Francis Cao
4580cb6179
preserve tooltip css
2026-09-08 09:46:51 -07:00
Mike Cao
9fb7bacee6
Rename package scripts to colon-based conventions and update build, seed, and API client references
2026-09-07 17:47:36 -07:00
Mike Cao
6156387251
Generate OpenAPI field descriptions and validate generated clients in CI
2026-09-07 17:30:56 -07:00
Mike Cao
9eef6f22c9
Prevent event details from wrapping in table rows
2026-09-07 10:37:22 -07:00
Mike Cao
9ff1ecb6dd
Migrate UI styles to Zen theme tokens and preserve brand colors
2026-09-07 10:28:16 -07:00
Mike Cao
0f187dcac1
Document API operations with concise endpoint descriptions
2026-09-06 23:36:53 -07:00
Mike Cao
9c78131671
Update API version to 3.3.1 and replace classnames with cn
2026-09-06 20:58:02 -07:00
Mike Cao
8b9ba7cce9
Merge pull request #4519 from umami-software/testing
...
Add API integration test suite with Postgres and ClickHouse coverage
2026-09-06 20:49:39 -07:00
Mike Cao
e18769e8cf
Add API integration test suite with Postgres and ClickHouse coverage
2026-09-06 16:42:53 -07:00
Mike Cao
42c5a53650
Merge pull request #4490 from justadityaraj/fix/page-selector-dev
...
Keep typed page paths selectable in reports
2026-09-05 22:41:30 -07:00
Mike Cao
d7bf253363
Merge pull request #4515 from umami-software/feat/mcp-api-client
...
Add OAuth-protected MCP server with generated API client and OpenAPI contracts
2026-09-05 19:41:58 -07:00
Mike Cao
162487eca1
Remove rate limiting from OAuth registration and MCP endpoints
...
Drop the per-IP registration limiter and the per-user MCP limiter along
with the shared in-memory/Redis helper. Request throttling is an
infrastructure concern (reverse proxy, CDN) rather than something each
endpoint should reimplement.
2026-09-05 19:20:56 -07:00
Mike Cao
d2b4aa174e
Rate limit dynamic client registration per source address
...
Replace the process-wide registration counter used without Redis with a
shared per-key fixed-window limiter, so one requester can no longer
exhaust the registration budget for every other client on the process.
The in-memory fallback is bounded (expired windows are swept, then the
oldest keys are shed) so memory stays constant under key churn.
Also fixes checkMcpRateLimit inverting redis.rateLimit's result: it
resolves true once the counter reaches its threshold, so with Redis the
MCP endpoint was denying requests below the limit and allowing those
above it. Both call sites now share the same limiter and semantics.
2026-09-05 17:57:20 -07:00
Mike Cao
67449d76ef
Harden OAuth metadata fetching and make token rotation transactional
2026-09-05 14:09:33 -07:00
Mike Cao
950ae63f87
Merge pull request #4511 from GroophyLifefor/change-url-icon
...
replace Waypoints icon with Link for URL
2026-09-05 00:36:28 -07:00
Francis Cao
15a57f9e34
Merge branch 'analytics' of https://github.com/umami-software/umami into dev
2026-09-04 09:23:04 -07:00
Mike Cao
9c44a3cbbf
Fix mobile date filter fullscreen dropdown
2026-09-03 17:14:22 -07:00
Mike Cao
65bf19e067
Add OAuth-protected MCP server with generated API client packages
2026-09-03 16:58:47 -07:00
Francis Cao
336fbcb3c5
Annotations workflow, UI/UX polish
2026-09-03 12:59:56 -07:00
Murat Kirazkaya
4044986e8a
refactor(website-menu): replace Waypoints icon with Link icon in expanded menu
2026-09-03 16:27:43 +03:00
Francis Cao
26e236c95c
Fix Goal/Funnel wildcard UI bug
2026-09-02 14:56:35 -07:00
Francis Cao
2709d8e8ea
Merge pull request #4502 from nicolas2601/fix/manage-teams-base-path
...
