAVMvKzE=
 cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
 cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
 firebase.google.com/go/v4 v4.20.0 h1:ighpjeAC45rY/95cUQ+ojIKlKcTnz2YC0ldam56z2YU=
@@ -96,8 +96,8 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=
-github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=
+github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
 github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=
 github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -141,8 +141,8 @@ github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNw
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.69.0 h1:OA85nJQS/T/MaYh/Q2CcgDKSGWqNIgrBDvDH85CuiNk=
 github.com/prometheus/common v0.69.0/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -173,8 +173,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
 go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
 go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
 go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
 go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
 go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
@@ -260,8 +260,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -274,18 +274,18 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.286.0 h1:TdTXMvzYKnWV1/lPbCdbXRqBrkDqjPto22H2xeZZ8LI=
-google.golang.org/api v0.286.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ=
+google.golang.org/api v0.287.0 h1:CQDMqUiqZZ0U/Yge3zyjAhNQ0OSYEH0PaA7l4xtEen4=
+google.golang.org/api v0.287.0/go.mod h1:pPW85yt3Iuc3unkpaMhFtMmOqnTdCwCqEOaUlnuxRlQ=
 google.golang.org/appengine/v2 v2.0.6 h1:LvPZLGuchSBslPBp+LAhihBeGSiRh1myRoYK4NtuBIw=
 google.golang.org/appengine/v2 v2.0.6/go.mod h1:WoEXGoXNfa0mLvaH5sV3ZSGXwVmy8yf7Z1JKf3J3wLI=
-google.golang.org/genproto v0.0.0-20260622175928-b703f567277d h1:CP5omUq8AJTiWMrPKM1WRLJ7zZeXd9OPcQD3TbBNAyY=
-google.golang.org/genproto v0.0.0-20260622175928-b703f567277d/go.mod h1:DrwuGJgFSEVNpv3S5Q5VxhRTvdnjauw9GtvwVOEARfA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d h1:xr2lwHI91bn3UiXcnyzRMQjp2LRiM8wEHzwUaE0YhTs=
-google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d/go.mod h1:O0ZOWSrfWfJ+Z5HbwZ+wNtHsg/vk1k2C/w67eww8PfQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d h1:mpAgMyM9vQHxycBlDq50y1VHpfSfVwzXvrQKtYbXuUY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto v0.0.0-20260630182238-925bb5da69e7 h1:lQG76ePMKmtujel4VIVMiFoHVWVNtJdawbCZJtWlVXU=
+google.golang.org/genproto v0.0.0-20260630182238-925bb5da69e7/go.mod h1:LwlOWYBU335L+sR55UuR5fbbU8KmEX+3tUHf3SwMmhM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

server/errors.go

@@ -136,8 +136,9 @@ var (
 	errHTTPBadRequestTemplateMessageTooLarge         = &errHTTP{40041, http.StatusBadRequest, "invalid request: message or title is too large after replacing template", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestTemplateMessageNotJSON          = &errHTTP{40042, http.StatusBadRequest, "invalid request: message body must be JSON if templating is enabled", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestTemplateInvalid                 = &errHTTP{40043, http.StatusBadRequest, "invalid request: could not parse template", "https://ntfy.sh/docs/publish/#message-templating", nil}
-	errHTTPBadRequestTemplateDisallowedFunctionCalls = &errHTTP{40044, http.StatusBadRequest, "invalid request: template contains disallowed function calls, e.g. template, call, or define", "https://ntfy.sh/docs/publish/#message-templating", nil}
+	errHTTPBadRequestTemplateDisallowedFunctionCalls = &errHTTP{40044, http.StatusBadRequest, "invalid request: template contains disallowed function calls, e.g. template, call, define, or block", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestTemplateExecuteFailed           = &errHTTP{40045, http.StatusBadRequest, "invalid request: template execution failed", "https://ntfy.sh/docs/publish/#message-templating", nil}
+	errHTTPBadRequestTemplateExecutionTimeout        = &errHTTP{40055, http.StatusBadRequest, "invalid request: template execution timed out", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestInvalidUsername                 = &errHTTP{40046, http.StatusBadRequest, "invalid request: invalid username", "", nil}
 	errHTTPBadRequestTemplateFileNotFound            = &errHTTP{40047, http.StatusBadRequest, "invalid request: template file not found", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestTemplateFileInvalid             = &errHTTP{40048, http.StatusBadRequest, "invalid request: template file invalid", "https://ntfy.sh/docs/publish/#message-templating", nil}

server/server.go

@@ -17,13 +17,11 @@ import (
 	"net/url"
 	"os"
 	"path"
-	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"sync"
-	"text/template"
 	"time"
 	"unicode/utf8"
 
@@ -31,7 +29,7 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"golang.org/x/sync/errgroup"
-	"gopkg.in/yaml.v2"
+	"heckel.io/ntfy/v2/action"
 	"heckel.io/ntfy/v2/attachment"
 	"heckel.io/ntfy/v2/db"
 	"heckel.io/ntfy/v2/db/pg"
@@ -42,7 +40,6 @@ import (
 	"heckel.io/ntfy/v2/payments"
 	"heckel.io/ntfy/v2/user"
 	"heckel.io/ntfy/v2/util"
-	"heckel.io/ntfy/v2/util/sprig"
 	"heckel.io/ntfy/v2/webpush"
 )
 
@@ -61,6 +58,7 @@ type Server struct {
 	topics            map[string]*topic
 	visitors          map[string]*visitor // ip:<ip> or user:<user>
 	firebaseClient    *firebaseClient
+	twilio            *twilioClient
 	messages          int64                               // Total number of messages (persisted if messageCache enabled)
 	messagesHistory   []int64                             // Last n values of the messages counter, used to determine rate
 	userManager       *user.Manager                       // Might be nil!
@@ -152,10 +150,12 @@ var (
 	templatesFs  embed.FS // Contains template config files (e.g. grafana.yml, github.yml, ...)
 	templatesDir = "templates"
 
-	// templateDisallowedRegex tests a template for disallowed expressions. While not really dangerous, they
-	// are not useful, and seem potentially troublesome.
-	templateDisallowedRegex = regexp.MustCompile(`(?m)\{\{-?\s*(call|template|define)\b`)
-	templateNameRegex       = regexp.MustCompile(`^[-_A-Za-z0-9]+$`)
+	templateNameRegex = regexp.MustCompile(`^[-_A-Za-z0-9]+$`)
+
+	// templateMaxExecutionTime is the wall-clock deadline for a single template render, a DoS guard
+	// (GHSA-rhwf-xgc9-m9fp). It is a var (not a const) solely so tests can raise it; it is never
+	// mutated in production.
+	templateMaxExecutionTime = 100 * time.Millisecond
 )
 
 const (
@@ -169,7 +169,6 @@ const (
 	unifiedPushTopicPrefix   = "up"                      // Temporarily, we rate limit all "up*" topics based on the subscriber
 	unifiedPushTopicLength   = 14                        // Length of UnifiedPush topics, including the "up" part
 	messagesHistoryMax       = 10                        // Number of message count values to keep in memory
-	templateMaxExecutionTime = 100 * time.Millisecond    // Maximum time a template can take to execute, used to prevent DoS attacks
 	templateMaxOutputBytes   = 1024 * 1024               // Maximum number of bytes a template can output, used to prevent DoS attacks
 	templateFileExtension    = ".yml"                    // Template files must end with this extension
 )
@@ -298,6 +297,7 @@ func New(conf *Config) (*Server, error) {
 		webPush:         wp,
 		attachment:      attachmentStore,
 		firebaseClient:  firebaseClient,
+		twilio:          newTwilioClient(conf, userManager),
 		mailer:          sender,
 		topics:          topics,
 		userManager:     userManager,
@@ -679,22 +679,6 @@ func (s *Server) handleInternal(w http.ResponseWriter, r *http.Request, v *visit
 	return errHTTPNotFound
 }
 
-// handleWebApp serves the embedded web app's index for client-side (SPA) routes that the
-// browser router resolves, so the app shell loads and the client-side router takes over.
-func (s *Server) handleWebApp(w http.ResponseWriter, r *http.Request, v *visitor) error {
-	r.URL.Path = webAppIndex
-	return s.handleStatic(w, r, v)
-}
-
-// handleWebAppNoIndex serves the web app index for the magic-link landing pages, whose path
-// carries a one-time token. The response is marked no-referrer (so the token can't leak to third
-// parties via the Referer header) and noindex (so it never gets indexed).
-func (s *Server) handleWebAppNoIndex(w http.ResponseWriter, r *http.Request, v *visitor) error {
-	w.Header().Set("Referrer-Policy", "no-referrer")
-	w.Header().Set("X-Robots-Tag", "noindex")
-	return s.handleWebApp(w, r, v)
-}
-
 func (s *Server) handleTopic(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	unifiedpush := readBoolParam(r, false, "x-unifiedpush", "unifiedpush", "up") // see PUT/POST too!
 	if unifiedpush {
@@ -721,61 +705,6 @@ func (s *Server) handleHealth(w http.ResponseWriter, _ *http.Request, _ *visitor
 	return s.writeJSON(w, response)
 }
 
-func (s *Server) handleConfig(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
-	w.Header().Set("Cache-Control", "no-cache")
-	return s.writeJSON(w, s.configResponse())
-}
-
-func (s *Server) handleWebConfig(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
-	b, err := json.MarshalIndent(s.configResponse(), "", "  ")
-	if err != nil {
-		return err
-	}
-	w.Header().Set("Content-Type", "text/javascript")
-	w.Header().Set("Cache-Control", "no-cache")
-	_, err = io.WriteString(w, fmt.Sprintf("// Generated server configuration\nvar config = %s;\n", string(b)))
-	return err
-}
-
-func (s *Server) configResponse() *apiConfigResponse {
-	return &apiConfigResponse{
-		BaseURL:             "", // Will translate to window.location.origin
-		AppRoot:             s.config.WebRoot,
-		EnableLogin:         s.config.EnableLogin,
-		RequireLogin:        s.config.RequireLogin,
-		EnableSignup:        s.config.EnableSignup,
-		EnablePayments:      s.config.StripeSecretKey != "",
-		EnableCalls:         s.config.TwilioAccount != "",
-		EnableEmails:        s.config.SMTPSenderFrom != "",
-		EnableResetPassword: s.config.SMTPSenderFrom != "" && s.config.BaseURL != "", // Reset links need SMTP + an absolute base-url
-		EnableReservations:  s.config.EnableReservations,
-		EnableWebPush:       s.config.WebPushPublicKey != "",
-		BillingContact:      s.config.BillingContact,
-		WebPushPublicKey:    s.config.WebPushPublicKey,
-		DisallowedTopics:    s.config.DisallowedTopics,
-		ConfigHash:          s.config.Hash(),
-	}
-}
-
-// handleWebManifest serves the web app manifest for the progressive web app (PWA)
-func (s *Server) handleWebManifest(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
-	response := &webManifestResponse{
-		Name:            "ntfy",
-		Description:     "ntfy lets you send push notifications via scripts from any computer or phone",
-		ShortName:       "ntfy",
-		Scope:           "/",
-		StartURL:        s.config.WebRoot,
-		Display:         "standalone",
-		BackgroundColor: "#ffffff",
-		ThemeColor:      "#317f6f",
-		Icons: []*webManifestIcon{
-			{SRC: "/static/images/pwa-192x192.png", Sizes: "192x192", Type: "image/png"},
-			{SRC: "/static/images/pwa-512x512.png", Sizes: "512x512", Type: "image/png"},
-		},
-	}
-	return s.writeJSONWithContentType(w, response, "application/manifest+json")
-}
-
 // handleMetrics returns Prometheus metrics. This endpoint is only called if enable-metrics is set,
 // and listen-metrics-http is not set.
 func (s *Server) handleMetrics(w http.ResponseWriter, r *http.Request, _ *visitor) error {
@@ -783,19 +712,6 @@ func (s *Server) handleMetrics(w http.ResponseWriter, r *http.Request, _ *visito
 	return nil
 }
 
-// handleStatic returns all static resources (excluding the docs), including the web app
-func (s *Server) handleStatic(w http.ResponseWriter, r *http.Request, _ *visitor) error {
-	r.URL.Path = webSiteDir + r.URL.Path
-	util.Gzip(http.FileServer(http.FS(webFsCached))).ServeHTTP(w, r)
-	return nil
-}
-
-// handleDocs returns static resources related to the docs
-func (s *Server) handleDocs(w http.ResponseWriter, r *http.Request, _ *visitor) error {
-	util.Gzip(http.FileServer(http.FS(docsStaticCached))).ServeHTTP(w, r)
-	return nil
-}
-
 // handleStats returns the publicly available server stats
 func (s *Server) handleStats(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
 	s.mu.RLock()
@@ -925,7 +841,7 @@ func (s *Server) handlePublishInternal(r *http.Request, v *visitor) (*model.Mess
 	}
 	if call != "" {
 		var httpErr *errHTTP
-		call, httpErr = s.convertPhoneNumber(v.User(), call)
+		call, httpErr = s.twilio.convertPhoneNumber(v.User(), call)
 		if httpErr != nil {
 			return nil, httpErr.With(t)
 		} else if !vrate.CallAllowed() {
@@ -974,7 +890,7 @@ func (s *Server) handlePublishInternal(r *http.Request, v *visitor) (*model.Mess
 			go s.sendEmail(v, m, email)
 		}
 		if s.config.TwilioAccount != "" && call != "" {
-			go s.callPhone(v, r, m, call)
+			go s.twilio.callPhone(v, r, m, call)
 		}
 		if s.config.UpstreamBaseURL != "" && !unifiedpush { // UP messages are not sent to upstream
 			go s.forwardPollRequest(v, m)
@@ -1283,7 +1199,7 @@ func (s *Server) parsePublishParams(r *http.Request, m *model.Message) (cache bo
 	}
 	actionsStr := readParam(r, "x-actions", "actions", "action")
 	if actionsStr != "" {
-		m.Actions, e = parseActions(actionsStr)
+		m.Actions, e = action.Parse(actionsStr)
 		if e != nil {
 			return false, false, "", "", "", false, "", errHTTPBadRequestActionsInvalid.Wrap("%s", e.Error())
 		}
@@ -1333,7 +1249,7 @@ func (s *Server) handlePublishBody(r *http.Request, v *visitor, m *model.Message
 	} else if m.Attachment != nil && m.Attachment.Name != "" {
 		return s.handleBodyAsAttachment(r, v, m, body) // Case 4
 	} else if template.Enabled() {
-		return s.handleBodyAsTemplatedTextMessage(m, template, body, priorityStr) // Case 5
+		return s.handleBodyAsTemplatedTextMessage(r.Context(), m, template, body, priorityStr) // Case 5
 	} else if !body.LimitReached && utf8.Valid(body.PeekedBytes) {
 		return s.handleBodyAsTextMessage(m, body) // Case 6
 	}
@@ -1369,114 +1285,6 @@ func (s *Server) handleBodyAsTextMessage(m *model.Message, body *util.PeekedRead
 	return nil
 }
 
-func (s *Server) handleBodyAsTemplatedTextMessage(m *model.Message, template templateMode, body *util.PeekedReadCloser, priorityStr string) error {
-	body, err := util.Peek(body, max(s.config.MessageSizeLimit, jsonBodyBytesLimit))
-	if err != nil {
-		return err
-	} else if body.LimitReached {
-		return errHTTPEntityTooLargeJSONBody
-	}
-	peekedBody := strings.TrimSpace(string(body.PeekedBytes))
-	if template.FileMode() {
-		if err := s.renderTemplateFromFile(m, template.FileName(), peekedBody); err != nil {
-			return err
-		}
-	} else {
-		if err := s.renderTemplateFromParams(m, peekedBody, priorityStr); err != nil {
-			return err
-		}
-	}
-	if len(m.Title) > s.config.MessageSizeLimit || len(m.Message) > s.config.MessageSizeLimit {
-		return errHTTPBadRequestTemplateMessageTooLarge
-	}
-	return nil
-}
-
-// renderTemplateFromFile transforms the JSON message body according to a template from the filesystem.
-// The template file must be in the templates directory, or in the configured template directory.
-func (s *Server) renderTemplateFromFile(m *model.Message, templateName, peekedBody string) error {
-	if !templateNameRegex.MatchString(templateName) {
-		return errHTTPBadRequestTemplateFileNotFound
-	}
-	templateContent, _ := templatesFs.ReadFile(filepath.Join(templatesDir, templateName+templateFileExtension)) // Read from the embedded filesystem first
-	if s.config.TemplateDir != "" {
-		if b, _ := os.ReadFile(filepath.Join(s.config.TemplateDir, templateName+templateFileExtension)); len(b) > 0 {
-			templateContent = b
-		}
-	}
-	if len(templateContent) == 0 {
-		return errHTTPBadRequestTemplateFileNotFound
-	}
-	var tpl templateFile
-	if err := yaml.Unmarshal(templateContent, &tpl); err != nil {
-		return errHTTPBadRequestTemplateFileInvalid
-	}
-	var err error
-	if tpl.Message != nil {
-		if m.Message, err = s.renderTemplate(templateName+" (message)", *tpl.Message, peekedBody); err != nil {
-			return err
-		}
-	}
-	if tpl.Title != nil {
-		if m.Title, err = s.renderTemplate(templateName+" (title)", *tpl.Title, peekedBody); err != nil {
-			return err
-		}
-	}
-	if tpl.Priority != nil {
-		renderedPriority, err := s.renderTemplate(templateName+" (priority)", *tpl.Priority, peekedBody)
-		if err != nil {
-			return err
-		}
-		if m.Priority, err = util.ParsePriority(renderedPriority); err != nil {
-			return errHTTPBadRequestPriorityInvalid
-		}
-	}
-	return nil
-}
-
-// renderTemplateFromParams transforms the JSON message body according to the inline template in the
-// message, title, and priority parameters.
-func (s *Server) renderTemplateFromParams(m *model.Message, peekedBody string, priorityStr string) error {
-	var err error
-	if m.Message, err = s.renderTemplate("priority query parameter", m.Message, peekedBody); err != nil {
-		return err
-	}
-	if m.Title, err = s.renderTemplate("title query parameter", m.Title, peekedBody); err != nil {
-		return err
-	}
-	if priorityStr != "" {
-		renderedPriority, err := s.renderTemplate("priority query parameter", priorityStr, peekedBody)
-		if err != nil {
-			return err
-		}
-		if m.Priority, err = util.ParsePriority(renderedPriority); err != nil {
-			return errHTTPBadRequestPriorityInvalid
-		}
-	}
-	return nil
-}
-
-// renderTemplate renders a template with the given JSON source data.
-func (s *Server) renderTemplate(name, tpl, source string) (string, error) {
-	if templateDisallowedRegex.MatchString(tpl) {
-		return "", errHTTPBadRequestTemplateDisallowedFunctionCalls
-	}
-	var data any
-	if err := json.Unmarshal([]byte(source), &data); err != nil {
-		return "", errHTTPBadRequestTemplateMessageNotJSON
-	}
-	t, err := template.New("").Funcs(sprig.TxtFuncMap()).Parse(tpl)
-	if err != nil {
-		return "", errHTTPBadRequestTemplateInvalid.Wrap("%s", err.Error())
-	}
-	var buf bytes.Buffer
-	limitWriter := util.NewLimitWriter(util.NewTimeoutWriter(&buf, templateMaxExecutionTime), util.NewFixedLimiter(templateMaxOutputBytes))
-	if err := t.Execute(limitWriter, data); err != nil {
-		return "", errHTTPBadRequestTemplateExecuteFailed.Wrap("template %s: %s", name, err.Error())
-	}
-	return strings.TrimSpace(strings.ReplaceAll(buf.String(), "\\n", "\n")), nil // replace any remaining "\n" (those outside of template curly braces) with newlines
-}
-
 func (s *Server) handleBodyAsAttachment(r *http.Request, v *visitor, m *model.Message, body *util.PeekedReadCloser) error {
 	if s.attachment == nil || s.config.BaseURL == "" {
 		return errHTTPBadRequestAttachmentsDisallowed.With(m)
@@ -2260,130 +2068,6 @@ func (s *Server) transformMatrixJSON(next handleFunc) handleFunc {
 	}
 }
 
-func (s *Server) authorizeTopicWrite(next handleFunc) handleFunc {
-	return s.authorizeTopic(next, user.PermissionWrite)
-}
-
-func (s *Server) authorizeTopicRead(next handleFunc) handleFunc {
-	return s.authorizeTopic(next, user.PermissionRead)
-}
-
-func (s *Server) authorizeTopic(next handleFunc, perm user.Permission) handleFunc {
-	return func(w http.ResponseWriter, r *http.Request, v *visitor) error {
-		if s.userManager == nil {
-			return next(w, r, v)
-		}
-		topics, _, err := s.topicsFromPath(v, r.URL.Path)
-		if err != nil {
-			return err
-		}
-		u := v.User()
-		for _, t := range topics {
-			if err := s.userManager.Authorize(u, t.ID, perm); err != nil {
-				logvr(v, r).With(t).Err(err).Debug("Access to topic %s not authorized", t.ID)
-				return errHTTPForbidden.With(t)
-			}
-		}
-		return next(w, r, v)
-	}
-}
-
-// maybeAuthenticate reads the "Authorization" header and will try to authenticate the user
-// if it is set.
-//
-//   - If auth-file is not configured, immediately return an IP-based visitor
-//   - If the header is not set or not supported (anything non-Basic and non-Bearer),
-//     an IP-based visitor is returned
-//   - If the header is set, authenticate will be called to check the username/password (Basic auth),
-//     or the token (Bearer auth), and read the user from the database
-//
-// This function will ALWAYS return a visitor, even if an error occurs (e.g. unauthorized), so
-// that subsequent logging calls still have a visitor context.
-func (s *Server) maybeAuthenticate(r *http.Request) (*visitor, error) {
-	// Read the "Authorization" header value and exit out early if it's not set
-	ip := extractIPAddress(r, s.config.BehindProxy, s.config.ProxyForwardedHeader, s.config.ProxyTrustedPrefixes)
-	vip := s.visitor(ip, nil)
-	if s.userManager == nil {
-		return vip, nil
-	}
-	header, err := readAuthHeader(r)
-	if err != nil {
-		return vip, err
-	} else if !supportedAuthHeader(header) {
-		return vip, nil
-	}
-	// If we're trying to auth, check the rate limiter first
-	if !vip.AuthAllowed() {
-		return vip, errHTTPTooManyRequestsLimitAuthFailure // Always return visitor, even when error occurs!
-	}
-	u, err := s.authenticate(r, header)
-	if err != nil {
-		vip.AuthFailed()
-		logr(r).Err(err).Debug("Authentication failed")
-		return vip, errHTTPUnauthorized // Always return visitor, even when error occurs!
-	}
-	// Authentication with user was successful
-	return s.visitor(ip, u), nil
-}
-
-// authenticate a user based on basic auth username/password (Authorization: Basic ...), or token auth (Authorization: Bearer ...).
-// The Authorization header can be passed as a header or the ?auth=... query param. The latter is required only to
-// support the WebSocket JavaScript class, which does not support passing headers during the initial request. The auth
-// query param is effectively doubly base64 encoded. Its format is base64(Basic base64(user:pass)).
-func (s *Server) authenticate(r *http.Request, header string) (user *user.User, err error) {
-	if strings.HasPrefix(header, "Bearer") {
-		return s.authenticateBearerAuth(r, strings.TrimSpace(strings.TrimPrefix(header, "Bearer")))
-	}
-	return s.authenticateBasicAuth(r, header)
-}
-
-// readAuthHeader reads the raw value of the Authorization header, either from the actual HTTP header,
-// or from the ?auth... query parameter
-func readAuthHeader(r *http.Request) (string, error) {
-	value := strings.TrimSpace(r.Header.Get("Authorization"))
-	queryParam := readQueryParam(r, "authorization", "auth")
-	if queryParam != "" {
-		a, err := base64.RawURLEncoding.DecodeString(queryParam)
-		if err != nil {
-			return "", err
-		}
-		value = strings.TrimSpace(string(a))
-	}
-	return value, nil
-}
-
-// supportedAuthHeader returns true only if the Authorization header value starts
-// with "Basic" or "Bearer". In particular, an empty value is not supported, and neither
-// are things like "WebPush", or "vapid" (see #629).
-func supportedAuthHeader(value string) bool {
-	value = strings.ToLower(value)
-	return strings.HasPrefix(value, "basic ") || strings.HasPrefix(value, "bearer ")
-}
-
-func (s *Server) authenticateBasicAuth(r *http.Request, value string) (user *user.User, err error) {
-	r.Header.Set("Authorization", value)
-	username, password, ok := r.BasicAuth()
-	if !ok {
-		return nil, errors.New("invalid basic auth")
-	} else if username == "" {
-		return s.authenticateBearerAuth(r, password) // Treat password as token
-	}
-	return s.userManager.Authenticate(username, password)
-}
-
-func (s *Server) authenticateBearerAuth(r *http.Request, token string) (*user.User, error) {
-	u, err := s.userManager.AuthenticateToken(token)
-	if err != nil {
-		return nil, err
-	}
-	ip := extractIPAddress(r, s.config.BehindProxy, s.config.ProxyForwardedHeader, s.config.ProxyTrustedPrefixes)
-	go s.userManager.EnqueueTokenUpdate(token, &user.TokenUpdate{
-		LastAccess: time.Now(),
-		LastOrigin: ip,
-	})
-	return u, nil
-}
-
 func (s *Server) visitor(ip netip.Addr, user *user.User) *visitor {
 	s.mu.Lock()
 	defer s.mu.Unlock()

server/server_account.go

@@ -107,6 +107,12 @@ func (s *Server) handleAccountGet(w http.ResponseWriter, r *http.Request, v *vis
 			if u.Prefs.Language != nil {
 				response.Language = *u.Prefs.Language
 			}
+			if u.Prefs.DateFormat != nil {
+				response.DateFormat = *u.Prefs.DateFormat
+			}
+			if u.Prefs.TimeFormat != nil {
+				response.TimeFormat = *u.Prefs.TimeFormat
+			}
 			if u.Prefs.Notification != nil {
 				response.Notification = u.Prefs.Notification
 			}
@@ -373,6 +379,12 @@ func (s *Server) handleAccountSettingsChange(w http.ResponseWriter, r *http.Requ
 	if newPrefs.Language != nil {
 		prefs.Language = newPrefs.Language
 	}
+	if newPrefs.DateFormat != nil {
+		prefs.DateFormat = newPrefs.DateFormat
+	}
+	if newPrefs.TimeFormat != nil {
+		prefs.TimeFormat = newPrefs.TimeFormat
+	}
 	if newPrefs.Notification != nil {
 		if prefs.Notification == nil {
 			prefs.Notification = &user.NotificationPrefs{}
@@ -601,7 +613,7 @@ func (s *Server) handleAccountPhoneNumberVerify(w http.ResponseWriter, r *http.R
 	}
 	// Actually add the unverified number, and send verification
 	logvr(v, r).Tag(tagAccount).Field("phone_number", req.Number).Debug("Sending phone number verification")
-	if err := s.verifyPhoneNumber(v, r, req.Number, req.Channel); err != nil {
+	if err := s.twilio.verifyPhoneNumber(v, r, req.Number, req.Channel); err != nil {
 		return err
 	}
 	return s.writeJSON(w, newSuccessResponse())
@@ -616,7 +628,7 @@ func (s *Server) handleAccountPhoneNumberAdd(w http.ResponseWriter, r *http.Requ
 	if !phoneNumberRegex.MatchString(req.Number) {
 		return errHTTPBadRequestPhoneNumberInvalid
 	}
-	if err := s.verifyPhoneNumberCheck(v, r, req.Number, req.Code); err != nil {
+	if err := s.twilio.verifyPhoneNumberCheck(v, r, req.Number, req.Code); err != nil {
 		return err
 	}
 	logvr(v, r).Tag(tagAccount).Field("phone_number", req.Number).Debug("Adding phone number as verified")

server/server_account_test.go

@@ -207,12 +207,19 @@ func TestAccount_ChangeSettings(t *testing.T) {
 		})
 		require.Equal(t, 200, rr.Code)
 
+		rr = request(t, s, "PATCH", "/v1/account/settings", `{"date_format": "iso8601", "time_format": "24h"}`, map[string]string{
+			"Authorization": util.BearerAuth(token.Value),
+		})
+		require.Equal(t, 200, rr.Code)
+
 		rr = request(t, s, "GET", "/v1/account", `{"username":"marian", "password":"marian"}`, map[string]string{
 			"Authorization": util.BearerAuth(token.Value),
 		})
 		require.Equal(t, 200, rr.Code)
 		account, _ := util.UnmarshalJSON[apiAccountResponse](io.NopCloser(rr.Body))
 		require.Equal(t, "de", account.Language)
+		require.Equal(t, "iso8601", account.DateFormat) // Merged, not overwritten by previous PATCH
+		require.Equal(t, "24h", account.TimeFormat)
 		require.Equal(t, util.Int(86400), account.Notification.DeleteAfter)
 		require.Equal(t, util.String("juntos"), account.Notification.Sound)
 		require.Nil(t, account.Notification.MinPriority) // Not set

server/server_auth.go

@@ -0,0 +1,107 @@
+package server
+
+import (
+	"encoding/base64"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"heckel.io/ntfy/v2/user"
+)
+
+// maybeAuthenticate reads the "Authorization" header and will try to authenticate the user
+// if it is set.
+//
+//   - If auth-file is not configured, immediately return an IP-based visitor
+//   - If the header is not set or not supported (anything non-Basic and non-Bearer),
+//     an IP-based visitor is returned
+//   - If the header is set, authenticate will be called to check the username/password (Basic auth),
+//     or the token (Bearer auth), and read the user from the database
+//
+// This function will ALWAYS return a visitor, even if an error occurs (e.g. unauthorized), so
+// that subsequent logging calls still have a visitor context.
+func (s *Server) maybeAuthenticate(r *http.Request) (*visitor, error) {
+	// Read the "Authorization" header value and exit out early if it's not set
+	ip := extractIPAddress(r, s.config.BehindProxy, s.config.ProxyForwardedHeader, s.config.ProxyTrustedPrefixes)
+	vip := s.visitor(ip, nil)
+	if s.userManager == nil {
+		return vip, nil
+	}
+	header, err := readAuthHeader(r)
+	if err != nil {
+		return vip, err
+	} else if !supportedAuthHeader(header) {
+		return vip, nil
+	}
+	// If we're trying to auth, check the rate limiter first
+	if !vip.AuthAllowed() {
+		return vip, errHTTPTooManyRequestsLimitAuthFailure // Always return visitor, even when error occurs!
+	}
+	u, err := s.authenticate(r, header)
+	if err != nil {
+		vip.AuthFailed()
+		logr(r).Err(err).Debug("Authentication failed")
+		return vip, errHTTPUnauthorized // Always return visitor, even when error occurs!
+	}
+	// Authentication with user was successful
+	return s.visitor(ip, u), nil
+}
+
+// authenticate a user based on basic auth username/password (Authorization: Basic ...), or token auth (Authorization: Bearer ...).
+// The Authorization header can be passed as a header or the ?auth=... query param. The latter is required only to
+// support the WebSocket JavaScript class, which does not support passing headers during the initial request. The auth
+// query param is effectively doubly base64 encoded. Its format is base64(Basic base64(user:pass)).
+func (s *Server) authenticate(r *http.Request, header string) (user *user.User, err error) {
+	if strings.HasPrefix(header, "Bearer") {
+		return s.authenticateBearerAuth(r, strings.TrimSpace(strings.TrimPrefix(header, "Bearer")))
+	}
+	return s.authenticateBasicAuth(r, header)
+}
+
+// readAuthHeader reads the raw value of the Authorization header, either from the actual HTTP header,
+// or from the ?auth... query parameter
+func readAuthHeader(r *http.Request) (string, error) {
+	value := strings.TrimSpace(r.Header.Get("Authorization"))
+	queryParam := readQueryParam(r, "authorization", "auth")
+	if queryParam != "" {
+		a, err := base64.RawURLEncoding.DecodeString(queryParam)
+		if err != nil {
+			return "", err
+		}
+		value = strings.TrimSpace(string(a))
+	}
+	return value, nil
+}
+
+// supportedAuthHeader returns true only if the Authorization header value starts
+// with "Basic" or "Bearer". In particular, an empty value is not supported, and neither
+// are things like "WebPush", or "vapid" (see #629).
+func supportedAuthHeader(value string) bool {
+	value = strings.ToLower(value)
+	return strings.HasPrefix(value, "basic ") || strings.HasPrefix(value, "bearer ")
+}
+
+func (s *Server) authenticateBasicAuth(r *http.Request, value string) (user *user.User, err error) {
+	r.Header.Set("Authorization", value)
+	username, password, ok := r.BasicAuth()
+	if !ok {
+		return nil, errors.New("invalid basic auth")
+	} else if username == "" {
+		return s.authenticateBearerAuth(r, password) // Treat password as token
+	}
+	return s.userManager.Authenticate(username, password)
+}
+
+func (s *Server) authenticateBearerAuth(r *http.Request, token string) (*user.User, error) {
+	u, err := s.userManager.AuthenticateToken(token)
+	if err != nil {
+		return nil, err
+	}
+	ip := extractIPAddress(r, s.config.BehindProxy, s.config.ProxyForwardedHeader, s.config.ProxyTrustedPrefixes)
+	go s.userManager.EnqueueTokenUpdate(token, &user.TokenUpdate{
+		LastAccess: time.Now(),
+		LastOrigin: ip,
+	})
+	return u, nil
+}

server/server_middleware.go

@@ -3,6 +3,7 @@ package server
 import (
 	"net/http"
 
+	"heckel.io/ntfy/v2/user"
 	"heckel.io/ntfy/v2/util"
 )
 
