# Umami changelog
> A simple, fast, privacy-focused alternative to Google Analytics.
- Vendor: Umami Software
- Category: Productivity
- Official site: https://umami.is
- Tracked by: What's New (https://whatsnew.fyi/product/umami)
- Harvested from: GitHub (umami-software/umami)
- Entries below: 10 (newest first)
What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.
Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.
## Releases
### v3.2.0
- Date: 2026-06-24
- Version: v3.2.0
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.2.0
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.2.0
- **added** — Heatmaps are now available as a first-class website report with click and scroll heatmaps to understand visitor interactions
- **added** — Snapshot-based heatmap rendering with iframe previews and page path filtering
- **added** — Screen-width grouping for responsive layouts in heatmaps with depth labels and improved overlay scaling
- **added** — Self-hosted heatmap recording and storage support
- **added** — Replay filters for finding sessions faster
- **added** — Event data filters for booleans, dates, and arrays
- **added** — Event data charts for arrays, booleans, dates, and numeric values
- **added** — Session data screens with filtering, pivot tables, and property charts
- **added** — Cumulative mode for revenue charts
- **added** — Manual table/card view toggle for DataGrid
- **added** — Sorting on non-analytics tables, including websites, boards, links, pixels, teams, and admin tables
- **added** — data-auto-pageview tracker attribute to suppress SPA pageview tracking when auto-pageview is disabled
- **added** — Share page options for filtering and theme enforcement
- **added** — Share-token permissions for websites, boards, links, and pixels
- **changed** — Fragmented replay events are normalized for playback
- **changed** — Full rrweb snapshots are handled as separate replay chunks
- **changed** — Replay payloads are chunked and oversized payloads are rejected
- **changed** — Replay events flush on pagehide with a shorter interval
- **changed** — Revenue reports have been split into focused APIs and views for better performance and flexibility
- **changed** — Website selector dropdown limit increased from 10 to 100
- **fixed** — Retention report completeness
- **fixed** — Dashboard and Board editing in Firefox
- **fixed** — Funnel alias issues
- **fixed** — Ambiguous query errors
- **fixed** — Username login case-insensitivity
- **fixed** — Redirect logged-in users away from the login page
- **fixed** — Active users indicator realtime link
- **fixed** — DataGrid pagination preserving query params
- **fixed** — Long URLs in Links table pushing action buttons off-screen
- **fixed** — Invalidates authenticated sessions after password changes
- **security** — Sanitizes sensitive data in logs
- **security** — Hides internal Prisma and database errors from API responses
- **security** — Hardens analytics writes and avoids leaking internal server errors to clients
- **security** — Validates SSO redirect URLs before setting auth tokens
- **security** — Restricts team owner assignment to admins
- **security** — Enforces team role hierarchy on user updates and removals
- **security** — Fixes share token confusion vulnerabilities
- **security** — Tightens API access checks by website section and share permissions
- **security** — Sanitizes CSV exports against formula injection
- **security** — Limits batch API payloads to 500 items
- **security** — Uses authenticated Redis keys on logout
Umami `v3.2.0` is here with new **Heatmaps**, improved properties reporting, better Session Replay controls, revenue report improvements, and a large set of security, performance, and UI fixes.
##### New features
###### Heatmaps
Heatmaps are now available as a first-class website report. Use click and scroll heatmaps to understand where visitors interact with each page, with overlays rendered from captured replay snapshots.
- Click and scroll heatmap reports
- Snapshot-based rendering with iframe previews
- Page path filtering
- Screen-width grouping for responsive layouts
- Depth labels and improved overlay scaling
- Self-hosted heatmap recording and storage support
###### Session Replay improvements
Session Replay received a round of reliability, filtering, and playback improvements.
- Replay filters for finding sessions faster
- Fragmented replay events are normalized for playback
- Full rrweb snapshots are handled as separate replay chunks
- Replay payloads are chunked and oversized payloads are rejected
- Replay events flush on `pagehide` with a shorter interval
- Mobile layout and modal styling improvements
###### Event and session property reporting
Property reports now support richer data types and reusable charting across both event data and session data.
- Event data filters for booleans, dates, and arrays
- Event data charts for arrays, booleans, dates, and numeric values
- Session data screens with filtering, pivot tables, and property charts
- Property filter UI shared across event and session data
- Query optimizations for session property filters
###### Revenue reporting
Revenue reports have been split into focused APIs and views for better performance and flexibility.
