v3.1.0

Umami v3.1.0 is here with a ton of new features, including the much-anticipated Boards and Session Replay. This release also brings Web Vitals performance tracking, a redesigned share page, and hundreds of fixes and improvements.

New features

Boards

Boards are here! Create your own custom dashboards by composing components on a flexible row/column canvas. Pick from charts, tables, and metric components, bind them to any website, and share the finished board with your team.

• Row/column layout editor with resize, reorder, and remove controls
• Per-component website binding and live preview
• Free-form TextBlock components for notes and section headers
• Board sharing, duplication, and table-level edit/delete actions
• Dashboard-wide date range and filter controls

Session Replay

Watch real user sessions replayed in the browser. Session Replay is built on rrweb and works alongside your existing tracker.

• Configurable masking levels for privacy (defaults to moderate)
• Per-visit recording so replays stay short and focused
• Filterable replays table with event-level filtering
• Replay modal with mobile-friendly playback

Web Vitals performance tracking

Track Core Web Vitals (LCP, INP, CLS, FCP, TTFB) from your visitors' browsers. The redesigned Performance page shows industry-standard calculations with rating badges for each metric.

Redesigned share page

Share pages have a fresh look with full mobile support, a collapsible sidenav, and per-share display options. You can now:

• Name each share link
• Choose which sections visitors can see (overview, events, etc.)
• Apply filtered navigation so visitors only see what you want

Filters, segments, and cohorts

• OR logic across filters, segments, and cohorts
• Regex operators for more powerful matching
• Multiselect on equals/not-equals operators
• UTM filters and fields exposed throughout the app
• Exclude bounces toggle with filter-form integration

Funnels

• Per-step event property filters in both funnel creation and overview
• Wildcard support in the goals report

Other improvements

• Custom slug support for Links
• Pixel and Link detail pages with sharing
• MetricsBar added to the Events page
• Event type filter on Journeys
• Time unit selector (hour/day/month)
• Distinct ID available as a filter and metric dimension
• Cache-control headers on GET responses
• SKIP_BUILD_GEO env variable to skip geo DB build
• Configurable salt rotation period via env vars
• EdgeOne geolocation headers
• Version endpoint and settings display
• Download for breakdown reports
• Pagination limit on event charts, metrics tables, and UTM reports

Admin & internationalization

• Migrated from react-intl to next-intl with all 51 locale files translated
• Adopted the react-zen design system across the app
• Consolidated top navigation with embedded selectors for websites, boards, links, and pixels
• Team validation and redirect for invalid teams
• Team-gated feature resolution via Redis

Security

• Fixed IDOR vulnerabilities in reports and segments
• Blocked share tokens from all editing permissions and API modifications
• Restricted x-umami-client-* headers to cloud mode
• Various dependency vulnerability fixes (tar, ajv, jws, brace-expansion, next)

Migrations

This release includes schema migrations for Boards, Shares, Session Replay, and board duplicate-key handling. Migrations run automatically during the build process.

Fixes

• PostgreSQL 12/13 syntax error in Journeys #3970
• Implicit alias syntax error in Postgres session and event queries #4147
• name alias compatibility for Postgres 12 relational queries #3970
• Table alias missing in filterQuery #3869
• Timezone not applied to relational queries #3975
• Revenue chart timezone mismatch #4107
• Ambiguous session_id errors in SQL queries
• Breakdown alias column not found
• www. prefix not stripped during hostname comparison #3256
• Minute label formatting #3088
• Website select page size limited to 10 #3913
• Deleted website visibility #3865
• BASE_PATH support #4064
• Pixel event tracking #4028
• Pagination issues #4029
• Login email case-sensitivity #3981
• Tracker double-initialization when script injected more than once
• Tracker fetch priority now set to low #3642
• robots.txt fixes #3996
• Goals wildcard support #4086
• MetricsBar on Events page #3830
• Distinct ID in filters / expanded metrics #3861
• Team admin workflow for team members #2767
• Event type filter for Journeys #2803
• Salt rotation configurable via env #3427
• Share token allowing access to pages with undefined share params
• Fix #4058 (pixel tracking null referrer)
• Autofill background color in forms
• Denied storage access in tracker
• Prisma session race condition
• Docker Prisma migrate and stray query log
• Monthly truncation timezone issue
• Share page retention and logo margins
• Filters persisting across website change
• "All time" filter on websites with no data
• Japanese translation for "breakdown" label
• UAE emirate names in iso-3166-2.json
• IPv6 handling for client IP detection
• Numerous mobile UI fixes across admin, nav, share, and team screens

