Mike Cao
15038b09d9
Handle fragmented replay events in recording and playback
2026-06-15 13:46:24 -07:00
Mike Cao
4987e0ca01
Bump runtime and tooling dependencies
2026-06-14 23:09:33 -07:00
Mike Cao
ceedbf3176
Upgrade rrweb and chunk replay payloads
2026-06-12 14:05:32 -07:00
Mike Cao
caa4ae1fd4
Refresh lockfile for updated frontend dependencies and platform metadata
2026-06-11 22:45:23 -07:00
Mike Cao
f69f76b3b1
Handle invalid IPs and localhost lookup failures in location detection
2026-06-11 19:01:04 -07:00
Mike Cao
fa4318fb87
Tighten side nav spacing and remove extra bottom margin
2026-06-11 17:55:44 -07:00
Mike Cao
475d9548de
Reject oversized replay payloads and chunk recorder flushes
2026-06-10 23:18:50 -07:00
Mike Cao
1118f4b28e
Upgrade rrweb and rrweb-player to 2.0.1
2026-06-10 21:41:24 -07:00
Mike Cao
c80e35efd7
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-10 20:26:09 -07:00
Mike Cao
38b5a8d25b
Flush replay events on pagehide with a shorter interval
2026-06-10 20:25:19 -07:00
Francis Cao
6837825512
Fix multiple rows per session bug. Add guard rails for bad data.
2026-06-10 09:44:48 -07:00
Francis Cao
f9cf213261
Add Session Activity guards for showing multiple records per result
2026-06-10 09:18:25 -07:00
Mike Cao
8227589ad9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-09 23:07:24 -07:00
Mike Cao
db01e3a1bb
Lower cloud free website limit to 1
2026-06-09 14:58:10 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Francis Cao
2df051e216
fix sharetoken permissions for pixels,links,boards, and failed routes
2026-06-08 19:16:01 -07:00
Mike Cao
d2eafd68f7
Allow unlimited cloud websites for subscribed accounts
2026-06-08 17:20:20 -07:00
Francis Cao
264466191e
deterministic order for getReports. Closes #4323
2026-06-05 09:53:45 -07:00
Mike Cao
f09df3cf14
Remove unused config property.
2026-06-04 20:15:57 -07:00
Mike Cao
de487e572e
Merge branch 'analytics' into dev
2026-06-04 19:56:02 -07:00
Mike Cao
7de662a71e
Revert to external API url.
2026-06-04 17:32:25 -07:00
Francis Cao
4956380942
revert api url changes. exclude auth from API_URL
2026-06-04 14:45:50 -07:00
Francis Cao
8473dea1ca
fix self-hosting auth issue with API_URL missing
2026-06-04 10:19:23 -07:00
Mike Cao
a52f32604a
Fixed channel metrics queries.
2026-06-04 02:08:01 -07:00
Mike Cao and GitHub
8a39e98961
Merge pull request #4283 from mturac/fix/3549-runtime-login-env
...
fix: evaluate login mode env at runtime
2026-06-03 23:51:21 -04:00
Mike Cao and GitHub
dc7c4f0246
Merge pull request #4292 from umami-software/blacksmith-migration-c0ea3ae
...
.github/workflows: Migrate workflows to Blacksmith runners
2026-06-03 23:47:25 -04:00
Mike Cao and GitHub
d659c5746b
Merge pull request #4317 from umami-software/opencode/nimble-planet
...
Fix board share entity authorization
2026-06-03 23:43:48 -04:00
Mike Cao
c0193ad7cd
Address board share review feedback
2026-06-03 20:29:08 -07:00
Mike Cao
a5f4a39f2b
Fix board share entity authorization
2026-06-03 00:02:54 -07:00
Mike Cao
e9925f2e4e
Sanitize CSV exports against formula injection
2026-06-03 00:00:37 -07:00
Mike Cao
0c08a27a81
Updated lock file.
2026-06-02 23:24:07 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
5bf1792b38
Restrict team owner assignment to admins
2026-06-02 22:17:10 -07:00
Mike Cao
44c6b4427f
Add schema to realtime route.
2026-06-02 22:07:46 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
0f36990040
Merge branch 'analytics' into dev
2026-06-02 20:22:32 -07:00
Mike Cao
fded75f940
Use authenticated Redis key on logout
2026-06-02 17:46:08 -07:00
Mike Cao
a9beebf1a9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-02 17:26:59 -07:00
Mike Cao
d44592ddb5
Validate SSO redirect URLs before setting auth token
2026-06-02 17:26:48 -07:00
Mike Cao and GitHub
72611027b7
Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3
...
Limit batch API payloads to 500 items
2026-06-02 19:59:21 -04:00
Mike Cao and GitHub
7161d83382
Merge pull request #4315 from umami-software/codex/umami-GHSA-jmch-5jr7-62q9
...
Tighten API access checks by website section and share permissions
2026-06-02 19:55:55 -04:00
Mike Cao
9ba5fb7c1b
Limit batch API payloads to 500 items
2026-06-02 16:54:35 -07:00
Mike Cao
f366d946e8
Allow unrestricted access when share token has no section flags
2026-06-02 16:28:30 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
9ced9ac85a
Fixed API_URL handling.
2026-06-02 11:19:33 -07:00
Mike Cao
f985b4f9a5
Use next rewrites for API_URL.
2026-06-02 11:12:48 -07:00
Francis Cao
c4b1452c29
apply path filter to heatmap pages
2026-06-01 14:23:27 -07:00
Francis Cao
4d831a97a4
Merge branch 'analytics' of https://github.com/umami-software/umami into dev
2026-06-01 12:43:57 -07:00
Francis Cao
169387958e
fix snapshot URL builder
2026-06-01 09:44:37 -07:00
Mike Cao
Mike Cao
Francis Cao