- Cumulative mode for revenue charts
- Separate revenue chart, metrics, stats, and session queries
- Revenue metrics table and metrics bar
- Improved realtime report UI
###### DataGrid and table improvements
- Manual table/card view toggle for DataGrid
- Sorting on non-analytics tables, including websites, boards, links, pixels, teams, and admin tables
- Horizontal scrolling for overflowing tables
- Stable event chart colors across date range changes
- Hidden events stay hidden when the date range changes
###### Tracker and API improvements
- `data-auto-pageview` tracker attribute to suppress SPA pageview tracking when auto-pageview is disabled
- Tracker click handling for annotated containers
- Graceful handling for invalid `pushState` URLs
- URL query values included in pages report display
- LLM channel logic
- URL pageview metric and expanded metric support
- Configurable internal API URL handling
###### Sharing
- Share page options for filtering and theme enforcement
- Share-token permissions for websites, boards, links, and pixels
- Board share entity authorization fixes
- Unrestricted access for share tokens without section flags
##### Security
- Invalidates authenticated sessions after password changes
- Sanitizes sensitive data in logs
- Hides internal Prisma and database errors from API responses
- Hardens analytics writes and avoids leaking internal server errors to clients
- Validates SSO redirect URLs before setting auth tokens
- Restricts team owner assignment to admins
- Enforces team role hierarchy on user updates and removals
- Fixes share token confusion vulnerabilities
- Tightens API access checks by website section and share permissions
- Sanitizes CSV exports against formula injection
- Limits batch API payloads to 500 items
- Uses authenticated Redis keys on logout
##### Migrations
This release includes schema migrations for Heatmaps and event/sessio
_[Truncated at 4000 characters — full notes: https://github.com/umami-software/umami/releases/tag/v3.2.0]_
### v3.1.0
- Date: 2026-04-16
- Version: v3.1.0
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.1.0
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.1.0
- **added** — Create custom dashboards with Boards feature including row/column layout editor, per-component website binding, TextBlock components, board sharing and duplication, and dashboard-wide date range and filter controls
- **added** — Session Replay feature to watch real user sessions replayed in the browser with configurable masking levels, per-visit recording, filterable replays table, and replay modal with mobile-friendly playback
- **added** — Web Vitals performance tracking for Core Web Vitals (LCP, INP, CLS, FCP, TTFB) with industry-standard calculations and rating badges
- **changed** — Redesigned share page with full mobile support, collapsible sidenav, per-share display options, ability to name share links, choose visible sections, and apply filtered navigation
- **added** — OR logic across filters, segments, and cohorts
- **added** — Regex operators for filter matching
- **added** — Multiselect on equals and not-equals operators
- **added** — UTM filters and fields exposed throughout the app
- **added** — Exclude bounces toggle with filter-form integration
- **added** — Per-step event property filters in funnel creation and overview
- **added** — Wildcard support in the goals report
- **added** — Custom slug support for Links
- **added** — Pixel and Link detail pages with sharing
- **added** — MetricsBar added to the Events page
- **added** — Event type filter on Journeys
- **added** — Time unit selector (hour/day/month)
- **added** — Distinct ID available as a filter and metric dimension
- **added** — Cache-control headers on GET responses
- **added** — SKIP_BUILD_GEO environment variable to skip geo database build
- **changed** — Migrated from react-intl to next-intl with all 51 locale files translated
Umami `v3.1.0` is here with a ton of new features, including the much-anticipated **Boards** and **Session Replay**. This release also brings Web Vitals performance tracking, a redesigned share page, and hundreds of fixes and improvements.
##### New features
###### Boards
Boards are here! Create your own custom dashboards by composing components on a flexible row/column canvas. Pick from charts, tables, and metric components, bind them to any website, and share the finished board with your team.
- Row/column layout editor with resize, reorder, and remove controls
- Per-component website binding and live preview
- Free-form `TextBlock` components for notes and section headers
- Board sharing, duplication, and table-level edit/delete actions
- Dashboard-wide date range and filter controls
###### Session Replay
Watch real user sessions replayed in the browser. Session Replay is built on [rrweb](https://www.rrweb.io/) and works alongside your existing tracker.
- Configurable masking levels for privacy (defaults to *moderate*)
- Per-visit recording so replays stay short and focused
- Filterable replays table with event-level filtering
- Replay modal with mobile-friendly playback
###### Web Vitals performance tracking
Track Core Web Vitals (LCP, INP, CLS, FCP, TTFB) from your visitors' browsers. The redesigned Performance page shows industry-standard calculations with rating badges for each metric.
