v3.5.0

Umami v3.5.0 adds browser error tracking, improved replay navigation, and fixes across tracking, reporting, and sharing.

New features

Browser error tracking

Capture JavaScript errors alongside your analytics and investigate affected visits.

• Automatically capture uncaught exceptions and unhandled promise rejections with data-errors="true"
• Capture handled errors with umami.captureException()
• Group errors into issues with stack traces, occurrence counts, and session details
• Resolve, ignore, and reopen issues
• Search and filter by release, environment, browser, and page path

Replays and navigation

• Previous/next replay controls with left/right arrow keyboard shortcuts
• Distinct visitor IDs in replay lists
• Team websites available in the website switcher outside a team
• Dashboard access from mobile navigation

Tracking and preferences

• Configure the tracker and recorder through window.umamiConfig, with script attributes taking precedence
• Optional client-provided session salts and hourly, daily, weekly, or monthly tracker salt rotation, enabled server-side with ENABLE_CLIENT_SALT
• Expanded server-side SALT_ROTATION options, including fixed salts
• TRUSTED_PROXIES configuration for client IP detection behind multiple proxies
• A 12/24-hour clock preference

Reporting improvements

• Click a website chart bar to zoom into its date range
• Select custom date ranges in a single two-month calendar
• Compare an ongoing period against the equivalent elapsed portion of the previous period
• Improved comparison chart alignment, timezone handling, and daylight-saving transitions
• Retention cell shading relative to the highest visible value
• Session referrers in Session Overview and active visitor indicators in the realtime log
• Faster attribution, funnel, and paginated queries

Security

• Require changing the seeded administrator password before continuing
• Enforce required two-factor enrollment on the server and harden verification against concurrent attempts and code reuse
• Revalidate share tokens against current share settings so deletion and permission changes take effect
• Restrict board shares from exposing raw event, session, revenue, and realtime activity data
• Tighten team permissions, password updates, and API key route checks
• Validate link destinations and collection input more strictly

Fixes

• Session resets, identity attribution, and concurrent anonymous-session claims
• Redis-backed login sessions expiring during active use
• Stale website, link, and pixel caches after updates or deletion
• Background-tab and prerendered-page performance measurements
• Heatmap overlays in Safari, snapshot sizing, and tracking inside preview frames
• Retention cohort dates, full-month navigation, and invalid custom date selections
• Search text being overwritten by delayed navigation
• Custom wildcard selections and missing values in negative filters
• Board ownership when transferring websites
• Docker/Podman server binding
• Translation, accessibility, and responsive layout issues

API updates

• Optional period parameters on analytics endpoints, including today, 24h, 7d, and 30d
• visitId in website event responses
• New error tracking endpoints and refreshed API client types
• Corrected event-filter handling in MCP tools

Upgrade notes

• APP_SECRET must be set explicitly. Falling back to DATABASE_URL is no longer supported.
• Node.js 20.19+ is required; Node.js 22 LTS is recommended.
• Password changes are now under Settings → Security.
• The public /api/config endpoint has been removed.

This release includes database migrations:

• PostgreSQL: 27_add_error_tracking

Full Changelog: v3.4.1…v3.5.0

Thanks

@anandghegde @Na5co @SulimanAbdulrazzaq @lidarbtc @4RH1T3CT0R7 @pOwn3d @Yashh56 @basstiekema @rubenmarcus @GalletitaDeAnis @sviat-barbutsa @zi0r @lemonteaau @maxence-cebios @sahil2448 @drakeo338 @TupiC @Enesuygurs @Vishesh-Verma-07 @CloudCorpRecords @Virako @twiesing @christianhuth @ghazy2001 @pcbeingused333 @Debasishhh @GhaithZamrik @Karanvir1729