18.09.2026
The biggest update so far: better filters, new feeds and a hardened container. Some changes affect existing setups, so please read the upgrade notes first.
Upgrade Notes
- The Docker image was renamed from
ransomware-bottoransomware-news-botso stop the old container before starting the new one, or you'll end up with two bots running side by side. config_general.jsonis no longer shipped. Copyconfig_general.example.jsonand fill it in.- Run
--check-configbefore upgrading. Feed and webhook URLs are checked more strictly. - Feeds must use HTTPS.
retry_max_attemptsnow counts retries after the first send (5= 6 sends).- Docker Compose now requires
RANSOMWARE_BOT_IMAGE_TAGto be set, for example tolatestor a release tag. - If you reorder your webhook URLs, the bot won't start until you run it once with
--accept-destination-remapto confirm the change. Adding new URLs at the end is fine. - If webhook or feed tokens may have shown up in old logs, rotate them.
What's New
- Filter on individual fields. Custom field labels, date formats and time zones; country names in your language.
- New feeds: CERT-EU and CERT-FR.
- A delivery log that shows why an alert was or wasn't sent.
- New
--healthcheckflag, also used by the Docker healthcheck. Instead of only checking that the process is running, it checks the config, the data directory, access to the ransomware.live API, failed deliveries and whether the RSS feeds are still polled successfully. If something is wrong, Docker marks the container as unhealthy. - New
--list-dead-letterflag that lists alerts which could not be delivered even after all retries, including details on how to recover them. - More settings apply without a restart.
Improvements
- Fewer duplicate alerts.
- Protection against spoofed links and hidden characters in feed text.
- Go 1.27 and Alpine 3.24; fewer third-party dependencies.
- Hardened container: read-only file system, all capabilities dropped, base images pinned by digest.