@@ -139,3 +140,31 @@ func (s *Server) withAccountSync(next handleFunc) handleFunc {
 		return err
 	}
 }
+
+func (s *Server) authorizeTopicWrite(next handleFunc) handleFunc {
+	return s.authorizeTopic(next, user.PermissionWrite)
+}
+
+func (s *Server) authorizeTopicRead(next handleFunc) handleFunc {
+	return s.authorizeTopic(next, user.PermissionRead)
+}
+
+func (s *Server) authorizeTopic(next handleFunc, perm user.Permission) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, v *visitor) error {
+		if s.userManager == nil {
+			return next(w, r, v)
+		}
+		topics, _, err := s.topicsFromPath(v, r.URL.Path)
+		if err != nil {
+			return err
+		}
+		u := v.User()
+		for _, t := range topics {
+			if err := s.userManager.Authorize(u, t.ID, perm); err != nil {
+				logvr(v, r).With(t).Err(err).Debug("Access to topic %s not authorized", t.ID)
+				return errHTTPForbidden.With(t)
+			}
+		}
+		return next(w, r, v)
+	}
+}

server/server_template.go

@@ -0,0 +1,190 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template/parse"
+
+	"gopkg.in/yaml.v2"
+	"heckel.io/ntfy/v2/model"
+	"heckel.io/ntfy/v2/template/gotext"
+	"heckel.io/ntfy/v2/util"
+	"heckel.io/ntfy/v2/util/sprig"
+)
+
+func (s *Server) handleBodyAsTemplatedTextMessage(ctx context.Context, m *model.Message, template templateMode, body *util.PeekedReadCloser, priorityStr string) error {
+	body, err := util.Peek(body, max(s.config.MessageSizeLimit, jsonBodyBytesLimit))
+	if err != nil {
+		return err
+	} else if body.LimitReached {
+		return errHTTPEntityTooLargeJSONBody
+	}
+	peekedBody := strings.TrimSpace(string(body.PeekedBytes))
+	if template.FileMode() {
+		if err := s.renderTemplateFromFile(ctx, m, template.FileName(), peekedBody); err != nil {
+			return err
+		}
+	} else {
+		if err := s.renderTemplateFromParams(ctx, m, peekedBody, priorityStr); err != nil {
+			return err
+		}
+	}
+	if len(m.Title) > s.config.MessageSizeLimit || len(m.Message) > s.config.MessageSizeLimit {
+		return errHTTPBadRequestTemplateMessageTooLarge
+	}
+	return nil
+}
+
+// renderTemplateFromFile transforms the JSON message body according to a template from the filesystem.
+// The template file must be in the templates directory, or in the configured template directory.
+func (s *Server) renderTemplateFromFile(ctx context.Context, m *model.Message, templateName, peekedBody string) error {
+	if !templateNameRegex.MatchString(templateName) {
+		return errHTTPBadRequestTemplateFileNotFound
+	}
+	templateContent, _ := templatesFs.ReadFile(filepath.Join(templatesDir, templateName+templateFileExtension)) // Read from the embedded filesystem first
+	if s.config.TemplateDir != "" {
+		if b, _ := os.ReadFile(filepath.Join(s.config.TemplateDir, templateName+templateFileExtension)); len(b) > 0 {
+			templateContent = b
+		}
+	}
+	if len(templateContent) == 0 {
+		return errHTTPBadRequestTemplateFileNotFound
+	}
+	var tpl templateFile
+	if err := yaml.Unmarshal(templateContent, &tpl); err != nil {
+		return errHTTPBadRequestTemplateFileInvalid
+	}
+	var err error
+	if tpl.Message != nil {
+		if m.Message, err = s.renderTemplate(ctx, templateName+" (message)", *tpl.Message, peekedBody); err != nil {
+			return err
+		}
+	}
+	if tpl.Title != nil {
+		if m.Title, err = s.renderTemplate(ctx, templateName+" (title)", *tpl.Title, peekedBody); err != nil {
+			return err
+		}
+	}
+	if tpl.Priority != nil {
+		renderedPriority, err := s.renderTemplate(ctx, templateName+" (priority)", *tpl.Priority, peekedBody)
+		if err != nil {
+			return err
+		}
+		if m.Priority, err = util.ParsePriority(renderedPriority); err != nil {
+			return errHTTPBadRequestPriorityInvalid
+		}
+	}
+	return nil
+}
+
+// renderTemplateFromParams transforms the JSON message body according to the inline template in the
+// message, title, and priority parameters.
+func (s *Server) renderTemplateFromParams(ctx context.Context, m *model.Message, peekedBody string, priorityStr string) error {
+	var err error
+	if m.Message, err = s.renderTemplate(ctx, "priority query parameter", m.Message, peekedBody); err != nil {
+		return err
+	}
+	if m.Title, err = s.renderTemplate(ctx, "title query parameter", m.Title, peekedBody); err != nil {
+		return err
+	}
+	if priorityStr != "" {
+		renderedPriority, err := s.renderTemplate(ctx, "priority query parameter", priorityStr, peekedBody)
+		if err != nil {
+			return err
+		}
+		if m.Priority, err = util.ParsePriority(renderedPriority); err != nil {
+			return errHTTPBadRequestPriorityInvalid
+		}
+	}
+	return nil
+}
+
+// renderTemplate renders a template with the given JSON source data.
+func (s *Server) renderTemplate(ctx context.Context, name, tpl, source string) (string, error) {
+	var data any
+	if err := json.Unmarshal([]byte(source), &data); err != nil {
+		return "", errHTTPBadRequestTemplateMessageNotJSON
+	}
+	t, err := gotext.New("").Funcs(sprig.TxtFuncMap()).Parse(tpl)
+	if err != nil {
+		return "", errHTTPBadRequestTemplateInvalid.Wrap("%s", err.Error())
+	}
+	if templateUsesDisallowedFeatures(t) {
+		return "", errHTTPBadRequestTemplateDisallowedFunctionCalls
+	}
+	// Bail out of runaway templates (GHSA-rhwf-xgc9-m9fp). The deadline starts here, after the body
+	// has already been read, so a slow upload is not counted against it. Deriving from the request
+	// context means a client disconnect aborts the render too.
+	execCtx, cancel := context.WithTimeout(ctx, templateMaxExecutionTime)
+	defer cancel()
+	var buf bytes.Buffer
+	limitWriter := util.NewLimitWriter(&buf, util.NewFixedLimiter(templateMaxOutputBytes))
+	if err := t.ExecuteContext(execCtx, limitWriter, data); err != nil {
+		if errors.Is(err, context.DeadlineExceeded) {
+			return "", errHTTPBadRequestTemplateExecutionTimeout
+		}
+		return "", errHTTPBadRequestTemplateExecuteFailed.Wrap("template %s: %s", name, err.Error())
+	}
+	return strings.TrimSpace(strings.ReplaceAll(buf.String(), "\\n", "\n")), nil // replace any remaining "\n" (those outside of template curly braces) with newlines
+}
+
+// templateUsesDisallowedFeatures reports whether the parsed template defines or invokes a
+// sub-template ({{define}}/{{block}}/{{template}}) or uses the {{call}} builtin. None are useful for
+// ntfy's JSON-data templates. Checking the parse tree (rather than the raw string) catches every
+// syntactic form -- e.g. {{if call .x}} or {{$y := call .x}} -- that a regex would miss.
+func templateUsesDisallowedFeatures(t *gotext.Template) bool {
+	if len(t.Templates()) > 1 { // {{define}}/{{block}} create additional associated templates
+		return true
+	}
+	return treeContainsDisallowedNode(t.Root)
+}
+
+// treeContainsDisallowedNode reports whether the parse tree contains a {{template}}/{{block}}
+// invocation or a {{call}} builtin, descending into pipes and command arguments (where {{call}} can
+// appear anywhere a function is allowed).
+func treeContainsDisallowedNode(node parse.Node) bool {
+	switch n := node.(type) {
+	case *parse.ListNode:
+		if n == nil {
+			return false
+		}
+		for _, child := range n.Nodes {
+			if treeContainsDisallowedNode(child) {
+				return true
+			}
+		}
+	case *parse.ActionNode:
+		return treeContainsDisallowedNode(n.Pipe)
+	case *parse.RangeNode:
+		return treeContainsDisallowedNode(n.Pipe) || treeContainsDisallowedNode(n.List) || treeContainsDisallowedNode(n.ElseList)
+	case *parse.IfNode:
+		return treeContainsDisallowedNode(n.Pipe) || treeContainsDisallowedNode(n.List) || treeContainsDisallowedNode(n.ElseList)
+	case *parse.WithNode:
+		return treeContainsDisallowedNode(n.Pipe) || treeContainsDisallowedNode(n.List) || treeContainsDisallowedNode(n.ElseList)
+	case *parse.TemplateNode: // {{template}} or {{block}} invocation
+		return true
+	case *parse.PipeNode:
+		if n == nil {
+			return false
+		}
+		for _, cmd := range n.Cmds {
+			if treeContainsDisallowedNode(cmd) {
+				return true
+			}
+		}
+	case *parse.CommandNode:
+		for _, arg := range n.Args {
+			if treeContainsDisallowedNode(arg) {
+				return true
+			}
+		}
+	case *parse.IdentifierNode: // a function name; {{call}} is the disallowed builtin
+		return n.Ident == "call"
+	}
+	return false
+}

server/server_test.go

@@ -3635,6 +3635,184 @@ func TestServer_MessageTemplate_Range(t *testing.T) {
 	})
 }
 
+func TestServer_MessageTemplate_ExecutionTimeout(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		// Nested range over a 1000-element JSON field with a no-output body: no Write ever happens,
+		// so the write-triggered TimeoutWriter never fires. Must be bounded by the executor's
+		// wall-clock deadline instead (GHSA-rhwf-xgc9-m9fp).
+		elems := make([]string, 1000)
+		for i := range elems {
+			elems[i] = "0"
+		}
+		jsonBody := `{"a":[` + strings.Join(elems, ",") + `]}`
+		msg := `{{range .a}}{{range $.a}}` + strings.Repeat(`{{$x := .}}`, 100) + `{{end}}{{end}}done`
+		start := time.Now()
+		response := request(t, s, "POST", "/mytopic", jsonBody, map[string]string{
+			"X-Message":  msg,
+			"X-Template": "1",
+		})
+		elapsed := time.Since(start)
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40055, toHTTPError(t, response.Body.String()).Code)
+		require.Less(t, elapsed, 500*time.Millisecond, "template must be interrupted by the deadline, not run to completion (took %s)", elapsed)
+	})
+}
+
+// TestServer_MessageTemplate_DataDrivenNestedRange_TimesOut is the regression for the exact hole the
+// old write-triggered TimeoutWriter missed: a nested {{range}} over a JSON array field with a
+// no-output body calls no function, so only the executor's wall-clock deadline can stop it
+// (GHSA-rhwf-xgc9-m9fp).
+func TestServer_MessageTemplate_DataDrivenNestedRange_TimesOut(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		elems := make([]string, 1000)
+		for i := range elems {
+			elems[i] = "0"
+		}
+		jsonBody := `{"a":[` + strings.Join(elems, ",") + `]}`
+		msg := `{{range .a}}{{range $.a}}{{range $.a}}{{$x := .}}{{end}}{{end}}{{end}}done`
+		start := time.Now()
+		response := request(t, s, "POST", "/mytopic", jsonBody, map[string]string{
+			"X-Message":  msg,
+			"X-Template": "1",
+		})
+		elapsed := time.Since(start)
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40055, toHTTPError(t, response.Body.String()).Code)
+		require.Less(t, elapsed, 500*time.Millisecond, "data-driven nested range should be cut off by the deadline (took %s)", elapsed)
+	})
+}
+
+// TestServer_MessageTemplate_ExpensiveFunctionLoop_TimesOut ensures the deadline also bounds loops
+// whose body calls an expensive function (hashing a large string), where a single call between
+// deadline checks could otherwise overshoot (GHSA-rhwf-xgc9-m9fp).
+func TestServer_MessageTemplate_ExpensiveFunctionLoop_TimesOut(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		msg := `{{$big := repeat 990 "0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789"}}{{range until 1000}}{{range until 1000}}{{$h := sha512sum $big}}{{end}}{{end}}`
+		start := time.Now()
+		response := request(t, s, "POST", "/mytopic", `{}`, map[string]string{
+			"X-Message":  msg,
+			"X-Template": "1",
+		})
+		elapsed := time.Since(start)
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40055, toHTTPError(t, response.Body.String()).Code)
+		require.Less(t, elapsed, 1500*time.Millisecond, "expensive-function loop should be cut off by the deadline (took %s)", elapsed)
+	})
+}
+
+// TestServer_MessageTemplate_NestedLoopPoC_TimesOut is the exact proof-of-concept from the advisory:
+// a range over a runtime-computed slice, nested, must be bounded by the deadline (GHSA-rhwf-xgc9-m9fp).
+func TestServer_MessageTemplate_NestedLoopPoC_TimesOut(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		start := time.Now()
+		response := request(t, s, "POST", "/mytopic", `{}`, map[string]string{
+			"X-Message":  `{{$x := until 10000}}{{range $x}}{{range $x}}{{end}}{{end}}done`,
+			"X-Template": "1",
+		})
+		elapsed := time.Since(start)
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40055, toHTTPError(t, response.Body.String()).Code)
+		require.Less(t, elapsed, 500*time.Millisecond, "advisory PoC should be cut off by the deadline (took %s)", elapsed)
+	})
+}
+
+func TestServer_MessageTemplate_GenuineError_NotTimeout(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		// A real runtime error (len of an int) must map to execute-failed, not the timeout code.
+		response := request(t, s, "POST", "/mytopic", `{}`, map[string]string{
+			"X-Message":  `{{ len 5 }}`,
+			"X-Template": "1",
+		})
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40045, toHTTPError(t, response.Body.String()).Code)
+	})
+}
+
+// slowBody delivers its data after a delay, simulating a slow client upload of the request body.
+type slowBody struct {
+	data  []byte
+	delay time.Duration
+	done  bool
+}
+
+func (b *slowBody) Read(p []byte) (int, error) {
+	if b.done {
+		return 0, io.EOF
+	}
+	time.Sleep(b.delay)
+	n := copy(p, b.data)
+	b.done = true
+	return n, nil
+}
+
+func (b *slowBody) Close() error { return nil }
+
+// TestServer_MessageTemplate_SlowUpload_NotCountedAgainstDeadline verifies that a slow request-body
+// upload does not consume the template execution deadline: the body is fully read (util.Peek)
+// before the deadline starts, so a trivial template still renders even when the upload alone took
+// longer than the deadline (GHSA-rhwf-xgc9-m9fp).
+func TestServer_MessageTemplate_SlowUpload_NotCountedAgainstDeadline(t *testing.T) {
+	s := newTestServer(t, newTestConfig(t, ""))
+	start := time.Now()
+	// The template runs in ~1ms, far under the deadline, so on correct code it renders fine; the
+	// point is that the deadline starts at execution, not when the (slow) upload began.
+	response := request(t, s, "POST", "/mytopic", `{"foo":"bar"}`, map[string]string{
+		"Template":  "yes",
+		"X-Message": `{{range until 5000}}{{$x := .}}{{end}}hello {{.foo}}`,
+	}, func(r *http.Request) {
+		r.Body = &slowBody{data: []byte(`{"foo":"bar"}`), delay: 3 * templateMaxExecutionTime}
+	})
+	elapsed := time.Since(start)
+	require.Greater(t, elapsed, templateMaxExecutionTime, "the slow upload must outlast the exec deadline for this test to be meaningful")
+	require.Equal(t, 200, response.Code) // Would be 40055 if upload time counted against the deadline
+	m := toMessage(t, response.Body.String())
+	require.Equal(t, "hello bar", m.Message)
+}
+
+// TestServer_MessageTemplate_ClientDisconnect_CancelsRender verifies that canceling the request
+// context (e.g. the client disconnecting) aborts an in-progress template render. The execution
+// deadline is raised well above the cancel delay for this test so that cancellation -- not the
+// deadline -- is what stops the render: a runaway template is canceled 500ms in and must abort
+// shortly after (well under the raised deadline), yielding the generic execute-failed code (40045),
+// not the timeout code (40055).
+//
+// Not parallel: it temporarily raises the package-global templateMaxExecutionTime. Non-parallel
+// tests run in their own phase (parallel tests are paused), so the override is race-free.
+func TestServer_MessageTemplate_ClientDisconnect_CancelsRender(t *testing.T) {
+	origDeadline := templateMaxExecutionTime
+	templateMaxExecutionTime = 30 * time.Second // large enough that only the cancel can stop the render
+	defer func() { templateMaxExecutionTime = origDeadline }()
+
+	s := newTestServer(t, newTestConfig(t, ""))
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(500 * time.Millisecond)
+		cancel()
+	}()
+	start := time.Now()
+	response := request(t, s, "POST", "/mytopic", `{}`, map[string]string{
+		"X-Message":  `{{$x := until 10000}}{{range $x}}{{range $x}}{{end}}{{end}}done`,
+		"X-Template": "1",
+	}, func(r *http.Request) {
+		*r = *r.WithContext(ctx)
+	})
+	elapsed := time.Since(start)
+	require.Equal(t, 400, response.Code)
+	require.Equal(t, 40045, toHTTPError(t, response.Body.String()).Code, "a canceled render should map to execute-failed, not the timeout code 40055")
+	require.Greater(t, elapsed, 500*time.Millisecond, "render must still be running when the cancel fires (took %s)", elapsed)
+	require.Less(t, elapsed, 700*time.Millisecond, "request-context cancel should abort the render promptly after firing (took %s)", elapsed)
+}
+
 func TestServer_MessageTemplate_ExceedMessageSize_TemplatedMessageOK(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		t.Parallel()
@@ -3729,11 +3907,18 @@ func TestServer_MessageTemplate_DisallowedCalls(t *testing.T) {
 			`{{- template ""}}`,
 			`{{-
 template ""}}`,
-			`{{      call abc}}`,
-			`{{      define "aa"}}`,
-			`We cannot {{define "aa"}}`,
+			`{{ call "aa"}}`,
+			`{{define "aa"}}hi{{end}}`,
+			`We cannot {{define "aa"}}hi{{end}}`,
 			`We cannot {{ call "aa"}}`,
 			`We cannot {{- template "aa"}}`,
+			`{{block "aa" .}}hi{{end}}`,
+			`We cannot {{- block "aa" .}}hi{{end}}`,
+			// call is a function, not a keyword, so it can hide in non-leading positions that a
+			// raw-string regex misses -- the parse-tree walk catches all of them.
+			`{{if call .x}}x{{end}}`,
+			`{{$y := call .x}}`,
+			`{{index (call .x) 0}}`,
 		}
 		for _, disallowedTemplate := range disallowedTemplates {
 			messageTemplate := disallowedTemplate

server/server_twilio.go

@@ -16,6 +16,21 @@ import (
 	"heckel.io/ntfy/v2/util"
 )
 
+// twilioClient talks to the Twilio API to make phone calls (for the "Call" feature) and to verify
+// phone numbers. It holds the Twilio configuration and the user manager (used to look up a user's
+// verified phone numbers), so that this functionality is decoupled from the main Server.
+type twilioClient struct {
+	config      *Config
+	userManager *user.Manager // May be nil!
+}
+
+func newTwilioClient(conf *Config, userManager *user.Manager) *twilioClient {
+	return &twilioClient{
+		config:      conf,
+		userManager: userManager,
+	}
+}
+
 // defaultTwilioCallFormatTemplate is the default TwiML template used for Twilio calls.
 // It can be overridden in the server configuration's twilio-call-format field.
 //
@@ -52,11 +67,11 @@ type twilioCallData struct {
 // convertPhoneNumber checks if the given phone number is verified for the given user, and if so, returns the verified
 // phone number. It also converts a boolean string ("yes", "1", "true") to the first verified phone number.
 // If the user is anonymous, it will return an error.
-func (s *Server) convertPhoneNumber(u *user.User, phoneNumber string) (string, *errHTTP) {
+func (c *twilioClient) convertPhoneNumber(u *user.User, phoneNumber string) (string, *errHTTP) {
 	if u == nil {
 		return "", errHTTPBadRequestAnonymousCallsNotAllowed
 	}
-	phoneNumbers, err := s.userManager.PhoneNumbers(u.ID)
+	phoneNumbers, err := c.userManager.PhoneNumbers(u.ID)
 	if err != nil {
 		return "", errHTTPInternalError
 	} else if len(phoneNumbers) == 0 {
@@ -67,24 +82,19 @@ func (s *Server) convertPhoneNumber(u *user.User, phoneNumber string) (string, *
 	} else if util.Contains(phoneNumbers, phoneNumber) {
 		return phoneNumber, nil
 	}
-	for _, p := range phoneNumbers {
-		if p == phoneNumber {
-			return phoneNumber, nil
-		}
-	}
 	return "", errHTTPBadRequestPhoneNumberNotVerified
 }
 
 // callPhone calls the Twilio API to make a phone call to the given phone number, using the given message.
 // Failures will be logged, but not returned to the caller.
-func (s *Server) callPhone(v *visitor, r *http.Request, m *model.Message, to string) {
+func (c *twilioClient) callPhone(v *visitor, r *http.Request, m *model.Message, to string) {
 	u, sender := v.User(), m.Sender.String()
 	if u != nil {
 		sender = u.Name
 	}
 	tmpl := defaultTwilioCallFormatTemplate
-	if s.config.TwilioCallFormat != nil {
-		tmpl = s.config.TwilioCallFormat
+	if c.config.TwilioCallFormat != nil {
+		tmpl = c.config.TwilioCallFormat
 	}
 	tags := make([]string, len(m.Tags))
 	for i, tag := range m.Tags {
@@ -106,11 +116,11 @@ func (s *Server) callPhone(v *visitor, r *http.Request, m *model.Message, to str
 	}
 	body := bodyBuf.String()
 	data := url.Values{}
-	data.Set("From", s.config.TwilioPhoneNumber)
+	data.Set("From", c.config.TwilioPhoneNumber)
 	data.Set("To", to)
 	data.Set("Twiml", body)
 	ev := logvrm(v, r, m).Tag(tagTwilio).Field("twilio_to", to).FieldIf("twilio_body", body, log.TraceLevel).Debug("Sending Twilio request")
-	response, err := s.callPhoneInternal(data)
+	response, err := c.callPhoneInternal(data)
 	if err != nil {
 		ev.Field("twilio_response", response).Err(err).Warn("Error sending Twilio request")
 		minc(metricCallsMadeFailure)
@@ -120,15 +130,15 @@ func (s *Server) callPhone(v *visitor, r *http.Request, m *model.Message, to str
 	minc(metricCallsMadeSuccess)
 }
 
-func (s *Server) callPhoneInternal(data url.Values) (string, error) {
-	requestURL := fmt.Sprintf("%s/2010-04-01/Accounts/%s/Calls.json", s.config.TwilioCallsBaseURL, s.config.TwilioAccount)
+func (c *twilioClient) callPhoneInternal(data url.Values) (string, error) {
+	requestURL := fmt.Sprintf("%s/2010-04-01/Accounts/%s/Calls.json", c.config.TwilioCallsBaseURL, c.config.TwilioAccount)
 	req, err := http.NewRequest(http.MethodPost, requestURL, strings.NewReader(data.Encode()))
 	if err != nil {
 		return "", err
 	}
-	req.Header.Set("User-Agent", "ntfy/"+s.config.BuildVersion)
+	req.Header.Set("User-Agent", "ntfy/"+c.config.BuildVersion)
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", util.BasicAuth(s.config.TwilioAccount, s.config.TwilioAuthToken))
+	req.Header.Set("Authorization", util.BasicAuth(c.config.TwilioAccount, c.config.TwilioAuthToken))
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return "", err
@@ -140,19 +150,19 @@ func (s *Server) callPhoneInternal(data url.Values) (string, error) {
 	return string(response), nil
 }
 
-func (s *Server) verifyPhoneNumber(v *visitor, r *http.Request, phoneNumber, channel string) error {
+func (c *twilioClient) verifyPhoneNumber(v *visitor, r *http.Request, phoneNumber, channel string) error {
 	ev := logvr(v, r).Tag(tagTwilio).Field("twilio_to", phoneNumber).Field("twilio_channel", channel).Debug("Sending phone verification")
 	data := url.Values{}
 	data.Set("To", phoneNumber)
 	data.Set("Channel", channel)
-	requestURL := fmt.Sprintf("%s/v2/Services/%s/Verifications", s.config.TwilioVerifyBaseURL, s.config.TwilioVerifyService)
+	requestURL := fmt.Sprintf("%s/v2/Services/%s/Verifications", c.config.TwilioVerifyBaseURL, c.config.TwilioVerifyService)
 	req, err := http.NewRequest(http.MethodPost, requestURL, strings.NewReader(data.Encode()))
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", "ntfy/"+s.config.BuildVersion)
+	req.Header.Set("User-Agent", "ntfy/"+c.config.BuildVersion)
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", util.BasicAuth(s.config.TwilioAccount, s.config.TwilioAuthToken))
+	req.Header.Set("Authorization", util.BasicAuth(c.config.TwilioAccount, c.config.TwilioAuthToken))
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return err
@@ -166,19 +176,19 @@ func (s *Server) verifyPhoneNumber(v *visitor, r *http.Request, phoneNumber, cha
 	return nil
 }
 
-func (s *Server) verifyPhoneNumberCheck(v *visitor, r *http.Request, phoneNumber, code string) error {
+func (c *twilioClient) verifyPhoneNumberCheck(v *visitor, r *http.Request, phoneNumber, code string) error {
 	ev := logvr(v, r).Tag(tagTwilio).Field("twilio_to", phoneNumber).Debug("Checking phone verification")
 	data := url.Values{}
 	data.Set("To", phoneNumber)
 	data.Set("Code", code)
-	requestURL := fmt.Sprintf("%s/v2/Services/%s/VerificationCheck", s.config.TwilioVerifyBaseURL, s.config.TwilioVerifyService)
+	requestURL := fmt.Sprintf("%s/v2/Services/%s/VerificationCheck", c.config.TwilioVerifyBaseURL, c.config.TwilioVerifyService)
 	req, err := http.NewRequest(http.MethodPost, requestURL, strings.NewReader(data.Encode()))
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", "ntfy/"+s.config.BuildVersion)
+	req.Header.Set("User-Agent", "ntfy/"+c.config.BuildVersion)
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", util.BasicAuth(s.config.TwilioAccount, s.config.TwilioAuthToken))
+	req.Header.Set("Authorization", util.BasicAuth(c.config.TwilioAccount, c.config.TwilioAuthToken))
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return err

server/server_web.go

@@ -0,0 +1,94 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"heckel.io/ntfy/v2/util"
+)
+
+// handleWebApp serves the embedded web app's index for client-side (SPA) routes that the
+// browser router resolves, so the app shell loads and the client-side router takes over.
+func (s *Server) handleWebApp(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	r.URL.Path = webAppIndex
+	return s.handleStatic(w, r, v)
+}
+
+// handleWebAppNoIndex serves the web app index for the magic-link landing pages, whose path
+// carries a one-time token. The response is marked no-referrer (so the token can't leak to third
+// parties via the Referer header) and noindex (so it never gets indexed).
+func (s *Server) handleWebAppNoIndex(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	w.Header().Set("Referrer-Policy", "no-referrer")
+	w.Header().Set("X-Robots-Tag", "noindex")
+	return s.handleWebApp(w, r, v)
+}
+
+func (s *Server) handleConfig(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
+	w.Header().Set("Cache-Control", "no-cache")
+	return s.writeJSON(w, s.configResponse())
+}
+
+func (s *Server) handleWebConfig(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
+	b, err := json.MarshalIndent(s.configResponse(), "", "  ")
+	if err != nil {
+		return err
+	}
+	w.Header().Set("Content-Type", "text/javascript")
+	w.Header().Set("Cache-Control", "no-cache")
+	_, err = io.WriteString(w, fmt.Sprintf("// Generated server configuration\nvar config = %s;\n", string(b)))
+	return err
+}
+
+// handleWebManifest serves the web app manifest for the progressive web app (PWA)
+func (s *Server) handleWebManifest(w http.ResponseWriter, _ *http.Request, _ *visitor) error {
+	response := &webManifestResponse{
+		Name:            "ntfy",
+		Description:     "ntfy lets you send push notifications via scripts from any computer or phone",
+		ShortName:       "ntfy",
+		Scope:           "/",
+		StartURL:        s.config.WebRoot,
+		Display:         "standalone",
+		BackgroundColor: "#ffffff",
+		ThemeColor:      "#317f6f",
+		Icons: []*webManifestIcon{
+			{SRC: "/static/images/pwa-192x192.png", Sizes: "192x192", Type: "image/png"},
+			{SRC: "/static/images/pwa-512x512.png", Sizes: "512x512", Type: "image/png"},
+		},
+	}
+	return s.writeJSONWithContentType(w, response, "application/manifest+json")
+}
+
+// handleStatic returns all static resources (excluding the docs), including the web app
+func (s *Server) handleStatic(w http.ResponseWriter, r *http.Request, _ *visitor) error {
+	r.URL.Path = webSiteDir + r.URL.Path
+	util.Gzip(http.FileServer(http.FS(webFsCached))).ServeHTTP(w, r)
+	return nil
+}
+
+// handleDocs returns static resources related to the docs
+func (s *Server) handleDocs(w http.ResponseWriter, r *http.Request, _ *visitor) error {
+	util.Gzip(http.FileServer(http.FS(docsStaticCached))).ServeHTTP(w, r)
+	return nil
+}
+
+func (s *Server) configResponse() *apiConfigResponse {
+	return &apiConfigResponse{
+		BaseURL:             "", // Will translate to window.location.origin
+		AppRoot:             s.config.WebRoot,
+		EnableLogin:         s.config.EnableLogin,
+		RequireLogin:        s.config.RequireLogin,
+		EnableSignup:        s.config.EnableSignup,
+		EnablePayments:      s.config.StripeSecretKey != "",
+		EnableCalls:         s.config.TwilioAccount != "",
+		EnableEmails:        s.config.SMTPSenderFrom != "",
+		EnableResetPassword: s.config.SMTPSenderFrom != "" && s.config.BaseURL != "", // Reset links need SMTP + an absolute base-url
+		EnableReservations:  s.config.EnableReservations,
+		EnableWebPush:       s.config.WebPushPublicKey != "",
+		BillingContact:      s.config.BillingContact,
+		WebPushPublicKey:    s.config.WebPushPublicKey,
+		DisallowedTopics:    s.config.DisallowedTopics,
+		ConfigHash:          s.config.Hash(),
+	}
+}

server/types.go

@@ -312,6 +312,8 @@ type apiAccountResponse struct {
 	SyncTopic     string                     `json:"sync_topic,omitempty"`
 	Provisioned   bool                       `json:"provisioned,omitempty"`
 	Language      string                     `json:"language,omitempty"`
+	DateFormat    string                     `json:"date_format,omitempty"`
+	TimeFormat    string                     `json:"time_format,omitempty"`
 	Notification  *user.NotificationPrefs    `json:"notification,omitempty"`
 	Subscriptions []*user.Subscription       `json:"subscriptions,omitempty"`
 	Reservations  []*apiAccountReservation   `json:"reservations,omitempty"`

template/gotext/GENERATED_FROM

@@ -0,0 +1 @@
+go1.26.5

template/gotext/README.md

@@ -0,0 +1,109 @@
+# `template/gotext/` -- vendored `text/template` with context cancellation
+
+This directory is a **verbatim copy of Go's standard-library `text/template` package**, plus one
+small patch that adds context-aware execution (`ExecuteContext`). It exists for exactly one reason:
+to stop **user-supplied** message templates (`Template: yes`, see the [templating docs](https://ntfy.sh/docs/publish/#message-templating))
+from burning CPU.
+
+- **Source:** Go stdlib `text/template` (+ `internal/fmtsort`), `$(go env GOROOT)/src`
+- **Version:** pinned in the repo-root [`.go-version`](../../.go-version); recorded in `GENERATED_FROM`
+- **Local modifications:** `patches/` (see [The patch](#the-patch))
+- **Update mechanism:** Manual -- `make update-template`, then commit (never autorolled; see [Updating](#updating-when-bumping-the-go-toolchain))
+
+## Why this exists
+
+ntfy lets users send a Go template that is rendered against a JSON body. Go's `text/template`
+**cannot be interrupted mid-execution** -- there is no context, no deadline, no cancellation
+([golang/go#31107](https://github.com/golang/go/issues/31107) proposed `ExecuteContext` but was
+declined, over a bundled context-*values* feature, not cancellation itself). So a crafted template
+with a tight or nested `{{range}}` (e.g. ranging over a large JSON array with a big loop body that
+writes no output) can run for tens of seconds on a single request. That is a CPU denial of service
+(GHSA-rhwf-xgc9-m9fp).
+
+There is no way to add an interrupt from the outside -- the executor's per-node `walk` loop is
+unexported. The only robust fix is to patch the executor itself. Rather than reach for fragile
+heuristics (guessing iteration counts, wrapping every function, etc.), we vendor the package and add
+the cancellation half of #31107 as a patch: `ExecuteContext(ctx, ...)` that aborts with `ctx.Err()`
+when `ctx` is canceled or its deadline passes. The check is a **single poll inside `walk`** of an
+atomic flag that a `context.AfterFunc` watcher flips -- so it bounds CPU for *any* template shape
+(cheap loops and expensive functions alike), it is exact (observed within one node), and it adds no
+measurable overhead. If #31107's cancellation half ever lands upstream, this fork can be deleted and
+the call site keeps compiling unchanged.
+
+The one user-facing execution site (`server/server_template.go` `renderTemplate`) wraps execution in
+`context.WithTimeout` and calls `ExecuteContext`, mapping `context.DeadlineExceeded` to a `400`.
+Trusted templates (operator config: Twilio, `cmd/serve.go`) keep using the standard library -- they
+are not user-supplied.
+
+## What's here
+
+| File | Origin |
+|------|--------|
+| `*.go` (`exec.go`, `funcs.go`, `template.go`, `option.go`, `helper.go`, `doc.go`) | verbatim from `$(go env GOROOT)/src/text/template/`, enumerated with `go list` so files added/removed upstream are picked up automatically |
+| `fmtsort/sort.go` | verbatim from `$(go env GOROOT)/src/internal/fmtsort/` -- `exec.go` needs it, and `internal/...` packages can't be imported from outside GOROOT, so it comes along |
+| `patches/0001-exec-context.patch` | our only real change (see below) |
+| `GENERATED_FROM` | the exact Go version `make update-template` last regenerated this copy from; provenance, written by that target |
+
+The Go toolchain version this copy is pinned to lives in the repo-root [`.go-version`](../../.go-version)
+file (the single source of truth, also consumed by CI and the `make` targets below). `GENERATED_FROM`
+must equal it -- `make check` fails otherwise (see below).
+
+We do **not** vendor `text/template/parse` -- it's a normal importable stdlib package and stays a
+plain import.
+
+## The patch
+
+`patches/` is a quilt-style ordered series (apply `0001-*`, then `0002-*`, ...). Today there is just
+`0001-exec-context.patch` -- small, purely additive, and touching only `exec.go`:
+
+- adds `ctx context.Context` and a shared `cancelled *atomic.Bool` to the executor `state`
+- adds `ExecuteContext` / `ExecuteTemplateContext`; `Execute` / `ExecuteTemplate` become
+  `context.Background()` wrappers, so their behavior and cost are unchanged
+- when `ctx.Done() != nil`, arms one `context.AfterFunc` watcher that flips the flag; `walk` polls it
+  per node and aborts via a `cancelError` that `errRecover` strips to the bare `ctx.Err()`
+  (`errors.Is(err, context.DeadlineExceeded)`)
+
+The flag is a `*atomic.Bool` (not a value) because `walkTemplate` copies `state` for nested
+`{{template}}` invocations; a shared pointer keeps one flag across all copies and avoids `go vet`
+copylocks. `template.go` is unchanged -- the context is per-call, not stored on the `Template`.
+
+Two *mechanical* transforms are applied by `make update-template` with `sed`, **not** the patch --
+renaming the package to `gotext`, and rewriting the `internal/fmtsort` import to
+`heckel.io/ntfy/v2/template/gotext/fmtsort`. Keeping them out of the patch means they apply to
+whatever files `go list` returns, so they survive upstream files being added or removed. (These two
+transforms are also the only difference between our patch and the upstream `text/template` diff.)
+
+Keeping the patch tiny (cancellation only, on one stable file) is deliberate: it makes re-basing
+onto a new Go release cheap.
+
+## Updating (when bumping the Go toolchain)
+
+The copy is **pinned to the Go version in the root `.go-version`**, so it's not frozen -- re-syncing
+on a Go bump pulls in all upstream fixes for free. `.go-version` is authoritative and hand-edited; to
+bump the toolchain: edit `.go-version`, install that toolchain
+(`go install golang.org/dl/<version>@latest && <version> download`), then re-sync:
+
+```
+make update-template   # copies the files from your GOROOT and re-applies patches/*.patch
+```
+
+`make update-template` **errors** unless your local Go matches `.go-version` -- it validates against
+the pin, it never writes it. If the patch hunks no longer apply against the new release, refresh the
+patch as part of the bump.
+
+`make template-check` (wired into `make check`) has two layers:
+
+1. **Marker check (ungated, runs on any toolchain):** fails if `GENERATED_FROM` != `.go-version`, i.e.
+   someone bumped the pin but forgot `make update-template` (or vice versa). This catches the common
+   mistake locally, on any developer's Go.
+2. **Content check (gated to the pinned Go):** re-derives the copy from `GOROOT + patches` and diffs it
+   against what's committed, catching hand-edits and patch problems. It no-ops on a non-pinned
+   toolchain so it never fails spuriously.
+
+CI installs exactly `.go-version` (`go-version-file`), so both layers run there. `make release`
+additionally refuses to run off the pinned Go, so the content check is never skipped for a release.
+
+## License
+
+These files are copyright The Go Authors, under the BSD-3-Clause license (headers preserved in each
+file). That is compatible with ntfy's Apache-2.0 / GPLv2 licensing.

