Mike Cao
caa4ae1fd4
Refresh lockfile for updated frontend dependencies and platform metadata
2026-06-11 22:45:23 -07:00
Francis Cao
6837825512
Fix multiple rows per session bug. Add guard rails for bad data.
2026-06-10 09:44:48 -07:00
Francis Cao
f9cf213261
Add Session Activity guards for showing multiple records per result
2026-06-10 09:18:25 -07:00
Mike Cao
8227589ad9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-09 23:07:24 -07:00
Mike Cao
db01e3a1bb
Lower cloud free website limit to 1
2026-06-09 14:58:10 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Francis Cao
2df051e216
fix sharetoken permissions for pixels,links,boards, and failed routes
2026-06-08 19:16:01 -07:00
Mike Cao
d2eafd68f7
Allow unlimited cloud websites for subscribed accounts
2026-06-08 17:20:20 -07:00
Francis Cao
264466191e
deterministic order for getReports. Closes #4323
2026-06-05 09:53:45 -07:00
Mike Cao
f09df3cf14
Remove unused config property.
2026-06-04 20:15:57 -07:00
Mike Cao
de487e572e
Merge branch 'analytics' into dev
2026-06-04 19:56:02 -07:00
Mike Cao
7de662a71e
Revert to external API url.
2026-06-04 17:32:25 -07:00
Francis Cao
4956380942
revert api url changes. exclude auth from API_URL
2026-06-04 14:45:50 -07:00
Francis Cao
8473dea1ca
fix self-hosting auth issue with API_URL missing
2026-06-04 10:19:23 -07:00
Mike Cao
a52f32604a
Fixed channel metrics queries.
2026-06-04 02:08:01 -07:00
Mike Cao and GitHub
8a39e98961
Merge pull request #4283 from mturac/fix/3549-runtime-login-env
...
fix: evaluate login mode env at runtime
2026-06-03 23:51:21 -04:00
Mike Cao and GitHub
dc7c4f0246
Merge pull request #4292 from umami-software/blacksmith-migration-c0ea3ae
...
.github/workflows: Migrate workflows to Blacksmith runners
2026-06-03 23:47:25 -04:00
Mike Cao and GitHub
d659c5746b
Merge pull request #4317 from umami-software/opencode/nimble-planet
...
Fix board share entity authorization
2026-06-03 23:43:48 -04:00
Mike Cao
c0193ad7cd
Address board share review feedback
2026-06-03 20:29:08 -07:00
Mike Cao
a5f4a39f2b
Fix board share entity authorization
2026-06-03 00:02:54 -07:00
Mike Cao
e9925f2e4e
Sanitize CSV exports against formula injection
2026-06-03 00:00:37 -07:00
Mike Cao
0c08a27a81
Updated lock file.
2026-06-02 23:24:07 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
5bf1792b38
Restrict team owner assignment to admins
2026-06-02 22:17:10 -07:00
Mike Cao
44c6b4427f
Add schema to realtime route.
2026-06-02 22:07:46 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
0f36990040
Merge branch 'analytics' into dev
2026-06-02 20:22:32 -07:00
Mike Cao
fded75f940
Use authenticated Redis key on logout
2026-06-02 17:46:08 -07:00
Mike Cao
a9beebf1a9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-02 17:26:59 -07:00
Mike Cao
d44592ddb5
Validate SSO redirect URLs before setting auth token
2026-06-02 17:26:48 -07:00
Mike Cao and GitHub
72611027b7
Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3
...
Limit batch API payloads to 500 items
2026-06-02 19:59:21 -04:00
Mike Cao and GitHub
7161d83382
Merge pull request #4315 from umami-software/codex/umami-GHSA-jmch-5jr7-62q9
...
Tighten API access checks by website section and share permissions
2026-06-02 19:55:55 -04:00
Mike Cao
9ba5fb7c1b
Limit batch API payloads to 500 items
2026-06-02 16:54:35 -07:00
Mike Cao
f366d946e8
Allow unrestricted access when share token has no section flags
2026-06-02 16:28:30 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
9ced9ac85a
Fixed API_URL handling.
2026-06-02 11:19:33 -07:00
Mike Cao
f985b4f9a5
Use next rewrites for API_URL.
2026-06-02 11:12:48 -07:00
Francis Cao
c4b1452c29
apply path filter to heatmap pages
2026-06-01 14:23:27 -07:00
Francis Cao
4d831a97a4
Merge branch 'analytics' of https://github.com/umami-software/umami into dev
2026-06-01 12:43:57 -07:00
Francis Cao
169387958e
fix snapshot URL builder
2026-06-01 09:44:37 -07:00
Francis Cao
60ec6d2e91
fix snapshot retrieval URL
2026-06-01 09:26:31 -07:00
Mike Cao and GitHub
4772c702b5
Merge pull request #4294 from swayam-mishra/dev
...
fix: update broken demo link from analytics.umami.is to cloud.umami.is
2026-05-29 14:11:14 -04:00
Mike Cao
18b72d3008
fix(tracker): restore link navigation when tracking fails
...
Use .finally() instead of .then() so internal link navigation is
always restored after e.preventDefault(), even if the tracking
request rejects (e.g. server down or a throwing beforeSend callback).
Fixes #4304
2026-05-29 10:58:11 -07:00
Mike Cao
10f6ee27da
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-29 10:54:25 -07:00
Mike Cao and GitHub
8ddc959b3f
Merge pull request #4018 from ip00/patch-1
...
Update hr-HR.json
2026-05-29 13:48:07 -04:00
Ivan Pletenac and Ivan Pletenac
c4a0c906bf
Update hr-HR.json - added labels previously missing from file
2026-05-29 08:25:38 +02:00
Ivan Pletenac and Ivan Pletenac
7f0a744bd0
fix(lang): remove trailing space in label.back (inherited from original file)
2026-05-29 08:25:38 +02:00
Ivan Pletenac and Ivan Pletenac
71ab5857bc
Update hr-HR.json
...
Completed full Croatian translation for Umami.
Reviewed, modernized, and aligned with existing i18n structure.
2026-05-29 08:23:40 +02:00
Mike Cao
e28309f8f7
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-28 13:37:42 -07:00
Mike Cao
Francis Cao
Mike Cao
Ivan PletenacandIvan Pletenac