sankalp/umami
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,620 Commits 1 Branch 0 Tags
ed2c0804aebeeaf6dc2e7a2e0bbda9d48daa5083
Commit Graph
6620 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Francis Cao ed2c0804ae Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-07-23 12:46:57 -07:00
Francis Cao 32170eed00 2FA migration and schema clean-up 2026-07-23 12:46:55 -07:00
Mike Cao 8187bb3336 Update lockfile for auth and test dependency upgrades 2026-07-23 12:06:41 -07:00
Francis Cao 13d18c0880 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-07-23 11:50:39 -07:00
Francis Cao d05d9c4f34 Session and event property filtering. Closes #2945. Closes #4008. 2026-07-23 11:50:35 -07:00
Mike Cao 36bd9d33b8 Merge pull request #4205 from boutterudy/feat-2FA 
feat(login): add 2FA
 2026-07-23 11:45:20 -07:00
Mike Cao aafe068bc1 Merge branch 'dev' into feat-2FA 2026-07-23 11:14:59 -07:00
Francis Cao 78346795eb Fix revenue query filtering. Closes #4286 2026-07-23 09:41:59 -07:00
Francis Cao 934c028a53 Merge pull request #4387 from rogerhmar/security/trivy-cve-patches 
fix(docker): drop bundled npm from runtime image to clear base-image CVEs
 2026-07-22 13:26:56 -07:00
Francis Cao 21fe2d8e75 Merge branch 'dev' into security/trivy-cve-patches 2026-07-22 13:12:25 -07:00
Francis Cao 03ef78724b add design translations. Fix empty-dashboard message. Closes #4398 2026-07-22 12:56:11 -07:00
Francis Cao 11e57d726a fix missing extension. Closes #4400 2026-07-22 12:35:38 -07:00
Francis Cao 7db8c1e979 Merge pull request #4404 from shubhamOrgpathak1/fix/website-backend-validation 
Validate website name and domain input on server side
 2026-07-22 12:27:47 -07:00
Francis Cao 58ee28a55e remove session recalculate and related queries 2026-07-21 12:33:41 -07:00
Shubham Pathak 715f306a48 Validate website name and domain input on server side 2026-07-21 21:25:14 +05:45
Mike Cao eb9a77ea64 Return 404 when session is not found and add test coverage for GET session route 2026-07-20 17:15:52 -07:00
Francis Cao 9bf95ef112 updaet session stitching model for post-identify reads. fix fullPath search 2026-07-20 12:21:07 -07:00
Mike Cao 5911ddaa93 Convert tracker build to TypeScript and add type checks 2026-07-19 22:04:49 -07:00
Mike Cao cb801230cc Fix identified session ID generation 2026-07-19 10:43:21 -07:00
Mike Cao 4691a344c5 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-07-18 01:35:25 -07:00
Mike Cao bc97f9f439 Enforce a per-plan team limit when creating teams in cloud mode 2026-07-18 01:35:13 -07:00
Francis Cao 8004afe63d Punycode support. Closes #2170 2026-07-17 10:22:37 -07:00
Francis Cao b47847958a fix code-textarea css 2026-07-16 11:58:49 -07:00
Francis Cao f7b94c259b add tracking code workflow for Add website. Add linked ID to session modal. 2026-07-16 11:32:32 -07:00
Francis Cao 7afc4ccf6b session activity identify stitching 2026-07-15 11:20:27 -07:00
Roger Hoem-MartinsenandClaude Opus 4.8 413448037c fix(docker): drop bundled npm from runtime image to clear base-image CVEs 
The runner stage ships the npm CLI bundled in node:22-alpine, whose
vendored dependencies carry known vulnerabilities that trivy flags on the
published postgresql-latest image:

  usr/local/lib/node_modules/npm/node_modules/...
    - sigstore 3.1.0        CVE-2026-48815 (HIGH)
    - picomatch 4.0.3       CVE-2026-33671 (HIGH)
    - @sigstore/core 2.0.0  CVE-2026-48758
    - brace-expansion 2.0.2 CVE-2026-33750
    - ip-address 10.1.0     CVE-2026-42338
    - tar 7.5.11            CVE-2026-53655

npm is only a build-time bootstrap for pnpm; it is not needed at runtime.
Install pnpm with it, then remove npm in the same layer so none of these
vendored packages are present in the final image, and run the container
via pnpm instead of npm. pnpm (and corepack) remain and were never flagged.