template/gotext/doc.go

@@ -0,0 +1,502 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+/*
+Package template implements data-driven templates for generating textual output.
+
+To generate HTML output, see [html/template], which has the same interface
+as this package but automatically secures HTML output against certain attacks.
+
+Templates are executed by applying them to a data structure. Annotations in the
+template refer to elements of the data structure (typically a field of a struct
+or a key in a map) to control execution and derive values to be displayed.
+Execution of the template walks the structure and sets the cursor, represented
+by a period '.' and called "dot", to the value at the current location in the
+structure as execution proceeds.
+
+The security model used by this package assumes that template authors are
+trusted. The package does not auto-escape output, so injecting code into
+a template can lead to arbitrary code execution if the template is executed
+by an untrusted source.
+
+The input text for a template is UTF-8-encoded text in any format.
+"Actions"--data evaluations or control structures--are delimited by
+"{{" and "}}"; all text outside actions is copied to the output unchanged.
+
+Once parsed, a template may be executed safely in parallel, although if parallel
+executions share a Writer the output may be interleaved.
+
+Here is a trivial example that prints "17 items are made of wool".
+
+	type Inventory struct {
+		Material string
+		Count    uint
+	}
+	sweaters := Inventory{"wool", 17}
+	tmpl, err := template.New("test").Parse("{{.Count}} items are made of {{.Material}}")
+	if err != nil { panic(err) }
+	err = tmpl.Execute(os.Stdout, sweaters)
+	if err != nil { panic(err) }
+
+More intricate examples appear below.
+
+Text and spaces
+
+By default, all text between actions is copied verbatim when the template is
+executed. For example, the string " items are made of " in the example above
+appears on standard output when the program is run.
+
+However, to aid in formatting template source code, if an action's left
+delimiter (by default "{{") is followed immediately by a minus sign and white
+space, all trailing white space is trimmed from the immediately preceding text.
+Similarly, if the right delimiter ("}}") is preceded by white space and a minus
+sign, all leading white space is trimmed from the immediately following text.
+In these trim markers, the white space must be present:
+"{{- 3}}" is like "{{3}}" but trims the immediately preceding text, while
+"{{-3}}" parses as an action containing the number -3.
+
+For instance, when executing the template whose source is
+
+	"{{23 -}} < {{- 45}}"
+
+the generated output would be
+
+	"23<45"
+
+For this trimming, the definition of white space characters is the same as in Go:
+space, horizontal tab, carriage return, and newline.
+
+Actions
+
+Here is the list of actions. "Arguments" and "pipelines" are evaluations of
+data, defined in detail in the corresponding sections that follow.
+
+*/
+//	{{/* a comment */}}
+//	{{- /* a comment with white space trimmed from preceding and following text */ -}}
+//		A comment; discarded. May contain newlines.
+//		Comments do not nest and must start and end at the
+//		delimiters, as shown here.
+/*
+
+	{{pipeline}}
+		The default textual representation (the same as would be
+		printed by fmt.Print) of the value of the pipeline is copied
+		to the output.
+
+	{{if pipeline}} T1 {{end}}
+		If the value of the pipeline is empty, no output is generated;
+		otherwise, T1 is executed. The empty values are false, 0, any
+		nil pointer or interface value, and any array, slice, map, or
+		string of length zero.
+		Dot is unaffected.
+
+	{{if pipeline}} T1 {{else}} T0 {{end}}
+		If the value of the pipeline is empty, T0 is executed;
+		otherwise, T1 is executed. Dot is unaffected.
+
+	{{if pipeline}} T1 {{else if pipeline}} T0 {{end}}
+		To simplify the appearance of if-else chains, the else action
+		of an if may include another if directly; the effect is exactly
+		the same as writing
+			{{if pipeline}} T1 {{else}}{{if pipeline}} T0 {{end}}{{end}}
+
+	{{range pipeline}} T1 {{end}}
+		The value of the pipeline must be an array, slice, map, iter.Seq,
+		iter.Seq2, integer or channel.
+		If the value of the pipeline has length zero, nothing is output;
+		otherwise, dot is set to the successive elements of the array,
+		slice, or map and T1 is executed. If the value is a map and the
+		keys are of basic type with a defined order, the elements will be
+		visited in sorted key order.
+
+	{{range pipeline}} T1 {{else}} T0 {{end}}
+		The value of the pipeline must be an array, slice, map, iter.Seq,
+		iter.Seq2, integer or channel.
+		If the value of the pipeline has length zero, dot is unaffected and
+		T0 is executed; otherwise, dot is set to the successive elements
+		of the array, slice, or map and T1 is executed.
+
+	{{break}}
+		The innermost {{range pipeline}} loop is ended early, stopping the
+		current iteration and bypassing all remaining iterations.
+
+	{{continue}}
+		The current iteration of the innermost {{range pipeline}} loop is
+		stopped, and the loop starts the next iteration.
+
+	{{template "name"}}
+		The template with the specified name is executed with nil data.
+
+	{{template "name" pipeline}}
+		The template with the specified name is executed with dot set
+		to the value of the pipeline.
+
+	{{block "name" pipeline}} T1 {{end}}
+		A block is shorthand for defining a template
+			{{define "name"}} T1 {{end}}
+		and then executing it in place
+			{{template "name" pipeline}}
+		The typical use is to define a set of root templates that are
+		then customized by redefining the block templates within.
+
+	{{with pipeline}} T1 {{end}}
+		If the value of the pipeline is empty, no output is generated;
+		otherwise, dot is set to the value of the pipeline and T1 is
+		executed.
+
+	{{with pipeline}} T1 {{else}} T0 {{end}}
+		If the value of the pipeline is empty, dot is unaffected and T0
+		is executed; otherwise, dot is set to the value of the pipeline
+		and T1 is executed.
+
+	{{with pipeline}} T1 {{else with pipeline}} T0 {{end}}
+		To simplify the appearance of with-else chains, the else action
+		of a with may include another with directly; the effect is exactly
+		the same as writing
+			{{with pipeline}} T1 {{else}}{{with pipeline}} T0 {{end}}{{end}}
+
+
+Arguments
+
+An argument is a simple value, denoted by one of the following.
+
+	- A boolean, string, character, integer, floating-point, imaginary
+	  or complex constant in Go syntax. These behave like Go's untyped
+	  constants. Note that, as in Go, whether a large integer constant
+	  overflows when assigned or passed to a function can depend on whether
+	  the host machine's ints are 32 or 64 bits.
+	- The keyword nil, representing an untyped Go nil.
+	- The character '.' (period):
+
+		.
+
+	  The result is the value of dot.
+	- A variable name, which is a (possibly empty) alphanumeric string
+	  preceded by a dollar sign, such as
+
+		$piOver2
+
+	  or
+
+		$
+
+	  The result is the value of the variable.
+	  Variables are described below.
+	- The name of a field of the data, which must be a struct, preceded
+	  by a period, such as
+
+		.Field
+
+	  The result is the value of the field. Field invocations may be
+	  chained:
+
+	    .Field1.Field2
+
+	  Fields can also be evaluated on variables, including chaining:
+
+	    $x.Field1.Field2
+	- The name of a key of the data, which must be a map, preceded
+	  by a period, such as
+
+		.Key
+
+	  The result is the map element value indexed by the key.
+	  Key invocations may be chained and combined with fields to any
+	  depth:
+
+	    .Field1.Key1.Field2.Key2
+
+	  Although the key must be an alphanumeric identifier, unlike with
+	  field names they do not need to start with an upper case letter.
+	  Keys can also be evaluated on variables, including chaining:
+
+	    $x.key1.key2
+	- The name of a niladic method of the data, preceded by a period,
+	  such as
+
+		.Method
+
+	  The result is the value of invoking the method with dot as the
+	  receiver, dot.Method(). Such a method must have one return value (of
+	  any type) or two return values, the second of which is an error.
+	  If it has two and the returned error is non-nil, execution terminates
+	  and an error is returned to the caller as the value of Execute.
+	  Method invocations may be chained and combined with fields and keys
+	  to any depth:
+
+	    .Field1.Key1.Method1.Field2.Key2.Method2
+
+	  Methods can also be evaluated on variables, including chaining:
+
+	    $x.Method1.Field
+	- The name of a niladic function, such as
+
+		fun
+
+	  The result is the value of invoking the function, fun(). The return
+	  types and values behave as in methods. Functions and function
+	  names are described below.
+	- A parenthesized instance of one the above, for grouping. The result
+	  may be accessed by a field or map key invocation.
+
+		print (.F1 arg1) (.F2 arg2)
+		(.StructValuedMethod "arg").Field
+
+Arguments may evaluate to any type; if they are pointers the implementation
+automatically indirects to the base type when required.
+If an evaluation yields a function value, such as a function-valued
+field of a struct, the function is not invoked automatically, but it
+can be used as a truth value for an if action and the like. To invoke
+it, use the call function, defined below.
+
+Pipelines
+
+A pipeline is a possibly chained sequence of "commands". A command is a simple
+value (argument) or a function or method call, possibly with multiple arguments:
+
+	Argument
+		The result is the value of evaluating the argument.
+	.Method [Argument...]
+		The method can be alone or the last element of a chain but,
+		unlike methods in the middle of a chain, it can take arguments.
+		The result is the value of calling the method with the
+		arguments:
+			dot.Method(Argument1, etc.)
+	functionName [Argument...]
+		The result is the value of calling the function associated
+		with the name:
+			function(Argument1, etc.)
+		Functions and function names are described below.
+
+A pipeline may be "chained" by separating a sequence of commands with pipeline
+characters '|'. In a chained pipeline, the result of each command is
+passed as the last argument of the following command. The output of the final
+command in the pipeline is the value of the pipeline.
+
+The output of a command will be either one value or two values, the second of
+which has type error. If that second value is present and evaluates to
+non-nil, execution terminates and the error is returned to the caller of
+Execute.
+
+Variables
+
+A pipeline inside an action may initialize a variable to capture the result.
+The initialization has syntax
+
+	$variable := pipeline
+
+where $variable is the name of the variable. An action that declares a
+variable produces no output.
+
+Variables previously declared can also be assigned, using the syntax
+
+	$variable = pipeline
+
+If a "range" action initializes a variable, the variable is set to the
+successive elements of the iteration. Also, a "range" may declare two
+variables, separated by a comma:
+
+	range $index, $element := pipeline
+
+in which case $index and $element are set to the successive values of the
+array/slice index or map key and element, respectively. Note that if there is
+only one variable, it is assigned the element; this is opposite to the
+convention in Go range clauses.
+
+A variable's scope extends to the "end" action of the control structure ("if",
+"with", or "range") in which it is declared, or to the end of the template if
+there is no such control structure. A template invocation does not inherit
+variables from the point of its invocation.
+
+When execution begins, $ is set to the data argument passed to Execute, that is,
+to the starting value of dot.
+
+Examples
+
+Here are some example one-line templates demonstrating pipelines and variables.
+All produce the quoted word "output":
+
+	{{"\"output\""}}
+		A string constant.
+	{{`"output"`}}
+		A raw string constant.
+	{{printf "%q" "output"}}
+		A function call.
+	{{"output" | printf "%q"}}
+		A function call whose final argument comes from the previous
+		command.
+	{{printf "%q" (print "out" "put")}}
+		A parenthesized argument.
+	{{"put" | printf "%s%s" "out" | printf "%q"}}
+		A more elaborate call.
+	{{"output" | printf "%s" | printf "%q"}}
+		A longer chain.
+	{{with "output"}}{{printf "%q" .}}{{end}}
+		A with action using dot.
+	{{with $x := "output" | printf "%q"}}{{$x}}{{end}}
+		A with action that creates and uses a variable.
+	{{with $x := "output"}}{{printf "%q" $x}}{{end}}
+		A with action that uses the variable in another action.
+	{{with $x := "output"}}{{$x | printf "%q"}}{{end}}
+		The same, but pipelined.
+
+Functions
+
+During execution functions are found in two function maps: first in the
+template, then in the global function map. By default, no functions are defined
+in the template but the Funcs method can be used to add them.
+
+Predefined global functions are named as follows.
+
+	and
+		Returns the boolean AND of its arguments by returning the
+		first empty argument or the last argument. That is,
+		"and x y" behaves as "if x then y else x."
+		Evaluation proceeds through the arguments left to right
+		and returns when the result is determined.
+	call
+		Returns the result of calling the first argument, which
+		must be a function, with the remaining arguments as parameters.
+		Thus "call .X.Y 1 2" is, in Go notation, dot.X.Y(1, 2) where
+		Y is a func-valued field, map entry, or the like.
+		The first argument must be the result of an evaluation
+		that yields a value of function type (as distinct from
+		a predefined function such as print). The function must
+		return either one or two result values, the second of which
+		is of type error. If the arguments don't match the function
+		or the returned error value is non-nil, execution stops.
+	html
+		Returns the escaped HTML equivalent of the textual
+		representation of its arguments. This function is unavailable
+		in html/template, with a few exceptions.
+	index
+		Returns the result of indexing its first argument by the
+		following arguments. Thus "index x 1 2 3" is, in Go syntax,
+		x[1][2][3]. Each indexed item must be a map, slice, or array.
+	slice
+		slice returns the result of slicing its first argument by the
+		remaining arguments. Thus "slice x 1 2" is, in Go syntax, x[1:2],
+		while "slice x" is x[:], "slice x 1" is x[1:], and "slice x 1 2 3"
+		is x[1:2:3]. The first argument must be a string, slice, or array.
+	js
+		Returns the escaped JavaScript equivalent of the textual
+		representation of its arguments.
+	len
+		Returns the integer length of its argument.
+	not
+		Returns the boolean negation of its single argument.
+	or
+		Returns the boolean OR of its arguments by returning the
+		first non-empty argument or the last argument, that is,
+		"or x y" behaves as "if x then x else y".
+		Evaluation proceeds through the arguments left to right
+		and returns when the result is determined.
+	print
+		An alias for fmt.Sprint
+	printf
+		An alias for fmt.Sprintf
+	println
+		An alias for fmt.Sprintln
+	urlquery
+		Returns the escaped value of the textual representation of
+		its arguments in a form suitable for embedding in a URL query.
+		This function is unavailable in html/template, with a few
+		exceptions.
+
+The boolean functions take any zero value to be false and a non-zero
+value to be true.
+
+There is also a set of binary comparison operators defined as
+functions:
+
+	eq
+		Returns the boolean truth of arg1 == arg2
+	ne
+		Returns the boolean truth of arg1 != arg2
+	lt
+		Returns the boolean truth of arg1 < arg2
+	le
+		Returns the boolean truth of arg1 <= arg2
+	gt
+		Returns the boolean truth of arg1 > arg2
+	ge
+		Returns the boolean truth of arg1 >= arg2
+
+For simpler multi-way equality tests, eq (only) accepts two or more
+arguments and compares the second and subsequent to the first,
+returning in effect
+
+	arg1==arg2 || arg1==arg3 || arg1==arg4 ...
+
+(Unlike with || in Go, however, eq is a function call and all the
+arguments will be evaluated.)
+
+The comparison functions work on any values whose type Go defines as
+comparable. For basic types such as integers, the rules are relaxed:
+size and exact type are ignored, so any integer value, signed or unsigned,
+may be compared with any other integer value. (The arithmetic value is compared,
+not the bit pattern, so all negative integers are less than all unsigned integers.)
+However, as usual, one may not compare an int with a float32 and so on.
+
+Associated templates
+
+Each template is named by a string specified when it is created. Also, each
+template is associated with zero or more other templates that it may invoke by
+name; such associations are transitive and form a name space of templates.
+
+A template may use a template invocation to instantiate another associated
+template; see the explanation of the "template" action above. The name must be
+that of a template associated with the template that contains the invocation.
+
+Nested template definitions
+
+When parsing a template, another template may be defined and associated with the
+template being parsed. Template definitions must appear at the top level of the
+template, much like global variables in a Go program.
+
+The syntax of such definitions is to surround each template declaration with a
+"define" and "end" action.
+
+The define action names the template being created by providing a string
+constant. Here is a simple example:
+
+	{{define "T1"}}ONE{{end}}
+	{{define "T2"}}TWO{{end}}
+	{{define "T3"}}{{template "T1"}} {{template "T2"}}{{end}}
+	{{template "T3"}}
+
+This defines two templates, T1 and T2, and a third T3 that invokes the other two
+when it is executed. Finally it invokes T3. If executed this template will
+produce the text
+
+	ONE TWO
+
+By construction, a template may reside in only one association. If it's
+necessary to have a template addressable from multiple associations, the
+template definition must be parsed multiple times to create distinct *Template
+values, or must be copied with [Template.Clone] or [Template.AddParseTree].
+
+Parse may be called multiple times to assemble the various associated templates;
+see [ParseFiles], [ParseGlob], [Template.ParseFiles] and [Template.ParseGlob]
+for simple ways to parse related templates stored in files.
+
+A template may be executed directly or through [Template.ExecuteTemplate], which executes
+an associated template identified by name. To invoke our example above, we
+might write,
+
+	err := tmpl.Execute(os.Stdout, "no data needed")
+	if err != nil {
+		log.Fatalf("execution failed: %s", err)
+	}
+
+or to invoke a particular template explicitly by name,
+
+	err := tmpl.ExecuteTemplate(os.Stdout, "T2", "no data needed")
+	if err != nil {
+		log.Fatalf("execution failed: %s", err)
+	}
+
+*/
+package gotext

template/gotext/fmtsort/sort.go

@@ -0,0 +1,154 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package fmtsort provides a general stable ordering mechanism
+// for maps, on behalf of the fmt and text/template packages.
+// It is not guaranteed to be efficient and works only for types
+// that are valid map keys.
+package fmtsort
+
+import (
+	"cmp"
+	"reflect"
+	"slices"
+)
+
+// Note: Throughout this package we avoid calling reflect.Value.Interface as
+// it is not always legal to do so and it's easier to avoid the issue than to face it.
+
+// SortedMap is a slice of KeyValue pairs that simplifies sorting
+// and iterating over map entries.
+//
+// Each KeyValue pair contains a map key and its corresponding value.
+type SortedMap []KeyValue
+
+// KeyValue holds a single key and value pair found in a map.
+type KeyValue struct {
+	Key, Value reflect.Value
+}
+
+// Sort accepts a map and returns a SortedMap that has the same keys and
+// values but in a stable sorted order according to the keys, modulo issues
+// raised by unorderable key values such as NaNs.
+//
+// The ordering rules are more general than with Go's < operator:
+//
+//   - when applicable, nil compares low
+//   - ints, floats, and strings order by <
+//   - NaN compares less than non-NaN floats
+//   - bool compares false before true
+//   - complex compares real, then imag
+//   - pointers compare by machine address
+//   - channel values compare by machine address
+//   - structs compare each field in turn
+//   - arrays compare each element in turn.
+//     Otherwise identical arrays compare by length.
+//   - interface values compare first by reflect.Type describing the concrete type
+//     and then by concrete value as described in the previous rules.
+func Sort(mapValue reflect.Value) SortedMap {
+	if mapValue.Type().Kind() != reflect.Map {
+		return nil
+	}
+	// Note: this code is arranged to not panic even in the presence
+	// of a concurrent map update. The runtime is responsible for
+	// yelling loudly if that happens. See issue 33275.
+	n := mapValue.Len()
+	sorted := make(SortedMap, 0, n)
+	iter := mapValue.MapRange()
+	for iter.Next() {
+		sorted = append(sorted, KeyValue{iter.Key(), iter.Value()})
+	}
+	slices.SortStableFunc(sorted, func(a, b KeyValue) int {
+		return compare(a.Key, b.Key)
+	})
+	return sorted
+}
+
+// compare compares two values of the same type. It returns -1, 0, 1
+// according to whether a > b (1), a == b (0), or a < b (-1).
+// If the types differ, it returns -1.
+// See the comment on Sort for the comparison rules.
+func compare(aVal, bVal reflect.Value) int {
+	aType, bType := aVal.Type(), bVal.Type()
+	if aType != bType {
+		return -1 // No good answer possible, but don't return 0: they're not equal.
+	}
+	switch aVal.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return cmp.Compare(aVal.Int(), bVal.Int())
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return cmp.Compare(aVal.Uint(), bVal.Uint())
+	case reflect.String:
+		return cmp.Compare(aVal.String(), bVal.String())
+	case reflect.Float32, reflect.Float64:
+		return cmp.Compare(aVal.Float(), bVal.Float())
+	case reflect.Complex64, reflect.Complex128:
+		a, b := aVal.Complex(), bVal.Complex()
+		if c := cmp.Compare(real(a), real(b)); c != 0 {
+			return c
+		}
+		return cmp.Compare(imag(a), imag(b))
+	case reflect.Bool:
+		a, b := aVal.Bool(), bVal.Bool()
+		switch {
+		case a == b:
+			return 0
+		case a:
+			return 1
+		default:
+			return -1
+		}
+	case reflect.Pointer, reflect.UnsafePointer:
+		return cmp.Compare(aVal.Pointer(), bVal.Pointer())
+	case reflect.Chan:
+		if c, ok := nilCompare(aVal, bVal); ok {
+			return c
+		}
+		return cmp.Compare(aVal.Pointer(), bVal.Pointer())
+	case reflect.Struct:
+		for i := 0; i < aVal.NumField(); i++ {
+			if c := compare(aVal.Field(i), bVal.Field(i)); c != 0 {
+				return c
+			}
+		}
+		return 0
+	case reflect.Array:
+		for i := 0; i < aVal.Len(); i++ {
+			if c := compare(aVal.Index(i), bVal.Index(i)); c != 0 {
+				return c
+			}
+		}
+		return 0
+	case reflect.Interface:
+		if c, ok := nilCompare(aVal, bVal); ok {
+			return c
+		}
+		c := compare(reflect.ValueOf(aVal.Elem().Type()), reflect.ValueOf(bVal.Elem().Type()))
+		if c != 0 {
+			return c
+		}
+		return compare(aVal.Elem(), bVal.Elem())
+	default:
+		// Certain types cannot appear as keys (maps, funcs, slices), but be explicit.
+		panic("bad type in compare: " + aType.String())
+	}
+}
+
+// nilCompare checks whether either value is nil. If not, the boolean is false.
+// If either value is nil, the boolean is true and the integer is the comparison
+// value. The comparison is defined to be 0 if both are nil, otherwise the one
+// nil value compares low. Both arguments must represent a chan, func,
+// interface, map, pointer, or slice.
+func nilCompare(aVal, bVal reflect.Value) (int, bool) {
+	if aVal.IsNil() {
+		if bVal.IsNil() {
+			return 0, true
+		}
+		return -1, true
+	}
+	if bVal.IsNil() {
+		return 1, true
+	}
+	return 0, false
+}

template/gotext/funcs.go

@@ -0,0 +1,774 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package gotext
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"reflect"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+)
+
+// FuncMap is the type of the map defining the mapping from names to functions.
+// Each function must have either a single return value, or two return values of
+// which the second has type error. In that case, if the second (error)
+// return value evaluates to non-nil during execution, execution terminates and
+// Execute returns that error.
+//
+// Errors returned by Execute wrap the underlying error; call [errors.AsType] to
+// unwrap them.
+//
+// When template execution invokes a function with an argument list, that list
+// must be assignable to the function's parameter types. Functions meant to
+// apply to arguments of arbitrary type can use parameters of type interface{} or
+// of type [reflect.Value]. Similarly, functions meant to return a result of arbitrary
+// type can return interface{} or [reflect.Value].
+type FuncMap map[string]any
+
+// builtins returns the FuncMap.
+// It is not a global variable so the linker can dead code eliminate
+// more when this isn't called. See golang.org/issue/36021.
+// TODO: revert this back to a global map once golang.org/issue/2559 is fixed.
+func builtins() FuncMap {
+	return FuncMap{
+		"and":      and,
+		"call":     emptyCall,
+		"html":     HTMLEscaper,
+		"index":    index,
+		"slice":    slice,
+		"js":       JSEscaper,
+		"len":      length,
+		"not":      not,
+		"or":       or,
+		"print":    fmt.Sprint,
+		"printf":   fmt.Sprintf,
+		"println":  fmt.Sprintln,
+		"urlquery": URLQueryEscaper,
+
+		// Comparisons
+		"eq": eq, // ==
+		"ge": ge, // >=
+		"gt": gt, // >
+		"le": le, // <=
+		"lt": lt, // <
+		"ne": ne, // !=
+	}
+}
+
+// builtinFuncs lazily computes & caches the builtinFuncs map.
+var builtinFuncs = sync.OnceValue(func() map[string]reflect.Value {
+	funcMap := builtins()
+	m := make(map[string]reflect.Value, len(funcMap))
+	addValueFuncs(m, funcMap)
+	return m
+})
+
+// addValueFuncs adds to values the functions in funcs, converting them to reflect.Values.
+func addValueFuncs(out map[string]reflect.Value, in FuncMap) {
+	for name, fn := range in {
+		if !goodName(name) {
+			panic(fmt.Errorf("function name %q is not a valid identifier", name))
+		}
+		v := reflect.ValueOf(fn)
+		if v.Kind() != reflect.Func {
+			panic("value for " + name + " not a function")
+		}
+		if err := goodFunc(name, v.Type()); err != nil {
+			panic(err)
+		}
+		out[name] = v
+	}
+}
+
+// addFuncs adds to values the functions in funcs. It does no checking of the input -
+// call addValueFuncs first.
+func addFuncs(out, in FuncMap) {
+	for name, fn := range in {
+		out[name] = fn
+	}
+}
+
+// goodFunc reports whether the function or method has the right result signature.
+func goodFunc(name string, typ reflect.Type) error {
+	// We allow functions with 1 result or 2 results where the second is an error.
+	switch numOut := typ.NumOut(); {
+	case numOut == 1:
+		return nil
+	case numOut == 2 && typ.Out(1) == errorType:
+		return nil
+	case numOut == 2:
+		return fmt.Errorf("invalid function signature for %s: second return value should be error; is %s", name, typ.Out(1))
+	default:
+		return fmt.Errorf("function %s has %d return values; should be 1 or 2", name, typ.NumOut())
+	}
+}
+
+// goodName reports whether the function name is a valid identifier.
+func goodName(name string) bool {
+	if name == "" {
+		return false
+	}
+	for i, r := range name {
+		switch {
+		case r == '_':
+		case i == 0 && !unicode.IsLetter(r):
+			return false
+		case !unicode.IsLetter(r) && !unicode.IsDigit(r):
+			return false
+		}
+	}
+	return true
+}
+
+// findFunction looks for a function in the template, and global map.
+func findFunction(name string, tmpl *Template) (v reflect.Value, isBuiltin, ok bool) {
+	if tmpl != nil && tmpl.common != nil {
+		tmpl.muFuncs.RLock()
+		defer tmpl.muFuncs.RUnlock()
+		if fn := tmpl.execFuncs[name]; fn.IsValid() {
+			return fn, false, true
+		}
+	}
+	if fn := builtinFuncs()[name]; fn.IsValid() {
+		return fn, true, true
+	}
+	return reflect.Value{}, false, false
+}
+
+// prepareArg checks if value can be used as an argument of type argType, and
+// converts an invalid value to appropriate zero if possible.
+func prepareArg(value reflect.Value, argType reflect.Type) (reflect.Value, error) {
+	if !value.IsValid() {
+		if !canBeNil(argType) {
+			return reflect.Value{}, fmt.Errorf("value is nil; should be of type %s", argType)
+		}
+		value = reflect.Zero(argType)
+	}
+	if value.Type().AssignableTo(argType) {
+		return value, nil
+	}
+	if intLike(value.Kind()) && intLike(argType.Kind()) && value.Type().ConvertibleTo(argType) {
+		value = value.Convert(argType)
+		return value, nil
+	}
+	return reflect.Value{}, fmt.Errorf("value has type %s; should be %s", value.Type(), argType)
+}
+
+func intLike(typ reflect.Kind) bool {
+	switch typ {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return true
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return true
+	}
+	return false
+}
+
+// indexArg checks if a reflect.Value can be used as an index, and converts it to int if possible.
+func indexArg(index reflect.Value, cap int) (int, error) {
+	var x int64
+	switch index.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		x = index.Int()
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		x = int64(index.Uint())
+	case reflect.Invalid:
+		return 0, fmt.Errorf("cannot index slice/array with nil")
+	default:
+		return 0, fmt.Errorf("cannot index slice/array with type %s", index.Type())
+	}
+	if x < 0 || int(x) < 0 || int(x) > cap {
+		return 0, fmt.Errorf("index out of range: %d", x)
+	}
+	return int(x), nil
+}
+
+// Indexing.
+
+// index returns the result of indexing its first argument by the following
+// arguments. Thus "index x 1 2 3" is, in Go syntax, x[1][2][3]. Each
+// indexed item must be a map, slice, or array.
+func index(item reflect.Value, indexes ...reflect.Value) (reflect.Value, error) {
+	item = indirectInterface(item)
+	if !item.IsValid() {
+		return reflect.Value{}, fmt.Errorf("index of untyped nil")
+	}
+	for _, index := range indexes {
+		index = indirectInterface(index)
+		var isNil bool
+		if item, isNil = indirect(item); isNil {
+			return reflect.Value{}, fmt.Errorf("index of nil pointer")
+		}
+		switch item.Kind() {
+		case reflect.Array, reflect.Slice, reflect.String:
+			x, err := indexArg(index, item.Len())
+			if err != nil {
+				return reflect.Value{}, err
+			}
+			item = item.Index(x)
+		case reflect.Map:
+			index, err := prepareArg(index, item.Type().Key())
+			if err != nil {
+				return reflect.Value{}, err
+			}
+			if x := item.MapIndex(index); x.IsValid() {
+				item = x
+			} else {
+				item = reflect.Zero(item.Type().Elem())
+			}
+		case reflect.Invalid:
+			// the loop holds invariant: item.IsValid()
+			panic("unreachable")
+		default:
+			return reflect.Value{}, fmt.Errorf("can't index item of type %s", item.Type())
+		}
+	}
+	return item, nil
+}
+
+// Slicing.
+
+// slice returns the result of slicing its first argument by the remaining
+// arguments. Thus "slice x 1 2" is, in Go syntax, x[1:2], while "slice x"
+// is x[:], "slice x 1" is x[1:], and "slice x 1 2 3" is x[1:2:3]. The first
+// argument must be a string, slice, or array.
+func slice(item reflect.Value, indexes ...reflect.Value) (reflect.Value, error) {
+	item = indirectInterface(item)
+	if !item.IsValid() {
+		return reflect.Value{}, fmt.Errorf("slice of untyped nil")
+	}
+	var isNil bool
+	if item, isNil = indirect(item); isNil {
+		return reflect.Value{}, fmt.Errorf("slice of nil pointer")
+	}
+	if len(indexes) > 3 {
+		return reflect.Value{}, fmt.Errorf("too many slice indexes: %d", len(indexes))
+	}
+	var cap int
+	switch item.Kind() {
+	case reflect.String:
+		if len(indexes) == 3 {
+			return reflect.Value{}, fmt.Errorf("cannot 3-index slice a string")
+		}
+		cap = item.Len()
+	case reflect.Array, reflect.Slice:
+		cap = item.Cap()
+	default:
+		return reflect.Value{}, fmt.Errorf("can't slice item of type %s", item.Type())
+	}
+	// set default values for cases item[:], item[i:].
+	idx := [3]int{0, item.Len()}
+	for i, index := range indexes {
+		x, err := indexArg(index, cap)
+		if err != nil {
+			return reflect.Value{}, err
+		}
+		idx[i] = x
+	}
+	// given item[i:j], make sure i <= j.
+	if idx[0] > idx[1] {
+		return reflect.Value{}, fmt.Errorf("invalid slice index: %d > %d", idx[0], idx[1])
+	}
+	if len(indexes) < 3 {
+		return item.Slice(idx[0], idx[1]), nil
+	}
+	// given item[i:j:k], make sure i <= j <= k.
+	if idx[1] > idx[2] {
+		return reflect.Value{}, fmt.Errorf("invalid slice index: %d > %d", idx[1], idx[2])
+	}
+	return item.Slice3(idx[0], idx[1], idx[2]), nil
+}
+
+// Length
+
+// length returns the length of the item, with an error if it has no defined length.
+func length(item reflect.Value) (int, error) {
+	item, isNil := indirect(item)
+	if isNil {
+		return 0, fmt.Errorf("len of nil pointer")
+	}
+	switch item.Kind() {
+	case reflect.Array, reflect.Chan, reflect.Map, reflect.Slice, reflect.String:
+		return item.Len(), nil
+	}
+	return 0, fmt.Errorf("len of type %s", item.Type())
+}
+
+// Function invocation
+
+func emptyCall(fn reflect.Value, args ...reflect.Value) reflect.Value {
+	panic("unreachable") // implemented as a special case in evalCall
+}
+
+// call returns the result of evaluating the first argument as a function.
+// The function must return 1 result, or 2 results, the second of which is an error.
+func call(name string, fn reflect.Value, args ...reflect.Value) (reflect.Value, error) {
+	fn = indirectInterface(fn)
+	if !fn.IsValid() {
+		return reflect.Value{}, fmt.Errorf("call of nil")
+	}
+	typ := fn.Type()
+	if typ.Kind() != reflect.Func {
+		return reflect.Value{}, fmt.Errorf("non-function %s of type %s", name, typ)
+	}
+
+	if err := goodFunc(name, typ); err != nil {
+		return reflect.Value{}, err
+	}
+	numIn := typ.NumIn()
+	var dddType reflect.Type
+	if typ.IsVariadic() {
+		if len(args) < numIn-1 {
+			return reflect.Value{}, fmt.Errorf("wrong number of args for %s: got %d want at least %d", name, len(args), numIn-1)
+		}
+		dddType = typ.In(numIn - 1).Elem()
+	} else {
+		if len(args) != numIn {
+			return reflect.Value{}, fmt.Errorf("wrong number of args for %s: got %d want %d", name, len(args), numIn)
+		}
+	}
+	argv := make([]reflect.Value, len(args))
+	for i, arg := range args {
+		arg = indirectInterface(arg)
+		// Compute the expected type. Clumsy because of variadics.
+		argType := dddType
+		if !typ.IsVariadic() || i < numIn-1 {
+			argType = typ.In(i)
+		}
+
+		var err error
+		if argv[i], err = prepareArg(arg, argType); err != nil {
+			return reflect.Value{}, fmt.Errorf("arg %d: %w", i, err)
+		}
+	}
+	return safeCall(fn, argv)
+}
+
+// safeCall runs fun.Call(args), and returns the resulting value and error, if
+// any. If the call panics, the panic value is returned as an error.
+func safeCall(fun reflect.Value, args []reflect.Value) (val reflect.Value, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if e, ok := r.(error); ok {
+				err = e
+			} else {
+				err = fmt.Errorf("%v", r)
+			}
+		}
+	}()
+	ret := fun.Call(args)
+	if len(ret) == 2 && !ret[1].IsNil() {
+		return ret[0], ret[1].Interface().(error)
+	}
+	return ret[0], nil
+}
+
+// Boolean logic.
+
+func truth(arg reflect.Value) bool {
+	t, _ := isTrue(indirectInterface(arg))
+	return t
+}
+
+// and computes the Boolean AND of its arguments, returning
+// the first false argument it encounters, or the last argument.
+func and(arg0 reflect.Value, args ...reflect.Value) reflect.Value {
+	panic("unreachable") // implemented as a special case in evalCall
+}
+
+// or computes the Boolean OR of its arguments, returning
+// the first true argument it encounters, or the last argument.
+func or(arg0 reflect.Value, args ...reflect.Value) reflect.Value {
+	panic("unreachable") // implemented as a special case in evalCall
+}
+
+// not returns the Boolean negation of its argument.
+func not(arg reflect.Value) bool {
+	return !truth(arg)
+}
+
+// Comparison.
+
+// TODO: Perhaps allow comparison between signed and unsigned integers.
+
+var (
+	errBadComparisonType = errors.New("invalid type for comparison")
+	errNoComparison      = errors.New("missing argument for comparison")
+)
+
+type kind int
+
+const (
+	invalidKind kind = iota
+	boolKind
+	complexKind
+	intKind
+	floatKind
+	stringKind
+	uintKind
+)
+
+func basicKind(v reflect.Value) (kind, error) {
+	switch v.Kind() {
+	case reflect.Bool:
+		return boolKind, nil
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return intKind, nil
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return uintKind, nil
+	case reflect.Float32, reflect.Float64:
+		return floatKind, nil
+	case reflect.Complex64, reflect.Complex128:
+		return complexKind, nil
+	case reflect.String:
+		return stringKind, nil
+	}
+	return invalidKind, errBadComparisonType
+}
+
+// isNil returns true if v is the zero reflect.Value, or nil of its type.
+func isNil(v reflect.Value) bool {
+	if !v.IsValid() {
+		return true
+	}
+	switch v.Kind() {
+	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Pointer, reflect.Slice:
+		return v.IsNil()
+	}
+	return false
+}
+
+// canCompare reports whether v1 and v2 are both the same kind, or one is nil.
+// Called only when dealing with nillable types, or there's about to be an error.
+func canCompare(v1, v2 reflect.Value) bool {
+	k1 := v1.Kind()
+	k2 := v2.Kind()
+	if k1 == k2 {
+		return true
+	}
+	// We know the type can be compared to nil.
+	return k1 == reflect.Invalid || k2 == reflect.Invalid
+}
+
+// eq evaluates the comparison a == b || a == c || ...
+func eq(arg1 reflect.Value, arg2 ...reflect.Value) (bool, error) {
+	arg1 = indirectInterface(arg1)
+	if len(arg2) == 0 {
+		return false, errNoComparison
+	}
+	k1, _ := basicKind(arg1)
+	for _, arg := range arg2 {
+		arg = indirectInterface(arg)
+		k2, _ := basicKind(arg)
+		truth := false
+		if k1 != k2 {
+			// Special case: Can compare integer values regardless of type's sign.
+			switch {
+			case k1 == intKind && k2 == uintKind:
+				truth = arg1.Int() >= 0 && uint64(arg1.Int()) == arg.Uint()
+			case k1 == uintKind && k2 == intKind:
+				truth = arg.Int() >= 0 && arg1.Uint() == uint64(arg.Int())
+			default:
+				if arg1.IsValid() && arg.IsValid() {
+					return false, fmt.Errorf("incompatible types for comparison: %v and %v", arg1.Type(), arg.Type())
+				}
+			}
+		} else {
+			switch k1 {
+			case boolKind:
+				truth = arg1.Bool() == arg.Bool()
+			case complexKind:
+				truth = arg1.Complex() == arg.Complex()
+			case floatKind:
+				truth = arg1.Float() == arg.Float()
+			case intKind:
+				truth = arg1.Int() == arg.Int()
+			case stringKind:
+				truth = arg1.String() == arg.String()
+			case uintKind:
+				truth = arg1.Uint() == arg.Uint()
+			default:
+				if !canCompare(arg1, arg) {
+					return false, fmt.Errorf("non-comparable types %s: %v, %s: %v", arg1, arg1.Type(), arg.Type(), arg)
+				}
+				if isNil(arg1) || isNil(arg) {
+					truth = isNil(arg) == isNil(arg1)
+				} else {
+					if !arg.Type().Comparable() {
+						return false, fmt.Errorf("non-comparable type %s: %v", arg, arg.Type())
+					}
+					truth = arg1.Interface() == arg.Interface()
+				}
+			}
+		}
+		if truth {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// ne evaluates the comparison a != b.
+func ne(arg1, arg2 reflect.Value) (bool, error) {
+	// != is the inverse of ==.
+	equal, err := eq(arg1, arg2)
+	return !equal, err
+}
+
+// lt evaluates the comparison a < b.
+func lt(arg1, arg2 reflect.Value) (bool, error) {
+	arg1 = indirectInterface(arg1)
+	k1, err := basicKind(arg1)
+	if err != nil {
+		return false, err
+	}
+	arg2 = indirectInterface(arg2)
+	k2, err := basicKind(arg2)
+	if err != nil {
+		return false, err
+	}
+	truth := false
+	if k1 != k2 {
+		// Special case: Can compare integer values regardless of type's sign.
+		switch {
+		case k1 == intKind && k2 == uintKind:
+			truth = arg1.Int() < 0 || uint64(arg1.Int()) < arg2.Uint()
+		case k1 == uintKind && k2 == intKind:
+			truth = arg2.Int() >= 0 && arg1.Uint() < uint64(arg2.Int())
+		default:
+			return false, fmt.Errorf("incompatible types for comparison: %v and %v", arg1.Type(), arg2.Type())
+		}
+	} else {
+		switch k1 {
+		case boolKind, complexKind:
+			return false, errBadComparisonType
+		case floatKind:
+			truth = arg1.Float() < arg2.Float()
+		case intKind:
+			truth = arg1.Int() < arg2.Int()
+		case stringKind:
+			truth = arg1.String() < arg2.String()
+		case uintKind:
+			truth = arg1.Uint() < arg2.Uint()
+		default:
+			panic("invalid kind")
+		}
+	}
+	return truth, nil
+}
+
+// le evaluates the comparison <= b.
+func le(arg1, arg2 reflect.Value) (bool, error) {
+	// <= is < or ==.
+	lessThan, err := lt(arg1, arg2)
+	if lessThan || err != nil {
+		return lessThan, err
+	}
+	return eq(arg1, arg2)
+}
+
+// gt evaluates the comparison a > b.
+func gt(arg1, arg2 reflect.Value) (bool, error) {
+	// > is the inverse of <=.
+	lessOrEqual, err := le(arg1, arg2)
+	if err != nil {
+		return false, err
+	}
+	return !lessOrEqual, nil
+}
+
+// ge evaluates the comparison a >= b.
+func ge(arg1, arg2 reflect.Value) (bool, error) {
+	// >= is the inverse of <.
+	lessThan, err := lt(arg1, arg2)
+	if err != nil {
+		return false, err
+	}
+	return !lessThan, nil
+}
+
+// HTML escaping.
+
+var (
+	htmlQuot = []byte("&#34;") // shorter than "&quot;"
+	htmlApos = []byte("&#39;") // shorter than "&apos;" and apos was not in HTML until HTML5
+	htmlAmp  = []byte("&amp;")
+	htmlLt   = []byte("&lt;")
+	htmlGt   = []byte("&gt;")
+	htmlNull = []byte("\uFFFD")
+)
+
+// HTMLEscape writes to w the escaped HTML equivalent of the plain text data b.
+func HTMLEscape(w io.Writer, b []byte) {
+	last := 0
+	for i, c := range b {
+		var html []byte
+		switch c {
+		case '\000':
+			html = htmlNull
+		case '"':
+			html = htmlQuot
+		case '\'':
+			html = htmlApos
+		case '&':
+			html = htmlAmp
+		case '<':
+			html = htmlLt
+		case '>':
+			html = htmlGt
+		default:
+			continue
+		}
+		w.Write(b[last:i])
+		w.Write(html)
+		last = i + 1
+	}
+	w.Write(b[last:])
+}
+
+// HTMLEscapeString returns the escaped HTML equivalent of the plain text data s.
+func HTMLEscapeString(s string) string {
+	// Avoid allocation if we can.
+	if !strings.ContainsAny(s, "'\"&<>\000") {
+		return s
+	}
+	var b strings.Builder
+	HTMLEscape(&b, []byte(s))
+	return b.String()
+}
+
+// HTMLEscaper returns the escaped HTML equivalent of the textual
+// representation of its arguments.
+func HTMLEscaper(args ...any) string {
+	return HTMLEscapeString(evalArgs(args))
+}
+
+// JavaScript escaping.
+
+var (
+	jsLowUni = []byte(`\u00`)
+	hex      = []byte("0123456789ABCDEF")
+
+	jsBackslash = []byte(`\\`)
+	jsApos      = []byte(`\'`)
+	jsQuot      = []byte(`\"`)
+	jsLt        = []byte(`\u003C`)
+	jsGt        = []byte(`\u003E`)
+	jsAmp       = []byte(`\u0026`)
+	jsEq        = []byte(`\u003D`)
+)
+
+// JSEscape writes to w the escaped JavaScript equivalent of the plain text data b.
+func JSEscape(w io.Writer, b []byte) {
+	last := 0
+	for i := 0; i < len(b); i++ {
+		c := b[i]
+
+		if !jsIsSpecial(rune(c)) {
+			// fast path: nothing to do
+			continue
+		}
+		w.Write(b[last:i])
+
+		if c < utf8.RuneSelf {
+			// Quotes, slashes and angle brackets get quoted.
+			// Control characters get written as \u00XX.
+			switch c {
+			case '\\':
+				w.Write(jsBackslash)
+			case '\'':
+				w.Write(jsApos)
+			case '"':
+				w.Write(jsQuot)
+			case '<':
+				w.Write(jsLt)
+			case '>':
+				w.Write(jsGt)
+			case '&':
+				w.Write(jsAmp)
+			case '=':
+				w.Write(jsEq)
+			default:
+				w.Write(jsLowUni)
+				t, b := c>>4, c&0x0f
+				w.Write(hex[t : t+1])
+				w.Write(hex[b : b+1])
+			}
+		} else {
+			// Unicode rune.
+			r, size := utf8.DecodeRune(b[i:])
+			if unicode.IsPrint(r) {
+				w.Write(b[i : i+size])
+			} else {
+				fmt.Fprintf(w, "\\u%04X", r)
+			}
+			i += size - 1
+		}
+		last = i + 1
+	}
+	w.Write(b[last:])
+}
+
+// JSEscapeString returns the escaped JavaScript equivalent of the plain text data s.
+func JSEscapeString(s string) string {
+	// Avoid allocation if we can.
+	if strings.IndexFunc(s, jsIsSpecial) < 0 {
+		return s
+	}
+	var b strings.Builder
+	JSEscape(&b, []byte(s))
+	return b.String()
+}
+
+func jsIsSpecial(r rune) bool {
+	switch r {
+	case '\\', '\'', '"', '<', '>', '&', '=':
+		return true
+	}
+	return r < ' ' || utf8.RuneSelf <= r
+}
+
+// JSEscaper returns the escaped JavaScript equivalent of the textual
+// representation of its arguments.
+func JSEscaper(args ...any) string {
+	return JSEscapeString(evalArgs(args))
+}
+
+// URLQueryEscaper returns the escaped value of the textual representation of
+// its arguments in a form suitable for embedding in a URL query.
+func URLQueryEscaper(args ...any) string {
+	return url.QueryEscape(evalArgs(args))
+}
+
+// evalArgs formats the list of arguments into a string. It is therefore equivalent to
+//
+//	fmt.Sprint(args...)
+//
+// except that each argument is indirected (if a pointer), as required,
+// using the same rules as the default string evaluation during template
+// execution.
+func evalArgs(args []any) string {
+	ok := false
+	var s string
+	// Fast path for simple common case.
+	if len(args) == 1 {
+		s, ok = args[0].(string)
+	}
+	if !ok {
+		for i, arg := range args {
+			a, ok := printableValue(reflect.ValueOf(arg))
+			if ok {
+				args[i] = a
+			} // else let fmt do its thing
+		}
+		s = fmt.Sprint(args...)
+	}
+	return s
+}