###### Redesigned share page
Share pages have a fresh look with full mobile support, a collapsible sidenav, and per-share display options. You can now:
- Name each share link
- Choose which sections visitors can see (overview, events, etc.)
- Apply filtered navigation so visitors only see what you want
###### Filters, segments, and cohorts
- **OR logic** across filters, segments, and cohorts
- **Regex operators** for more powerful matching
- **Multiselect** on equals/not-equals operators
- UTM filters and fields exposed throughout the app
- **Exclude bounces** toggle with filter-form integration
###### Funnels
- Per-step event property filters in both funnel creation and overview
- Wildcard support in the goals report
###### Other improvements
- Custom slug support for Links
- Pixel and Link detail pages with sharing
- `MetricsBar` added to the Events page
- Event type filter on Journeys
- Time unit selector (hour/day/month)
- Distinct ID available as a filter and metric dimension
- Cache-control headers on `GET` responses
- `SKIP_BUILD_GEO` env variable to skip geo DB build
- Configurable salt rotation period via env vars
- EdgeOne geolocation headers
- Version endpoint and settings display
- Download for breakdown reports
- Pagination limit on event charts, metrics tables, and UTM reports
###### Admin & internationalization
- Migrated from `react-intl` to `next-intl` with all 51 locale files translated
- Adopted the [`react-zen`](https://zen.umami.is) design system across the app
- Consolidated top navigation with embedded selectors for websites, boards, links, and pixels
- Team validation and redirect for invalid teams
- Team-gated feature resolution via Redis
##### Security
- Fixed IDOR vulnerabilities in reports and segments
- Blocked share tokens from all editing permissions and API modifications
- Restricted `x-umami-client-*` headers to cloud mode
- Various dependency vulnerability fixes (tar, ajv, jws, brace-expansion, next)
##### Migrations
This release includ
_[Truncated at 4000 characters — full notes: https://github.com/umami-software/umami/releases/tag/v3.1.0]_
### v3.0.3
- Date: 2025-12-12
- Version: v3.0.3
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.0.3
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.0.3
- **security** — Updated Next.js to address a security vulnerability
Patch release for the latest Next.js security issue. See https://nextjs.org/blog/security-update-2025-12-11
### v2.20.2
- Date: 2025-12-12
- Version: v2.20.2
- Original notes: https://github.com/umami-software/umami/releases/tag/v2.20.2
- Permalink: https://whatsnew.fyi/product/umami/releases/v2.20.2
- **security** — Patch for the latest Next.js security issue
Patch release for the latest Next.js security issue. See https://nextjs.org/blog/security-update-2025-12-11
### v2.20.1
- Date: 2025-12-07
- Version: v2.20.1
- Original notes: https://github.com/umami-software/umami/releases/tag/v2.20.1
- Permalink: https://whatsnew.fyi/product/umami/releases/v2.20.1
- **security** — Address Next.js CVE-2025-66478 by updating affected React versions
- **fixed** — Fix Docker build issues
This is a patch release to address the Next.js [CVE](https://nextjs.org/blog/CVE-2025-66478). The previous release did not update the affected React versions, only Next.js. This release also fixes some Docker build issues.
### v2.20.0
- Date: 2025-12-05
- Version: v2.20.0
- Original notes: https://github.com/umami-software/umami/releases/tag/v2.20.0
- Permalink: https://whatsnew.fyi/product/umami/releases/v2.20.0
- **security** — Address Next.js CVE-2025-66478
This release is only to address the the Next.js [CVE](https://nextjs.org/blog/CVE-2025-66478) for v2.
### v3.0.2
- Date: 2025-12-04
- Version: v3.0.2
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.0.2
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.0.2
- **security** — Address Next.js CVE-2025-66478 critical vulnerability in RSC
- **fixed** — Time range selection back and forward arrows not jumping with correct steps
- **fixed** — Links and Pixels are prefetched on dashboard
- **fixed** — Chart legend extends beyond container boundaries when URL is too long, disrupting page layout
- **fixed** — User is not able to switch back to My Account after switching to the Team
- **fixed** — Reset of website stats is not possible after entries in Revenue table
- **fixed** — Team workspace is not selectable after login
- **fixed** — Error with long UTM parameters and click IDs
- **fixed** — Direct visitors are missing on Channels
- **fixed** — Last seen and First seen fields broken
- **fixed** — Tests are failing
- **fixed** — Revenue sums not showing
- **fixed** — Read-only prevents user from joining team
- **fixed** — URL theme and lang parameters no longer work for public share links
- **changed** — Next.js updated to 15.5.7
- **changed** — Prisma updated to 6.19.0
This is a patch release to address the Next.js [CVE](https://nextjs.org/blog/CVE-2025-66478) and fixes many bugs.
