# Umami v3.2.0 - Product: Umami (https://whatsnew.fyi/product/umami) - Vendor: Umami Software - Date: 2026-06-24 - Version: v3.2.0 - Original notes: https://github.com/umami-software/umami/releases/tag/v3.2.0 - Permalink: https://whatsnew.fyi/product/umami/releases/v3.2.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Heatmaps are now available as a first-class website report with click and scroll heatmaps to understand visitor interactions - **added** — Snapshot-based heatmap rendering with iframe previews and page path filtering - **added** — Screen-width grouping for responsive layouts in heatmaps with depth labels and improved overlay scaling - **added** — Self-hosted heatmap recording and storage support - **added** — Replay filters for finding sessions faster - **added** — Event data filters for booleans, dates, and arrays - **added** — Event data charts for arrays, booleans, dates, and numeric values - **added** — Session data screens with filtering, pivot tables, and property charts - **added** — Cumulative mode for revenue charts - **added** — Manual table/card view toggle for DataGrid - **added** — Sorting on non-analytics tables, including websites, boards, links, pixels, teams, and admin tables - **added** — data-auto-pageview tracker attribute to suppress SPA pageview tracking when auto-pageview is disabled - **added** — Share page options for filtering and theme enforcement - **added** — Share-token permissions for websites, boards, links, and pixels - **changed** — Fragmented replay events are normalized for playback - **changed** — Full rrweb snapshots are handled as separate replay chunks - **changed** — Replay payloads are chunked and oversized payloads are rejected - **changed** — Replay events flush on pagehide with a shorter interval - **changed** — Revenue reports have been split into focused APIs and views for better performance and flexibility - **changed** — Website selector dropdown limit increased from 10 to 100 - **fixed** — Retention report completeness - **fixed** — Dashboard and Board editing in Firefox - **fixed** — Funnel alias issues - **fixed** — Ambiguous query errors - **fixed** — Username login case-insensitivity - **fixed** — Redirect logged-in users away from the login page - **fixed** — Active users indicator realtime link - **fixed** — DataGrid pagination preserving query params - **fixed** — Long URLs in Links table pushing action buttons off-screen - **fixed** — Invalidates authenticated sessions after password changes - **security** — Sanitizes sensitive data in logs - **security** — Hides internal Prisma and database errors from API responses - **security** — Hardens analytics writes and avoids leaking internal server errors to clients - **security** — Validates SSO redirect URLs before setting auth tokens - **security** — Restricts team owner assignment to admins - **security** — Enforces team role hierarchy on user updates and removals - **security** — Fixes share token confusion vulnerabilities - **security** — Tightens API access checks by website section and share permissions - **security** — Sanitizes CSV exports against formula injection - **security** — Limits batch API payloads to 500 items - **security** — Uses authenticated Redis keys on logout Umami `v3.2.0` is here with new **Heatmaps**, improved properties reporting, better Session Replay controls, revenue report improvements, and a large set of security, performance, and UI fixes. ##### New features ###### Heatmaps image Heatmaps are now available as a first-class website report. Use click and scroll heatmaps to understand where visitors interact with each page, with overlays rendered from captured replay snapshots. - Click and scroll heatmap reports - Snapshot-based rendering with iframe previews - Page path filtering - Screen-width grouping for responsive layouts - Depth labels and improved overlay scaling - Self-hosted heatmap recording and storage support ###### Session Replay improvements Session Replay received a round of reliability, filtering, and playback improvements. - Replay filters for finding sessions faster - Fragmented replay events are normalized for playback - Full rrweb snapshots are handled as separate replay chunks - Replay payloads are chunked and oversized payloads are rejected - Replay events flush on `pagehide` with a shorter interval - Mobile layout and modal styling improvements ###### Event and session property reporting image Property reports now support richer data types and reusable charting across both event data and session data. - Event data filters for booleans, dates, and arrays - Event data charts for arrays, booleans, dates, and numeric values - Session data screens with filtering, pivot tables, and property charts - Property filter UI shared across event and session data - Query optimizations for session property filters ###### Revenue reporting Revenue reports have been split into focused APIs and views for better performance and flexibility. - Cumulative mode for revenue charts - Separate revenue chart, metrics, stats, and session queries - Revenue metrics table and metrics bar - Improved realtime report UI ###### DataGrid and table improvements - Manual table/card view toggle for DataGrid - Sorting on non-analytics tables, including websites, boards, links, pixels, teams, and admin tables - Horizontal scrolling for overflowing tables - Stable event chart colors across date range changes - Hidden events stay hidden when the date range changes ###### Tracker and API improvements - `data-auto-pageview` tracker attribute to suppress SPA pageview tracking when auto-pageview is disabled - Tracker click handling for annotated containers - Graceful handling for invalid `pushState` URLs - URL query values included in pages report display - LLM channel logic - URL pageview metric and expanded metric support - Configurable internal API URL handling ###### Sharing - Share page options for filtering and theme enforcement - Share-token permissions for websites, boards, links, and pixels - Board share entity authorization fixes - Unrestricted access for share tokens without section flags ##### Security - Invalidates authenticated sessions after password changes - Sanitizes sensitive data in logs - Hides internal Prisma and database errors from API responses - Hardens analytics writes and avoids leaking internal server errors to clients - Validates SSO redirect URLs before setting auth tokens - Restricts team owner assignment to admins - Enforces team role hierarchy on user updates and removals - Fixes share token confusion vulnerabilities - Tightens API access checks by website section and share permissions - Sanitizes CSV exports against formula injection - Limits batch API payloads to 500 items - Uses authenticated Redis keys on logout ##### Migrations This release includes schema migrations for Heatmaps and event/sessio _[Truncated at 4000 characters — full notes: https://github.com/umami-software/umami/releases/tag/v3.2.0]_