template/gotext/helper.go

@@ -0,0 +1,178 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Helper functions to make constructing templates easier.
+
+package gotext
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+)
+
+// Functions and methods to parse templates.
+
+// Must is a helper that wraps a call to a function returning ([*Template], error)
+// and panics if the error is non-nil. It is intended for use in variable
+// initializations such as
+//
+//	var t = template.Must(template.New("name").Parse("text"))
+func Must(t *Template, err error) *Template {
+	if err != nil {
+		panic(err)
+	}
+	return t
+}
+
+// ParseFiles creates a new [Template] and parses the template definitions from
+// the named files. The returned template's name will have the base name and
+// parsed contents of the first file. There must be at least one file.
+// If an error occurs, parsing stops and the returned *Template is nil.
+//
+// When parsing multiple files with the same name in different directories,
+// the last one mentioned will be the one that results.
+// For instance, ParseFiles("a/foo", "b/foo") stores "b/foo" as the template
+// named "foo", while "a/foo" is unavailable.
+func ParseFiles(filenames ...string) (*Template, error) {
+	return parseFiles(nil, readFileOS, filenames...)
+}
+
+// ParseFiles parses the named files and associates the resulting templates with
+// t. If an error occurs, parsing stops and the returned template is nil;
+// otherwise it is t. There must be at least one file.
+// Since the templates created by ParseFiles are named by the base
+// (see [filepath.Base]) names of the argument files, t should usually have the
+// name of one of the (base) names of the files. If it does not, depending on
+// t's contents before calling ParseFiles, t.Execute may fail. In that
+// case use t.ExecuteTemplate to execute a valid template.
+//
+// When parsing multiple files with the same name in different directories,
+// the last one mentioned will be the one that results.
+func (t *Template) ParseFiles(filenames ...string) (*Template, error) {
+	t.init()
+	return parseFiles(t, readFileOS, filenames...)
+}
+
+// parseFiles is the helper for the method and function. If the argument
+// template is nil, it is created from the first file.
+func parseFiles(t *Template, readFile func(string) (string, []byte, error), filenames ...string) (*Template, error) {
+	if len(filenames) == 0 {
+		// Not really a problem, but be consistent.
+		return nil, fmt.Errorf("template: no files named in call to ParseFiles")
+	}
+	for _, filename := range filenames {
+		name, b, err := readFile(filename)
+		if err != nil {
+			return nil, err
+		}
+		s := string(b)
+		// First template becomes return value if not already defined,
+		// and we use that one for subsequent New calls to associate
+		// all the templates together. Also, if this file has the same name
+		// as t, this file becomes the contents of t, so
+		//  t, err := New(name).Funcs(xxx).ParseFiles(name)
+		// works. Otherwise we create a new template associated with t.
+		var tmpl *Template
+		if t == nil {
+			t = New(name)
+		}
+		if name == t.Name() {
+			tmpl = t
+		} else {
+			tmpl = t.New(name)
+		}
+		_, err = tmpl.Parse(s)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return t, nil
+}
+
+// ParseGlob creates a new [Template] and parses the template definitions from
+// the files identified by the pattern. The files are matched according to the
+// semantics of [filepath.Match], and the pattern must match at least one file.
+// The returned template will have the [filepath.Base] name and (parsed)
+// contents of the first file matched by the pattern. ParseGlob is equivalent to
+// calling [ParseFiles] with the list of files matched by the pattern.
+//
+// When parsing multiple files with the same name in different directories,
+// the last one mentioned will be the one that results.
+func ParseGlob(pattern string) (*Template, error) {
+	return parseGlob(nil, pattern)
+}
+
+// ParseGlob parses the template definitions in the files identified by the
+// pattern and associates the resulting templates with t. The files are matched
+// according to the semantics of [filepath.Match], and the pattern must match at
+// least one file. ParseGlob is equivalent to calling [Template.ParseFiles] with
+// the list of files matched by the pattern.
+//
+// When parsing multiple files with the same name in different directories,
+// the last one mentioned will be the one that results.
+func (t *Template) ParseGlob(pattern string) (*Template, error) {
+	t.init()
+	return parseGlob(t, pattern)
+}
+
+// parseGlob is the implementation of the function and method ParseGlob.
+func parseGlob(t *Template, pattern string) (*Template, error) {
+	filenames, err := filepath.Glob(pattern)
+	if err != nil {
+		return nil, err
+	}
+	if len(filenames) == 0 {
+		return nil, fmt.Errorf("template: pattern matches no files: %#q", pattern)
+	}
+	return parseFiles(t, readFileOS, filenames...)
+}
+
+// ParseFS is like [Template.ParseFiles] or [Template.ParseGlob] but reads from the file system fsys
+// instead of the host operating system's file system.
+// It accepts a list of glob patterns (see [path.Match]).
+// (Note that most file names serve as glob patterns matching only themselves.)
+func ParseFS(fsys fs.FS, patterns ...string) (*Template, error) {
+	return parseFS(nil, fsys, patterns)
+}
+
+// ParseFS is like [Template.ParseFiles] or [Template.ParseGlob] but reads from the file system fsys
+// instead of the host operating system's file system.
+// It accepts a list of glob patterns (see [path.Match]).
+// (Note that most file names serve as glob patterns matching only themselves.)
+func (t *Template) ParseFS(fsys fs.FS, patterns ...string) (*Template, error) {
+	t.init()
+	return parseFS(t, fsys, patterns)
+}
+
+func parseFS(t *Template, fsys fs.FS, patterns []string) (*Template, error) {
+	var filenames []string
+	for _, pattern := range patterns {
+		list, err := fs.Glob(fsys, pattern)
+		if err != nil {
+			return nil, err
+		}
+		if len(list) == 0 {
+			return nil, fmt.Errorf("template: pattern matches no files: %#q", pattern)
+		}
+		filenames = append(filenames, list...)
+	}
+	return parseFiles(t, readFileFS(fsys), filenames...)
+}
+
+func readFileOS(file string) (name string, b []byte, err error) {
+	name = filepath.Base(file)
+	b, err = os.ReadFile(file)
+	return
+}
+
+func readFileFS(fsys fs.FS) func(string) (string, []byte, error) {
+	return func(file string) (name string, b []byte, err error) {
+		name = path.Base(file)
+		b, err = fs.ReadFile(fsys, file)
+		return
+	}
+}

template/gotext/option.go

@@ -0,0 +1,72 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// This file contains the code to handle template options.
+
+package gotext
+
+import "strings"
+
+// missingKeyAction defines how to respond to indexing a map with a key that is not present.
+type missingKeyAction int
+
+const (
+	mapInvalid   missingKeyAction = iota // Return an invalid reflect.Value.
+	mapZeroValue                         // Return the zero value for the map element.
+	mapError                             // Error out
+)
+
+type option struct {
+	missingKey missingKeyAction
+}
+
+// Option sets options for the template. Options are described by
+// strings, either a simple string or "key=value". There can be at
+// most one equals sign in an option string. If the option string
+// is unrecognized or otherwise invalid, Option panics.
+//
+// Known options:
+//
+// missingkey: Control the behavior during execution if a map is
+// indexed with a key that is not present in the map.
+//
+//	"missingkey=default" or "missingkey=invalid"
+//		The default behavior: Do nothing and continue execution.
+//		If printed, the result of the index operation is the string
+//		"<no value>".
+//	"missingkey=zero"
+//		The operation returns the zero value for the map type's element.
+//	"missingkey=error"
+//		Execution stops immediately with an error.
+func (t *Template) Option(opt ...string) *Template {
+	t.init()
+	for _, s := range opt {
+		t.setOption(s)
+	}
+	return t
+}
+
+func (t *Template) setOption(opt string) {
+	if opt == "" {
+		panic("empty option string")
+	}
+	// key=value
+	if key, value, ok := strings.Cut(opt, "="); ok {
+		switch key {
+		case "missingkey":
+			switch value {
+			case "invalid", "default":
+				t.option.missingKey = mapInvalid
+				return
+			case "zero":
+				t.option.missingKey = mapZeroValue
+				return
+			case "error":
+				t.option.missingKey = mapError
+				return
+			}
+		}
+	}
+	panic("unrecognized option: " + opt)
+}

template/gotext/patches/0001-exec-context.patch

@@ -0,0 +1,149 @@
+--- a/exec.go	2026-07-10 01:31:35.188129862 +0200
++++ b/exec.go	2026-07-10 01:31:35.189129894 +0200
+@@ -5,14 +5,17 @@
+ package gotext
+ 
+ import (
++	"context"
+ 	"errors"
+ 	"fmt"
+-	"heckel.io/ntfy/v2/template/gotext/fmtsort"
+ 	"io"
+ 	"reflect"
+ 	"runtime"
+ 	"strings"
++	"sync/atomic"
+ 	"text/template/parse"
++
++	"heckel.io/ntfy/v2/template/gotext/fmtsort"
+ )
+ 
+ // maxExecDepth specifies the maximum stack depth of templates within
+@@ -32,11 +35,13 @@
+ // template so that multiple executions of the same template
+ // can execute in parallel.
+ type state struct {
+-	tmpl  *Template
+-	wr    io.Writer
+-	node  parse.Node // current node, for errors
+-	vars  []variable // push-down stack of variable values.
+-	depth int        // the height of the stack of executing templates.
++	tmpl      *Template
++	ctx       context.Context // ctx-ex: execution context; Execute uses context.Background.
++	wr        io.Writer
++	node      parse.Node   // current node, for errors
++	vars      []variable   // push-down stack of variable values.
++	depth     int          // the height of the stack of executing templates.
++	cancelled *atomic.Bool // ctx-ex: shared flag set by the context.AfterFunc watcher; nil if ctx cannot be canceled
+ }
+ 
+ // variable holds the dynamic value of a variable such as $, $x etc.
+@@ -160,6 +165,14 @@
+ 	})
+ }
+ 
++// cancelError is the wrapper type used internally when execution is aborted
++// because the context is done. Like writeError, it is stripped in errRecover
++// so the caller receives the original ctx.Err(). It is not an implementation
++// of error, so it cannot escape from the package as an error value.
++type cancelError struct {
++	Err error // Original context error.
++}
++
+ // errRecover is the handler that turns panics into returns from the top
+ // level of Parse.
+ func errRecover(errp *error) {
+@@ -170,6 +183,8 @@
+ 			panic(e)
+ 		case writeError:
+ 			*errp = err.Err // Strip the wrapper.
++		case cancelError:
++			*errp = err.Err // Strip the wrapper; return the context error.
+ 		case ExecError:
+ 			*errp = err // Keep the wrapper.
+ 		default:
+@@ -186,11 +201,19 @@
+ // A template may be executed safely in parallel, although if parallel
+ // executions share a Writer the output may be interleaved.
+ func (t *Template) ExecuteTemplate(wr io.Writer, name string, data any) error {
++	return t.ExecuteTemplateContext(context.Background(), wr, name, data)
++}
++
++// ExecuteTemplateContext is like [Template.ExecuteTemplate], but aborts and
++// returns ctx.Err() if ctx is canceled or its deadline is exceeded before
++// execution completes. See [Template.ExecuteContext] for the cancellation
++// semantics.
++func (t *Template) ExecuteTemplateContext(ctx context.Context, wr io.Writer, name string, data any) error {
+ 	tmpl := t.Lookup(name)
+ 	if tmpl == nil {
+ 		return fmt.Errorf("template: no template %q associated with template %q", name, t.name)
+ 	}
+-	return tmpl.Execute(wr, data)
++	return tmpl.ExecuteContext(ctx, wr, data)
+ }
+ 
+ // Execute applies a parsed template to the specified data object,
+@@ -204,10 +227,27 @@
+ // If data is a [reflect.Value], the template applies to the concrete
+ // value that the reflect.Value holds, as in [fmt.Print].
+ func (t *Template) Execute(wr io.Writer, data any) error {
+-	return t.execute(wr, data)
++	return t.executeContext(context.Background(), wr, data)
+ }
+ 
+-func (t *Template) execute(wr io.Writer, data any) (err error) {
++// ExecuteContext is like [Template.Execute], but aborts and returns ctx.Err()
++// (either [context.Canceled] or [context.DeadlineExceeded], retrievable with
++// [errors.Is]) if ctx is canceled or its deadline is exceeded before execution
++// completes.
++//
++// Cancellation is observed between node evaluations as the template is walked,
++// so long-running renders -- including tight or nested {{range}} loops that
++// write no output -- are aborted promptly. A template blocked inside a single
++// function call is not interrupted until that call returns. Partial results may
++// already have been written to wr.
++func (t *Template) ExecuteContext(ctx context.Context, wr io.Writer, data any) error {
++	if err := ctx.Err(); err != nil {
++		return err
++	}
++	return t.executeContext(ctx, wr, data)
++}
++
++func (t *Template) executeContext(ctx context.Context, wr io.Writer, data any) (err error) {
+ 	defer errRecover(&err)
+ 	value, ok := data.(reflect.Value)
+ 	if !ok {
+@@ -215,9 +255,20 @@
+ 	}
+ 	state := &state{
+ 		tmpl: t,
++		ctx:  ctx,
+ 		wr:   wr,
+ 		vars: []variable{{"$", value}},
+ 	}
++	// If the context can be canceled, watch it with a single context.AfterFunc
++	// callback that flips an atomic flag; walk polls that flag per node (a cheap
++	// monomorphic atomic load) instead of calling ctx.Err() every node.
++	// Contexts that can never be canceled (Background, TODO) have a nil Done
++	// channel, so the default Execute path installs nothing and pays nothing.
++	if ctx.Done() != nil {
++		state.cancelled = new(atomic.Bool)
++		stop := context.AfterFunc(ctx, func() { state.cancelled.Store(true) })
++		defer stop()
++	}
+ 	if t.Tree == nil || t.Root == nil {
+ 		state.errorf("%q is an incomplete or empty template", t.Name())
+ 	}
+@@ -260,6 +311,12 @@
+ // generating output as they go.
+ func (s *state) walk(dot reflect.Value, node parse.Node) {
+ 	s.at(node)
++	// Abort if the context has been canceled or its deadline has passed. The
++	// flag is set by the watcher installed in executeContext; observing it here
++	// interrupts any template shape, including loops that write no output.
++	if s.cancelled != nil && s.cancelled.Load() {
++		panic(cancelError{s.ctx.Err()})
++	}
+ 	switch node := node.(type) {
+ 	case *parse.ActionNode:
+ 		// Do not pop variables so they persist until next end.

template/gotext/template.go

@@ -0,0 +1,236 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package gotext
+
+import (
+	"maps"
+	"reflect"
+	"sync"
+	"text/template/parse"
+)
+
+// common holds the information shared by related templates.
+type common struct {
+	tmpl   map[string]*Template // Map from name to defined templates.
+	muTmpl sync.RWMutex         // protects tmpl
+	option option
+	// We use two maps, one for parsing and one for execution.
+	// This separation makes the API cleaner since it doesn't
+	// expose reflection to the client.
+	muFuncs    sync.RWMutex // protects parseFuncs and execFuncs
+	parseFuncs FuncMap
+	execFuncs  map[string]reflect.Value
+}
+
+// Template is the representation of a parsed template. The *parse.Tree
+// field is exported only for use by [html/template] and should be treated
+// as unexported by all other clients.
+type Template struct {
+	name string
+	*parse.Tree
+	*common
+	leftDelim  string
+	rightDelim string
+}
+
+// New allocates a new, undefined template with the given name.
+func New(name string) *Template {
+	t := &Template{
+		name: name,
+	}
+	t.init()
+	return t
+}
+
+// Name returns the name of the template.
+func (t *Template) Name() string {
+	return t.name
+}
+
+// New allocates a new, undefined template associated with the given one and with the same
+// delimiters. The association, which is transitive, allows one template to
+// invoke another with a {{template}} action.
+//
+// Because associated templates share underlying data, template construction
+// cannot be done safely in parallel. Once the templates are constructed, they
+// can be executed in parallel.
+func (t *Template) New(name string) *Template {
+	t.init()
+	nt := &Template{
+		name:       name,
+		common:     t.common,
+		leftDelim:  t.leftDelim,
+		rightDelim: t.rightDelim,
+	}
+	return nt
+}
+
+// init guarantees that t has a valid common structure.
+func (t *Template) init() {
+	if t.common == nil {
+		c := new(common)
+		c.tmpl = make(map[string]*Template)
+		c.parseFuncs = make(FuncMap)
+		c.execFuncs = make(map[string]reflect.Value)
+		t.common = c
+	}
+}
+
+// Clone returns a duplicate of the template, including all associated
+// templates. The actual representation is not copied, but the name space of
+// associated templates is, so further calls to [Template.Parse] in the copy will add
+// templates to the copy but not to the original. Clone can be used to prepare
+// common templates and use them with variant definitions for other templates
+// by adding the variants after the clone is made.
+func (t *Template) Clone() (*Template, error) {
+	nt := t.copy(nil)
+	nt.init()
+	if t.common == nil {
+		return nt, nil
+	}
+	nt.option = t.option
+	t.muTmpl.RLock()
+	defer t.muTmpl.RUnlock()
+	for k, v := range t.tmpl {
+		if k == t.name {
+			nt.tmpl[t.name] = nt
+			continue
+		}
+		// The associated templates share nt's common structure.
+		tmpl := v.copy(nt.common)
+		nt.tmpl[k] = tmpl
+	}
+	t.muFuncs.RLock()
+	defer t.muFuncs.RUnlock()
+	maps.Copy(nt.parseFuncs, t.parseFuncs)
+	maps.Copy(nt.execFuncs, t.execFuncs)
+	return nt, nil
+}
+
+// copy returns a shallow copy of t, with common set to the argument.
+func (t *Template) copy(c *common) *Template {
+	return &Template{
+		name:       t.name,
+		Tree:       t.Tree,
+		common:     c,
+		leftDelim:  t.leftDelim,
+		rightDelim: t.rightDelim,
+	}
+}
+
+// AddParseTree associates the argument parse tree with the template t, giving
+// it the specified name. If the template has not been defined, this tree becomes
+// its definition. If it has been defined and already has that name, the existing
+// definition is replaced; otherwise a new template is created, defined, and returned.
+func (t *Template) AddParseTree(name string, tree *parse.Tree) (*Template, error) {
+	t.init()
+	t.muTmpl.Lock()
+	defer t.muTmpl.Unlock()
+	nt := t
+	if name != t.name {
+		nt = t.New(name)
+	}
+	// Even if nt == t, we need to install it in the common.tmpl map.
+	if t.associate(nt, tree) || nt.Tree == nil {
+		nt.Tree = tree
+	}
+	return nt, nil
+}
+
+// Templates returns a slice of defined templates associated with t.
+func (t *Template) Templates() []*Template {
+	if t.common == nil {
+		return nil
+	}
+	// Return a slice so we don't expose the map.
+	t.muTmpl.RLock()
+	defer t.muTmpl.RUnlock()
+	m := make([]*Template, 0, len(t.tmpl))
+	for _, v := range t.tmpl {
+		m = append(m, v)
+	}
+	return m
+}
+
+// Delims sets the action delimiters to the specified strings, to be used in
+// subsequent calls to [Template.Parse], [Template.ParseFiles], or [Template.ParseGlob]. Nested template
+// definitions will inherit the settings. An empty delimiter stands for the
+// corresponding default: {{ or }}.
+// The return value is the template, so calls can be chained.
+func (t *Template) Delims(left, right string) *Template {
+	t.init()
+	t.leftDelim = left
+	t.rightDelim = right
+	return t
+}
+
+// Funcs adds the elements of the argument map to the template's function map.
+// It must be called before the template is parsed.
+// It panics if a value in the map is not a function with appropriate return
+// type or if the name cannot be used syntactically as a function in a template.
+// It is legal to overwrite elements of the map. The return value is the template,
+// so calls can be chained.
+func (t *Template) Funcs(funcMap FuncMap) *Template {
+	t.init()
+	t.muFuncs.Lock()
+	defer t.muFuncs.Unlock()
+	addValueFuncs(t.execFuncs, funcMap)
+	addFuncs(t.parseFuncs, funcMap)
+	return t
+}
+
+// Lookup returns the template with the given name that is associated with t.
+// It returns nil if there is no such template or the template has no definition.
+func (t *Template) Lookup(name string) *Template {
+	if t.common == nil {
+		return nil
+	}
+	t.muTmpl.RLock()
+	defer t.muTmpl.RUnlock()
+	return t.tmpl[name]
+}
+
+// Parse parses text as a template body for t.
+// Named template definitions ({{define ...}} or {{block ...}} statements) in text
+// define additional templates associated with t and are removed from the
+// definition of t itself.
+//
+// Templates can be redefined in successive calls to Parse.
+// A template definition with a body containing only white space and comments
+// is considered empty and will not replace an existing template's body.
+// This allows using Parse to add new named template definitions without
+// overwriting the main template body.
+func (t *Template) Parse(text string) (*Template, error) {
+	t.init()
+	t.muFuncs.RLock()
+	trees, err := parse.Parse(t.name, text, t.leftDelim, t.rightDelim, t.parseFuncs, builtins())
+	t.muFuncs.RUnlock()
+	if err != nil {
+		return nil, err
+	}
+	// Add the newly parsed trees, including the one for t, into our common structure.
+	for name, tree := range trees {
+		if _, err := t.AddParseTree(name, tree); err != nil {
+			return nil, err
+		}
+	}
+	return t, nil
+}
+
+// associate installs the new template into the group of templates associated
+// with t. The two are already known to share the common structure.
+// The boolean return value reports whether to store this tree as t.Tree.
+func (t *Template) associate(new *Template, tree *parse.Tree) bool {
+	if new.common != t.common {
+		panic("internal error: associate not common")
+	}
+	if old := t.tmpl[new.name]; old != nil && parse.IsEmptyTree(tree.Root) && old.Tree != nil {
+		// If a template by that name exists,
+		// don't replace it with an empty template.
+		return false
+	}
+	t.tmpl[new.name] = new
+	return true
+}

user/types.go

@@ -97,6 +97,8 @@ type MagicLink struct {
 // Prefs represents a user's configuration settings
 type Prefs struct {
 	Language      *string            `json:"language,omitempty"`
+	DateFormat    *string            `json:"date_format,omitempty"`
+	TimeFormat    *string            `json:"time_format,omitempty"`
 	Notification  *NotificationPrefs `json:"notification,omitempty"`
 	Subscriptions []*Subscription    `json:"subscriptions,omitempty"`
 }

util/sprig/functions.go

@@ -5,7 +5,6 @@ import (
 	"path/filepath"
 	"reflect"
 	"strings"
-	"text/template"
 	"time"
 )
 
@@ -21,8 +20,9 @@ const (
 //
 //	tpl := template.New("foo").Funcs(sprig.FuncMap()))
 //
-// TxtFuncMap returns a 'text/template'.FuncMap
-func TxtFuncMap() template.FuncMap {
+// TxtFuncMap returns the function map as a plain map[string]any, assignable to any text/template or
+// html/template FuncMap (including ntfy's vendored internal/template).
+func TxtFuncMap() map[string]any {
 	return map[string]any{
 		// Date functions
 		"ago":            dateAgo,

util/timeout_writer.go

@@ -1,34 +0,0 @@
-package util
-
-import (
-	"errors"
-	"io"
-	"time"
-)
-
-// ErrWriteTimeout is returned when a write timed out
-var ErrWriteTimeout = errors.New("write operation failed due to timeout")
-
-// TimeoutWriter wraps an io.Writer that will time out after the given timeout
-type TimeoutWriter struct {
-	writer  io.Writer
-	timeout time.Duration
-	start   time.Time
-}
-
-// NewTimeoutWriter creates a new TimeoutWriter
-func NewTimeoutWriter(w io.Writer, timeout time.Duration) *TimeoutWriter {
-	return &TimeoutWriter{
-		writer:  w,
-		timeout: timeout,
-		start:   time.Now(),
-	}
-}
-
-// Write implements the io.Writer interface, failing if called after the timeout period from creation.
-func (tw *TimeoutWriter) Write(p []byte) (n int, err error) {
-	if time.Since(tw.start) > tw.timeout {
-		return 0, ErrWriteTimeout
-	}
-	return tw.writer.Write(p)
-}

web/index.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />

web/jsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx",
+    "checkJs": false
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "build"]
+}