##### Fixes
- Nextjs/RSC critical vulnerability #3829
- Time range selection back and forward arrows not jumping with correct steps #3828
- Links and Pixels are prefetched on dashboard #3814
- In the chart legend, when the URL is too long, the legend extends beyond the container boundaries, disrupting the page layout. #3813
- User is not able to switch back to My Account after switching to the Team #3802
- Reset of website stats is not possible after entries in Revenue table #3798
- Team workspace is not selectable after login #3796
- Error with long UTM parameters and click IDs #3790
- Direct visitors are missing on Channels (3.0.1) #3789
- "Last seen" - "First seen" fields broken since 3.0.1 #3775
- Tests are failing in 3.0.1 #3773
- Revenue sums not showing in 3.0.1 #3769
- Read-only prevents user from joining team #3764
- Regression: URL theme and lang parameters no longer work for public share links #3754
##### Updates
- Next.js `15.5.7`
- Prisma `6.19.0`
##### Thanks
@Lokimorty @imsyedabdullah @RaenonX @IndraGunawan
### v3.0.1
- Date: 2025-11-18
- Version: v3.0.1
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.0.1
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.0.1
- **fixed** — Password managers unable to detect email field on login form
- **fixed** — Support local timezone for date period
- **fixed** — Event data raw query failure
- **fixed** — Website Stats API Call returns null in some fields
- **fixed** — Loop when login page not accessed directly
- **fixed** — Geo-location tracking (Country) broken in v3.0, showing "Unknown" for majority of visitors
- **fixed** — Prevent exporting empty datasets
- **fixed** — Events view for "Today" doesn't show all hourly columns
- **fixed** — Realtime activity view basically unusable on mobile
- **fixed** — No Revenue showing after update to 3.0.0
- **fixed** — Deprecated timezone 'Asia/Saigon' causes PostgreSQL error in Umami
- **fixed** — Long links are cut off
- **fixed** — Queries fail with Asia/Calcutta timezone causing Postgres 22023 / Prisma P2010 error
- **fixed** — Location statistics broken when tracking IPv6 clients
- **fixed** — Invalid reference to FROM-clause entry for table "session_data"
This is a patch release that fixes many bugs.
##### Fixes
- Password managers unable to detect email field on login form #3735
- Support local timezone for date period #3733
- Event data raw query failure #3732
- Website Stats API Call returns null in some fields #3712
- Loop when login page not accessed directly #3703
- Geo-location tracking (Country) broken in v3.0, showing "Unknown" for majority of visitors #3701
- UX – Prevent exporting empty datasets #3699
- Events view for "Today" doesn't show all hourly columns #3697
- Realtime activity view basically unusable on mobile #3694
- No Revenue showing after update to 3.0.0 #3692
- Deprecated timezone 'Asia/Saigon' causes PostgreSQL error in Umami (chart shows empty) #3691
- Support local timezone for date period #3733
- Long links are cut off #3680
- Queries fail with Asia/Calcutta timezone → Postgres 22023 / Prisma P2010 (Umami 2.19.0) #3660
- Location statistics broken when tracking IPv6 clients #3616
- Invalid reference to FROM-clause entry for table "session_data" at character 362 #3545
##### Thanks
@Maxime-J @Mintimate @prince0xdev @mathis5711
### v3.0.0
- Date: 2025-11-07
- Version: v3.0.0
- Original notes: https://github.com/umami-software/umami/releases/tag/v3.0.0
- Permalink: https://whatsnew.fyi/product/umami/releases/v3.0.0
- **changed** — Update UI to be more user-friendly with a new navigation bar and separated reports into individual pages
- **changed** — Apply filters universally throughout the application via query string to allow sharing filtered URLs with teams
- **changed** — Enhance filter form to add and edit multiple filters at once
- **added** — Add segments as saved sets of filters that can be reused across the application
- **added** — Add cohorts to track groups of users who share a common event or experience during a specific time period
- **added** — Introduce links as short URLs for tracking clicks and downloads with dedicated stats pages
- **added** — Introduce pixels as invisible images for tracking traffic and measuring metrics like email open rates with dedicated stats pages
- **added** — Add dedicated admin page for admin users to view and manage all users, websites, and teams in the system
- **removed** — Remove support for MySQL as a database option, only PostgreSQL is now supported
- **changed** — Update Next to v15.5.3
- **changed** — Update Prisma to v6.18.0
We are excited to announce the release of Umami v3! This release comes with a new interface, lots of new features and enhancements and lays the groundwork for the future of the application. Read more about it on our [blog post](https://umami.is/blog/umami-v3).
