Francis Cao
735d85c7af
fix channel attribution for organic Facebook traffic. Closes #4297
2026-07-02 11:51:46 -07:00
Francis Cao
4c4071b270
keep createSession raw writes on primary when replicas are enabled
2026-07-01 09:53:08 -07:00
Francis Cao
ab5b1bf354
Board component, security, test updates
2026-06-29 18:17:57 -07:00
Francis Cao
8a0bdc2727
heatmap migration/code clean-up
2026-06-23 15:01:00 -07:00
Francis Cao
3888ec6f4f
Allow legacy stateless tokens that were minted without a password fingerprint.
2026-06-23 13:24:55 -07:00
Francis Cao
9defe7e3e0
Only enforce password-change invalidation for sessions that include a password fingerprint.
2026-06-23 00:27:44 -07:00
Francis Cao
727490269b
Invalidate auth sessions after password changes
2026-06-22 23:31:12 -07:00
Francis Cao
2e74b3ebae
sanitize logging of sensitive info.
2026-06-22 23:03:01 -07:00
Francis Cao
129681ebd7
fix: harden analytics writes and hide internal server errors from client
2026-06-22 22:07:07 -07:00
Francis Cao
c61c01e3bb
implement session replay filters
2026-06-17 11:38:57 -07:00
Francis Cao
f3ce0e64ca
typescript fixes, replayer close error, show page toggle fix.
2026-06-17 10:02:12 -07:00
Mike Cao
05cce05a11
Batch Kafka messages and drop oversized payloads
2026-06-15 22:02:08 -07:00
Mike Cao
95ece5ba56
Normalize replay events for rrweb-player playback
2026-06-15 20:08:53 -07:00
Mike Cao
15038b09d9
Handle fragmented replay events in recording and playback
2026-06-15 13:46:24 -07:00
Mike Cao
f69f76b3b1
Handle invalid IPs and localhost lookup failures in location detection
2026-06-11 19:01:04 -07:00
Mike Cao
475d9548de
Reject oversized replay payloads and chunk recorder flushes
2026-06-10 23:18:50 -07:00
Mike Cao
db01e3a1bb
Lower cloud free website limit to 1
2026-06-09 14:58:10 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Mike Cao
d2eafd68f7
Allow unlimited cloud websites for subscribed accounts
2026-06-08 17:20:20 -07:00
Mike Cao
de487e572e
Merge branch 'analytics' into dev
2026-06-04 19:56:02 -07:00
Mike Cao
7de662a71e
Revert to external API url.
2026-06-04 17:32:25 -07:00
Francis Cao
4956380942
revert api url changes. exclude auth from API_URL
2026-06-04 14:45:50 -07:00
Francis Cao
8473dea1ca
fix self-hosting auth issue with API_URL missing
2026-06-04 10:19:23 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
0f36990040
Merge branch 'analytics' into dev
2026-06-02 20:22:32 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
9ced9ac85a
Fixed API_URL handling.
2026-06-02 11:19:33 -07:00
Mike Cao
c41bf7c93e
Enforce cloud website limits by subscription tier
2026-05-26 20:45:07 -07:00
Francis Cao
462be82782
swap out S3 for R2 for heatmap storage
2026-05-22 10:47:56 -07:00
Francis Cao
07e40db5f4
add clickhouse+s3 workflow for heatmaps
2026-05-19 22:41:59 -07:00
Francis Cao
5bd92ce950
implement sepearte replay/heatmap enabled routes and collection
2026-05-19 15:46:01 -07:00
Francis Cao
a7a0d73dd7
fix PieChart rendering issues by giving default height.
2026-05-18 23:06:47 -07:00
Mike Cao
b6a4c70a7a
Fix IntersectionObserver mock for updated lib.dom.d.ts
2026-05-17 22:34:47 -07:00
Mike Cao
5bcbdc8ced
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-17 21:04:46 -07:00
Mike Cao
0fff8fbb86
Merge branch 'fix-4123' of https://github.com/ElfenB/umami into ElfenB-fix-4123
2026-05-17 21:04:17 -07:00
Francis Cao
3230f6596f
add more truncation fields on save
2026-05-16 17:44:53 -07:00
Mike Cao
c0ea3aefbe
Migrate tests to Vitest
2026-05-14 22:05:34 -07:00
Mike Cao
a48f5aad5f
Merge pull request #4140 from seojcarlos/fix/firefox-events-nan
...
fix: prevent NaN timestamps from breaking event charts in Firefox
2026-05-14 23:28:51 -04:00
Francis Cao
cd20b3aafd
Heatmaps bug fixes, update schema to match overlay, use react-zen component to match ui/ux, polish
2026-05-14 14:23:41 -07:00
Mike Cao
985aa285b2
Merge pull request #4039 from God-2077/umami-v3-dev-2
...
fix: Optimize IP detection logic and add error handling
2026-05-14 05:53:05 -04:00
Mike Cao
0be5b5aa26
Route /auth and /config to local API; everything else uses API_URL
2026-05-13 00:07:30 -07:00
Francis Cao
21b56d2922
add LLM channel logic
2026-05-11 10:31:04 -07:00
Mike Cao
216cf6c448
Migrate test suite from Cypress and Jest to Playwright and Vitest
2026-05-09 01:23:20 -07:00
Mike Cao
2fd319f910
Add configurable internal API URL
2026-05-09 01:06:52 -07:00
Francis Cao
fa182d0947
implement URL pageview metric/expanded metric
2026-05-07 16:59:30 -07:00
Mike Cao
6c2155d496
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-07 14:54:25 -07:00
Mike Cao
9b18511af0
Merge branch 'heatmaps' into dev
...
# Conflicts:
# db/clickhouse/schema.sql
2026-05-07 14:49:21 -07:00
Mike Cao
6672ea04f0
Label generic browser as unknown
2026-05-07 14:30:43 -07:00
Francis Cao