Roger Hoem-MartinsenandClaude Opus 4.8
413448037c
The runner stage ships the npm CLI bundled in node:22-alpine, whose
vendored dependencies carry known vulnerabilities that trivy flags on the
published postgresql-latest image:
usr/local/lib/node_modules/npm/node_modules/...
- sigstore 3.1.0 CVE-2026-48815 (HIGH)
- picomatch 4.0.3 CVE-2026-33671 (HIGH)
- @sigstore/core 2.0.0 CVE-2026-48758
- brace-expansion 2.0.2 CVE-2026-33750
- ip-address 10.1.0 CVE-2026-42338
- tar 7.5.11 CVE-2026-53655
npm is only a build-time bootstrap for pnpm; it is not needed at runtime.
Install pnpm with it, then remove npm in the same layer so none of these
vendored packages are present in the final image, and run the container
via pnpm instead of npm. pnpm (and corepack) remain and were never flagged.
The curl/libcurl/c-ares HIGH findings are resolved by rebuilding alone,
since Alpine 3.24 already serves curl 8.21.0-r0 / c-ares 1.34.8-r0 (the
published image is simply stale).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Umami
Umami is a simple, fast, privacy-focused alternative to Google Analytics.
🚀 Getting Started
A detailed getting started guide can be found at umami.is/docs.
🛠 Installing from Source
Requirements
- A server with Node.js version 18.18+.
- A PostgreSQL database version v12.14+.
Get the source code and install packages
git clone https://github.com/umami-software/umami.git
cd umami
pnpm install
Configure Umami
Create an .env file with the following:
DATABASE_URL=connection-url
Optional: set API_URL to change the base URL used by internal UI API calls.
Relative paths are served under BASE_PATH; absolute URLs are proxied through the local /api route.
For example, API_URL=/internal-api or API_URL=https://api.example.com/api.
The connection URL format:
postgresql://username:mypassword@localhost:5432/mydb
Build the Application
pnpm run build
The build step will create tables in your database if you are installing for the first time. It will also create a login user with username admin and password umami.
Start the Application
pnpm run start
By default, this will launch the application on http://localhost:3000. You will need to either proxy requests from your web server or change the port to serve the application directly.
🐳 Installing with Docker
Umami provides Docker images as well as a Docker compose file for easy deployment.
Docker image:
docker pull docker.umami.is/umami-software/umami:latest
Docker compose (Runs Umami with a PostgreSQL database):
docker compose up -d
🔄 Getting Updates
To get the latest features, simply do a pull, install any new dependencies, and rebuild:
git pull
pnpm install
pnpm build
To update the Docker image, simply pull the new images and rebuild:
docker compose pull
docker compose up --force-recreate -d
🛟 Support