fix(teams): respect basePath in Manage teams menu link
2026-09-02 14:40:29 -07:00
Mike Cao
f1c5b4f7bb
Add account API key management
2026-09-01 21:50:07 -07:00
Mike Cao
98b824ce48
Update Next.js and related dependencies
2026-09-01 17:47:03 -07:00
Mike Cao
8d0229b598
Remove autogenerated operation descriptions from OpenAPI contracts
2026-09-01 16:07:08 -07:00
Mike Cao
e1a4934038
Generate explicit OpenAPI contracts for API routes
2026-09-01 15:09:10 -07:00
Mike Cao
cc5d71d39f
Generate OpenAPI from App Router handlers with inferred contracts and source analysis
2026-09-01 13:09:40 -07:00
Nicolas Moreno
054c365504
fix(teams): respect basePath in Manage teams menu link
2026-09-01 06:59:38 -05:00
Mike Cao
5ce5664b29
Add OpenAPI schema generation and validation for API routes
2026-08-31 19:37:37 -07:00
Mike Cao
5d822e6c7e
Add annotation modal headings and restore row button styling
2026-08-27 00:17:25 -07:00
Mike Cao
64e4cc1c3b
Add website annotations with chart markers and CRUD management
2026-08-27 00:09:03 -07:00
Aditya
de7c06c0a5
Fix page selector custom values
2026-08-26 18:22:15 +05:30
Mike Cao
eea124bbf8
Migrate UI theme variables to react-zen tokens and update dependency package
2026-08-24 17:02:57 -07:00
Francis Cao
af542569bf
fix realtime search bar css
2026-08-19 22:25:41 -07:00
Francis Cao
cb9cb27fbe
fix(send): reset visit state on session drift and add missing 2FA translations
2026-08-19 22:06:19 -07:00
Francis Cao
c3a70b123d
fix(relational): prevent orphaned website_event sessions and keep event pagination stable. Closes #4462 .
2026-08-18 14:16:03 -07:00
Francis Cao
1a91b5f1f3
fix event_name parameter collision. Closes #4461
2026-08-18 10:49:14 -07:00
Francis Cao
a2374e1515
add padding to avoid content and scroll-bar collision in expanded menu
2026-08-17 16:17:23 -07:00
NoiceHax
319a09cdb5
fix(send): keep the root path when REMOVE_TRAILING_SLASH is enabled
...
The trailing-slash regex also matched the leading slash of the root URL, so with REMOVE_TRAILING_SLASH set every home page view was stored with an empty url_path: the home page vanished from the paths/entry/exit reports and could not be selected as a funnel step. Skip the match at the start of the path so "/" and "/#hash" are preserved while "/blog/" and "/blog/#hash" are still trimmed.
Closes #4152
2026-08-17 11:21:07 -07:00
Francis Cao and NoiceHax
d6a3b8c6d3
fix(auth): lowercase existing usernames for pre-3.2 accounts
...
Co-authored-by: NoiceHax <yashasprakash021@gmail.com >
2026-08-17 10:39:49 -07:00
Francis Cao
dd6b5ddf3a
fix: preserve menu item actions in admin dropdowns. Closes #4453 .
2026-08-17 10:00:15 -07:00
Francis Cao
0a77e50da1
Harden 2FA APi routes and UI when 2FA env var missing. Closes #4443 .
2026-08-14 10:32:09 -07:00
Francis Cao
f94a5cfc02
Merge pull request #4450 from NoiceHax/fix/issue-4443
...
fix(2fa): gate two-factor auth when the encryption key is missing
2026-08-14 09:32:50 -07:00
Francis Cao
5ca2be7598
expanded metrics performance updates.
2026-08-13 10:16:29 -07:00
NoiceHax
a40b418038
fix(2fa): gate two-factor auth when the encryption key is missing
...
TWO_FACTOR_ENCRYPTION_KEY has no default, so instances upgrading to 3.3
without setting it hit an unhandled throw from encryptSecret: the setup
dialog only reported "Something went wrong", and where 2FA was required
the blocking dialog made the whole app unusable. The status endpoint now
reports 2FA as not required while the key is missing or invalid, and
setup initiation returns 503 with a two-factor-error-not-configured code
that the setup dialog renders as a readable message. Also documents the
variable in the README and the example compose file.
Closes #4443
2026-08-13 22:39:31 +05:30
Nejc Tomažič
b58172c591
fix funnel step editor crash on null event values
2026-08-13 12:59:02 +02:00
Francis Cao
3e729bc0e4
harden eventData delete. Add translations. Closes #4435 .
2026-08-10 12:41:41 -07:00
Yash
d9dfd75549
fix(i18n): add missing invalidValue translation keys
2026-08-08 16:29:11 +05:30
Yash
3dce2c85ea
feat: added client side validation
2026-08-08 16:15:38 +05:30
Mike Cao
8a05dfee58
Replace global scrollbars with themed overlay scroll areas
2026-08-07 15:31:14 -07:00
Francis Cao