web/package-lock.json

@@ -16,7 +16,7 @@
         "dexie": "^4.4.4",
         "dexie-react-hooks": "^4.4.0",
         "i18next": "^21.6.14",
-        "i18next-browser-languagedetector": "^6.1.4",
+        "i18next-browser-languagedetector": "^8.2.1",
         "i18next-http-backend": "^4.0.0",
         "react": "latest",
         "react-dom": "latest",
@@ -36,7 +36,7 @@
         "eslint-plugin-jsx-a11y": "^6.7.1",
         "eslint-plugin-react": "^7.32.2",
         "eslint-plugin-react-hooks": "^4.6.0",
-        "prettier": "^2.8.8",
+        "prettier": "^3.9.4",
         "vite": "^8.0.16",
         "vite-plugin-pwa": "^1.0.0",
         "vitest": "^4.1.9"
@@ -2199,14 +2199,14 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
+        "@tybys/wasm-util": "^0.10.3"
       },
       "funding": {
         "type": "github",
@@ -2285,9 +2285,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.2.tgz",
-      "integrity": "sha512-2cZ+7xRS+DBcuJBJKnfzsbleumJhBqSlJVpuzHC0nTqfd3QQ7Vx2/x5YR/D7cBamKSeWplwo82Fn9lqYUDEMfA==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.3.tgz",
+      "integrity": "sha512-DT6Z3PhvioeHMvxo+xHc3KtqggrI7CCTXCmC2h/5zUlp5jVitv7XEy+9q5/7v8IolhlioawpMo8Kg0EEBy7J0g==",
       "cpu": [
         "arm64"
       ],
@@ -2302,9 +2302,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.2.tgz",
-      "integrity": "sha512-RkPMJnygxsgOYdkfqgpwY0/Fzm8d0VQe6HGU2/B00Xa9eqdLbrII+DOKAodbJAn3ZL1AJxGHkZRPYazgGY6Ljw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.3.tgz",
+      "integrity": "sha512-0NwgwsjM7LrsuVnXMK3koTpagBNOhloc/BNjKqZjv4V5zI5r13qx69uVhRx+o5Z0yy4Hzq+lpy7TAgUG/ocvrw==",
       "cpu": [
         "arm64"
       ],
@@ -2319,9 +2319,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.2.tgz",
-      "integrity": "sha512-Uiczh6vFhwyfd7WNe7Q7mCA4KxAiLdz7jPE/WGizfRpIieoyFuNVMmM8HqZ9HwudTkY6/AeMQwlNJ9NJijguWw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.3.tgz",
+      "integrity": "sha512-YtiBp4disu6V560loT6PjMdiRaWmVvDNrUunAalbiFx2ggeJwxdAsgZMcoGP17uyAsTwAj5V1niksxlHnVQ1Sw==",
       "cpu": [
         "x64"
       ],
@@ -2336,9 +2336,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.2.tgz",
-      "integrity": "sha512-+TpdtTRgHiJFjCVFbw311SuLk3KfytPOQQn+VlAEv+gBxYPtL7E6JS9e/tk+8CwxhIZvemJKo4rTKgfWNsKkkA==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.3.tgz",
+      "integrity": "sha512-yD3EkEdXk2LypPxnf/kSZHirarsI8gcPzc62SukhR9VJTyvV+F9Q/GxWNuCojc7sXyuVC4DxRGhdDK4X8VSsbw==",
       "cpu": [
         "x64"
       ],
@@ -2353,9 +2353,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.2.tgz",
-      "integrity": "sha512-4lv1/tkmi7ueIVHnyreaOeUpiZP26BH9rRy6hoYfR9310A2B9nUEVRDvBx69vx64Nr3eTPPRkyciqJJs+j9Jmw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.3.tgz",
+      "integrity": "sha512-c+8vieQbsD7HNAHKIA34w0GJ9FedFFuJGD+7E6vz7Q3uqAIugL5p45fhlsj4UaAsHpcmlqugBWMhA0/j7o0sIg==",
       "cpu": [
         "arm"
       ],
@@ -2370,9 +2370,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.2.tgz",
-      "integrity": "sha512-gBSUVO0eaWgw1JMjK3gB8BMlX2Mk148s2lTiVT3e9vjVxbl7UDfMWWY8CfIaaqiXuM9fVTMxIpUz6CAo/B6Vlw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.3.tgz",
+      "integrity": "sha512-50jD0uUwLvur7Zz9LHz17kaAdTPjn5wN93hEgjvmYFRZwiR7ZJYovTd5ipyWJDAnXKvZ+wgc+/Ika6dwSF5OcA==",
       "cpu": [
         "arm64"
       ],
@@ -2390,9 +2390,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.2.tgz",
-      "integrity": "sha512-LjQP/iZLBu8o8PjIfk4x3At0/mT6h282pvz8Z5LAyhGbu/kDezyO7ea62rF5uoqmgnIYqbN/MqJ3Si3Aymi7xQ==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.3.tgz",
+      "integrity": "sha512-BO9+oPL8K9poZJBfYPsXNtYjPE5uM3qeehT3aFcW4LITOl+iSqhp0abzjR2nWBUNjIZeKXjAEWBZ64WjNoHd6w==",
       "cpu": [
         "arm64"
       ],
@@ -2410,9 +2410,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.2.tgz",
-      "integrity": "sha512-X/7bVLWelEsbyWDUSXt7zVsTniLLPIY2n1rH58qr78l9i7MNbbxBWD8gI2vRfBWf4NUXJCUuQnfZDsp32LqsfQ==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.3.tgz",
+      "integrity": "sha512-f3VpLB1vQ0Eo6ecr/6cekLnvYMFF4YBFoVGkfkvPLq1bAkbAwHYQPZKoAmG6OJyTcxxoC+AvezGx/S1obNC0Mw==",
       "cpu": [
         "ppc64"
       ],
@@ -2430,9 +2430,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.2.tgz",
-      "integrity": "sha512-gb6dYKW/1KDorGXyy48glEBJs/sxVSC5pcVrox/pFGV4mvwSFeg2sK5L2tRkVsVlh7kueqOgg4GEcuipJcGuKg==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.3.tgz",
+      "integrity": "sha512-AmurZ26Pqx/RI9N1gzEOCklkKXl927yjfXWUUS0O7Puh8ARM/Ob8qfrD3qnWksScdw6cSrW5PSHE9DyLu7+PtA==",
       "cpu": [
         "s390x"
       ],
@@ -2450,9 +2450,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.2.tgz",
-      "integrity": "sha512-JY4w85pU3iAiJVMh5nuk4/Mh9GjMsupe8MrIN53rwxAZW64GKrWeJBuN6SxQg9QTU5uB1cxyhDzW8jqRn1EABw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.3.tgz",
+      "integrity": "sha512-JJpqs8bRGITDOdbkNKnlojzBabbOHrqjSvDr0IVsZObE1lBcPjxItUEY9eWIDbxaJ3cGrXPWGfGkIxFijg/URg==",
       "cpu": [
         "x64"
       ],
@@ -2470,9 +2470,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.2.tgz",
-      "integrity": "sha512-xvpA7o5KCYLB0Rwscmuylb1/zHHSUx4g4xilm4prC5jP76pEUlzBmMbgpbh7bVDbId4NcfT96gN5i6mE6UDaiw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.3.tgz",
+      "integrity": "sha512-rSJcdjPxzA/by/6/rYs+v+bXU7UjvnbUWz8MJb6kh6+knqB1dCrtHg0uu7C/4haqJvqdkYHQ5IGn+tCH9GLW/g==",
       "cpu": [
         "x64"
       ],
@@ -2490,9 +2490,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.2.tgz",
-      "integrity": "sha512-p/ts6KBLjuk49Bp21XH77poQGt02iNz7ChgHep7tudPOaLinR/De/RHdxF8w8Yj4r/bF/bqXwH6PZrB2sA+Nvw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.3.tgz",
+      "integrity": "sha512-hQ3/PYkDJICgevvyNcVrihVeqq7k1Pp3VZ9lY+dauAYUJKO+auqApvANhvR1An9BhmqYKvW2Mu1F9u4DXSMLxQ==",
       "cpu": [
         "arm64"
       ],
@@ -2507,9 +2507,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.2.tgz",
-      "integrity": "sha512-VMu/wmrZ9hJzYlRhbw7jK5PODlugyKZ5mOdX78+lS8OvuFkWNQdz1pFLrI2p3P0pjXOmUZ7B48o5VnMH9QOGtg==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.3.tgz",
+      "integrity": "sha512-Elcv/BtML9lXrV6JuKITc/grN2kYV9gjsQpW8Jfw4ioK0TOkjBjye0nnyqQNy9STNaI20lXNaQBRrD5gSgR0Yg==",
       "cpu": [
         "wasm32"
       ],
@@ -2519,16 +2519,16 @@
       "dependencies": {
         "@emnapi/core": "1.11.1",
         "@emnapi/runtime": "1.11.1",
-        "@napi-rs/wasm-runtime": "^1.1.5"
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.2.tgz",
-      "integrity": "sha512-xtUJqs8qEkuSviS0n1tsohaPuz3a1SPhZywOji4Oo+sgrJs8daEDMZ0QtqL0OS7dx8PoVpg2J/ZZycPY5I2+Zg==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.3.tgz",
+      "integrity": "sha512-2DrEfhluH9yhiaFApmsjsjwrSYbNcY1oFTzYSP1a535jDbV98zCFanA/96TBUd0iDFcxGmw9QRExwGCXz3U+/g==",
       "cpu": [
         "arm64"
       ],
@@ -2543,9 +2543,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.2.tgz",
-      "integrity": "sha512-85YiLQqjUKgSO/Zjnf9e0XIn5Ymrh1fLDWBeAkZqpuBR/3R8TpfoHXuyblqyQrftSSgWO9qpcHN8mkyKsLraoA==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.3.tgz",
+      "integrity": "sha512-OL4OMk7UPXOeVGGd3qo5zJyPIljf4AFgk5QAkPPS+OoLuOOozhuaQGC18MxVTnw/06q93gShAJzlwnSCY9YtqA==",
       "cpu": [
         "x64"
       ],
@@ -2686,6 +2686,13 @@
         }
       }
     },
+    "node_modules/@rollup/pluginutils/node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@rollup/rollup-android-arm-eabi": {
       "version": "4.62.2",
       "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
@@ -3299,16 +3306,6 @@
         }
       }
     },
-    "node_modules/@vitest/mocker/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0"
-      }
-    },
     "node_modules/@vitest/pretty-format": {
       "version": "4.1.9",
       "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
@@ -4350,9 +4347,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.377",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.377.tgz",
-      "integrity": "sha512-cH1jZgJHoezfTnKfKwnScpHywTFVnJUNITDPREFdhNjiuD502+QFpG0Qk7G8jhsV/f+CEAFlIrzP1fT+IMb92g==",
+      "version": "1.5.378",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.378.tgz",
+      "integrity": "sha512-VinvOAuuPmdD1guEgGv5f2Qp7/vlfqOrUOMYNnOD4wj3pit8kRsQHzfIf6teyUGWo15Tg5+bOJaRunvyltpVWQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -5039,11 +5036,14 @@
       }
     },
     "node_modules/estree-walker": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
-      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
     },
     "node_modules/esutils": {
       "version": "2.0.3",
@@ -5694,12 +5694,12 @@
       }
     },
     "node_modules/i18next-browser-languagedetector": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-6.1.8.tgz",
-      "integrity": "sha512-Svm+MduCElO0Meqpj1kJAriTC6OhI41VhlT/A0UPjGoPZBhAHIaGE5EfsHlTpgdH09UVX7rcc72pSDDBeKSQQA==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-8.2.1.tgz",
+      "integrity": "sha512-bZg8+4bdmaOiApD7N7BPT9W8MLZG+nPTOFlLiJiT8uzKXFjhxw4v2ierCXOwB5sFDMtuA5G4kgYZ0AznZxQ/cw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.19.0"
+        "@babel/runtime": "^7.23.2"
       }
     },
     "node_modules/i18next-http-backend": {
@@ -7150,9 +7150,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.48",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.48.tgz",
-      "integrity": "sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA==",
+      "version": "2.0.49",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.49.tgz",
+      "integrity": "sha512-f06bl1D+8ZDkn2oOQQKAh5/otFWqVnM1Q5oerA8Pex7UfT66Tx4IPHIqVVFKqFT3FUtaDstdgkM7yT7JWhqxfw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7576,16 +7576,16 @@
       }
     },
     "node_modules/prettier": {
-      "version": "2.8.8",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.8.tgz",
-      "integrity": "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==",
+      "version": "3.9.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz",
+      "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==",
       "dev": true,
       "license": "MIT",
       "bin": {
-        "prettier": "bin-prettier.js"
+        "prettier": "bin/prettier.cjs"
       },
       "engines": {
-        "node": ">=10.13.0"
+        "node": ">=14"
       },
       "funding": {
         "url": "https://github.com/prettier/prettier?sponsor=1"
@@ -8008,9 +8008,9 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.2.tgz",
-      "integrity": "sha512-x0CrQQqCXWGeI8dTvFfN/Dnv3yMKT9hv5jFjlOreKAx9wqLq9wz7VvLLHyaAXC90/CpggTu9SisSbsJJTPSjNQ==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.3.tgz",
+      "integrity": "sha512-1F1eEtUBtFvcGm1HQ9TiUIUHPQG7mSAODrhIzjxoUEFuo8OcbrGLiVLkevNgj84TE4lnHvnumwFjhJO5Eu135g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8024,21 +8024,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.1.2",
-        "@rolldown/binding-darwin-arm64": "1.1.2",
-        "@rolldown/binding-darwin-x64": "1.1.2",
-        "@rolldown/binding-freebsd-x64": "1.1.2",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.1.2",
-        "@rolldown/binding-linux-arm64-gnu": "1.1.2",
-        "@rolldown/binding-linux-arm64-musl": "1.1.2",
-        "@rolldown/binding-linux-ppc64-gnu": "1.1.2",
-        "@rolldown/binding-linux-s390x-gnu": "1.1.2",
-        "@rolldown/binding-linux-x64-gnu": "1.1.2",
-        "@rolldown/binding-linux-x64-musl": "1.1.2",
-        "@rolldown/binding-openharmony-arm64": "1.1.2",
-        "@rolldown/binding-wasm32-wasi": "1.1.2",
-        "@rolldown/binding-win32-arm64-msvc": "1.1.2",
-        "@rolldown/binding-win32-x64-msvc": "1.1.2"
+        "@rolldown/binding-android-arm64": "1.1.3",
+        "@rolldown/binding-darwin-arm64": "1.1.3",
+        "@rolldown/binding-darwin-x64": "1.1.3",
+        "@rolldown/binding-freebsd-x64": "1.1.3",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.3",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.3",
+        "@rolldown/binding-linux-arm64-musl": "1.1.3",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.3",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.3",
+        "@rolldown/binding-linux-x64-gnu": "1.1.3",
+        "@rolldown/binding-linux-x64-musl": "1.1.3",
+        "@rolldown/binding-openharmony-arm64": "1.1.3",
+        "@rolldown/binding-wasm32-wasi": "1.1.3",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.3",
+        "@rolldown/binding-win32-x64-msvc": "1.1.3"
       }
     },
     "node_modules/rollup": {

web/package.json

@@ -21,7 +21,7 @@
     "dexie": "^4.4.4",
     "dexie-react-hooks": "^4.4.0",
     "i18next": "^21.6.14",
-    "i18next-browser-languagedetector": "^6.1.4",
+    "i18next-browser-languagedetector": "^8.2.1",
     "i18next-http-backend": "^4.0.0",
     "react": "latest",
     "react-dom": "latest",
@@ -41,7 +41,7 @@
     "eslint-plugin-jsx-a11y": "^6.7.1",
     "eslint-plugin-react": "^7.32.2",
     "eslint-plugin-react-hooks": "^4.6.0",
-    "prettier": "^2.8.8",
+    "prettier": "^3.9.4",
     "vite": "^8.0.16",
     "vite-plugin-pwa": "^1.0.0",
     "vitest": "^4.1.9"

web/public/static/css/fonts.css

@@ -5,7 +5,9 @@
   font-family: "Roboto";
   font-style: normal;
   font-weight: 300;
-  src: local(""), url("../fonts/roboto-v29-latin-300.woff2") format("woff2");
+  src:
+    local(""),
+    url("../fonts/roboto-v29-latin-300.woff2") format("woff2");
 }
 
 /* roboto-regular - latin */
@@ -13,7 +15,9 @@
   font-family: "Roboto";
   font-style: normal;
   font-weight: 400;
-  src: local(""), url("../fonts/roboto-v29-latin-regular.woff2") format("woff2");
+  src:
+    local(""),
+    url("../fonts/roboto-v29-latin-regular.woff2") format("woff2");
 }
 
 /* roboto-500 - latin */
@@ -21,7 +25,9 @@
   font-family: "Roboto";
   font-style: normal;
   font-weight: 500;
-  src: local(""), url("../fonts/roboto-v29-latin-500.woff2") format("woff2");
+  src:
+    local(""),
+    url("../fonts/roboto-v29-latin-500.woff2") format("woff2");
 }
 
 /* roboto-700 - latin */
@@ -29,5 +35,7 @@
   font-family: "Roboto";
   font-style: normal;
   font-weight: 700;
-  src: local(""), url("../fonts/roboto-v29-latin-700.woff2") format("woff2");
+  src:
+    local(""),
+    url("../fonts/roboto-v29-latin-700.woff2") format("woff2");
 }

web/public/static/langs/ar.json

@@ -361,7 +361,7 @@
     "account_upgrade_dialog_tier_price_per_month": "شهر",
     "prefs_appearance_theme_title": "السمة",
     "subscribe_dialog_subscribe_use_another_background_info": "لن يتم استلام الاشعارات من الخوادم الخارجية عندما يكون تطبيق الويب مغلقاً",
-    "prefs_appearance_theme_system": "النظام (الافتراضي)",
+    "prefs_system_default": "النظام الافتراضي",
     "prefs_notifications_min_priority_low_and_higher": "أولوية منخفضة وأعلى",
     "prefs_notifications_min_priority_default_and_higher": "الأولوية الافتراضية وما فوقها",
     "prefs_notifications_min_priority_high_and_higher": "أولوية عالية وأعلى"

web/public/static/langs/bg.json

@@ -243,8 +243,8 @@
     "account_basics_password_description": "Промяна на паролата на профила",
     "account_basics_tier_title": "Вид на профила",
     "account_basics_tier_admin": "Администратор",
-    "account_basics_tier_admin_suffix_with_tier": "(с {{tier}} ниво)",
-    "account_basics_tier_admin_suffix_no_tier": "(без ниво)",
+    "account_basics_tier_admin_suffix_with_tier": "с {{tier}} ниво",
+    "account_basics_tier_admin_suffix_no_tier": "без ниво",
     "account_basics_tier_free": "безплатен",
     "account_basics_tier_basic": "базов",
     "account_basics_tier_change_button": "Променяне",
@@ -373,7 +373,7 @@
     "prefs_reservations_table_everyone_read_write": "Всички могат да публикуват и да се абонират",
     "reservation_delete_dialog_submit_button": "Премахване на резервирането",
     "account_tokens_description": "Използвайте код за достъп когато публикувате или се абонирате през ППИ на ntfy, за да не се налага да изпращате потребителско име и парола. Прочетете <Link>документацията</Link> за повече информация.",
-    "account_tokens_delete_dialog_description": "Преди да премахвате код за достъп се уверете, че не се използва от приложения или скриптове. <strong>Действието е необратимо.</strong>",
+    "account_tokens_delete_dialog_description": "Преди да премахвате код за достъп се уверете, че не се използва от приложения или скриптове. <strong>Действието е необратимо.</strong>.",
     "prefs_reservations_dialog_description": "Резервирането ви осигурява собственост върху темата и ви дава възможност да определяте права за достъп от други потребители.",
     "reservation_delete_dialog_action_keep_title": "Пазене на съобщения и прикачени файлове",
     "reservation_delete_dialog_action_keep_description": "Съобщенията и прикачените файлове, които са във временната памет на сървъра ще бъдат достъпни за всеки, който знае името на темата.",
@@ -400,12 +400,64 @@
     "prefs_notifications_web_push_title": "Известия във фонов режим",
     "prefs_notifications_web_push_enabled_description": "Известията ще бъдат получавани даже и ако приложението за уеб не работи (чрез Web Push)",
     "prefs_appearance_theme_title": "Цветова тема",
-    "prefs_appearance_theme_system": "Системна (подразбирана)",
+    "prefs_system_default": "Системна подразбирана",
     "web_push_subscription_expiring_title": "Известията временно ще бъдат спрени",
     "web_push_subscription_expiring_body": "За да продължите да получавате известия, отворете ntfy",
     "action_bar_unmute_notifications": "Включване звука на известията",
     "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Кодът за защита от външна система не може да бъде променян или премахван",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Потребител от външна система не може да бъде променян или премахван",
     "common_close": "Затваряне",
-    "common_refresh": "Презареждане"
+    "common_refresh": "Презареждане",
+    "email_verify_progress_title": "Проверяване адреса на ел. поща…",
+    "email_verify_success_title": "Адресът на ел. поща е проверен",
+    "email_verify_success_description": "Адресът на ел. поща е проверен е добавен към профила.",
+    "email_verify_error_title": "Проверката не е успешна",
+    "email_verify_error_description": "Препратката за проверка е повредена или с изтекла валидност. Вземете друга от настройките на профила.",
+    "email_verify_button_account": "Към профила",
+    "version_update_available_title": "Налично е ново издание",
+    "version_update_available_description": "Сървърът на ntfy е обновен. Презаредете страницата.",
+    "signup_form_email": "Адрес на ел. поща (по желание, с цел възстановяване)",
+    "login_link_forgot_password": "Забравена парола",
+    "reset_password_request_title": "Нулиране на парола",
+    "reset_password_request_description": "Въведете потребителско име или адрес на ел. поща. Ако такъв профил съществува по пощата ще бъде изпратена препратка, от която да смените паролата си.",
+    "reset_password_request_primary_required": "Работи само в случай, че сте задали и потвърдили основен адрес на ел. поща.",
+    "reset_password_request_identifier_label": "Потребителско име или ел. поща",
+    "reset_password_request_button_submit": "Изпращане",
+    "reset_password_sent_title": "Проверете входящата поща",
+    "reset_password_sent_description": "Ако такъв профил съществува на пощата е изпратена препратка, от която да смените паролата си.",
+    "reset_password_back_to_login": "Към вписване",
+    "reset_password_disabled": "Смяната на парола е изключена",
+    "reset_password_title": "Задаване на нова парола",
+    "reset_password_form_password": "Нова парола",
+    "reset_password_form_confirm": "Потвърждаване на новата парола",
+    "reset_password_form_button_submit": "Задаване на парола",
+    "reset_password_form_error_invalid": "Препратката е неприемлива или изтекла. Поискайте нова.",
+    "reset_password_success_title": "Паролата е променена",
+    "reset_password_success_description": "Паролата е сменена. Можете да се впишете с нея.",
+    "action_bar_reload": "Презареждане на приложението",
+    "account_basics_emails_title": "Адреси на ел. поща",
+    "account_basics_emails_description": "За известия и промяна на праролата",
+    "account_basics_emails_no_emails_yet": "Не са зададени ел. адреси",
+    "account_basics_emails_copied_to_clipboard": "Адресът на ел. поща е копиран",
+    "account_basics_emails_chip_actions_primary": "Основен адрес, използван като ел. адрес по подразбиране. Щракнете за действия.",
+    "account_basics_emails_chip_actions_verified": "Може да бъде използван за известия. Щракнете за действия.",
+    "account_basics_emails_chip_actions_unverified": "Непотвърден адрес, проверете входящата поща. Щракнете за действия.",
+    "account_basics_emails_unverified": "непотвърден",
+    "account_basics_emails_set_primary": "Задаване като основен",
+    "account_basics_emails_delete": "Премахване",
+    "account_basics_emails_resend": "Повторно изпращане на писмо за потвърждаване",
+    "account_basics_emails_resent": "Писмото е изпратено, проверете входящата поща",
+    "account_basics_emails_primary_elsewhere": "Този адрес на ел. поща е използван като основен адрес на друг профил",
+    "account_basics_emails_no_recovery_warning": "Добавете адрес на ел. поща, за да можете да възстановите профила ако забравите паролата.",
+    "account_basics_emails_no_primary_warning": "Добавете основен адрес на ел. поща, за да можете да възстановите профила ако забравите паролата.",
+    "account_basics_emails_dialog_title": "Добавяне адреси на ел. поща",
+    "account_basics_emails_dialog_description": "Въведете адрес на ел. поща, който да бъде добавен към профила. Ще бъде изпратена препратка за потвърждение.",
+    "account_basics_emails_dialog_email_label": "Адрес на ел. поща",
+    "account_basics_emails_dialog_email_placeholder": "напр. user@example.com",
+    "account_basics_emails_dialog_verify_button": "Препратка за потвърждаване",
+    "account_basics_emails_dialog_check_inbox": "Проверете входящата поща и посетете препратката за потвърждаване. Докато не го направите адресът ще стои непотвърден.",
+    "account_basics_tier_provisioned": "Потребител от външна система",
+    "account_usage_emails_none": "Профилът не може да изпраща известия по ел. поща",
+    "prefs_users_dialog_base_url_invalid": "Неприемлив формат на адрес. Трябва да започва с http:// или https://",
+    "prefs_users_dialog_base_url_exists": "Потребител за този адрес на услуга вече съществува"
 }

web/public/static/langs/cs.json

@@ -398,7 +398,7 @@
     "prefs_notifications_web_push_disabled_description": "Oznámení jsou přijímána, když je webová aplikace spuštěna (přes WebSocket)",
     "prefs_notifications_web_push_disabled": "Zakázáno",
     "prefs_appearance_theme_title": "Motiv",
-    "prefs_appearance_theme_system": "Systém (výchozí)",
+    "prefs_system_default": "Systém výchozí",
     "prefs_appearance_theme_dark": "Tmavý režim",
     "prefs_appearance_theme_light": "Světlý režim",
     "web_push_subscription_expiring_title": "Oznámení budou pozastavena",

web/public/static/langs/de.json

@@ -236,8 +236,8 @@
     "account_usage_limits_reset_daily": "Verbrauchslimits werden täglich um Mitternacht (UTC) zurückgesetzt",
     "account_basics_password_title": "Kennwort",
     "account_basics_tier_description": "Der Funktionsumfang Deines Konto-Levels",
-    "account_basics_tier_admin_suffix_with_tier": "(mit Level {{tier}})",
-    "account_basics_tier_admin_suffix_no_tier": "(kein Level)",
+    "account_basics_tier_admin_suffix_with_tier": "mit Level {{tier}}",
+    "account_basics_tier_admin_suffix_no_tier": "kein Level",
     "account_basics_tier_admin": "Admin",
     "account_basics_tier_basic": "Basic",
     "account_basics_tier_free": "Kostenlos",
@@ -395,7 +395,7 @@
     "prefs_notifications_web_push_enabled": "Aktiviert für {{server}}",
     "prefs_notifications_web_push_disabled": "Deaktiviert",
     "prefs_appearance_theme_title": "Thema",
-    "prefs_appearance_theme_system": "System (Standard)",
+    "prefs_system_default": "System Standard",
     "prefs_appearance_theme_dark": "Nachtmodus",
     "prefs_appearance_theme_light": "Tagmodus",
     "error_boundary_button_reload_ntfy": "ntfy neu laden",

web/public/static/langs/en.json

@@ -412,9 +412,17 @@
   "prefs_appearance_title": "Appearance",
   "prefs_appearance_language_title": "Language",
   "prefs_appearance_theme_title": "Theme",
-  "prefs_appearance_theme_system": "System (default)",
+  "prefs_system_default": "System default",
   "prefs_appearance_theme_dark": "Dark mode",
   "prefs_appearance_theme_light": "Light mode",
+  "prefs_appearance_date_format_title": "Date format",
+  "prefs_appearance_date_format_iso8601": "ISO 8601",
+  "prefs_appearance_date_format_dmy": "Day/Month/Year",
+  "prefs_appearance_date_format_dmy_dot": "Day.Month.Year",
+  "prefs_appearance_date_format_mdy": "Month/Day/Year",
+  "prefs_appearance_time_format_title": "Time format",
+  "prefs_appearance_time_format_12h": "12-hour",
+  "prefs_appearance_time_format_24h": "24-hour",
   "prefs_reservations_title": "Reserved topics",
   "prefs_reservations_description": "You can reserve topic names for personal use here. Reserving a topic gives you ownership over the topic, and allows you to define access permissions for other users over the topic.",
   "prefs_reservations_limit_reached": "You reached your reserved topics limit.",

web/public/static/langs/es.json

@@ -395,7 +395,7 @@
     "prefs_notifications_web_push_enabled_description": "Las notificaciones se reciben incluso cuando la aplicación web no se está ejecutando (a través de Web Push)",
     "prefs_notifications_web_push_disabled": "Desactivado",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_appearance_theme_system": "Sistema (por defecto)",
+    "prefs_system_default": "Sistema por defecto",
     "error_boundary_button_reload_ntfy": "Volver a cargar ntfy",
     "web_push_subscription_expiring_title": "Las notificaciones se pausarán",
     "prefs_notifications_web_push_disabled_description": "Las notificaciones se reciben cuando la aplicación web se está ejecutando (a través de WebSocket)",
@@ -406,5 +406,25 @@
     "web_push_unknown_notification_title": "Notificación desconocida recibida del servidor",
     "web_push_unknown_notification_body": "Puede que necesites actualizar ntfy abriendo la aplicación web",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Un usuario provisionado no se puede editar o eliminar",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "No se puede editar o eliminar un token provisionado"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "No se puede editar o eliminar un token provisionado",
+    "common_refresh": "Recargar",
+    "email_verify_progress_title": "Verificando tu correo...",
+    "email_verify_success_title": "Correo verificado",
+    "email_verify_success_description": "Tu correo electronico ha sido verificado y añadido a tu cuenta.",
+    "email_verify_error_title": "La verificacion falló",
+    "email_verify_error_description": "Este enlace de verificacion es invalido o ha expirado. Puedes solicitar unon nuevo desde los ajustes de tu cuenta.",
+    "email_verify_button_account": "Ir a cuenta",
+    "version_update_available_title": "Nueva versión disponible",
+    "version_update_available_description": "El servidor ntfy ha sido actualizado. Por favor recarga la página.",
+    "signup_form_email": "Correo (opcional, para recuperación de cuenta)",
+    "login_link_forgot_password": "Olvidé mi contraseña",
+    "reset_password_request_title": "Reiniciar contraseña",
+    "reset_password_request_description": "Introduce tu usuario o correo electrónico. Si una cuenta existe, un enlace para reiniciar tu contraseña será enviado a tu correo.",
+    "reset_password_request_primary_required": "Esto solo funciona si ya añadiste un correo eletrónico primario y lo verificaste.",
+    "reset_password_request_identifier_label": "Usuario o correo",
+    "reset_password_request_button_submit": "Enviar enlace de reinicio",
+    "reset_password_sent_title": "Checa tu bandeja de entrada",
+    "reset_password_sent_description": "Si una cuenta existe, un enlace para reiniciar tu contraseña se acaba de enviar a tu correo.",
+    "reset_password_back_to_login": "Regresar a iniciar sesión",
+    "reset_password_disabled": "Reinicio de contraseña ha sido deshabilitado"
 }

web/public/static/langs/et.json

@@ -238,7 +238,7 @@
     "account_basics_tier_title": "Kasutajakonto tüüp",
     "account_basics_tier_description": "Sinu kasutajakonto õigused",
     "account_delete_dialog_button_submit": "Kustuta kasutajakonto jäädavalt",
-    "prefs_appearance_theme_system": "Süsteemi kujundus",
+    "prefs_system_default": "Süsteemi kujundus",
     "prefs_appearance_theme_dark": "Tume kujundus",
     "prefs_appearance_theme_light": "Hele kujundus",
     "prefs_reservations_title": "Reserveeritud teemad",
@@ -332,8 +332,8 @@
     "subscribe_dialog_error_user_not_authorized": "Kasutajal {{username}} puudub volitus",
     "account_usage_of_limit": "piirangust {{limit}}",
     "account_usage_limits_reset_daily": "Kasutuspiirangud lähtestatakse keskööl (UTC järgi)",
-    "account_basics_tier_admin_suffix_with_tier": "(tasemega {{tier}})",
-    "account_basics_tier_admin_suffix_no_tier": "(tase puudub)",
+    "account_basics_tier_admin_suffix_with_tier": "tasemega {{tier}}",
+    "account_basics_tier_admin_suffix_no_tier": "tase puudub",
     "account_upgrade_dialog_title": "Muuda kasutajakonto taset",
     "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} faili kohta",
     "account_upgrade_dialog_tier_features_calls_other": "{{calls}} kõnet päevas",
@@ -405,5 +405,59 @@
     "account_upgrade_dialog_reservations_warning_other": "Sinu praegune teenusepakett võimaldab senise paketiga võrreldes reserveerida vähem teemasid. Enne paketi muutmist <strong>palun esmalt kustuta vähemalt {{count}} reserveeringut</strong>. Seda saad <Link>teha siin</Link>.",
     "prefs_users_description": "Oma kaitstud teemade kasutajaid saad lisada ja eemaldada siin. Palun arvesta, et kasutajanimi ja salasõna on salvestatud veebibrauseri kohalikus andmeruumis.",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Eelsisestatud kasutajat ei saa muuta ega kustutada",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Eelsisestatud tunnusluba ei saa muuta ega kustutada"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Eelsisestatud tunnusluba ei saa muuta ega kustutada",
+    "common_close": "Sulge",
+    "common_refresh": "Värskenda andmeid",
+    "email_verify_progress_title": "Kontrollin sinu e-posti aadressi…",
+    "email_verify_success_title": "E-posti aadress on kontrollitud",
+    "email_verify_success_description": "Sinu a-posti aadress on kontrollitud ja lisatud sinu kasutajakontole.",
+    "email_verify_error_title": "Õigsuse kontrollimine ei õnnestunud",
+    "login_link_forgot_password": "Unustasin salasõna",
+    "reset_password_request_title": "Lähtesta salasõna",
+    "reset_password_request_description": "Sisesta oma kasutajanimi või e-posti aadress. Kui selline kasutajakonto on olemas, siis saadame seotud e-posti aadressile kirja salasõna lähtestamise lingiga.",
+    "reset_password_request_primary_required": "Selline võimalus toimib vaid siis, kui kasutajakontoga on seotud põhiline e-posti aadress ja see on kinnitatud olekus.",
+    "reset_password_request_identifier_label": "Kasutajanimi või e-posti aadress",
+    "reset_password_request_button_submit": "Saada lähtestamise link",
+    "reset_password_sent_title": "Vaata oma saabuvate e-kirjade postkasti",
+    "version_update_available_title": "Saadaval on uus versioon",
+    "version_update_available_description": "ntfy server on uuendatud. Palun laadi leht uuesti.",
+    "signup_form_email": "E-posti aadress (pole kohustuslik, aga on kasutatav kasutajakontole ligipääsu taastamisel)",
+    "reset_password_back_to_login": "Tagasi sisselogimiseks",
+    "reset_password_disabled": "Salasõnade lähtestamise võimalus on lülitatud välja",
+    "reset_password_title": "Sisesta uus salasõna",
+    "reset_password_form_password": "Uus salasõna",
+    "reset_password_form_confirm": "Kinnita uus salasõna",
+    "reset_password_form_button_submit": "Sisesta salasõna",
+    "reset_password_form_error_invalid": "Lähtestamise link on vigane või aegunud. Palun saada see link endale uuesti.",
+    "reset_password_success_title": "Salasõna on muudetud",
+    "reset_password_success_description": "Sinu salasõna on muudetud. Saad nüüd uue salasõnaga sisse logida.",
+    "action_bar_reload": "Laadi rakendus uuesti",
+    "account_basics_emails_title": "E-posti aadressid",
+    "account_basics_emails_description": "E-kirjaga saadetavate teavituste ja salasõna lähtestamise jaoks",
+    "account_basics_emails_no_emails_yet": "E-posti aadresse veel pole",
+    "account_basics_emails_copied_to_clipboard": "E-posti aadress on kopeeritud lõikelauale",
+    "account_basics_emails_delete": "Eemalda aadress",
+    "account_basics_emails_set_primary": "Määra põhiliseks e-posti aadressika",
+    "account_basics_emails_resend": "Saada kinnituskiri uuesti",
+    "account_basics_emails_resent": "Kinnituskiri on saadetud, vaata oma saabuvate kirjade postkasti",
+    "account_basics_emails_dialog_email_label": "E-posti aadress",
+    "account_basics_emails_dialog_email_placeholder": "nt. kadri@toredomeen.com",
+    "prefs_users_dialog_base_url_exists": "Selle teenuse võrguaadressi jaoks on kasutaja juba olemas",
+    "prefs_users_dialog_base_url_invalid": "Vigane võrguaadressi vorming. Alguses peab olema http:// või https://",
+    "account_basics_emails_dialog_verify_button": "Saada kinnituslink",
+    "account_basics_emails_dialog_check_inbox": "Vaata oma saabuvate e-kirjade postkasti ja klõpsa selle e-posti aadressi kinnituskirjas leiduvat linki. Seni on e-posti aadress kinnitamata olekus.",
+    "account_basics_tier_provisioned": "Ettevalmistatud",
+    "account_basics_emails_chip_actions_primary": "Põhiline e-posti aadress, mida kasutatakse vaikimisi aadressina. Tegevuste nägemiseks klõpsa.",
+    "account_basics_emails_chip_actions_verified": "Võid kasutada ka teavituste jaoks. Tegevuste nägemiseks klõpsa.",
+    "account_basics_emails_chip_actions_unverified": "Kinnitamata e-posti aadress, kinnitamiseks vaata oma saabuvate kirjade postkasti. Tegevuste nägemiseks klõpsa.",
+    "account_basics_emails_unverified": "kinnitamata",
+    "email_verify_error_description": "Kinnituse link on vigane või aegunud. Oma kasutajakonto seadistustest võid saata uue.",
+    "email_verify_button_account": "Mine kasutajakonto juurde",
+    "reset_password_sent_description": "Kui selline kasutajakonto on olemas, saadetakse sinna e-kiri salasõna lähtestamiseks vajaliku lingiga.",
+    "account_basics_emails_primary_elsewhere": "Seda e-posti aadressi kasutatakse põhilise e-postiaadressina ühe teise kasutajakonto juures",
+    "account_basics_emails_no_recovery_warning": "Tagamaks, et saada peale salasõna unustamist/kaotamist vajadusel taastada ligipääsu oma kasutajakontole lisa vähemalt üks e-posti aadress.",
+    "account_basics_emails_no_primary_warning": "Tagamaks, et saada peale salasõna unustamist/kaotamist vajadusel taastada ligipääsu oma kasutajakontole põhiline e-posti aadress.",
+    "account_basics_emails_dialog_title": "Lisa e-posti aadress",
+    "account_basics_emails_dialog_description": "Sisesta kasutajakontole lisatav e-posti aadress. Kinnitamaks, et tegemist on sinu e-posti aadressiga saadame sinna kinnituslingi.",
+    "account_usage_emails_none": "Selle kasutajakontoga seotud teavitusi pole võimalik saata"
 }

web/public/static/langs/fi.json

@@ -390,7 +390,7 @@
     "alert_notification_ios_install_required_title": "iOS-asennus vaaditaan",
     "publish_dialog_checkbox_markdown": "Muotoile Markdownina",
     "prefs_notifications_web_push_title": "Taustailmoitukset",
-    "prefs_appearance_theme_system": "Järjestelmä (oletus)",
+    "prefs_system_default": "Järjestelmä oletus",
     "alert_notification_permission_denied_description": "Ota ilmoitukset uudelleen käyttöön selaimessa",
     "prefs_appearance_theme_title": "Teema",
     "prefs_appearance_theme_light": "Vaalea tila",

