v3.3.0

Umami v3.3.0 is here with new Two-Factor Authentication, session identity stitching, property filtering, board cloning, sparklines, improved bounce detection, and a large set of security, performance, and UI fixes.

New features

Two-Factor Authentication (2FA)

Umami now supports TOTP-based two-factor authentication for self-hosted installs.

• 2FA setup with QR code and manual key entry
• Backup codes for account recovery
• 2FA step integrated into the login flow
• User security settings page
• Team-level 2FA enforcement settings
• Admin security settings and 2FA reset for users
• Rate limiting with 429 responses on repeated failed attempts
• Transactional backup code handling to prevent double-use race conditions

Session identity stitching

Sessions are now stitched together when a visitor is identified, giving you a complete view of activity across devices and visits.

• Identified sessions are linked for post-identify reads
• Linked ID displayed in the session profile
• Session delete feature for relational databases #2940
• Session modals use full-height layouts with improved mobile behavior

Session and event property filtering

Filter your data using session and event properties. #2945 #4008

• Property filters across session and event data views
• Unique session data entries enforced at the database level
• Duplicate data types resolved using dominant type logic
• Performance improvements for session activity queries

Board cloning

Boards can now be cloned, making it easy to duplicate and iterate on dashboards.

Sparklines

Website, Link, and Pixel tables now display sparklines for a quick visual overview of activity.

Tracking code workflow

Adding a new website now walks you through installing the tracking code.

Bounce detection

• Simplified bounce definition for SPA websites
• Optimized bounce detection queries

Tracker and API improvements

• Tracker build converted to TypeScript with published type definitions
• recorder.js CORS header support #4426
• Punycode domain support #2170
• Same-domain referrers are no longer saved and path-only referrers resolve correctly
• IRR (Iranian Rial) added to supported currencies
• Improved Persian (fa-IR) support and Hebrew RTL support
• Organic Facebook traffic channel attribution #4297
• Web app manifest fetched with credentials

Security

• Server-side validation for website name and domain input
• Hardened event data deletion #4435
• Hardened report references in boards
• Minimum 8-character slug enforced on share link create/update #4376
• Channel metrics literals escaped in queries
• Docker runtime image CVE fixes and bundled npm removed
• 2FA encryption key validation and transactional OTP handling

Migrations

This release includes schema migrations for session linking, 2FA, and session data:

• prisma/migrations/21_add_session_link
• prisma/migrations/22_add_2fa
• prisma/migrations/23_update_session_data

Migrations run automatically during the build process.

Fixes

• Funnel validation #4434
• Revenue query filtering #4286
• Board funnel and goal preview
• ComboBox and MultiSelect issues #4355
• Session modal issues on mobile #4358
• Session modals dismiss when clicking outside
• Dashboard empty-state Edit label
• formatLongNumber billions calculation
• Custom CLIENT_IP_HEADER not parsing x-forwarded-for chains
• GROUP BY error in event data queries on PostgreSQL
• Identified session ID generation
• Session 404 handling with added test coverage
• Heatmap and session replay mobile layouts #4417
• Heatmap iframe alignment and viewport clipping
• Website transfer state bug
• Dialog context error in language popover
• Docker ALLOWED_FRAME_URLS resolved from the runtime environment
• Docker server runs as PID 1 to drop idle launcher processes
• Website events query performance and activity search persistence
• Sidebar navigation accessibility and layout improvements
• Themed overlay scroll areas replacing global scrollbars
• Missing translations for Russian, Korean, Spanish, German, and European Portuguese

Updates

• Next.js 16.3.0
• Prisma 7.9.1
• React Zen component library upgrades
• Tracker type checking added to the build
• Runtime, frontend, and security dependency updates

Thanks

@boutterudy @Yashh56 @sushant-kataria @maxiride @Niki2k1 @mamal72 @m0sth8 @Sagittarius @luca-seemann @brantsrasmus @imparpaulo01 @sarmah-rup @rogerhmar @ShubhamPathak1 @leonacostaok @Kopaev @daeho-ro @PeterUstinox @Sebasmzt @sebiweise @anvme

Full Changelog: v3.2.0...v3.3.0