The curl/libcurl/c-ares HIGH findings are resolved by rebuilding alone,
since Alpine 3.24 already serves curl 8.21.0-r0 / c-ares 1.34.8-r0 (the
published image is simply stale).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-15 11:30:18 +02:00
Francis Cao 8a75208d5b fix permissions loop for charts route 2026-07-14 15:23:32 -07:00
Francis Cao 712b32c7bf sparkline performance 2026-07-14 14:58:11 -07:00
Mike Cao e030faf236 Merge pull request #4377 from leonacostaok/fix/kafka-verify-tls 
verify Kafka broker TLS certificate by default
 2026-07-13 17:49:45 -07:00
Mike Cao a8c275ec61 Merge pull request #4382 from Kopaev/fix/ru-ru-missing-translations 
i18n(ru-RU): add 21 missing Russian translations
 2026-07-13 17:47:41 -07:00
Aleksey Kopaev 71f1745111 i18n(ru-RU): add 21 missing Russian translations 
Several keys present in en-US were missing from ru-RU, so the UI showed
raw keys (e.g. label.heatmaps) on the Russian locale. Adds translations
for the missing label.* and message.* keys, including heatmap, replay
recorder, board, LLM, and upgrade/plan strings.
 2026-07-13 10:11:58 +02:00
Mike Cao 889b2b7952 Merge pull request #4381 from daeho-ro/i18n-ko-KR 
Add Korean translations to sync english keys
 2026-07-09 16:36:25 -07:00
Francis Cao 31c479cf5e Fix board funnel/goal preview 2026-07-08 11:11:55 -07:00
Francis Cao 28230ee471 sync bucket labeling 2026-07-08 10:32:16 -07:00
Francis Cao 86b35475c0 Add sparklines to Website, Pixel, Link tables 2026-07-08 10:03:08 -07:00
Daeho Ro cd409cc617 Add Korean translations to sync english keys 
Fill 21 missing keys in ko-KR messages (19 labels, 2 messages) to reach
100% parity with en-US, following existing translation conventions.
 2026-07-08 20:01:42 +09:00
Francis Cao 1fb565bc27 fix failed prisma tests 2026-07-06 15:34:00 -07:00
Francis Cao e47d1570b9 fix iframe viewport clipping 2026-07-06 11:24:19 -07:00
Francis Cao 7bdc2f215e harden report references in boards 2026-07-06 10:58:43 -07:00
Francis Cao a4a0167515 enforce minimum 8 character slug on create/update. Closes #4376 2026-07-04 08:44:23 -07:00
Leon Acosta 2771abc6a7 verify Kafka broker TLS certificate by default 
When SASL credentials are present, getClient() connected with
`rejectUnauthorized: false`, so the SASL password was sent over a TLS
connection whose broker certificate was never verified — a MITM could
present any certificate and capture the credentials.

Verify by default; set KAFKA_SSL_ALLOW_UNAUTHORIZED=true to opt out for
self-signed brokers.
 2026-07-04 18:45:45 +07:00
Francis Cao 735d85c7af fix channel attribution for organic Facebook traffic. Closes #4297 2026-07-02 11:51:46 -07:00
Francis Cao 0d7503a320 remove event property mock data 2026-07-02 11:12:26 -07:00
Francis Cao 8b177f1a21 Fix ComboBox/MultiSelect issues. Closes #4355 2026-07-02 11:11:53 -07:00
Francis Cao 22176eb76d Fix: Session modal issues on mobile: scroll jumps to top on close, avatar overflow causes horizontal scroll. Closes #4358 2026-07-02 10:41:57 -07:00
Francis Cao 952143ba5e match order by with clickhouse queries 2026-07-02 10:32:43 -07:00
Francis Cao 2575f11d26 Merge pull request #4365 from PeterUstinox/fix/eventdata-events-groupby-postgres 
fix(events): add GROUP BY to getEventDataEvents no-event relational branch (PostgreSQL 42803)
 2026-07-02 10:30:27 -07:00
Francis Cao 6af12977d1 Merge pull request #4364 from Sebasmzt/feat/es-ES-add-missing-keys 
Add Spanish translations to sync with en-US.json keys
 2026-07-02 10:21:00 -07:00
Francis Cao 0b0a784c76 fix: improve 100vh heatmap iframe alignment 2026-07-02 09:52:51 -07:00
Francis Cao 4c4071b270 keep createSession raw writes on primary when replicas are enabled 2026-07-01 09:53:08 -07:00