Updates

• Next.js 16.2.4
• Prisma 7.6.0
• Minimum Node.js version bumped to 22 (Prisma 7 requirement)

Thanks

@Yashh56 @boutterudy @AymanAlSuleihi @juanisidoro @cryst-hq @RaenonX @PaiJi @Gouttfi @AlejandroGispert @lawrence3699 @kkhys @journry789 @sputnik-mac @sbozh @Mintimate @Mravuri96 @maphubs @maennenajere @XahidEx @IndraGunawan @GochoMugo @FEgor04 @Nayrode @diogotcorreia @dyanakiev @fauzora @BrentRobert @hilja

v3.0.3

Patch release for the latest Next.js security issue. See https://nextjs.org/blog/security-update-2025-12-11

v2.20.2

Patch release for the latest Next.js security issue. See https://nextjs.org/blog/security-update-2025-12-11

v2.20.1

This is a patch release to address the Next.js CVE. The previous release did not update the affected React versions, only Next.js. This release also fixes some Docker build issues.

v2.20.0

This release is only to address the the Next.js CVE for v2.

v3.0.2

This is a patch release to address the Next.js CVE and fixes many bugs.

Fixes

• Nextjs/RSC critical vulnerability #3829
• Time range selection back and forward arrows not jumping with correct steps #3828
• Links and Pixels are prefetched on dashboard #3814
• In the chart legend, when the URL is too long, the legend extends beyond the container boundaries, disrupting the page layout. #3813
• User is not able to switch back to My Account after switching to the Team #3802
• Reset of website stats is not possible after entries in Revenue table #3798
• Team workspace is not selectable after login #3796
• Error with long UTM parameters and click IDs #3790
• Direct visitors are missing on Channels (3.0.1) #3789
• "Last seen" - "First seen" fields broken since 3.0.1 #3775
• Tests are failing in 3.0.1 #3773
• Revenue sums not showing in 3.0.1 #3769
• Read-only prevents user from joining team #3764
• Regression: URL theme and lang parameters no longer work for public share links #3754

Updates

• Next.js 15.5.7
• Prisma 6.19.0

Thanks

@Lokimorty @imsyedabdullah @RaenonX @IndraGunawan

v3.0.1

This is a patch release that fixes many bugs.

Fixes

• Password managers unable to detect email field on login form #3735
• Support local timezone for date period #3733
• Event data raw query failure #3732
• Website Stats API Call returns null in some fields #3712
• Loop when login page not accessed directly #3703
• Geo-location tracking (Country) broken in v3.0, showing "Unknown" for majority of visitors #3701
• UX – Prevent exporting empty datasets #3699
• Events view for "Today" doesn't show all hourly columns #3697
• Realtime activity view basically unusable on mobile #3694
• No Revenue showing after update to 3.0.0 #3692
• Deprecated timezone 'Asia/Saigon' causes PostgreSQL error in Umami (chart shows empty) #3691
• Support local timezone for date period #3733
• Long links are cut off #3680
• Queries fail with Asia/Calcutta timezone → Postgres 22023 / Prisma P2010 (Umami 2.19.0) #3660
• Location statistics broken when tracking IPv6 clients #3616
• Invalid reference to FROM-clause entry for table "session_data" at character 362 #3545

Thanks

@Maxime-J @Mintimate @prince0xdev @mathis5711

v3.0.0

We are excited to announce the release of Umami v3! This release comes with a new interface, lots of new features and enhancements and lays the groundwork for the future of the application. Read more about it on our blog post.

