v0.4.5

Mobile fix: custom-range date pickers no longer spill past the modal on iOS Safari.

v0.4.4

Mobile fixes: drag-to-reorder now works on touch devices (long-press lifts a drag ghost that follows your finger — stat tiles, dashboard grid, goals/funnels row, and the modules panel), and the page no longer pans sideways on phones (card grids pinned to the viewport, long paths truncate again).

v0.4.3

v0.4.3

• MCP (stdio): get_event_props tool — event property breakdown/aggregation (event, prop, optional by grouping), matching the dashboard's Event properties card
• Docs: README + install guides caught up to v0.4.2 (event props, goal revenue, bots, Email delivery, v0.4.0 setup code)

v0.4.2

Per-site currency & in-app email delivery.

Sites can name a revenue currency — goal revenue then renders as real money (€49.99, not 49.99), plain numbers stay the default. And the ESP swap: Settings → Email delivery lets the admin point melytics at any SMTP provider (Resend, Postmark, Brevo…) with a guided form and a send-a-test-email button, because shared-host sendmail too often lands digests, alerts and password resets in spam. Reverting goes back to host sendmail, never to silent logging.

v0.4.1

Event properties & goal revenue.

Explore your custom-event properties from the dashboard: string properties get a value distribution, numeric ones get sum/avg/count, and a numeric property grouped by a string one gives revenue-by-segment (by plan, by currency, ...). Event goals can now name a numeric property to sum — each goal reports total revenue and average per converting visitor (guarded goals.value_prop migration, applied on update). Also: CSP is injected at build time only (fixes vite dev HMR) and a sharper README tagline.

v0.4.0 — security hardening pass 2

Security hardening pass 2.

Install setup-token gate (only someone with file-system access can claim the admin account on a fresh public instance), Content-Security-Policy on the dashboard, MCP connector token expiry, OAuth state bound to the browser, visitor-id HMAC, and a zip-slip guard on the self-updater. Completes the security audit (builds on v0.3.9's ingest/headers/checksum hardening).

v0.3.9 — security hardening

Ingest throttle + domain-bind + event_props cap, trusted-IP header, update checksum verification, scoped MCP tokens, security headers, and auth/XSS hardening.

v0.3.8 — live update banner

The update banner now surfaces on open dashboards within the 60s auto-refresh — no page reload needed. The (12h-cached) release check rides the batched /dashboard payload.

v0.3.7 — Bots module

Bot traffic vs human. Blocked bot beacons (self-declared crawlers + asset-path scrapers) are now counted in a new bot_hits table instead of dropped silently. New Bots dashboard card: share-of-traffic split, blocked vs human counts, top crawler names. Human stats queries and rollups untouched; bot rows follow each site's retention window.

Also: dashboard footer.

Run migrations after updating (the built-in updater does this automatically).

v0.3.6 — live-updating dashboard

What's new

• The dashboard now updates itself — data quietly refreshes every 60 seconds while the tab is visible, updating numbers and charts in place with no spinner and no page reload. 60s matches how often rollups land, so nothing faster could show newer data anyway. Hidden tabs pause entirely and catch up the moment you come back.

Upgrading

One-click from the dashboard update banner. No migrations.