web/public/static/langs/fr.json

@@ -64,7 +64,7 @@
     "notifications_actions_not_supported": "Cette action n'est pas supportée dans l'application web",
     "notifications_actions_http_request_title": "Envoyer une requête HTTP {{method}} à {{url}}",
     "publish_dialog_attachment_limits_quota_reached": "quota dépassé, {{remainingBytes}} restants",
-    "publish_dialog_tags_placeholder": "Liste d'étiquettes séparée par des virgules, par ex. avertissement, backup-srv1",
+    "publish_dialog_tags_placeholder": "Liste d'étiquettes séparées par des virgules, par ex. avertissement, backup-srv1",
     "publish_dialog_priority_label": "Priorité",
     "publish_dialog_click_label": "URL du clic",
     "publish_dialog_click_placeholder": "URL ouverte lors d'un clic sur la notification",
@@ -248,8 +248,8 @@
     "account_basics_tier_title": "Type de compte",
     "account_basics_tier_description": "Le niveau de puissance de votre compte",
     "account_basics_tier_admin": "Administrateur",
-    "account_basics_tier_admin_suffix_with_tier": "(avec le tarif {{tier}})",
-    "account_basics_tier_admin_suffix_no_tier": "(pas de tarif)",
+    "account_basics_tier_admin_suffix_with_tier": "avec le niveau {{tier}}",
+    "account_basics_tier_admin_suffix_no_tier": "pas de niveau",
     "account_basics_tier_free": "Gratuit",
     "account_basics_tier_upgrade_button": "Passer à Pro",
     "account_basics_tier_change_button": "Changer",
@@ -396,7 +396,7 @@
     "prefs_notifications_web_push_enabled": "Activé pour {{server}}",
     "prefs_notifications_web_push_disabled": "Désactivé",
     "prefs_appearance_theme_title": "Thème",
-    "prefs_appearance_theme_system": "Système (défaut)",
+    "prefs_system_default": "Système défaut",
     "prefs_appearance_theme_dark": "Mode sombre",
     "prefs_appearance_theme_light": "Mode clair",
     "error_boundary_button_reload_ntfy": "Recharger ntfy",
@@ -405,5 +405,59 @@
     "web_push_unknown_notification_title": "Notification inconnue reçue du serveur",
     "web_push_unknown_notification_body": "Il est possible que vous deviez mettre à jour ntfy en ouvrant l'application web",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Un utilisateur provisionné ne peut pas être modifié ou supprimé",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossible de modifier ou de supprimer le jeton provisionné"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossible de modifier ou de supprimer le jeton provisionné",
+    "common_close": "Fermer",
+    "common_refresh": "Rafraichir",
+    "email_verify_progress_title": "Vérification de votre email...",
+    "email_verify_success_title": "Email vérifié",
+    "email_verify_success_description": "Votre adresse mail a été vérifiée et ajoutée à votre compte.",
+    "email_verify_error_title": "Echec de la vérification",
+    "email_verify_error_description": "Ce lien de vérification est invalide ou a expiré. Vous pouvez en demander un nouveau depuis les paramètres de votre compte.",
+    "email_verify_button_account": "Aller au compte",
+    "version_update_available_title": "Nouvelle version disponible",
+    "version_update_available_description": "Le serveur ntfy a été lis à jour. Veuillez rafraichir la page.",
+    "signup_form_email": "Email (optionnel, pour la récupération du compte)",
+    "login_link_forgot_password": "Mot de passe oublié",
+    "reset_password_request_title": "Réinitialiser le mot de passe",
+    "reset_password_request_description": "Entrer votre nom d'utilisateur ou une adresse mail. Si un compte existe, un lien pour réinitialiser votre mot de passe sera envoyé par mail.",
+    "reset_password_request_primary_required": "Ceci ne fonctionne que si vous avez ajouté une adresse mail primaire et que vous l'avez vérifiée.",
+    "reset_password_request_identifier_label": "Nom d'utilisateur ou email",
+    "reset_password_request_button_submit": "Envoyer un lien de réinitialisation",
+    "reset_password_sent_title": "Vérifiez votre boîte de réception",
+    "reset_password_sent_description": "Si un compte existe, un lien pour réinitialiser votre mot de passe sera envoyé par mail.",
+    "reset_password_back_to_login": "Retour à l'authentification",
+    "reset_password_disabled": "La réinitialisation du mot de passe est désactivée",
+    "reset_password_title": "Définir un nouveau mot de passe",
+    "reset_password_form_password": "Nouveau mot de passe",
+    "reset_password_form_confirm": "Confirmer le nouveau mot de passe",
+    "reset_password_form_button_submit": "Définir le mot de passe",
+    "reset_password_form_error_invalid": "Ce lien de réinitialisation est invalide ou a expiré. Merci d'en demander un nouveau.",
+    "reset_password_success_title": "Mot de passe modifié",
+    "reset_password_success_description": "Votre mot de passe a été changé. Vous pouvez maintenant vous authentifier avec votre nouveau mot de passe.",
+    "action_bar_reload": "Recharger l'application",
+    "account_basics_emails_title": "Adresses mail",
+    "account_basics_emails_description": "Pour les notifications par mail et la réinitialisation du mot de passe",
+    "account_basics_emails_no_emails_yet": "Pas encore d'emails",
+    "account_basics_emails_copied_to_clipboard": "Adresse mail copiée dans le presse papiers",
+    "account_basics_emails_chip_actions_primary": "Adresse primaire, utilisée comme votre adresse mail par défaut. Cliquer pour choisir l'action.",
+    "account_basics_emails_chip_actions_verified": "Peut être utilisée pour les notifications. Cliquer pour choisir l'action.",
+    "account_basics_emails_chip_actions_unverified": "Adresse non vérifiée, vérifier votre boîte de réception pour la vérifier. Cliquer pour choisir l'action.",
+    "account_basics_emails_unverified": "Non vérifié",
+    "account_basics_emails_set_primary": "Définir comme adresse mail primaire",
+    "account_basics_emails_delete": "Supprimer l'adresse",
+    "account_basics_emails_resend": "Renvoyer le mail de vérification",
+    "account_basics_emails_resent": "Mail de vérification envoyé, vérifier votre boite de réception",
+    "account_basics_emails_primary_elsewhere": "Cette adresse mail est utilisée comme adresse primaire d'un autre compte",
+    "account_basics_emails_no_recovery_warning": "Ajouter au moins une adresse mail pour garantir que vous pouvez récupérer votre compte si vous oubliez votre mot de passe.",
+    "account_basics_emails_no_primary_warning": "Ajouter une adresse mail primaire pour garantir la récupération de votre compte si vous oubliez votre mot de paqsse.",
+    "account_basics_emails_dialog_title": "Ajouter une adresse mail",
+    "account_basics_emails_dialog_description": "Entrer une adresse mail pour l'ajouter à votre compte. Un lien de vérification sera envoyé pour confirmer votre adresse.",
+    "account_basics_emails_dialog_email_label": "Adresse mail",
+    "account_basics_emails_dialog_email_placeholder": "par ex. utilisateur@example.com",
+    "account_basics_emails_dialog_verify_button": "Envoyer le lien de vérification",
+    "account_basics_emails_dialog_check_inbox": "Vérifier votre boîte de réception et cliquer sur le lien de vérification pour confirmer cette adresse mail. Elle apparaitra non vérifiée tant qu'elle n'aura pas été vérifiée.",
+    "account_basics_tier_provisioned": "Provisionné",
+    "account_usage_emails_none": "Aucune notification par mail ne peut être envoyée avec ce compte",
+    "prefs_users_dialog_base_url_invalid": "Format d'URL invalide. Doit commencer par http:// ou https://",
+    "prefs_users_dialog_base_url_exists": "Un utilisateur pour cette URL existe déjà"
 }

web/public/static/langs/gl.json

@@ -398,7 +398,7 @@
     "prefs_notifications_web_push_enabled": "Activadas para {{server}}",
     "prefs_notifications_web_push_disabled": "Desactivadas",
     "prefs_appearance_theme_title": "Decorado",
-    "prefs_appearance_theme_system": "Sistema (por defecto)",
+    "prefs_system_default": "Sistema por defecto",
     "prefs_appearance_theme_dark": "Modo escuro",
     "prefs_appearance_theme_light": "Modo claro",
     "error_boundary_button_reload_ntfy": "Recargar ntfy",

web/public/static/langs/hu.json

@@ -273,8 +273,8 @@
     "account_basics_tier_title": "Számlatípus",
     "account_basics_tier_description": "Fiókod erősségi szintje",
     "account_basics_tier_admin": "Admin",
-    "account_basics_tier_admin_suffix_with_tier": "(a{{tier}}szinttel)",
-    "account_basics_tier_admin_suffix_no_tier": "(nincs besorolás)",
+    "account_basics_tier_admin_suffix_with_tier": "C(a{{tier}}szinttel)",
+    "account_basics_tier_admin_suffix_no_tier": "nincs szint",
     "account_basics_tier_basic": "Alapvető",
     "account_basics_tier_free": "Ingyenes",
     "account_basics_tier_interval_monthly": "havonta",
@@ -371,7 +371,7 @@
     "prefs_users_description_no_sync": "A felhasználónevek és jelszavak nem kerülnek szinkronizálásra a fiókjával.",
     "prefs_users_table_cannot_delete_or_edit": "A bejelentkezett felhasználót nem lehet törölni vagy szerkeszteni",
     "prefs_appearance_theme_title": "Téma",
-    "prefs_appearance_theme_system": "Rendszer (alapértelmezett)",
+    "prefs_system_default": "Rendszer alapértelmezett",
     "prefs_appearance_theme_dark": "Sötét mód",
     "prefs_appearance_theme_light": "Világos mód",
     "prefs_reservations_title": "Fenntartott témák",
@@ -405,5 +405,59 @@
     "web_push_subscription_expiring_title": "Az értesítések felfüggesztésre kerülnek",
     "web_push_subscription_expiring_body": "Nyissa meg az ntfy alkalmazást, hogy továbbra is értesítéseket kapjon",
     "web_push_unknown_notification_title": "Ismeretlen értesítés érkezett a szerverről",
-    "web_push_unknown_notification_body": "Előfordulhat, hogy a webalkalmazás megnyitásával frissítenie kell az ntfy-t"
+    "web_push_unknown_notification_body": "Előfordulhat, hogy a webalkalmazás megnyitásával frissítenie kell az ntfy-t",
+    "common_close": "Bezár",
+    "common_refresh": "Frissítés",
+    "email_verify_progress_title": "E-mail címed ellenőrzése...",
+    "email_verify_success_title": "E-mail cím ellenőrizve",
+    "email_verify_success_description": "Az e-mail címedet ellenőriztük és hozzáadtuk a fiókodhoz.",
+    "email_verify_error_title": "Az ellenőrzés sikertelen",
+    "email_verify_error_description": "Ez az ellenőrző link érvénytelen vagy lejárt. Újat kérhet a fiókbeállításaiban.",
+    "email_verify_button_account": "Ugrás a fiókhoz",
+    "version_update_available_title": "Új verzió elérhető",
+    "version_update_available_description": "Az ntfy szerver frissült. Kérjük, frissítse az oldalt.",
+    "signup_form_email": "E-mail cím (opcionális, a fiók helyreállításához)",
+    "login_link_forgot_password": "Elfelejtett jelszó",
+    "reset_password_request_title": "Jelszó visszaállítása",
+    "reset_password_request_description": "Add meg a felhasználóneved vagy e-mail címed. Ha van fiókod, akkor e-mailben kapsz egy linket a jelszavad visszaállításához.",
+    "reset_password_request_primary_required": "Ez csak akkor működik, ha már hozzáadott egy elsődleges e-mail címet, és ellenőrizte azt.",
+    "reset_password_request_identifier_label": "Felhasználónév vagy e-mail cím",
+    "reset_password_request_button_submit": "Visszaállítási link küldése",
+    "reset_password_sent_title": "Ellenőrizd a beérkező leveleidet",
+    "reset_password_sent_description": "Ha létezik fiók, e-mailben elküldtük a jelszó visszaállításához szükséges linket.",
+    "reset_password_back_to_login": "Vissza a bejelentkezéshez",
+    "reset_password_disabled": "Jelszó-visszaállítás le van tiltva",
+    "reset_password_title": "Új jelszó beállítása",
+    "reset_password_form_password": "Új jelszó",
+    "reset_password_form_confirm": "Új jelszó megerősítése",
+    "reset_password_form_button_submit": "Jelszó beállítása",
+    "reset_password_form_error_invalid": "Ez a visszaállító link érvénytelen vagy lejárt. Kérjen újat.",
+    "reset_password_success_title": "Jelszó megváltozott",
+    "reset_password_success_description": "A jelszava megváltozott. Most már bejelentkezhet az új jelszavával.",
+    "action_bar_reload": "Alkalmazás újratöltése",
+    "account_basics_emails_title": "E-mail címek",
+    "account_basics_emails_description": "E-mail értesítésekért és jelszó-visszaállításért",
+    "account_basics_emails_no_emails_yet": "Még nincsenek e-mailek",
+    "account_basics_emails_copied_to_clipboard": "E-mail cím másolva a vágólapra",
+    "account_basics_emails_chip_actions_primary": "Elsődleges cím, amelyet alapértelmezett e-mail címként használunk. Kattintson a műveletekhez.",
+    "account_basics_emails_chip_actions_verified": "Elsődleges cím, amelyet alapértelmezett e-mail címként használunk. Kattintson a művelethez.",
+    "account_basics_emails_chip_actions_unverified": "Értesítésekhez használható. Kattintson a műveletekért.",
+    "account_basics_emails_unverified": "ellenőrizetlen",
+    "account_basics_emails_set_primary": "Beállítás elsődleges e-mail címként",
+    "account_basics_emails_delete": "Cím eltávolítása",
+    "account_basics_emails_resend": "Ellenőrző e-mail újraküldése",
+    "account_basics_emails_resent": "Megerősítő e-mail elküldve, ellenőrizze a beérkező leveleit",
+    "account_basics_emails_primary_elsewhere": "Ez az e-mail cím egy másik fiók elsődleges címként van használatban.",
+    "account_basics_emails_no_recovery_warning": "Adjon meg legalább egy e-mail címet, hogy biztosan vissza tudja állítani fiókját, ha elveszíti jelszavát.",
+    "account_basics_emails_no_primary_warning": "Adjon meg egy elsődleges e-mail címet, hogy biztosan vissza tudja állítani fiókját, ha elveszíti jelszavát.",
+    "account_basics_emails_dialog_title": "E-mail cím hozzáadása",
+    "account_basics_emails_dialog_description": "Add meg az e-mail címedet, hogy hozzáadhasd a fiókodhoz. Egy ellenőrző linket fogsz küldeni, hogy megerősítsd, hogy a címed a tiéd.",
+    "account_basics_emails_dialog_email_label": "Email cím",
+    "account_basics_emails_dialog_email_placeholder": "pl. user@example.com",
+    "account_basics_emails_dialog_verify_button": "Ellenőrző link küldése",
+    "account_basics_emails_dialog_check_inbox": "Ellenőrizd a beérkező leveleidet, és kattints a megerősítő linkre az e-mail cím megerősítéséhez. Amíg ezt nem teszed meg, addig ellenőrizetlenként fog megjelenni.",
+    "account_basics_tier_provisioned": "Kiépített",
+    "prefs_users_dialog_base_url_exists": "Már létezik egy felhasználó ehhez a szolgáltatás URL címéhez.",
+    "account_usage_emails_none": "Ezzel a fiókkal nem küldhetők e-mail értesítések",
+    "prefs_users_dialog_base_url_invalid": "érvénytelen URL-formátum. http:// vagy https:// előtaggal kell kezdődnie"
 }

web/public/static/langs/id.json

@@ -237,7 +237,7 @@
     "account_usage_limits_reset_daily": "Batasan penggunaan diatur ulang setiap hari di tengah malam (UTC)",
     "account_basics_tier_title": "Jenis akun",
     "account_basics_tier_description": "Tingkat daya akun Anda",
-    "account_basics_tier_admin_suffix_no_tier": "(tidak ada peringkat)",
+    "account_basics_tier_admin_suffix_no_tier": "tanpa tingkatan",
     "account_basics_tier_basic": "Dasaran",
     "account_basics_tier_change_button": "Ubah",
     "account_basics_tier_paid_until": "Langganan dibayar sampai {{date}}, dan akan dibayar secara otomatis",
@@ -299,7 +299,7 @@
     "prefs_reservations_dialog_title_edit": "Sunting reservasi topik",
     "subscribe_dialog_subscribe_button_generate_topic_name": "Buat nama",
     "account_basics_title": "Akun",
-    "account_basics_tier_admin_suffix_with_tier": "(dengan peringkat {{tier}})",
+    "account_basics_tier_admin_suffix_with_tier": "dengan tingkatan {{tier}}",
     "account_basics_tier_free": "Gratis",
     "account_tokens_dialog_expires_label": "Token akses kedaluwarsa dalam",
     "account_basics_username_description": "Hei, itu Anda ❤",
@@ -399,12 +399,66 @@
     "prefs_notifications_web_push_enabled": "Diaktifkan untuk {{server}}",
     "prefs_notifications_web_push_disabled": "Dinonaktifkan",
     "prefs_appearance_theme_dark": "Mode gelap",
-    "prefs_appearance_theme_system": "Sistem (bawaan)",
+    "prefs_system_default": "Sistem bawaan",
     "prefs_appearance_theme_light": "Mode terang",
     "web_push_subscription_expiring_title": "Notifikasi akan dijeda",
     "web_push_subscription_expiring_body": "Buka ntfy untuk terus menerima notifikasi",
     "web_push_unknown_notification_title": "Notifikasi yang tidak diketahui diterima dari server",
     "web_push_unknown_notification_body": "Anda mungkin harus memperbarui ntfy dengan membuka aplikasi web",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Pengguna yang telah ditetapkan tidak dapat diedit atau dihapus",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Tidak dapat mengedit atau menghapus token yang disediakan"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Tidak dapat mengedit atau menghapus token yang disediakan",
+    "common_close": "Tutup",
+    "common_refresh": "Segarkan",
+    "email_verify_progress_title": "Memverifikasi alamat email Anda...",
+    "email_verify_success_title": "Email telah diverifikasi",
+    "email_verify_success_description": "Alamat email Anda telah diverifikasi dan ditambahkan ke akun Anda.",
+    "email_verify_error_title": "Verifikasi gagal",
+    "email_verify_error_description": "Tautan verifikasi ini tidak valid atau sudah kedaluwarsa. Anda dapat meminta tautan baru dari pengaturan akun Anda.",
+    "email_verify_button_account": "Pergi ke akun",
+    "version_update_available_title": "Versi baru sudah tersedia",
+    "version_update_available_description": "Server ntfy telah diperbarui. Silakan segarkan halaman ini.",
+    "signup_form_email": "Email (opsional, untuk pemulihan akun)",
+    "login_link_forgot_password": "Lupa kata sandi",
+    "reset_password_request_title": "Atur ulang kata sandi",
+    "reset_password_request_description": "Masukkan nama pengguna atau alamat email Anda. Jika akun tersebut sudah ada, tautan untuk mengatur ulang kata sandi akan dikirimkan melalui email.",
+    "reset_password_request_primary_required": "Fitur ini hanya berfungsi jika Anda sudah menambahkan alamat email utama dan memverifikasinya.",
+    "reset_password_request_identifier_label": "Nama pengguna atau email",
+    "reset_password_request_button_submit": "Kirim tautan atur ulang",
+    "reset_password_sent_title": "Periksa kotak masuk Anda",
+    "reset_password_sent_description": "Jika akun tersebut sudah ada, tautan untuk mengatur ulang kata sandi Anda telah dikirimkan melalui email.",
+    "reset_password_back_to_login": "Kembali ke halaman masuk",
+    "reset_password_disabled": "Pengaturan ulang kata sandi dinonaktifkan",
+    "reset_password_title": "Atur kata sandi baru",
+    "reset_password_form_password": "Kata sandi baru",
+    "reset_password_form_confirm": "Konfirmasi kata sandi baru",
+    "reset_password_form_button_submit": "Atur kata sandi",
+    "reset_password_form_error_invalid": "Tautan pengaturan ulang ini tidak sah atau sudah kedaluwarsa. Silakan minta tautan baru.",
+    "reset_password_success_title": "Kata sandi diubah",
+    "reset_password_success_description": "Kata sandi Anda telah diubah. Sekarang Anda dapat masuk menggunakan kata sandi baru Anda.",
+    "action_bar_reload": "Muat ulang aplikasi",
+    "account_basics_emails_title": "Alamat email",
+    "account_basics_emails_description": "Untuk pemberitahuan melalui email dan pengaturan ulang kata sandi",
+    "account_basics_emails_no_emails_yet": "Belum ada email",
+    "account_basics_emails_copied_to_clipboard": "Alamat email telah disalin ke papan klip",
+    "account_basics_emails_chip_actions_primary": "Alamat utama, yang digunakan sebagai alamat email utama Anda. Klik untuk melakukan tindakan.",
+    "account_basics_emails_chip_actions_verified": "Dapat digunakan untuk pemberitahuan. Klik untuk melakukan tindakan.",
+    "account_basics_emails_chip_actions_unverified": "Alamat yang belum diverifikasi, silakan periksa kotak masuk Anda untuk melakukan verifikasi. Klik untuk melakukan tindakan.",
+    "account_basics_emails_unverified": "belum diverifikasi",
+    "account_basics_emails_set_primary": "Tetapkan sebagai email utama",
+    "account_basics_emails_delete": "Hapus alamat",
+    "account_basics_emails_resend": "Kirim ulang email verifikasi",
+    "account_basics_emails_resent": "Email verifikasi telah dikirim, silakan periksa kotak masuk Anda",
+    "account_basics_emails_primary_elsewhere": "Alamat email ini digunakan sebagai alamat utama pada akun lain",
+    "account_basics_emails_no_recovery_warning": "Tambahkan setidaknya satu alamat email agar Anda dapat memulihkan akun Anda jika lupa kata sandi.",
+    "account_basics_emails_no_primary_warning": "Tambahkan alamat email utama agar Anda dapat memulihkan akun Anda jika lupa kata sandi.",
+    "account_basics_emails_dialog_title": "Tambahkan alamat email",
+    "account_basics_emails_dialog_description": "Masukkan alamat email untuk menambahkannya ke akun Anda. Tautan verifikasi akan dikirimkan untuk memastikan bahwa alamat email tersebut memang milik Anda.",
+    "account_basics_emails_dialog_email_label": "Alamat email",
+    "account_basics_emails_dialog_email_placeholder": "misalnya user@example.com",
+    "account_basics_emails_dialog_verify_button": "Kirim tautan verifikasi",
+    "account_basics_emails_dialog_check_inbox": "Periksa kotak masuk Anda dan klik tautan verifikasi untuk mengonfirmasi alamat email ini. Alamat email tersebut akan tetap berstatus belum diverifikasi sampai Anda melakukannya.",
+    "account_basics_tier_provisioned": "Telah disediakan",
+    "account_usage_emails_none": "Tidak ada pemberitahuan email yang dapat dikirim melalui akun ini",
+    "prefs_users_dialog_base_url_invalid": "Format URL tidak sah. Harus diawali dengan http:// atau https://",
+    "prefs_users_dialog_base_url_exists": "Pengguna dengan URL layanan ini sudah ada"
 }

web/public/static/langs/it.json

@@ -252,8 +252,8 @@
     "account_basics_tier_title": "Tipo di account",
     "account_basics_tier_description": "Permessi del tuo account",
     "account_basics_tier_admin": "Amministratore",
-    "account_basics_tier_admin_suffix_with_tier": "(con livello {{tier}})",
-    "account_basics_tier_admin_suffix_no_tier": "(nessun livello)",
+    "account_basics_tier_admin_suffix_with_tier": "con livello {{tier}}",
+    "account_basics_tier_admin_suffix_no_tier": "nessun livello",
     "account_basics_tier_basic": "Base",
     "account_basics_tier_free": "Gratuito",
     "account_usage_emails_title": "Email inviate",
@@ -390,7 +390,7 @@
     "prefs_notifications_web_push_disabled": "Disabilitato",
     "prefs_users_table_cannot_delete_or_edit": "Impossibile eliminare o modificare l'utente registrato",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_appearance_theme_system": "Sistema (predefinito)",
+    "prefs_system_default": "Sistema predefinito",
     "prefs_appearance_theme_dark": "Modalità scura",
     "prefs_appearance_theme_light": "Modalità chiara",
     "prefs_reservations_table_topic_header": "Argomento",
@@ -405,5 +405,59 @@
     "account_tokens_dialog_expires_x_hours": "Il token scade tra {{hours}} ore",
     "prefs_reservations_table": "Tabella argomenti riservati",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Un utente autorizzato non può essere modificato o eliminato",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossibile modificare o eliminare il token fornito"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossibile modificare o eliminare il token fornito",
+    "common_close": "Chiudi",
+    "common_refresh": "Aggiorna",
+    "email_verify_progress_title": "Verificando il tuo indirizzo di posta elettronica...",
+    "email_verify_success_title": "Indirizzo di posta elettronica verificato",
+    "email_verify_success_description": "Il tuo indirizzo di posta elettronica è stato verificato ed aggiunto al tuo profilo.",
+    "email_verify_error_title": "Verifica non riuscita",
+    "email_verify_error_description": "Questo indirizzo di verifica è invalido o scaduto. Puoi richiederne un'altro dalle impostazioni del profilo.",
+    "email_verify_button_account": "Vai al tuo profilo",
+    "version_update_available_title": "Nuova versione disponibile",
+    "version_update_available_description": "Il server ntfy è stato aggiornato. Ricarica la pagina.",
+    "signup_form_email": "Indirizzo di posta elettronica (opzionale, per il recupero del profilo)",
+    "login_link_forgot_password": "Password dimenticata",
+    "reset_password_request_title": "Reimposta la password",
+    "reset_password_request_description": "Inserisci il tuo nome utente e indirizzo di posta elettronica. Se un profilo esiste, un indirizzo per reimpostare la password sarà inviato tramite posta elettronica.",
+    "reset_password_request_primary_required": "Questa procedura funziona solamente se hai già aggiunto un indirizzo di posta elettronica primario e lo hai verificato.",
+    "reset_password_request_identifier_label": "Nome utente o indirizzo di posta elettronica",
+    "reset_password_request_button_submit": "Invia collegamento per la reimpostazione della password",
+    "reset_password_sent_title": "Controlla la tua casella di posta elettronica in arrivo",
+    "reset_password_sent_description": "Se un profilo esiste, un indirizzo per reimpostare la password è stato inviato tramite posta elettronica.",
+    "reset_password_back_to_login": "Ritorna all'accesso",
+    "reset_password_disabled": "La reimpostazione della password è disabilitata",
+    "reset_password_title": "Imposta una nuova password",
+    "reset_password_form_password": "Nuova password",
+    "reset_password_form_confirm": "Conferma nuova password",
+    "reset_password_form_button_submit": "Imposta la password",
+    "reset_password_form_error_invalid": "Questo indirizzo di reimpostazione delle credenziali è invalido o scaduto. Richiederne uno nuovo.",
+    "reset_password_success_title": "Password modificata",
+    "reset_password_success_description": "La tua password è stata modificata. Ora puoi accedere con la tua nuova password.",
+    "action_bar_reload": "Ricarica app",
+    "account_basics_emails_title": "Indirizzo di posta elettronica",
+    "account_basics_emails_description": "Per notifiche tramite posta elettronica e reimpostazione della password",
+    "account_basics_emails_no_emails_yet": "Ancora nessun messaggio di posta elettronica",
+    "account_basics_emails_copied_to_clipboard": "Indirizzo di posta elettronica copiato negli appunti",
+    "account_basics_emails_chip_actions_primary": "Indirizzo primario, utilizzato come indirizzo di posta elettronica predefinito. Clicca per azioni.",
+    "account_basics_emails_chip_actions_verified": "Può essere usato per le notifiche. Clicca per azioni.",
+    "account_basics_emails_chip_actions_unverified": "Indirizzo non verificato, controlla la tua casella di posta elettronica in arrivo per verificare. Clicca per azioni.",
+    "account_basics_emails_unverified": "non verificato",
+    "account_basics_emails_set_primary": "Imposta come indirizzo di posta elettronica primario",
+    "account_basics_emails_delete": "Rimuovi indirizzo",
+    "account_basics_emails_resend": "Reinvia messaggio di posta elettronica di verifica",
+    "account_basics_emails_resent": "Messaggio di posta elettronica di verifica inviato, controlla la tua casella di posta in arrivo",
+    "account_basics_emails_primary_elsewhere": "L'indirizzo di posta elettronica è utilizzato come indirizzo primario su un profilo diverso",
+    "account_basics_emails_no_recovery_warning": "Aggiungi almeno un indirizzo di posta elettronica per assicurarti di poter recuperare il tuo profilo nel caso perdessi la tua password.",
+    "account_basics_emails_no_primary_warning": "Aggiungi un indirizzo di posta elettronica primario per assicurarti di poter recuperare il tuo profilo nel caso dimenticassi la tua password.",
+    "account_basics_emails_dialog_title": "Aggiungi un indirizzo di posta elettronica",
+    "account_basics_emails_dialog_description": "Inserisci un indirizzo di posta elettronica da aggiungere al tuo profilo. Un indirizzo di verifica ti verrà inviato per confermare che ti appartenga.",
+    "account_basics_emails_dialog_email_label": "Indirizzo di posta elettronica",
+    "account_basics_emails_dialog_email_placeholder": "p.es. utente@esempio.com",
+    "account_basics_emails_dialog_verify_button": "Invia indirizzo di verifica",
+    "account_basics_emails_dialog_check_inbox": "Controlla la tua casella di posta elettronica in arrivo e clicca sull'indirizzo di verifica per confermare questo indirizzo di posta elettronica. Apparirà come non verificato finchè questa procedura non verrà completata.",
+    "account_basics_tier_provisioned": "Predisposto",
+    "account_usage_emails_none": "Le notifiche tramite posta elettronica non possono essere inviate con questo profilo",
+    "prefs_users_dialog_base_url_invalid": "Formato dell'indirizzo invalido. Deve iniziare con http:// o https://",
+    "prefs_users_dialog_base_url_exists": "Un utente per questo indirizzo di servizio è già presente"
 }

web/public/static/langs/ja.json

@@ -226,7 +226,7 @@
     "account_basics_title": "アカウント",
     "account_basics_tier_description": "アカウントのパワーレベル",
     "account_basics_tier_admin": "管理者",
-    "account_basics_tier_admin_suffix_with_tier": "（ティア {{tier}}）",
+    "account_basics_tier_admin_suffix_with_tier": "ティア {{tier}}",
     "account_basics_tier_free": "無料",
     "account_usage_attachment_storage_description": "1ファイルあたり{{filesize}}、{{expiry}}を過ぎると削除",
     "account_usage_basis_ip_description": "アカウントの使用量統計および制限はあなたのIPアドレスに基づいているため、他のユーザーと共有される可能性があります。上記制限は既存のレート制限に基づく概算値です。",
@@ -320,7 +320,7 @@
     "account_basics_password_dialog_button_submit": "パスワードを変更",
     "account_usage_title": "使用量",
     "account_basics_tier_title": "アカウントタイプ",
-    "account_basics_tier_admin_suffix_no_tier": "（ティアなし）",
+    "account_basics_tier_admin_suffix_no_tier": "ティアなし",
     "account_basics_tier_change_button": "変更",
     "account_basics_tier_payment_overdue": "支払期限を過ぎています。支払い方法を更新しないと、近日中にアカウントはダウングレードされます。",
     "account_basics_tier_canceled_subscription": "あなたのサブスクリプションはキャンセルされ{{date}}に無料アカウントにダウングレードされます。",
@@ -400,10 +400,64 @@
     "prefs_notifications_web_push_enabled": "{{server}}で有効",
     "prefs_notifications_web_push_disabled": "無効",
     "prefs_appearance_theme_title": "テーマ",
-    "prefs_appearance_theme_system": "システム (既定)",
+    "prefs_system_default": "システム 既定",
     "prefs_appearance_theme_dark": "ダークモード",
     "web_push_unknown_notification_title": "不明な通知を受信しました",
     "web_push_unknown_notification_body": "ウェブアプリを開いてntfyをアップデートする必要があります",
     "account_basics_cannot_edit_or_delete_provisioned_user": "自動作成されたユーザーの編集や削除はできません",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "自動作成されたトークンは編集や削除はできません"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "自動作成されたトークンは編集や削除はできません",
+    "common_close": "閉じる",
+    "common_refresh": "更新",
+    "email_verify_progress_title": "メールアドレスを確認中…",
+    "email_verify_success_title": "メールアドレスを確認しました",
+    "email_verify_success_description": "メールアドレスが確認されアカウントに追加されました。",
+    "email_verify_error_title": "確認失敗",
+    "email_verify_error_description": "確認リンクが不正か期限切れです。アカウント設定から再度リクエストが可能です。",
+    "email_verify_button_account": "アカウント設定へ",
+    "version_update_available_title": "新しいバージョンが利用可能",
+    "version_update_available_description": "ntfyサーバーがアップデートされました。ページを更新して下さい。",
+    "signup_form_email": "メールアドレス（任意、アカウント復元用）",
+    "login_link_forgot_password": "パスワードを忘れた",
+    "reset_password_request_title": "パスワードをリセット",
+    "reset_password_request_description": "ユーザー名かメールアドレスを入力してください。アカウントが存在していれば、パスワードリセット用のリンクがメールで送信されます。",
+    "reset_password_request_primary_required": "この機能はプライマリメールアドレスが設定され確認されている場合にのみ使用できます。",
+    "reset_password_request_identifier_label": "ユーザー名またはメールアドレス",
+    "reset_password_request_button_submit": "リセット用リンクを送信する",
+    "reset_password_sent_title": "メールボックスを確認して下さい",
+    "reset_password_sent_description": "もしアカウントが存在していれば、パスワードリセット用のリンクがメールで送信されています。",
+    "reset_password_back_to_login": "サインイン画面に戻る",
+    "reset_password_disabled": "パスワードリセットは無効化されています",
+    "reset_password_title": "新しいパスワードを入力",
+    "reset_password_form_password": "新しいパスワード",
+    "reset_password_form_confirm": "新しいパスワードを確認",
+    "reset_password_form_button_submit": "パスワードを設定",
+    "reset_password_form_error_invalid": "このリセット用リンクは不正あるいは期限切れです。再度申請して下さい。",
+    "reset_password_success_title": "パスワードが変更されました",
+    "reset_password_success_description": "パスワードが変更されました。新しいパスワードでサインインして下さい。",
+    "action_bar_reload": "アプリをリロード",
+    "account_basics_emails_title": "メールアドレス",
+    "account_basics_emails_description": "メール通知とパスワードリセット用",
+    "account_basics_emails_no_emails_yet": "まだメールアドレスはありません",
+    "account_basics_emails_copied_to_clipboard": "メールアドレスをクリップボードにコピーしました",
+    "account_basics_emails_chip_actions_primary": "主アドレス、デフォルトのメールアドレスとして使用します。クリックして操作を表示。",
+    "account_basics_emails_chip_actions_verified": "通知として使えます。クリックして操作を表示。",
+    "account_basics_emails_chip_actions_unverified": "未確認のメールアドレス、メールボックスを確認してください。クリックして操作を表示。",
+    "account_basics_emails_unverified": "未確認",
+    "account_basics_emails_set_primary": "プライマリメールアドレスに設定",
+    "account_basics_emails_delete": "メールアドレスを削除",
+    "account_basics_emails_resend": "確認メールを再送信",
+    "account_basics_emails_resent": "確認メールを送信しました、メールボックスを確認してください",
+    "account_basics_emails_primary_elsewhere": "このメールアドレスは他のアカウントでプライマリアドレスとして使用されています",
+    "account_basics_emails_no_recovery_warning": "パスワードを忘れた時にアカウントを復活させられるように最低ひとつのメールアドレスを追加して下さい。",
+    "account_basics_emails_no_primary_warning": "パスワードを忘れた時にアカウントを復活させられるようにプライマリメールアドレスを追加して下さい。",
+    "account_basics_emails_dialog_title": "メールアドレスを追加",
+    "account_basics_emails_dialog_description": "メールアドレスを入力してアカウントに追加します。あなたのものである事を確認するために確認リンクが送信されます。",
+    "account_basics_emails_dialog_email_label": "メールアドレス",
+    "account_basics_emails_dialog_email_placeholder": "例: user@example.com",
+    "account_basics_emails_dialog_verify_button": "確認リンクを送信",
+    "account_basics_emails_dialog_check_inbox": "メールアドレスを確認するためにメールボックスの確認リンクをクリックして下さい。それまでは未確認として表示されます。",
+    "account_basics_tier_provisioned": "事前割り当て",
+    "account_usage_emails_none": "このアカウントではメール通知を送信できません",
+    "prefs_users_dialog_base_url_invalid": "URL形式が不正です。 http:// あるいは https:// から始まる必要があります",
+    "prefs_users_dialog_base_url_exists": "このサービスURLにはユーザーが既に存在します"
 }

web/public/static/langs/nb_NO.json

@@ -266,7 +266,7 @@
     "account_upgrade_dialog_button_cancel_subscription": "Avslutt abonnement",
     "account_tokens_description": "Bruk tilgangstokener når du publiserer og abonnerer via ntfy-APIet, slik at du ikke trenger å sende innloggingsinformasjon for kontoen din. Se <Link>dokumentasjonen</Link> for å lære mer.",
     "account_tokens_table_current_session": "Nåværende nettleserøkt",
-    "prefs_appearance_theme_system": "System (standard)",
+    "prefs_system_default": "System standard",
     "prefs_notifications_web_push_disabled_description": "Varslinger mottas når web-appen kjører (via WebSocket)",
     "prefs_appearance_theme_title": "Tema",
     "prefs_appearance_theme_dark": "Mørk modus",

web/public/static/langs/nl.json

@@ -397,7 +397,7 @@
     "prefs_notifications_web_push_disabled": "Uitgezet",
     "prefs_notifications_web_push_enabled_description": "Notificaties worden ontvangen, ook als de webapplicatie niet geopend is (via Web Push)",
     "prefs_appearance_theme_title": "Thema",
-    "prefs_appearance_theme_system": "Systeem (standaard)",
+    "prefs_system_default": "Systeem standaard",
     "prefs_appearance_theme_dark": "Donkere modus",
     "prefs_appearance_theme_light": "Lichte modus",
     "error_boundary_button_reload_ntfy": "Herlaad ntfy",