##### New features and improvements
###### Updated UI
We've updated the UI to be more user friendly and help you see all your data at a glance. With the new navigation bar you can quickly see all your website content and even easily switch between websites with the embedded dropdown.
Additionally, all the previous reports have been separated out into individual pages for easier access.
###### Improved filters
Filters are now applied universally everywhere in the application via the query string. That means you can copy the URL to share with your team and it will remember what filters were applied.
We've also enhanced the filter form so that you can add and edit multiple filters at once.
###### Segments and cohorts
Segments are a set of filters that you can save to use for later. For example, you can create a segment called *Windows users from the United States*, and apply it to your data via the filter form.
A cohort is a group of users who share a common event or experience during a specific time period, and are then tracked over time. For example, you can create a cohort called *Users who signed up in November*. You can then analyze retention or behavior over time. Just like segments, cohorts can be applied as a filter parameter.
###### Links and pixels
Umami v3 introduces two additional elements you can use for tracking, links and pixels. Links are simply short URLs that redirect to another URL. You can use links to measure how often users are clicking on certain links or as download links to a file to see how many downloads
it received.
Pixels are invisible images your can embed elsewhere to measure traffic. For example, on external websites where you can't install a website tracker but can post images. You can also embed pixels into your emails to measure open rates, for example in a monthly newsletter to members.
Both links and pixels have their own stats pages just like websites.
###### New admin page
There is a new dedicated admin page for admin users. You can view and make changes to all the users, websites and teams in the system.
###### Coming soon
One feature that unfortunately didn't make it into this release was Boards. With boards, you would be able to create your own dashboards and components to display your data however you like. We're still hard at work on it and it will be available in the next release.
##### Breaking changes
Umami v3 no longer supports MySQL as a database option, only PostgreSQL. If you want to migrate your data over we've written a [guide](https://umami.is/docs/guides/migrate-mysql-postgresql) to help you migrate.
##### Updates
- Next `v15.5.3`
- Prisma `v6.18.0`
##### Thanks
@mdotme @mcnaveen @kronthto @malwarepad @nickcmaynard @andreynering @matiasfacello @halkeye @fauzora @0xflotus @badmike @fnwbr @markkuhar
### v2.19.0
- Date: 2025-07-27
- Version: v2.19.0
- Original notes: https://github.com/umami-software/umami/releases/tag/v2.19.0
- Permalink: https://whatsnew.fyi/product/umami/releases/v2.19.0
- **added** — Export data directly from the UI with a download button on the overview page to get all stats in CSV format
- **added** — Download individual stats from different sections and reports in CSV format
- **added** — View custom event properties as a chart or as a table
- **added** — Create a new table for holding revenue data via migration
- **fixed** — Fixed environment variables so they work in Docker at runtime
- **fixed** — Fixed malformed frameAncestors
- **fixed** — Added keepalive to tracker fetch
- **fixed** — Improved performance of send
- **fixed** — URL hash is not included in record
- **changed** — Upgraded Next to 15.3.3
- **changed** — Upgraded Prisma to 6.7.0
Today we're excited to release Umami `v2.19.0`! This will likely be the final release of the `v2` series as we prepare for `v3`. In this release, we are preparing the underlying tables for the v3 migration.
##### Features
###### Data export
You can now export data directly from the UI. On the overview page, there is a download button that will get all the stats from the current page.
Additionally, you can download individual stats from different sections and from reports. All data returned is in CSV format.
###### Event properties chart/table view
You can now view custom event properties as a chart or as a table.
##### Migrations
This release includes a migration to create a new table for holding revenue data.
If you have any revenue data, you will need to run the migration under `scripts/data-migrations/populate-revenue-table.sql`.
##### Fixes
- Fixed environment variables so they work in Docker at runtime #3412
- Fixed malformed frameAncestors #3494
- Added keepalive to tracker fetch #3489
- Improved performance of send #3469
- URL hash is not included in record #3445
##### Updates
- Language updates: Vietnamese, Arabic
- Upgraded Next to `15.3.3`
- Upgrade Prisma to `6.7.0`
##### Thanks
@vedantbhavsar26 @sancho1952007 @sufyanfa @eoussama @abcsnoob @basbroek @vicke4 @AlexEscalante @alasjo @Sov3rain @KrakenWagen @querry43 @Nambers @ruchernchong @monyasau