# Umami v3.3.0 - Product: Umami (https://whatsnew.fyi/product/umami) - Vendor: Umami Software - Date: 2026-08-12 - Version: v3.3.0 - Original notes: https://github.com/umami-software/umami/releases/tag/v3.3.0 - Permalink: https://whatsnew.fyi/product/umami/releases/v3.3.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Two-Factor Authentication (2FA) support with TOTP-based authentication for self-hosted installs - **added** — 2FA setup with QR code and manual key entry - **added** — Backup codes for account recovery - **added** — User security settings page - **added** — Team-level 2FA enforcement settings - **added** — Admin security settings and 2FA reset for users - **added** — Session identity stitching to link identified sessions across devices and visits - **added** — Session and event property filtering across data views - **added** — Board cloning feature to duplicate and iterate on dashboards - **added** — Sparklines display in Website, Link, and Pixel tables for quick visual overview of activity - **added** — Tracking code workflow that walks users through installing tracking code when adding a new website - **added** — Linked ID displayed in the session profile - **added** — Session delete feature for relational databases - **added** — Punycode domain support - **added** — IRR (Iranian Rial) added to supported currencies - **added** — Organic Facebook traffic channel attribution - **changed** — Simplified bounce definition for SPA websites - **changed** — Tracker build converted to TypeScript with published type definitions - **changed** — Session modals use full-height layouts with improved mobile behavior - **changed** — Same-domain referrers are no longer saved and path-only referrers resolve correctly - **changed** — Improved Persian (fa-IR) support and Hebrew RTL support - **fixed** — Rate limiting with 429 responses on repeated failed attempts - **fixed** — Transactional backup code handling to prevent double-use race conditions - **fixed** — Transactional OTP handling in 2FA encryption - **fixed** — Unique session data entries enforced at the database level - **fixed** — Optimized bounce detection queries - **fixed** — recorder.js CORS header support - **fixed** — Minimum 8-character slug enforced on share link create and update - **security** — Server-side validation for website name and domain input - **security** — Hardened event data deletion - **security** — Hardened report references in boards - **security** — Channel metrics literals escaped in queries - **security** — Docker runtime image CVE fixes and bundled npm removed Umami `v3.3.0` is here with new **Two-Factor Authentication**, session identity stitching, property filtering, board cloning, sparklines, improved bounce detection, and a large set of security, performance, and UI fixes. ##### New features ###### Two-Factor Authentication (2FA) image Umami now supports TOTP-based two-factor authentication for self-hosted installs. - 2FA setup with QR code and manual key entry - Backup codes for account recovery - 2FA step integrated into the login flow - User security settings page - Team-level 2FA enforcement settings - Admin security settings and 2FA reset for users - Rate limiting with `429` responses on repeated failed attempts - Transactional backup code handling to prevent double-use race conditions ###### Session identity stitching image Sessions are now stitched together when a visitor is identified, giving you a complete view of activity across devices and visits. - Identified sessions are linked for post-identify reads - Linked ID displayed in the session profile - Session delete feature for relational databases #2940 - Session modals use full-height layouts with improved mobile behavior ###### Session and event property filtering image Filter your data using session and event properties. #2945 #4008 - Property filters across session and event data views - Unique session data entries enforced at the database level - Duplicate data types resolved using dominant type logic - Performance improvements for session activity queries ###### Board cloning Boards can now be cloned, making it easy to duplicate and iterate on dashboards. ###### Sparklines image Website, Link, and Pixel tables now display sparklines for a quick visual overview of activity. ###### Tracking code workflow Adding a new website now walks you through installing the tracking code. ###### Bounce detection - Simplified bounce definition for SPA websites - Optimized bounce detection queries ###### Tracker and API improvements - Tracker build converted to TypeScript with published type definitions - `recorder.js` CORS header support #4426 - Punycode domain support #2170 - Same-domain referrers are no longer saved and path-only referrers resolve correctly - IRR (Iranian Rial) added to supported currencies - Improved Persian (fa-IR) support and Hebrew RTL support - Organic Facebook traffic channel attribution #4297 - Web app manifest fetched with credentials ##### Security - Server-side validation for website name and domain input - Hardened event data deletion #4435 - Hardened report references in boards - Minimum 8-character slug enforced on share link create/update #4376 - Channel metrics literals escaped in queries - Docker runtime image CVE fixes and bundled npm removed - 2FA encryption key validation and transactional OTP handling ##### Migrations This release includes schema migrations for session linking, 2FA, and session data: - `prisma/migrations/21_add_session_link` - `prisma/migrations/22_add_2fa` - `prisma/migrations/23_update_session_data` Migrations run automatically during the build process. ##### Fixes - Funnel validation #4434 - Revenue query filtering #4286 - Board funnel and goal preview - ComboBox and MultiSelect issues #4355 - Session modal issues on mobile #4358 - Session modals dismiss when clicking outside - Dashboard empty-state Edit label - `formatLongNumber` billions calculation - Custom `CLIENT_IP_HEADER` not parsing `x-forwarded-for` chains - `G _[Truncated at 4000 characters — full notes: https://github.com/umami-software/umami/releases/tag/v3.3.0]_