web/public/static/langs/pl.json

@@ -50,7 +50,7 @@
     "publish_dialog_title_no_topic": "Opublikuj powiadomienie",
     "publish_dialog_progress_uploading": "Przesyłanie …",
     "publish_dialog_progress_uploading_detail": "Przesyłanie {{loaded}}/{{total}} ({{percent}}%) …",
-    "publish_dialog_message_published": "Powiadomienie wysłane",
+    "publish_dialog_message_published": "Powiadomienie opublikowane",
     "publish_dialog_attachment_limits_file_and_quota_reached": "przekracza limit rozmiaru pliku {{fileSizeLimit}}, pozostaje {{remainingBytes}}",
     "publish_dialog_attachment_limits_file_reached": "przekracza limit rozmiaru pliku {{filesizeLimit}}",
     "publish_dialog_attachment_limits_quota_reached": "przekracza limit, {{remainingBytes}} pozostało",
@@ -63,11 +63,11 @@
     "publish_dialog_topic_placeholder": "Nazwa tematu, np. moje_alerty",
     "publish_dialog_topic_reset": "Resetuj temat",
     "publish_dialog_title_label": "Tytuł",
-    "publish_dialog_title_placeholder": "Tytuł notyfikacji, np. Niski poziom baterrii",
+    "publish_dialog_title_placeholder": "Tytuł powiadomienia, np. Alert o miejscu na dysku",
     "publish_dialog_message_label": "Wiadomość",
     "publish_dialog_message_placeholder": "Wpisz wiadomość tutaj",
     "publish_dialog_tags_label": "Tagi",
-    "publish_dialog_tags_placeholder": "Lista tagów oddzielona przecinkami, np. ostrzeżenie, srv1-backup",
+    "publish_dialog_tags_placeholder": "Lista tagów rozdzielonych przecinkami, np. ostrzeżenie, srv1-backup",
     "publish_dialog_priority_label": "Priorytet",
     "publish_dialog_click_label": "Kliknij Adres URL",
     "publish_dialog_click_placeholder": "Adres URL, który ma być otwarty po kliknięciu na powiadomienie",
@@ -286,8 +286,8 @@
     "account_basics_tier_title": "Rodzaj konta",
     "account_basics_tier_description": "Mocarność Twojego konta",
     "account_basics_tier_admin": "Administrator",
-    "account_basics_tier_admin_suffix_with_tier": "(plan {{tier}})",
-    "account_basics_tier_admin_suffix_no_tier": "(brak planu)",
+    "account_basics_tier_admin_suffix_with_tier": "z planem {{tier}}",
+    "account_basics_tier_admin_suffix_no_tier": "brak planu",
     "account_basics_tier_basic": "Podstawowe",
     "account_basics_tier_free": "Darmowe",
     "account_basics_tier_upgrade_button": "Przejdź na Pro",
@@ -329,11 +329,11 @@
     "account_basics_phone_numbers_dialog_verify_button_sms": "Wyślij SMS",
     "account_tokens_dialog_expires_never": "Token nigdy nie wygasa",
     "account_tokens_dialog_expires_x_days": "Token wygasa za {{days}} dni",
-    "account_basics_phone_numbers_dialog_description": "Aby używać funkcji powiadomień telefonicznych, musisz dodać i zweryfikować no najmniej jeden numer telefonu. Weryfikacja może być dokonana przez SMS lub połączenie telefoniczne.",
+    "account_basics_phone_numbers_dialog_description": "Aby korzystać z funkcji powiadomień o połączeniach, należy dodać i zweryfikować co najmniej jeden numer telefonu. Weryfikacji można dokonać za pomocą wiadomości SMS lub połączenia telefonicznego.",
     "account_upgrade_dialog_tier_features_messages_other": "Dzienne wiadomości: {{messages}}",
     "account_basics_phone_numbers_no_phone_numbers_yet": "Brak numerów telefonów",
     "account_tokens_delete_dialog_title": "Usuń token dostępu",
-    "publish_dialog_chip_call_label": "Rozmowa telefoniczna",
+    "publish_dialog_chip_call_label": "Połączenie telefoniczne",
     "account_basics_phone_numbers_dialog_title": "Dodaj numer telefonu",
     "account_upgrade_dialog_tier_features_reservations_other": "Zarezerwowane tematy: {{reservations}}",
     "account_upgrade_dialog_reservations_warning_one": "Wybrany plan zezwala na mniejszą liczbę zarezerwowanych tematów niż obecny. Przed zmianą planu, <strong>usuń co najmniej jedną rezerwację</strong>. Rezerwacje możesz usunąć w <Link>Ustawieniach</Link>.",
@@ -341,7 +341,7 @@
     "account_upgrade_dialog_cancel_warning": "To <strong>anuluje Twoją subskrypcję</strong> i obniży status Twojego konta {{date}}. Tego dnia rezerwacja tematów oraz wiadomości przechowywane na serwerze <strong>zostaną usunięte</strong>.",
     "account_tokens_dialog_expires_x_hours": "Token wygasa za {{hours}} godzin(y)",
     "publish_dialog_chip_call_no_verified_numbers_tooltip": "Brak zweryfikowanych numerów telefonów",
-    "publish_dialog_call_label": "Rozmowa telefoniczna",
+    "publish_dialog_call_label": "Połączenie telefoniczne",
     "account_usage_calls_title": "Wykonane połączenia telefoniczne",
     "account_basics_phone_numbers_copied_to_clipboard": "Numer telefonu skopiowany do schowka",
     "account_basics_phone_numbers_dialog_number_placeholder": "np. +1222333444",
@@ -355,7 +355,7 @@
     "publish_dialog_call_item": "Zadzwoń pod numer {{number}}",
     "account_basics_phone_numbers_dialog_channel_sms": "SMS",
     "account_upgrade_dialog_tier_selected_label": "Wybrane",
-    "account_upgrade_dialog_reservations_warning_other": "Wybrany plan zezwala na mniejszą liczbę zarezerwowanych tematów niż obecny. Przed zmianą planu, <strong>usuń co najmniej tyle rezerwacji: {{count}}</strong>. Rezerwacje możesz usunąć w <Link>Ustawieniach</Link>.",
+    "account_upgrade_dialog_reservations_warning_other": "Wybrany plan pozwala na mniejszą liczbę zarezerwowanych tematów niż Twój obecny plan. Przed zmianą planu <strong>usuń co najmniej {{count}} rezerwacji</strong>. Rezerwacje możesz usunąć w <Link>Ustawieniach</Link>.",
     "prefs_reservations_title": "Zarezerwowane tematy",
     "prefs_reservations_table_everyone_read_only": "Ja mogę publikować i subskrybować, każdy może subskrybować",
     "prefs_reservations_table_not_subscribed": "Nie jesteś zasubskrybowany",
@@ -377,7 +377,7 @@
     "prefs_notifications_web_push_disabled_description": "Powiadomienia są dostarczane kiedy aplikacja jest aktywna (poprzez WebSocket)",
     "prefs_notifications_web_push_enabled": "Włączone dla {{server}}",
     "prefs_notifications_web_push_disabled": "Wyłączone",
-    "prefs_appearance_theme_system": "Systemowy (domyślny)",
+    "prefs_system_default": "Systemowy domyślny",
     "prefs_appearance_theme_dark": "Tryb ciemny",
     "prefs_appearance_theme_light": "Tryb jasny",
     "prefs_reservations_edit_button": "Modyfikuj ustawienia dostępu dla tematu",
@@ -409,5 +409,61 @@
     "prefs_appearance_theme_title": "Wygląd",
     "prefs_reservations_dialog_description": "Zastrzeżenie tematu daje użytkownikowi prawo własności do tego tematu i umożliwia zdefiniowanie uprawnień dostępu do tego tematu dla innych użytkowników.",
     "reservation_delete_dialog_description": "Usunięcie rezerwacji powoduje rezygnację z prawa własności do tematu i umożliwia innym jego zarezerwowanie. Istniejące wiadomości i załączniki można zachować lub usunąć.",
-    "web_push_unknown_notification_body": "Konieczne może być zaktualizowanie ntfy poprzez otwarcie aplikacji internetowej"
+    "web_push_unknown_notification_body": "Konieczne może być zaktualizowanie ntfy poprzez otwarcie aplikacji internetowej",
+    "common_close": "Zamknij",
+    "common_refresh": "Odśwież",
+    "email_verify_progress_title": "Weryfikuję Twój adres e-mail...",
+    "email_verify_success_title": "E-mail zweryfikowany",
+    "email_verify_success_description": "Twój adres e-mail został zweryfikowany i dodany do Twojego konta.",
+    "email_verify_error_title": "Weryfikacja nie powiodła się",
+    "email_verify_error_description": "Ten link weryfikacyjny jest nieprawidłowy lub wygasł. Możesz poprosić o nowy w ustawieniach konta.",
+    "email_verify_button_account": "Przejdź do konta",
+    "version_update_available_title": "Nowa wersja dostępna",
+    "version_update_available_description": "Serwer ntfy został zaktualizowany. Odśwież stronę.",
+    "signup_form_email": "Adres e-mail (opcjonalnie, w celu odzyskania konta)",
+    "login_link_forgot_password": "Zapomniałem hasła",
+    "reset_password_request_title": "Zresetuj hasło",
+    "reset_password_request_description": "Wprowadź swoją nazwę użytkownika lub adres e-mail. Jeśli konto istnieje, link do zresetowania hasła zostanie wysłany e-mailem.",
+    "reset_password_request_primary_required": "Ta opcja działa tylko wtedy, gdy dodałeś już główny adres e-mail i go zweryfikowałeś.",
+    "reset_password_request_identifier_label": "Nazwa użytkownika lub adres e-mail",
+    "reset_password_request_button_submit": "Wyślij link resetujący",
+    "reset_password_sent_title": "Sprawdź swoją skrzynkę odbiorczą",
+    "reset_password_sent_description": "Jeśli konto istnieje, link umożliwiający zresetowanie hasła został wysłany na podany adres e-mail.",
+    "reset_password_back_to_login": "Powrót do logowania",
+    "reset_password_disabled": "Resetowanie hasła jest wyłączone",
+    "reset_password_title": "Ustaw nowe hasło",
+    "reset_password_form_password": "Nowe hasło",
+    "reset_password_form_confirm": "Potwierdź nowe hasło",
+    "reset_password_form_button_submit": "Ustaw hasło",
+    "reset_password_form_error_invalid": "Ten link resetujący jest nieprawidłowy lub wygasł. Poproś o nowy.",
+    "reset_password_success_title": "Zmieniono hasło",
+    "reset_password_success_description": "Twoje hasło zostało zmienione. Możesz teraz zalogować się przy użyciu nowego hasła.",
+    "action_bar_reload": "Załaduj ponownie aplikację",
+    "account_basics_emails_title": "Adresy e-mail",
+    "account_basics_emails_description": "Aby otrzymywać powiadomienia e-mail i resetować hasło",
+    "account_basics_emails_no_emails_yet": "Brak jeszcze wiadomości e-mail",
+    "account_basics_emails_copied_to_clipboard": "Adres e-mail skopiowany do schowka",
+    "account_basics_emails_chip_actions_primary": "Adres główny, używany jako domyślny adres e-mail. Kliknij, aby wykonać działania.",
+    "account_basics_emails_chip_actions_verified": "Można używać do powiadomień. Kliknij, aby wykonać akcję.",
+    "account_basics_emails_chip_actions_unverified": "Adres niezweryfikowany. Sprawdź skrzynkę odbiorczą, aby go zweryfikować. Kliknij, aby wykonać działania.",
+    "account_basics_emails_unverified": "niezweryfikowany",
+    "account_basics_emails_set_primary": "Ustaw jako główny adres e-mail",
+    "account_basics_emails_delete": "Usuń adres",
+    "account_basics_emails_resend": "Wyślij ponownie e-mail weryfikacyjny",
+    "account_basics_emails_resent": "E-mail weryfikacyjny został wysłany, sprawdź skrzynkę odbiorczą",
+    "account_basics_emails_primary_elsewhere": "Ten adres e-mail jest używany jako adres główny innego konta",
+    "account_basics_emails_no_recovery_warning": "Dodaj co najmniej jeden adres e-mail, aby mieć pewność, że będziesz mógł odzyskać konto, jeśli zgubisz hasło.",
+    "account_basics_emails_no_primary_warning": "Dodaj główny adres e-mail, aby mieć pewność, że w razie utraty hasła będziesz mógł odzyskać konto.",
+    "account_basics_emails_dialog_title": "Dodaj adres e-mail",
+    "account_basics_emails_dialog_description": "Podaj adres e-mail, aby dodać go do swojego konta. Zostanie wysłany link weryfikacyjny, który potwierdzi, że adres należy do Ciebie.",
+    "account_basics_emails_dialog_email_label": "Adres e-mail",
+    "account_basics_emails_dialog_email_placeholder": "np. użytkownik@example.com",
+    "account_basics_emails_dialog_verify_button": "Wyślij link weryfikacyjny",
+    "account_basics_emails_dialog_check_inbox": "Sprawdź swoją skrzynkę odbiorczą i kliknij link weryfikacyjny, aby potwierdzić ten adres e-mail. Będzie on widoczny jako niezweryfikowany, dopóki tego nie zrobisz.",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Zainicjowanego użytkownika nie można edytować ani usunąć",
+    "account_basics_tier_provisioned": "Tymaczasowy",
+    "account_usage_emails_none": "Za pomocą tego konta nie można wysyłać powiadomień e-mail",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Nie można edytować ani usunąć dostarczonego tokenu",
+    "prefs_users_dialog_base_url_invalid": "Nieprawidłowy format adresu URL. Musi zaczynać się od http:// lub https://",
+    "prefs_users_dialog_base_url_exists": "Użytkownik tego adresu URL usługi już istnieje"
 }

web/public/static/langs/pt.json

@@ -370,7 +370,7 @@
     "prefs_notifications_web_push_disabled": "Desativado",
     "prefs_users_table_cannot_delete_or_edit": "Não é possível apagar ou editar o utilizador conectado",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_appearance_theme_system": "Sistema (padrão)",
+    "prefs_system_default": "Sistema padrão",
     "prefs_appearance_theme_dark": "Modo escuro",
     "prefs_appearance_theme_light": "Modo claro",
     "prefs_reservations_title": "Tópicos reservados",

web/public/static/langs/pt_BR.json

@@ -384,7 +384,7 @@
     "prefs_notifications_web_push_disabled": "Desativado",
     "prefs_appearance_theme_title": "Tema",
     "prefs_users_table_cannot_delete_or_edit": "Não é possível apagar ou editar o usuário conectado",
-    "prefs_appearance_theme_system": "Sistema (padrão)",
+    "prefs_system_default": "Sistema padrão",
     "prefs_appearance_theme_dark": "Modo escuro",
     "prefs_appearance_theme_light": "Modo claro",
     "prefs_reservations_title": "Tópicos reservados",

web/public/static/langs/ro.json

@@ -341,7 +341,7 @@
     "prefs_appearance_title": "Aspect",
     "prefs_appearance_language_title": "Limbă",
     "prefs_appearance_theme_title": "Temă",
-    "prefs_appearance_theme_system": "Sistem (implicit)",
+    "prefs_system_default": "Sistem implicit",
     "prefs_appearance_theme_dark": "Mod întunecat",
     "prefs_appearance_theme_light": "Mod luminos",
     "prefs_reservations_title": "Subiecte rezervate",

web/public/static/langs/ru.json

@@ -401,7 +401,7 @@
     "notifications_actions_failed_notification": "Неудачное действие",
     "publish_dialog_checkbox_markdown": "Форматировать как Markdown",
     "subscribe_dialog_subscribe_use_another_background_info": "Уведомления с других серверов не будут получены, когда веб-приложение не открыто",
-    "prefs_appearance_theme_system": "Как в системе (по умолчанию)",
+    "prefs_system_default": "Как в системе по умолчанию",
     "prefs_appearance_theme_dark": "Тёмная",
     "prefs_appearance_theme_light": "Светлая",
     "account_basics_cannot_edit_or_delete_provisioned_user": "Пользователя, созданного автоматически, нельзя изменить или удалить",

web/public/static/langs/sk.json

@@ -397,7 +397,7 @@
     "prefs_notifications_web_push_enabled": "Povolené pre {{server}}",
     "prefs_notifications_web_push_disabled": "Zakázané",
     "prefs_appearance_theme_title": "Téma",
-    "prefs_appearance_theme_system": "Systémové (predvolené)",
+    "prefs_system_default": "Systémové predvolené",
     "prefs_appearance_theme_dark": "Tmavý režim",
     "prefs_appearance_theme_light": "Svetlý režim",
     "error_boundary_button_reload_ntfy": "Obnoviť ntfy",

web/public/static/langs/sv.json

@@ -395,7 +395,7 @@
     "prefs_notifications_web_push_enabled": "Aktivera för {{server}}",
     "prefs_notifications_web_push_disabled": "Avaktivera",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_appearance_theme_system": "System (basinställning)",
+    "prefs_system_default": "System basinställning",
     "prefs_appearance_theme_dark": "Mörkt läge",
     "prefs_appearance_theme_light": "Ljust läge",
     "error_boundary_button_reload_ntfy": "Ladda om ntfy",

web/public/static/langs/ta.json

@@ -235,7 +235,7 @@
     "prefs_appearance_title": "தோற்றம்",
     "prefs_appearance_language_title": "மொழி",
     "prefs_appearance_theme_title": "கருப்பொருள்",
-    "prefs_appearance_theme_system": "கணினி (இயல்புநிலை)",
+    "prefs_system_default": "கணினி இயல்புநிலை",
     "prefs_appearance_theme_dark": "இருண்ட முறை",
     "prefs_appearance_theme_light": "ஒளி பயன்முறை",
     "prefs_reservations_title": "ஒதுக்கப்பட்ட தலைப்புகள்",

web/public/static/langs/tr.json

@@ -395,7 +395,7 @@
     "prefs_notifications_web_push_enabled": "{{server}} için etkinleştirildi",
     "prefs_notifications_web_push_disabled": "Devre dışı",
     "prefs_appearance_theme_title": "Tema",
-    "prefs_appearance_theme_system": "Sistem (öntanımlı)",
+    "prefs_system_default": "Sistem öntanımlı",
     "prefs_appearance_theme_dark": "Koyu mod",
     "prefs_appearance_theme_light": "Açık mod",
     "error_boundary_button_reload_ntfy": "ntfy'yi yeniden yükle",

web/public/static/langs/uk.json

@@ -398,7 +398,7 @@
     "prefs_notifications_web_push_enabled": "Увімкнено для {{server}}",
     "prefs_notifications_web_push_disabled": "Вимкнено",
     "prefs_appearance_theme_title": "Тема оформлення",
-    "prefs_appearance_theme_system": "Система (за замовчуванням)",
+    "prefs_system_default": "Система за замовчуванням",
     "prefs_appearance_theme_light": "Світлий режим",
     "error_boundary_button_reload_ntfy": "Перезавантажити ntfy",
     "web_push_subscription_expiring_title": "Сповіщення буде призупинено",

web/public/static/langs/zh_Hans.json

@@ -152,7 +152,7 @@
     "prefs_appearance_title": "外观",
     "prefs_appearance_language_title": "语言",
     "prefs_appearance_theme_title": "主題",
-    "prefs_appearance_theme_system": "系统 (默认)",
+    "prefs_system_default": "系统 默认",
     "prefs_appearance_theme_dark": "深色模式",
     "prefs_appearance_theme_light": "浅色模式",
     "priority_min": "最低",
@@ -405,5 +405,59 @@
     "web_push_unknown_notification_title": "接收到未知通知",
     "web_push_unknown_notification_body": "你可能需要打开网页来更新ntfy",
     "account_basics_cannot_edit_or_delete_provisioned_user": "已设置的用户无法被编辑或删除",
-    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "无法编辑或删除已设置的令牌"
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "无法编辑或删除已设置的令牌",
+    "common_close": "关闭",
+    "common_refresh": "刷新",
+    "signup_form_email": "邮箱地址（可选，仅用于账户恢复）",
+    "login_link_forgot_password": "忘记密码",
+    "reset_password_request_title": "重置密码",
+    "reset_password_disabled": "密码重置已禁用",
+    "reset_password_title": "设置一个新的密码",
+    "reset_password_form_password": "新密码",
+    "reset_password_success_title": "密码已修改",
+    "version_update_available_description": "ntfy服务器已更新。请刷新页面。",
+    "email_verify_success_title": "邮箱已认证",
+    "email_verify_error_title": "认证失败",
+    "email_verify_error_description": "此认证链接无效或已过期。你可以从账户设置页面申请一个新的。",
+    "email_verify_success_description": "您的邮箱地址已认证并添加到您的账户。",
+    "email_verify_progress_title": "正在认证你的邮箱。。。",
+    "version_update_available_title": "有新版本可用",
+    "reset_password_request_button_submit": "发送重置链接",
+    "reset_password_sent_title": "检查你的收件箱",
+    "reset_password_request_identifier_label": "用户名或邮箱",
+    "account_basics_emails_dialog_email_label": "邮箱地址",
+    "account_basics_emails_dialog_email_placeholder": "例如：user@example.com",
+    "account_basics_emails_dialog_title": "添加邮箱地址",
+    "email_verify_button_account": "转到账户",
+    "reset_password_request_description": "输入用户名或邮箱地址。如果账户存在，将通过电子邮件发送重置密码的链接。",
+    "reset_password_request_primary_required": "只有已经添加了主邮件地址并验证过才有效。",
+    "reset_password_sent_description": "如果账户存在，那么已通过电子邮件发送了重置密码的链接。",
+    "reset_password_back_to_login": "返回登录",
+    "reset_password_form_confirm": "确认新密码",
+    "reset_password_form_button_submit": "设置密码",
+    "reset_password_form_error_invalid": "此重置链接无效或已过期。请请求新链接。",
+    "reset_password_success_description": "密码已更改。现在可以用新密码登录。",
+    "action_bar_reload": "重新加载应用",
+    "account_basics_emails_title": "电子邮件地址",
+    "account_basics_emails_description": "用于电子邮件通知和重置密码",
+    "account_basics_emails_no_emails_yet": "尚无邮箱",
+    "account_basics_emails_copied_to_clipboard": "已复制电子邮箱到剪贴板",
+    "account_basics_emails_chip_actions_primary": "主邮箱地址，用作默认邮箱地址。单击查看操作。",
+    "account_basics_emails_chip_actions_verified": "可用于通知。单击查看操作。",
+    "account_basics_emails_chip_actions_unverified": "未验证的地址，检查收件箱进行验证。单击查看操作。",
+    "account_basics_emails_unverified": "未验证",
+    "account_basics_emails_set_primary": "设为主邮箱",
+    "account_basics_emails_delete": "删除地址",
+    "account_basics_emails_resend": "重新发送验证地址",
+    "account_basics_emails_resent": "已发送验证邮件，检查收件箱",
+    "account_basics_emails_primary_elsewhere": "此邮件地址被用作另一个账户的主邮箱",
+    "account_basics_emails_no_recovery_warning": "添加至少一个邮箱确保如果丢失密码可以恢复账户。",
+    "account_basics_emails_no_primary_warning": "添加一个主邮箱确保如果丢失密码可以恢复账户。",
+    "account_basics_emails_dialog_description": "输入一个邮箱将其添加到你的账户。将发送一个验证链接确认这个邮箱是你的。",
+    "account_basics_emails_dialog_verify_button": "发送验证链接",
+    "account_basics_emails_dialog_check_inbox": "检查收件箱并单击验证链接确认此邮箱地址。在你验证前邮箱地址将一直以未验证状态呈现。",
+    "account_basics_tier_provisioned": "已开通",
+    "account_usage_emails_none": "无法向此账户发送邮件通知",
+    "prefs_users_dialog_base_url_invalid": "无效的 URL 格式。必须以 http:// 或 https:// 开头",
+    "prefs_users_dialog_base_url_exists": "此服务 URL 已存在一名用户"
 }

web/public/static/langs/zh_Hant.json

@@ -229,7 +229,7 @@
     "prefs_appearance_language_title": "語言",
     "prefs_appearance_theme_dark": "深色模式",
     "prefs_appearance_theme_light": "淺色模式",
-    "prefs_appearance_theme_system": "系統 (預設)",
+    "prefs_system_default": "系統 預設",
     "prefs_appearance_theme_title": "主題",
     "prefs_appearance_title": "外觀",
     "prefs_notifications_delete_after_never_description": "永不自動刪除通知",

web/public/static/langs/zu.json

@@ -0,0 +1 @@
+{}

web/public/sw.js

@@ -61,7 +61,7 @@ const handlePushMessage = async (data) => {
       topicRoute: new URL(message.topic, self.location.origin).toString(),
       baseUrl: subscription.baseUrl,
       topic: subscription.topic,
-    })
+    }),
   );
 
   // Delete existing notification with same sequence ID (if any)
@@ -417,7 +417,7 @@ self.addEventListener("notificationclick", (event) => {
 // [{"revision":"aaabbbcccdddeeefff12345","url":"/index.html"},...]
 precacheAndRoute(
   // eslint-disable-next-line no-underscore-dangle
-  self.__WB_MANIFEST
+  self.__WB_MANIFEST,
 );
 
 // Claim all open windows
@@ -441,7 +441,7 @@ if (!import.meta.env.DEV) {
         // the app root itself, could be /, or not
         new RegExp(`^${config.app_root}$`),
       ],
-    })
+    }),
   );
 
   // the manifest excludes config.js (see vite.config.js) since the dist-file differs from the

web/src/app/AccountApi.js

@@ -448,6 +448,12 @@ class AccountApi {
       if (account.language) {
         await i18n.changeLanguage(account.language);
       }
+      if (account.date_format) {
+        await prefs.setDateFormat(account.date_format);
+      }
+      if (account.time_format) {
+        await prefs.setTimeFormat(account.time_format);
+      }
       if (account.notification) {
         if (account.notification.sound) {
           await prefs.setSound(account.notification.sound);

web/src/app/AccountApi.test.js

@@ -13,7 +13,7 @@ vi.mock("./Session", () => ({
 }));
 vi.mock("./SubscriptionManager", () => ({ default: { syncFromRemote: vi.fn() } }));
 vi.mock("./Prefs", () => ({
-  default: { setSound: vi.fn(), setDeleteAfter: vi.fn(), setMinPriority: vi.fn() },
+  default: { setSound: vi.fn(), setDeleteAfter: vi.fn(), setMinPriority: vi.fn(), setDateFormat: vi.fn(), setTimeFormat: vi.fn() },
   THEME: { DARK: "dark", LIGHT: "light", SYSTEM: "system" },
 }));
 vi.mock("i18next", () => ({ default: { changeLanguage: vi.fn() } }));
@@ -65,7 +65,7 @@ describe("AccountApi.create", () => {
     await accountApi.create("phil", "pw");
     expect(fetchMock).toHaveBeenCalledWith(
       "https://ntfy.sh/v1/account",
-      expect.objectContaining({ method: "POST", body: JSON.stringify({ username: "phil", password: "pw", email: "" }) })
+      expect.objectContaining({ method: "POST", body: JSON.stringify({ username: "phil", password: "pw", email: "" }) }),
     );
   });
 });
@@ -190,15 +190,19 @@ describe("AccountApi.sync", () => {
     fetchMock.mockResolvedValue(
       ok({
         language: "de",
+        date_format: "iso8601",
+        time_format: "24h",
         notification: { sound: "ding", delete_after: 3600, min_priority: 3 },
         subscriptions: [{ topic: "t" }],
         reservations: [{ topic: "t" }],
-      })
+      }),
     );
 
     await accountApi.sync();
 
     expect(i18n.changeLanguage).toHaveBeenCalledWith("de");
+    expect(prefs.setDateFormat).toHaveBeenCalledWith("iso8601");
+    expect(prefs.setTimeFormat).toHaveBeenCalledWith("24h");
     expect(prefs.setSound).toHaveBeenCalledWith("ding");
     expect(prefs.setDeleteAfter).toHaveBeenCalledWith(3600);
     expect(prefs.setMinPriority).toHaveBeenCalledWith(3);

web/src/app/Api.test.js

@@ -57,7 +57,7 @@ describe("Api.publish", () => {
       expect.objectContaining({
         method: "PUT",
         body: JSON.stringify({ topic: "mytopic", message: "Hello", priority: 5, tags: ["warning"] }),
-      })
+      }),
     );
   });
 
@@ -109,7 +109,7 @@ describe("Api web push", () => {
       expect.objectContaining({
         method: "POST",
         body: JSON.stringify({ endpoint: "https://push.example/abc", auth: "AUTH", p256dh: "P256", topics: ["topicA", "topicB"] }),
-      })
+      }),
     );
   });
 
@@ -121,7 +121,7 @@ describe("Api web push", () => {
       expect.objectContaining({
         method: "DELETE",
         body: JSON.stringify({ endpoint: "https://push.example/abc" }),
-      })
+      }),
     );
   });
 });

web/src/app/Connection.js

@@ -67,7 +67,7 @@ class Connection {
     this.ws.onclose = (event) => {
       if (event.wasClean) {
         console.log(
-          `[Connection, ${this.shortUrl}, ${this.connectionId}] Connection closed cleanly, code=${event.code} reason=${event.reason}`
+          `[Connection, ${this.shortUrl}, ${this.connectionId}] Connection closed cleanly, code=${event.code} reason=${event.reason}`,
         );
         this.ws = null;
       } else {

web/src/app/ConnectionManager.js

@@ -70,13 +70,13 @@ class ConnectionManager {
           user,
           since,
           (subId, notification) => this.notificationReceived(subId, notification),
-          (subId, state) => this.stateChanged(subId, state)
+          (subId, state) => this.stateChanged(subId, state),
         );
         this.connections.set(connectionId, connection);
         console.log(
           `[ConnectionManager] Starting new connection ${connectionId} (subscription ${subscriptionId} with user ${
             user ? user.username : "anonymous"
-          })`
+          })`,
         );
         connection.start();
       }

web/src/app/Notifier.js

@@ -30,7 +30,7 @@ class Notifier {
         topicRoute: new URL(routes.forSubscription(subscription), window.location.origin).toString(),
         baseUrl: subscription.baseUrl,
         topic: subscription.topic,
-      })
+      }),
     );
   }
 

web/src/app/Poller.js

@@ -35,7 +35,7 @@ class Poller {
         } catch (e) {
           console.log(`[Poller] Error polling ${s.id}`, e);
         }
-      })
+      }),
     );
   }
 
@@ -61,7 +61,7 @@ class Poller {
     if (deletedSequenceIds.length > 0) {
       console.log(`[Poller] Deleting notifications with deleted sequence IDs for ${subscription.id}`, deletedSequenceIds);
       await Promise.all(
-        deletedSequenceIds.map((sequenceId) => subscriptionManager.deleteNotificationBySequenceId(subscription.id, sequenceId))
+        deletedSequenceIds.map((sequenceId) => subscriptionManager.deleteNotificationBySequenceId(subscription.id, sequenceId)),
       );
     }
 

web/src/app/Prefs.js

@@ -6,16 +6,43 @@ export const THEME = {
   SYSTEM: "system",
 };
 
+// How the date component is displayed. SYSTEM follows the browser's locale (i.e. the OS region/
+// format settings, not the chosen UI translation language); ISO8601 forces YYYY-MM-DD; DMY and MDY
+// force the day/month order regardless of locale (e.g. for an English UI that defaults to US order).
+export const DATE_FORMAT = {
+  SYSTEM: "system",
+  ISO8601: "iso8601",
+  DMY: "dmy",
+  DMY_DOT: "dmy_dot",
+  MDY: "mdy",
+};
+
+// How the time component (clock) is displayed. Orthogonal to DATE_FORMAT and to the UI language --
+// SYSTEM lets the browser locale decide, H12/H24 force a 12- or 24-hour clock. ISO 8601 dates are
+// always 24-hour, so this setting is ignored in that mode.
+export const TIME_FORMAT = {
+  SYSTEM: "system",
+  H12: "12h",
+  H24: "24h",
+};
+
 // Default values the getters return when a pref is unset; also used by PrefCache (PrefCache.jsx).
 export const PREF_DEFAULTS = {
   sound: "ding",
   minPriority: 1,
   deleteAfter: 604800, // one week
   theme: THEME.SYSTEM,
+  dateFormat: DATE_FORMAT.SYSTEM,
+  timeFormat: TIME_FORMAT.SYSTEM,
   webPushEnabled: false,
 };
 
-class Prefs {
+// Guards against values the current build doesn't know about (e.g. a pref synced from a newer
+// client, or a renamed enum). An unknown value would leave the Settings <Select> with no matching
+// option, so we fall back to the default instead.
+const isKnownValue = (constants, value) => Object.values(constants).includes(value);
+
+export class Prefs {
   constructor(dbImpl) {
     this.db = dbImpl;
   }
@@ -64,6 +91,24 @@ class Prefs {
   async setTheme(mode) {
     await this.db.prefs.put({ key: "theme", value: mode });
   }
+
+  async dateFormat() {
+    const dateFormat = await this.db.prefs.get("dateFormat");
+    return isKnownValue(DATE_FORMAT, dateFormat?.value) ? dateFormat.value : PREF_DEFAULTS.dateFormat;
+  }
+
+  async setDateFormat(format) {
+    await this.db.prefs.put({ key: "dateFormat", value: format });
+  }
+
+  async timeFormat() {
+    const timeFormat = await this.db.prefs.get("timeFormat");
+    return isKnownValue(TIME_FORMAT, timeFormat?.value) ? timeFormat.value : PREF_DEFAULTS.timeFormat;
+  }
+
+  async setTimeFormat(format) {
+    await this.db.prefs.put({ key: "timeFormat", value: format });
+  }
 }
 
 const prefs = new Prefs(db());

web/src/app/Prefs.test.js

@@ -0,0 +1,33 @@
+import { describe, expect, it, vi } from "vitest";
+import { Prefs, DATE_FORMAT, TIME_FORMAT, PREF_DEFAULTS } from "./Prefs";
+
+// The module instantiates `new Prefs(db())` at import; stub db() so that doesn't touch IndexedDB.
+vi.mock("./db", () => ({ default: () => ({}) }));
+
+// Minimal fake of the Dexie `prefs` table: get() returns a stored {key, value} or undefined.
+const fakeDb = (stored) => ({
+  prefs: {
+    get: async (key) => (key in stored ? { key, value: stored[key] } : undefined),
+    put: async () => {},
+  },
+});
+
+describe("Prefs date/time format validation", () => {
+  it("returns the stored value when it is a known format", async () => {
+    const prefs = new Prefs(fakeDb({ dateFormat: DATE_FORMAT.ISO8601, timeFormat: TIME_FORMAT.H24 }));
+    expect(await prefs.dateFormat()).toBe(DATE_FORMAT.ISO8601);
+    expect(await prefs.timeFormat()).toBe(TIME_FORMAT.H24);
+  });
+
+  it("falls back to the default for an unknown stored value (e.g. synced from a newer client)", async () => {
+    const prefs = new Prefs(fakeDb({ dateFormat: "newer-client-format", timeFormat: "36h" }));
+    expect(await prefs.dateFormat()).toBe(PREF_DEFAULTS.dateFormat);
+    expect(await prefs.timeFormat()).toBe(PREF_DEFAULTS.timeFormat);
+  });
+
+  it("falls back to the default when unset", async () => {
+    const prefs = new Prefs(fakeDb({}));
+    expect(await prefs.dateFormat()).toBe(PREF_DEFAULTS.dateFormat);
+    expect(await prefs.timeFormat()).toBe(PREF_DEFAULTS.timeFormat);
+  });
+});

web/src/app/SubscriptionManager.js

@@ -18,7 +18,7 @@ export class SubscriptionManager {
       subscriptions.map(async (s) => ({
         ...s,
         new: await this.db.notifications.where({ subscriptionId: s.id, new: 1 }).count(),
-      }))
+      })),
     );
   }
 
@@ -122,7 +122,7 @@ export class SubscriptionManager {
         });
 
         return local.id;
-      })
+      }),
     );
 
     // Remove local subscriptions that do not exist remotely
@@ -134,7 +134,7 @@ export class SubscriptionManager {
         if (!local.internal && !remoteExists) {
           await this.remove(local);
         }
-      })
+      }),
     );
   }
 
