Umami

Umami v3.2.0 is here with new Heatmaps, improved properties reporting, better Session Replay controls, revenue report improvements, and a large set of security, performance, and UI fixes.

New features

Heatmaps

<img width="1272" height="966" alt="image" src="https://github.com/user-attachments/assets/69839459-3dd9-4dc6-9056-0b63d17bdb75" />

Heatmaps are now available as a first-class website report. Use click and scroll heatmaps to understand where visitors interact with each page, with overlays rendered from captured replay snapshots.

• Click and scroll heatmap reports
• Snapshot-based rendering with iframe previews
• Page path filtering
• Screen-width grouping for responsive layouts
• Depth labels and improved overlay scaling
• Self-hosted heatmap recording and storage support

Session Replay improvements

Session Replay received a round of reliability, filtering, and playback improvements.

• Replay filters for finding sessions faster
• Fragmented replay events are normalized for playback
• Full rrweb snapshots are handled as separate replay chunks
• Replay payloads are chunked and oversized payloads are rejected
• Replay events flush on pagehide with a shorter interval
• Mobile layout and modal styling improvements

Event and session property reporting

<img width="1331" height="1009" alt="image" src="https://github.com/user-attachments/assets/d8afe33f-fa6b-434a-9b38-a73ad78f1a2e" />

Property reports now support richer data types and reusable charting across both event data and session data.

• Event data filters for booleans, dates, and arrays
• Event data charts for arrays, booleans, dates, and numeric values
• Session data screens with filtering, pivot tables, and property charts
• Property filter UI shared across event and session data
• Query optimizations for session property filters

Revenue reporting

Revenue reports have been split into focused APIs and views for better performance and flexibility.

• Cumulative mode for revenue charts
• Separate revenue chart, metrics, stats, and session queries
• Revenue metrics table and metrics bar
• Improved realtime report UI

DataGrid and table improvements

• Manual table/card view toggle for DataGrid
• Sorting on non-analytics tables, including websites, boards, links, pixels, teams, and admin tables
• Horizontal scrolling for overflowing tables
• Stable event chart colors across date range changes
• Hidden events stay hidden when the date range changes

Tracker and API improvements

• data-auto-pageview tracker attribute to suppress SPA pageview tracking when auto-pageview is disabled
• Tracker click handling for annotated containers
• Graceful handling for invalid pushState URLs
• URL query values included in pages report display
• LLM channel logic
• URL pageview metric and expanded metric support
• Configurable internal API URL handling

Sharing

• Share page options for filtering and theme enforcement
• Share-token permissions for websites, boards, links, and pixels
• Board share entity authorization fixes
• Unrestricted access for share tokens without section flags

Security

• Invalidates authenticated sessions after password changes
• Sanitizes sensitive data in logs
• Hides internal Prisma and database errors from API responses
• Hardens analytics writes and avoids leaking internal server errors to clients
• Validates SSO redirect URLs before setting auth tokens
• Restricts team owner assignment to admins
• Enforces team role hierarchy on user updates and removals
• Fixes share token confusion vulnerabilities
• Tightens API access checks by website section and share permissions
• Sanitizes CSV exports against formula injection
• Limits batch API payloads to 500 items
• Uses authenticated Redis keys on logout

Migrations

This release includes schema migrations for Heatmaps and event/session data pivot support:

• `pr

<p align="center">

<img src="https://content.umami.is/website/images/umami-logo.png" alt="Umami Logo" width="100">

</p>

<h1 align="center">Umami</h1>

<p align="center">

<i>Umami is a simple, fast, privacy-focused alternative to Google Analytics.</i>

</p>

<p align="center">

<a href="https://github.com/umami-software/umami/releases"><img src="https://img.shields.io/github/release/umami-software/umami.svg" alt="GitHub Release" /></a>

<a href="https://github.com/umami-software/umami/blob/master/LICENSE"><img src="https://img.shields.io/github/license/umami-software/umami.svg" alt="MIT License" /></a>

<a href="https://github.com/umami-software/umami/actions"><img src="https://img.shields.io/github/actions/workflow/status/umami-software/umami/ci.yml" alt="Build Status" /></a>

<a href="https://cloud.umami.is/share/LGazGOecbDtaIwDr/umami.is" style="text-decoration: none;"><img src="https://img.shields.io/badge/Try%20Demo%20Now-Click%20Here-brightgreen" alt="Umami Demo" /></a>

</p>

---

🚀 Getting Started

A detailed getting started guide can be found at umami.is/docs.

---

🛠 Installing from Source

Requirements

• A server with Node.js version 18.18+.
• A PostgreSQL database version v12.14+.

Get the source code and install packages

git clone https://github.com/umami-software/umami.git
cd umami
pnpm install

Configure Umami

Create an .env file with the following:

DATABASE_URL=connection-url

Optional: set API_URL to change the base URL used by internal UI API calls.

Relative paths are served under BASE_PATH; absolute URLs are proxied through the local /api route.

For example, API_URL=/internal-api or API_URL=https://api.example.com/api.

The connection URL format:

postgresql://username:mypassword@localhost:5432/mydb

Build the Application

pnpm run build

The build step will create tables in your database if you are installing for the first time. It will also create a login user with username admin and password umami.

Start the Application

pnpm run start

By default, this will launch the application on http://localhost:3000. You will need to either proxy requests from your web server or change the port to serve the application directly.

---

🐳 Installing with Docker

Umami provides Docker images as well as a Docker compose file for easy deployment.

Docker image:

docker pull docker.umami.is/umami-software/umami:latest

Docker compose (Runs Umami with a PostgreSQL database):

docker compose up -d

---

🔄 Getting Updates

To get the latest features, simply do a pull, install any new dependencies, and rebuild:

git pull
pnpm install
pnpm build

To update the Docker image, simply pull the new images and rebuild:

docker compose pull
docker compose up --force-recreate -d

---

🛟 Support

<p align="center">

<a href="https://github.com/umami-software/umami"><img src="https://img.shields.io/badge/GitHub--blue?style=social&logo=github" alt="GitHub" /></a>

<a href="https://twitter.com/umami_software"><img src="https://img.shields.io/badge/Twitter--blue?style=social&logo=twitter" alt="Twitter" /></a>

<a href="https://linkedin.com/company/umami-software"><img src="https://img.shields.io/badge/LinkedIn--blue?style=social&logo=linkedin" alt="LinkedIn" /></a>

<a href="https://umami.is/discord"><img src="https://img.shields.io/badge/Discord--blue?style=social&logo=discord" alt="Discord" /></a>

</p>

[release-shield]: https://img.shields.io/github/release/umami-software/umami.svg

[releases-url]: https://github.com/umami-software/umami/releases

[license-shield]: https://img.shields.io/github/license/umami-software/umami.svg

[license-url]: https://github.com/umami-software/umami/blob/master/LICENSE

[build-shield]: https://img.shields.io/github/actions/workflow/status/umami-software/umami/ci.yml

[build-url]: https://github.com/umami-software/umami/actions

[github-shield]: https://img.shields.io/badge/GitHub--blue?style=social&logo=github

[github-url]: https://github.com/umami-software/umami

[twitter-shield]: https://img.shields.io/badge/Twitter--blue?style=social&logo=twitter

[twitter-url]: https://twitter.com/umami_software

[linkedin-shield]: https://img.shields.io/badge/LinkedIn--blue?style=social&logo=linkedin

[linkedin-url]: https://linkedin.com/company/umami-software

[discord-shield]: https://img.shields.io/badge/Discord--blue?style=social&logo=discord

[discord-url]: https://discord.com/invite/4dz4zcXYrQ