New features and improvements

Updated UI

We've updated the UI to be more user friendly and help you see all your data at a glance. With the new navigation bar you can quickly see all your website content and even easily switch between websites with the embedded dropdown.

Additionally, all the previous reports have been separated out into individual pages for easier access.

Improved filters

Filters are now applied universally everywhere in the application via the query string. That means you can copy the URL to share with your team and it will remember what filters were applied.

We've also enhanced the filter form so that you can add and edit multiple filters at once.

Segments and cohorts

Segments are a set of filters that you can save to use for later. For example, you can create a segment called Windows users from the United States, and apply it to your data via the filter form.

A cohort is a group of users who share a common event or experience during a specific time period, and are then tracked over time. For example, you can create a cohort called Users who signed up in November. You can then analyze retention or behavior over time. Just like segments, cohorts can be applied as a filter parameter.

Links and pixels

Umami v3 introduces two additional elements you can use for tracking, links and pixels. Links are simply short URLs that redirect to another URL. You can use links to measure how often users are clicking on certain links or as download links to a file to see how many downloads
it received.

Pixels are invisible images your can embed elsewhere to measure traffic. For example, on external websites where you can't install a website tracker but can post images. You can also embed pixels into your emails to measure open rates, for example in a monthly newsletter to members.

Both links and pixels have their own stats pages just like websites.

New admin page

There is a new dedicated admin page for admin users. You can view and make changes to all the users, websites and teams in the system.

Coming soon

One feature that unfortunately didn't make it into this release was Boards. With boards, you would be able to create your own dashboards and components to display your data however you like. We're still hard at work on it and it will be available in the next release.

Breaking changes

Umami v3 no longer supports MySQL as a database option, only PostgreSQL. If you want to migrate your data over we've written a guide to help you migrate.

Updates

• Next v15.5.3
• Prisma v6.18.0

Thanks

@mdotme @mcnaveen @kronthto @malwarepad @nickcmaynard @andreynering @matiasfacello @halkeye @fauzora @0xflotus @badmike @fnwbr @markkuhar

v2.19.0

Today we're excited to release Umami v2.19.0! This will likely be the final release of the v2 series as we prepare for v3. In this release, we are preparing the underlying tables for the v3 migration.

Features

Data export

You can now export data directly from the UI. On the overview page, there is a download button that will get all the stats from the current page.

Additionally, you can download individual stats from different sections and from reports. All data returned is in CSV format.

Event properties chart/table view

You can now view custom event properties as a chart or as a table.

Migrations

This release includes a migration to create a new table for holding revenue data.

If you have any revenue data, you will need to run the migration under scripts/data-migrations/populate-revenue-table.sql.

Fixes

• Fixed environment variables so they work in Docker at runtime #3412
• Fixed malformed frameAncestors #3494
• Added keepalive to tracker fetch #3489
• Improved performance of send #3469
• URL hash is not included in record #3445

Updates

• Language updates: Vietnamese, Arabic
• Upgraded Next to 15.3.3
• Upgrade Prisma to 6.7.0

Thanks

@vedantbhavsar26 @sancho1952007 @sufyanfa @eoussama @abcsnoob @basbroek @vicke4 @AlexEscalante @alasjo @Sov3rain @KrakenWagen @querry43 @Nambers @ruchernchong @monyasau

v2.18.1

Fixes

• Incorrect Channel Metrics caused by missing ReferrerQuery data #3403
• BASE_PATH issue with set-routes-manifest.js #3402
• Migrate data script for postgresql fails #3401
• Minutes not showing on realtime graph #3396
• Identify returns a 400 #3409

Thanks

@tsykin @Maxime-J