@@ -144,7 +144,7 @@ export class SubscriptionManager {
 
     if (!browserSubscription) {
       console.log(
-        "[SubscriptionManager] No browser subscription currently exists, so web push was never enabled or the notification permission was removed. Skipping."
+        "[SubscriptionManager] No browser subscription currently exists, so web push was never enabled or the notification permission was removed. Skipping.",
       );
       return;
     }

web/src/app/errors.test.js

@@ -56,7 +56,7 @@ describe("throwAppError", () => {
     await expect(throwAppError(fakeResponse(409, { code: UserExistsError.CODE }))).rejects.toBeInstanceOf(UserExistsError);
     await expect(throwAppError(fakeResponse(409, { code: TopicReservedError.CODE }))).rejects.toBeInstanceOf(TopicReservedError);
     await expect(throwAppError(fakeResponse(429, { code: AccountActionLimitReachedError.CODE }))).rejects.toBeInstanceOf(
-      AccountActionLimitReachedError
+      AccountActionLimitReachedError,
     );
   });
 
@@ -78,7 +78,7 @@ describe("fetchOrThrow", () => {
     const response = { status: 200 };
     vi.stubGlobal(
       "fetch",
-      vi.fn(async () => response)
+      vi.fn(async () => response),
     );
     await expect(fetchOrThrow("https://ntfy.sh/mytopic/json")).resolves.toBe(response);
   });
@@ -86,7 +86,7 @@ describe("fetchOrThrow", () => {
   it("throws on a non-200 response", async () => {
     vi.stubGlobal(
       "fetch",
-      vi.fn(async () => fakeResponse(401))
+      vi.fn(async () => fakeResponse(401)),
     );
     await expect(fetchOrThrow("https://ntfy.sh/mytopic/json")).rejects.toBeInstanceOf(UnauthorizedError);
   });

web/src/app/utils.js

@@ -7,7 +7,7 @@ import pop from "../sounds/pop.mp3";
 import popSwoosh from "../sounds/pop-swoosh.mp3";
 import config from "./config";
 import emojisMapped from "./emojisMapped";
-import { THEME } from "./Prefs";
+import { THEME, DATE_FORMAT, TIME_FORMAT } from "./Prefs";
 
 export const tiersUrl = (baseUrl) => `${baseUrl}/v1/tiers`;
 export const shortUrl = (url) => url.replaceAll(/https?:\/\//g, "");
@@ -151,14 +151,68 @@ export const hashCode = (s) => {
  */
 export const getKebabCaseLangStr = (language) => (typeof language === "string" && language.length > 0 ? language.replace(/_/g, "-") : "en");
 
-export const formatShortDateTime = (timestamp, language) =>
-  new Intl.DateTimeFormat(getKebabCaseLangStr(language), {
-    dateStyle: "short",
+// Date/time display is intentionally NOT tied to the UI translation language; it follows the
+// dedicated dateFormat/timeFormat prefs (see Prefs.js). SYSTEM modes pass no locale to Intl so it
+// uses the browser's default (the user's OS region/format settings). DMY/MDY force the day/month
+// order; ISO8601 forces an unambiguous, locale-independent and always-24-hour format. The clock
+// (12h/24h) is chosen independently via timeFormat. All variants render local time.
+const pad2 = (n) => String(n).padStart(2, "0");
+
+// Per-format date builders (only ISO zero-pads; the rest drop leading zeros). The router below
+// (formatDate) picks one of these for a fixed-order format, or falls back to the browser locale.
+const formatDateIso = (date) => `${date.getFullYear()}-${pad2(date.getMonth() + 1)}-${pad2(date.getDate())}`;
+const formatDateDmy = (date) => `${date.getDate()}/${date.getMonth() + 1}/${date.getFullYear()}`;
+const formatDateDmyDot = (date) => `${date.getDate()}.${date.getMonth() + 1}.${date.getFullYear()}`;
+const formatDateMdy = (date) => `${date.getMonth() + 1}/${date.getDate()}/${date.getFullYear()}`;
+
+// ISO date-time is always YYYY-MM-DD HH:mm (24-hour), independent of the timeFormat pref.
+const formatDateTimeIso = (date) => `${formatDateIso(date)} ${pad2(date.getHours())}:${pad2(date.getMinutes())}`;
+
+// undefined lets the locale decide the clock; true/false force a 12- or 24-hour clock. Passing
+// hour12: undefined to Intl is equivalent to omitting it (and avoids an object spread that would
+// otherwise widen the sibling dateStyle/timeStyle string literals).
+const hour12For = (timeFormat) => {
+  if (timeFormat === TIME_FORMAT.H12) return true;
+  if (timeFormat === TIME_FORMAT.H24) return false;
+  return undefined;
+};
+
+// The date router: delegates to a fixed-order builder, or falls back to the browser locale (SYSTEM).
+export const formatDate = (timestamp, dateFormat = DATE_FORMAT.SYSTEM) => {
+  const date = new Date(timestamp * 1000);
+  switch (dateFormat) {
+    case DATE_FORMAT.ISO8601:
+      return formatDateIso(date);
+    case DATE_FORMAT.DMY:
+      return formatDateDmy(date);
+    case DATE_FORMAT.DMY_DOT:
+      return formatDateDmyDot(date);
+    case DATE_FORMAT.MDY:
+      return formatDateMdy(date);
+    default:
+      return new Intl.DateTimeFormat(undefined, { dateStyle: "short" }).format(date);
+  }
+};
+
+export const formatTime = (timestamp, timeFormat = TIME_FORMAT.SYSTEM) =>
+  new Intl.DateTimeFormat(undefined, {
     timeStyle: "short",
+    hour12: hour12For(timeFormat),
   }).format(new Date(timestamp * 1000));
 
-export const formatShortDate = (timestamp, language) =>
-  new Intl.DateTimeFormat(getKebabCaseLangStr(language), { dateStyle: "short" }).format(new Date(timestamp * 1000));
+export const formatDateTime = (timestamp, dateFormat = DATE_FORMAT.SYSTEM, timeFormat = TIME_FORMAT.SYSTEM) => {
+  if (dateFormat === DATE_FORMAT.ISO8601) {
+    return formatDateTimeIso(new Date(timestamp * 1000));
+  }
+  if ([DATE_FORMAT.DMY, DATE_FORMAT.DMY_DOT, DATE_FORMAT.MDY].includes(dateFormat)) {
+    return `${formatDate(timestamp, dateFormat)} ${formatTime(timestamp, timeFormat)}`;
+  }
+  return new Intl.DateTimeFormat(undefined, {
+    dateStyle: "short",
+    timeStyle: "short",
+    hour12: hour12For(timeFormat),
+  }).format(new Date(timestamp * 1000));
+};
 
 export const formatShortDuration = (ms, language) => {
   const seconds = Math.round(ms / 1000);
@@ -390,6 +444,17 @@ export const updateFavicon = async (count) => {
   }
 };
 
+// Matches a URL whose scheme is NOT in the safe list (https, mailto, ...). A scheme
+// (RFC 3986: [a-z][a-z0-9+.-]*) can't contain a slash, query, or hash, so a colon later
+// in the path/query (e.g. foo?x=a:b) is never mistaken for a protocol separator. Relative
+// URLs have no scheme and never match. This strips javascript:/data:/vbscript:/... so React
+// never has to block a javascript: URL at render time -- which it does loudly, throwing an
+// uncaught error.
+const unsafeUrlProtocol = /^\s*(?!(?:https?|ftps?|ircs?|mailto|xmpp|tel):)[a-z][a-z0-9+.-]*:/i;
+
+// Returns the URL unchanged if it uses a safe protocol or is relative, otherwise "".
+export const sanitizeUrl = (url) => (url && unsafeUrlProtocol.test(url) ? "" : url || "");
+
 export const copyToClipboard = (text) => {
   if (navigator.clipboard && window.isSecureContext) {
     return navigator.clipboard.writeText(text);

web/src/app/utils.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { THEME } from "./Prefs";
+import { THEME, DATE_FORMAT, TIME_FORMAT } from "./Prefs";
 import {
   topicUrl,
   topicUrlWs,
@@ -19,11 +19,15 @@ import {
   withBearerAuth,
   maybeWithAuth,
   splitNoEmpty,
+  sanitizeUrl,
   hashCode,
   formatBytes,
   formatNumber,
   formatPrice,
   formatShortDuration,
+  formatDate,
+  formatDateTime,
+  formatTime,
   getKebabCaseLangStr,
   darkModeEnabled,
   urlB64ToUint8Array,
@@ -151,3 +155,104 @@ describe("misc pure helpers", () => {
     expect(Array.from(urlB64ToUint8Array("AQID"))).toEqual([1, 2, 3]);
   });
 });
+
+describe("date/time formatting", () => {
+  // 2026-03-08 14:30 in the runner's local timezone (the same wall-clock time Intl renders).
+  const ts = Math.floor(new Date(2026, 2, 8, 14, 30, 0).getTime() / 1000);
+
+  it("ISO 8601 mode renders YYYY-MM-DD HH:mm regardless of locale", () => {
+    expect(formatDateTime(ts, DATE_FORMAT.ISO8601)).toBe("2026-03-08 14:30");
+    expect(formatDate(ts, DATE_FORMAT.ISO8601)).toBe("2026-03-08");
+  });
+
+  it("ISO 8601 mode zero-pads single-digit months, days, hours and minutes", () => {
+    const early = Math.floor(new Date(2026, 0, 5, 9, 7, 0).getTime() / 1000);
+    expect(formatDateTime(early, DATE_FORMAT.ISO8601)).toBe("2026-01-05 09:07");
+  });
+
+  it("default mode follows the browser locale, not the UI translation language", () => {
+    // The format must depend only on the browser's default locale -- passing a language
+    // tag (the old behavior) must NOT change the output anymore.
+    const browserDefault = new Intl.DateTimeFormat(undefined, { dateStyle: "short", timeStyle: "short" }).format(new Date(ts * 1000));
+    expect(formatDateTime(ts, DATE_FORMAT.SYSTEM)).toBe(browserDefault);
+    expect(formatDateTime(ts, "fr")).toBe(browserDefault);
+    expect(formatDateTime(ts, "en_US")).toBe(browserDefault);
+    expect(formatDateTime(ts, undefined)).toBe(browserDefault);
+  });
+
+  it("only ISO 8601 zero-pads; DMY, dot-separated DMY and MDY all drop leading zeros", () => {
+    expect(formatDate(ts, DATE_FORMAT.DMY)).toBe("8/3/2026");
+    expect(formatDate(ts, DATE_FORMAT.DMY_DOT)).toBe("8.3.2026");
+    expect(formatDate(ts, DATE_FORMAT.MDY)).toBe("3/8/2026");
+    // Double-digit day/month are left intact.
+    const ts2 = Math.floor(new Date(2026, 11, 25, 14, 30, 0).getTime() / 1000);
+    expect(formatDate(ts2, DATE_FORMAT.DMY)).toBe("25/12/2026");
+    expect(formatDate(ts2, DATE_FORMAT.DMY_DOT)).toBe("25.12.2026");
+    expect(formatDate(ts2, DATE_FORMAT.MDY)).toBe("12/25/2026");
+    // The same ordering prefixes the datetime variant.
+    expect(formatDateTime(ts, DATE_FORMAT.DMY)).toMatch(/^8\/3\/2026 /);
+    expect(formatDateTime(ts, DATE_FORMAT.DMY_DOT)).toMatch(/^8\.3\.2026 /);
+    expect(formatDateTime(ts, DATE_FORMAT.MDY)).toMatch(/^3\/8\/2026 /);
+  });
+
+  it("formatTime renders only the time, honoring the 12/24-hour choice", () => {
+    const local24 = new Intl.DateTimeFormat(undefined, { timeStyle: "short", hour12: false }).format(new Date(ts * 1000));
+    expect(formatTime(ts, TIME_FORMAT.H24)).toBe(local24);
+    expect(formatTime(ts, TIME_FORMAT.H24)).toContain("14:30");
+    expect(formatTime(ts, TIME_FORMAT.H12)).toContain("2:30");
+  });
+
+  it("time format selects 12-hour vs 24-hour independently of the date format", () => {
+    const local24 = new Intl.DateTimeFormat(undefined, { timeStyle: "short", hour12: false }).format(new Date(ts * 1000));
+    expect(formatDateTime(ts, DATE_FORMAT.DMY, TIME_FORMAT.H24)).toBe(`8/3/2026 ${local24}`);
+
+    const h12 = formatDateTime(ts, DATE_FORMAT.SYSTEM, TIME_FORMAT.H12);
+    const h24 = formatDateTime(ts, DATE_FORMAT.SYSTEM, TIME_FORMAT.H24);
+    expect(h24).toContain("14:30");
+    expect(h12).toContain("2:30");
+    expect(h12).not.toBe(h24);
+  });
+
+  it("ISO 8601 is always 24-hour regardless of the time format", () => {
+    expect(formatDateTime(ts, DATE_FORMAT.ISO8601, TIME_FORMAT.H12)).toBe("2026-03-08 14:30");
+  });
+});
+
+describe("sanitizeUrl", () => {
+  it("keeps safe absolute URLs", () => {
+    expect(sanitizeUrl("https://ntfy.sh")).toBe("https://ntfy.sh");
+    expect(sanitizeUrl("http://example.com/foo?bar=1")).toBe("http://example.com/foo?bar=1");
+    expect(sanitizeUrl("mailto:phil@ntfy.sh")).toBe("mailto:phil@ntfy.sh");
+    expect(sanitizeUrl("ftp://ftp.example.com/file.txt")).toBe("ftp://ftp.example.com/file.txt");
+    expect(sanitizeUrl("ftps://ftp.example.com/file.txt")).toBe("ftps://ftp.example.com/file.txt");
+  });
+
+  it("keeps relative URLs, fragments and query strings", () => {
+    expect(sanitizeUrl("/docs")).toBe("/docs");
+    expect(sanitizeUrl("./foo")).toBe("./foo");
+    expect(sanitizeUrl("#section")).toBe("#section");
+    expect(sanitizeUrl("?q=1")).toBe("?q=1");
+    expect(sanitizeUrl("foo/bar")).toBe("foo/bar");
+  });
+
+  it("does not treat a colon after a slash/query/hash as a protocol", () => {
+    expect(sanitizeUrl("/path:with:colons")).toBe("/path:with:colons");
+    expect(sanitizeUrl("foo?x=a:b")).toBe("foo?x=a:b");
+  });
+
+  it("strips dangerous protocols", () => {
+    /* eslint-disable no-script-url -- these javascript: literals are exactly what we're testing */
+    expect(sanitizeUrl("javascript:alert(document.domain)")).toBe("");
+    expect(sanitizeUrl("JavaScript:alert(1)")).toBe("");
+    expect(sanitizeUrl("  javascript:alert(1)")).toBe("");
+    /* eslint-enable no-script-url */
+    expect(sanitizeUrl("vbscript:msgbox(1)")).toBe("");
+    expect(sanitizeUrl("data:text/html,<script>alert(1)</script>")).toBe("");
+  });
+
+  it("handles empty and nullish input", () => {
+    expect(sanitizeUrl("")).toBe("");
+    expect(sanitizeUrl(undefined)).toBe("");
+    expect(sanitizeUrl(null)).toBe("");
+  });
+});

web/src/components/Account.jsx

@@ -52,12 +52,13 @@ import ContentCopy from "@mui/icons-material/ContentCopy";
 import Public from "@mui/icons-material/Public";
 import AddIcon from "@mui/icons-material/Add";
 import routes from "./routes";
-import { copyToClipboard, formatBytes, formatShortDate, formatShortDateTime, formatShortDuration, openUrl } from "../app/utils";
+import { copyToClipboard, formatBytes, formatDate, formatDateTime, formatShortDuration, openUrl } from "../app/utils";
 import accountApi, { LimitBasis, Role, SubscriptionInterval, SubscriptionStatus } from "../app/AccountApi";
 import { Pref, PrefGroup } from "./Pref";
 import db from "../app/db";
 import UpgradeDialog from "./UpgradeDialog";
 import AccountContext from "./AccountContext";
+import { usePrefCache } from "./PrefCache";
 import DialogFooter from "./DialogFooter";
 import { Paragraph } from "./styles";
 import { EmailPrimaryElsewhereError, IncorrectPasswordError, UnauthorizedError } from "../app/errors";
@@ -242,7 +243,8 @@ const ChangePasswordDialog = (props) => {
 };
 
 const AccountType = () => {
-  const { t, i18n } = useTranslation();
+  const { t } = useTranslation();
+  const { dateFormat } = usePrefCache();
   const { account } = useContext(AccountContext);
   const [upgradeDialogKey, setUpgradeDialogKey] = useState(0);
   const [upgradeDialogOpen, setUpgradeDialogOpen] = useState(false);
@@ -304,7 +306,7 @@ const AccountType = () => {
         {account.billing?.paid_until && !account.billing?.cancel_at && (
           <Tooltip
             title={t("account_basics_tier_paid_until", {
-              date: formatShortDate(account.billing?.paid_until, i18n.language),
+              date: formatDate(account.billing?.paid_until, dateFormat),
             })}
           >
             <span>
@@ -349,7 +351,7 @@ const AccountType = () => {
       {account.billing?.cancel_at > 0 && (
         <Alert severity="warning" sx={{ mt: 1 }}>
           {t("account_basics_tier_canceled_subscription", {
-            date: formatShortDate(account.billing.cancel_at, i18n.language),
+            date: formatDate(account.billing.cancel_at, dateFormat),
           })}
         </Alert>
       )}
@@ -1076,7 +1078,8 @@ const Tokens = () => {
 };
 
 const TokensTable = (props) => {
-  const { t, i18n } = useTranslation();
+  const { t } = useTranslation();
+  const { dateFormat, timeFormat } = usePrefCache();
   const [snackOpen, setSnackOpen] = useState(false);
   const [upsertDialogKey, setUpsertDialogKey] = useState(0);
   const [upsertDialogOpen, setUpsertDialogOpen] = useState(false);
@@ -1154,11 +1157,11 @@ const TokensTable = (props) => {
                 {token.token !== session.token() && (token.label || "-")}
               </TableCell>
               <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_expires_header")}>
-                {token.expires ? formatShortDateTime(token.expires, i18n.language) : <em>{t("account_tokens_table_never_expires")}</em>}
+                {token.expires ? formatDateTime(token.expires, dateFormat, timeFormat) : <em>{t("account_tokens_table_never_expires")}</em>}
               </TableCell>
               <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_last_access_header")}>
                 <div style={{ display: "flex", alignItems: "center" }}>
-                  {hasLastAccess ? <span>{formatShortDateTime(token.last_access, i18n.language)}</span> : <em>-</em>}
+                  {hasLastAccess ? <span>{formatDateTime(token.last_access, dateFormat, timeFormat)}</span> : <em>-</em>}
                   {hasLastOrigin && (
                     <Tooltip
                       title={t("account_tokens_table_last_origin_tooltip", {

web/src/components/App.jsx

@@ -130,7 +130,7 @@ const Layout = () => {
   const [selected] = (subscriptionsWithoutInternal || []).filter(
     (s) =>
       (params.baseUrl && expandUrl(params.baseUrl).includes(s.baseUrl) && params.topic === s.topic) ||
-      (config.base_url === s.baseUrl && params.topic === s.topic)
+      (config.base_url === s.baseUrl && params.topic === s.topic),
   );
 
   useConnectionListeners(account, subscriptions, users, webPushTopics);

web/src/components/MarkdownContent.jsx

@@ -2,6 +2,18 @@ import * as React from "react";
 import { useEffect } from "react";
 import { useRemark } from "react-remark";
 import styled from "@emotion/styled";
+import { sanitizeUrl } from "../app/utils";
+
+// Strip unsafe URL protocols (javascript:, data:, ...) from links and images. Without
+// this, React blocks javascript: URLs at render time and throws an uncaught "React has
+// blocked a javascript: URL" error.
+const SafeLink = ({ href, children, ...props }) => (
+  <a href={sanitizeUrl(href)} {...props}>
+    {children}
+  </a>
+);
+
+const SafeImage = ({ src, alt, ...props }) => <img src={sanitizeUrl(src)} alt={alt} {...props} />;
 
 const MarkdownContainer = styled("div")`
   line-height: 1;
@@ -50,7 +62,9 @@ const MarkdownContainer = styled("div")`
 // dependency stack) is heavy, so this component lives in its own module and is loaded
 // lazily by Notifications.jsx -- it only ships when a markdown message is actually shown.
 const MarkdownContent = ({ content }) => {
-  const [reactContent, setMarkdownSource] = useRemark();
+  const [reactContent, setMarkdownSource] = useRemark({
+    rehypeReactOptions: { components: { a: SafeLink, img: SafeImage } },
+  });
 
   useEffect(() => {
     setMarkdownSource(content);

web/src/components/Notifications.jsx

@@ -23,16 +23,7 @@ import CloseIcon from "@mui/icons-material/Close";
 import InfiniteScroll from "react-infinite-scroll-component";
 import { Trans, useTranslation } from "react-i18next";
 import { useOutletContext } from "react-router-dom";
-import {
-  copyToClipboard,
-  formatBytes,
-  formatShortDateTime,
-  maybeActionErrors,
-  openUrl,
-  shortUrl,
-  topicUrl,
-  unmatchedTags,
-} from "../app/utils";
+import { copyToClipboard, formatBytes, formatDateTime, maybeActionErrors, openUrl, shortUrl, topicUrl, unmatchedTags } from "../app/utils";
 import { ACTION_BROADCAST, ACTION_COPY, ACTION_HTTP, ACTION_VIEW } from "../app/actions";
 import { formatMessage, formatTitle, isImage } from "../app/notificationUtils";
 import { LightboxBackdrop, Paragraph, VerticallyCenteredContainer } from "./styles";
@@ -45,6 +36,7 @@ import priority5 from "../img/priority-5.svg";
 import logoOutline from "../img/ntfy-outline.svg";
 import AttachmentIcon from "./AttachmentIcon";
 import { useAutoSubscribe } from "./hooks";
+import { usePrefCache } from "./PrefCache";
 
 const priorityFiles = {
   1: priority1,
@@ -88,7 +80,7 @@ const SingleSubscriptionList = (props) => {
   // getAllNotifications() filtered by id), so topic switches are instant.
   const notifications = useMemo(
     () => allNotifications.filter((notification) => notification.subscriptionId === subscription.id),
-    [allNotifications, subscription.id]
+    [allNotifications, subscription.id],
   );
   if (notifications.length === 0) {
     return <NoNotifications subscription={subscription} />;
@@ -112,7 +104,7 @@ const NotificationList = (props) => {
         main.scrollTo(0, 0);
       }
     },
-    [props.id]
+    [props.id],
   );
 
   return (
@@ -186,10 +178,11 @@ const NotificationBody = ({ notification }) => {
 };
 
 const NotificationItem = (props) => {
-  const { t, i18n } = useTranslation();
+  const { t } = useTranslation();
+  const { dateFormat, timeFormat } = usePrefCache();
   const { notification } = props;
   const { attachment } = notification;
-  const date = formatShortDateTime(notification.time, i18n.language);
+  const date = formatDateTime(notification.time, dateFormat, timeFormat);
   const otherTags = unmatchedTags(notification.tags);
   const tags = otherTags.length > 0 ? otherTags.join(", ") : null;
   const handleDelete = async () => {
@@ -305,7 +298,8 @@ const NotificationItem = (props) => {
 };
 
 const Attachment = (props) => {
-  const { t, i18n } = useTranslation();
+  const { t } = useTranslation();
+  const { dateFormat, timeFormat } = usePrefCache();
   const { attachment } = props;
   const expired = attachment.expires && attachment.expires < Date.now() / 1000;
   const expires = attachment.expires && attachment.expires > Date.now() / 1000;
@@ -324,8 +318,8 @@ const Attachment = (props) => {
   if (expires) {
     infos.push(
       t("notifications_attachment_link_expires", {
-        date: formatShortDateTime(attachment.expires, i18n.language),
-      })
+        date: formatDateTime(attachment.expires, dateFormat, timeFormat),
+      }),
     );
   }
   if (expired) {

web/src/components/PrefCache.jsx

@@ -32,6 +32,8 @@ export const PrefCacheProvider = ({ children }) => {
     minPriority: await prefs.minPriority(),
     deleteAfter: await prefs.deleteAfter(),
     theme: await prefs.theme(),
+    dateFormat: await prefs.dateFormat(),
+    timeFormat: await prefs.timeFormat(),
     webPushEnabled: await prefs.webPushEnabled(),
   }));
 

web/src/components/Preferences.jsx

@@ -2,6 +2,7 @@ import * as React from "react";
 import { useContext, useEffect, useState } from "react";
 import {
   Alert,
+  Box,
   CardActions,
   CardContent,
   Chip,
@@ -36,14 +37,14 @@ import { useTranslation } from "react-i18next";
 import Info from "@mui/icons-material/Info";
 import { useOutletContext } from "react-router-dom";
 import userManager from "../app/UserManager";
-import { playSound, shortUrl, shuffle, sounds, validUrl } from "../app/utils";
+import { formatDate, formatTime, playSound, shortUrl, shuffle, sounds, validUrl } from "../app/utils";
 import session from "../app/Session";
 import routes from "./routes";
 import accountApi, { Permission, Role } from "../app/AccountApi";
 import { Pref, PrefGroup } from "./Pref";
 import AccountContext from "./AccountContext";
 import { Paragraph } from "./styles";
-import prefs, { THEME } from "../app/Prefs";
+import prefs, { THEME, DATE_FORMAT, TIME_FORMAT } from "../app/Prefs";
 import { PermissionDenyAll, PermissionRead, PermissionReadWrite, PermissionWrite } from "./ReserveIcons";
 import { ReserveAddDialog, ReserveDeleteDialog, ReserveEditDialog } from "./ReserveDialogs";
 import { UnauthorizedError } from "../app/errors";
@@ -228,10 +229,18 @@ const DeleteAfter = () => {
   );
 };
 
+// Shows the resolved/sample value of an option (the current system mode, or a date/time sample) in muted gray.
+const FormatExample = ({ children }) => (
+  <Box component="span" sx={{ color: "text.secondary", ml: 1 }}>
+    {children}
+  </Box>
+);
+
 const Theme = () => {
   const { t } = useTranslation();
   const labelId = "prefTheme";
   const { theme } = usePrefCache();
+  const prefersDarkMode = useMediaQuery("(prefers-color-scheme: dark)");
   const handleChange = async (ev) => {
     await prefs.setTheme(ev.target.value);
   };
@@ -240,7 +249,10 @@ const Theme = () => {
     <Pref labelId={labelId} title={t("prefs_appearance_theme_title")}>
       <FormControl fullWidth variant="standard" sx={{ m: 1 }}>
         <Select value={theme} onChange={handleChange} aria-labelledby={labelId}>
-          <MenuItem value={THEME.SYSTEM}>{t("prefs_appearance_theme_system")}</MenuItem>
+          <MenuItem value={THEME.SYSTEM}>
+            {t("prefs_system_default")}
+            <FormatExample>{prefersDarkMode ? t("prefs_appearance_theme_dark") : t("prefs_appearance_theme_light")}</FormatExample>
+          </MenuItem>
           <MenuItem value={THEME.DARK}>{t("prefs_appearance_theme_dark")}</MenuItem>
           <MenuItem value={THEME.LIGHT}>{t("prefs_appearance_theme_light")}</MenuItem>
         </Select>
@@ -249,6 +261,84 @@ const Theme = () => {
   );
 };
 
+// An unambiguous sample (April 26, 2:30 PM, current year) used for each option's example: the day
+// (26) is too large to be a month, so the day/month order is unmistakable, and 14:30 distinguishes
+// the 12h/24h clock. Using today's date could be ambiguous (e.g. when the day could pass for a month).
+const EXAMPLE_TIMESTAMP = Math.round(new Date(new Date().getFullYear(), 3, 26, 14, 30).getTime() / 1000);
+
+const DateFormat = () => {
+  const { t } = useTranslation();
+  const labelId = "prefDateFormat";
+  const { dateFormat } = usePrefCache();
+  const handleChange = async (ev) => {
+    await prefs.setDateFormat(ev.target.value);
+    await maybeUpdateAccountSettings({ date_format: ev.target.value });
+  };
+
+  return (
+    <Pref labelId={labelId} title={t("prefs_appearance_date_format_title")}>
+      <FormControl fullWidth variant="standard" sx={{ m: 1 }}>
+        <Select value={dateFormat} onChange={handleChange} aria-labelledby={labelId}>
+          <MenuItem value={DATE_FORMAT.SYSTEM}>
+            {t("prefs_system_default")}
+            <FormatExample>{formatDate(EXAMPLE_TIMESTAMP, DATE_FORMAT.SYSTEM)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={DATE_FORMAT.ISO8601}>
+            {t("prefs_appearance_date_format_iso8601")}
+            <FormatExample>{formatDate(EXAMPLE_TIMESTAMP, DATE_FORMAT.ISO8601)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={DATE_FORMAT.DMY}>
+            {t("prefs_appearance_date_format_dmy")}
+            <FormatExample>{formatDate(EXAMPLE_TIMESTAMP, DATE_FORMAT.DMY)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={DATE_FORMAT.DMY_DOT}>
+            {t("prefs_appearance_date_format_dmy_dot")}
+            <FormatExample>{formatDate(EXAMPLE_TIMESTAMP, DATE_FORMAT.DMY_DOT)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={DATE_FORMAT.MDY}>
+            {t("prefs_appearance_date_format_mdy")}
+            <FormatExample>{formatDate(EXAMPLE_TIMESTAMP, DATE_FORMAT.MDY)}</FormatExample>
+          </MenuItem>
+        </Select>
+      </FormControl>
+    </Pref>
+  );
+};
+
+const TimeFormat = () => {
+  const { t } = useTranslation();
+  const labelId = "prefTimeFormat";
+  const { timeFormat, dateFormat } = usePrefCache();
+  // ISO 8601 dates are always 24-hour, so the clock choice is fixed while it's selected. Disable the
+  // control and show 24-hour, but leave the stored pref untouched so it returns for other date formats.
+  const fixedTo24h = dateFormat === DATE_FORMAT.ISO8601;
+  const handleChange = async (ev) => {
+    await prefs.setTimeFormat(ev.target.value);
+    await maybeUpdateAccountSettings({ time_format: ev.target.value });
+  };
+
+  return (
+    <Pref labelId={labelId} title={t("prefs_appearance_time_format_title")}>
+      <FormControl fullWidth variant="standard" sx={{ m: 1 }}>
+        <Select value={fixedTo24h ? TIME_FORMAT.H24 : timeFormat} onChange={handleChange} disabled={fixedTo24h} aria-labelledby={labelId}>
+          <MenuItem value={TIME_FORMAT.SYSTEM}>
+            {t("prefs_system_default")}
+            <FormatExample>{formatTime(EXAMPLE_TIMESTAMP, TIME_FORMAT.SYSTEM)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={TIME_FORMAT.H12}>
+            {t("prefs_appearance_time_format_12h")}
+            <FormatExample>{formatTime(EXAMPLE_TIMESTAMP, TIME_FORMAT.H12)}</FormatExample>
+          </MenuItem>
+          <MenuItem value={TIME_FORMAT.H24}>
+            {t("prefs_appearance_time_format_24h")}
+            <FormatExample>{formatTime(EXAMPLE_TIMESTAMP, TIME_FORMAT.H24)}</FormatExample>
+          </MenuItem>
+        </Select>
+      </FormControl>
+    </Pref>
+  );
+};
+
 const WebPushEnabled = () => {
   const { t } = useTranslation();
   const labelId = "prefWebPushEnabled";
@@ -518,6 +608,8 @@ const Appearance = () => {
       </Typography>
       <PrefGroup>
         <Theme />
+        <DateFormat />
+        <TimeFormat />
         <Language />
       </PrefGroup>
     </Card>

web/src/components/PublishDialog.jsx

@@ -168,7 +168,7 @@ const PublishDialog = (props) => {
               loaded: formatBytes(ev.loaded),
               total: formatBytes(ev.total),
               percent: Math.round((ev.loaded * 100.0) / ev.total),
-            })
+            }),
           );
         } else {
           setStatus(t("publish_dialog_progress_uploading"));
@@ -201,19 +201,19 @@ const PublishDialog = (props) => {
           t("publish_dialog_attachment_limits_file_and_quota_reached", {
             fileSizeLimit: formatBytes(fileSizeLimit),
             remainingBytes: formatBytes(remainingBytes),
-          })
+          }),
         );
       } else if (fileSizeLimitReached) {
         setAttachFileError(
           t("publish_dialog_attachment_limits_file_reached", {
             fileSizeLimit: formatBytes(fileSizeLimit),
-          })
+          }),
         );
       } else if (quotaReached) {
         setAttachFileError(
           t("publish_dialog_attachment_limits_quota_reached", {
             remainingBytes: formatBytes(remainingBytes),
-          })
+          }),
         );
       } else {
         setAttachFileError("");

web/src/components/SubscribeDialog.jsx

@@ -93,7 +93,7 @@ const SubscribePage = (props) => {
   const { topic } = props;
   const existingTopicUrls = props.subscriptions.map((s) => topicUrl(s.baseUrl, s.topic));
   const existingBaseUrls = Array.from(new Set([publicBaseUrl, ...props.subscriptions.map((s) => s.baseUrl)])).filter(
-    (s) => s !== config.base_url
+    (s) => s !== config.base_url,
   );
   const showReserveTopicCheckbox = config.enable_reservations && !anotherServerVisible && (config.enable_payments || account);
   const reserveTopicEnabled =
@@ -113,7 +113,7 @@ const SubscribePage = (props) => {
         setError(
           t("subscribe_dialog_error_user_not_authorized", {
             username,
-          })
+          }),
         );
         return;
       }

web/src/components/SubscriptionPopup.jsx

@@ -35,14 +35,16 @@ import accountApi, { Role } from "../app/AccountApi";
 import session from "../app/Session";
 import routes from "./routes";
 import PopupMenu from "./PopupMenu";
-import { formatShortDateTime, shuffle } from "../app/utils";
+import { formatDateTime, shuffle } from "../app/utils";
 import api from "../app/Api";
 import AccountContext from "./AccountContext";
+import { usePrefCache } from "./PrefCache";
 import { ReserveAddDialog, ReserveDeleteDialog, ReserveEditDialog } from "./ReserveDialogs";
 import { UnauthorizedError } from "../app/errors";
 
 export const SubscriptionPopup = (props) => {
   const { t } = useTranslation();
+  const { dateFormat, timeFormat } = usePrefCache();
   const { account } = useContext(AccountContext);
   const navigate = useNavigate();
   const [displayNameDialogOpen, setDisplayNameDialogOpen] = useState(false);
@@ -115,15 +117,17 @@ export const SubscriptionPopup = (props) => {
     ])[0];
     const nowSeconds = Math.round(Date.now() / 1000);
     const message = shuffle([
-      `Hello friend, this is a test notification from ntfy web. It's ${formatShortDateTime(
+      `Hello friend, this is a test notification from ntfy web. It's ${formatDateTime(
         nowSeconds,
-        "en-US"
+        dateFormat,
+        timeFormat,
       )} right now. Is that early or late?`,
       `So I heard you like ntfy? If that's true, go to GitHub and star it, or to the Play store and rate it. Thanks! Oh yeah, this is a test notification.`,
       `It's almost like you want to hear what I have to say. I'm not even a machine. I'm just a sentence that Phil typed on a random Thursday.`,
-      `Alright then, it's ${formatShortDateTime(
+      `Alright then, it's ${formatDateTime(
         nowSeconds,
-        "en-US"
+        dateFormat,
+        timeFormat,
       )} already. Boy oh boy, where did the time go? I hope you're alright, friend.`,
       `There are nine million bicycles in Beijing That's a fact; It's a thing we can't deny. I wonder if that's true ...`,
       `I'm really excited that you're trying out ntfy. Did you know that there are a few public topics, such as ntfy.sh/stats and ntfy.sh/announcements.`,

web/src/components/UpgradeDialog.jsx

@@ -28,8 +28,9 @@ import Check from "@mui/icons-material/Check";
 import Close from "@mui/icons-material/Close";
 import { NavLink } from "react-router-dom";
 import { UnauthorizedError } from "../app/errors";
-import { formatBytes, formatNumber, formatPrice, formatShortDate } from "../app/utils";
+import { formatBytes, formatNumber, formatPrice, formatDate } from "../app/utils";
 import AccountContext from "./AccountContext";
+import { usePrefCache } from "./PrefCache";
 import routes from "./routes";
 import session from "../app/Session";
 import accountApi, { SubscriptionInterval } from "../app/AccountApi";
@@ -63,7 +64,8 @@ const Banner = {
 
 const UpgradeDialog = (props) => {
   const theme = useTheme();
-  const { t, i18n } = useTranslation();
+  const { t } = useTranslation();
+  const { dateFormat } = usePrefCache();
   const { account } = useContext(AccountContext); // May be undefined!
   const [error, setError] = useState("");
   const [tiers, setTiers] = useState(null);
@@ -234,7 +236,7 @@ const UpgradeDialog = (props) => {
             <Trans
               i18nKey="account_upgrade_dialog_cancel_warning"
               values={{
-                date: formatShortDate(account?.billing?.paid_until || 0, i18n.language),
+                date: formatDate(account?.billing?.paid_until || 0, dateFormat),
               }}
             />
           </Alert>