v3.3.0

Umami `v3.3.0` is here with new **Two-Factor Authentication**, session identity stitching, property filtering, board cloning, sparklines, improved bounce detection, and a large set of security, performance, and UI fixes.

## New features

### Two-Factor Authentication (2FA)

<img width="600px" alt="image" src="https://github.com/user-attachments/assets/8fe7eae6-e8c6-47a6-9af1-f60989ea144d" />

Umami now supports TOTP-based two-factor authentication for self-hosted installs.

- 2FA setup with QR code and manual key entry
- Backup codes for account recovery
- 2FA step integrated into the login flow
- User security settings page
- Team-level 2FA enforcement settings
- Admin security settings and 2FA reset for users
- Rate limiting with `429` responses on repeated failed attempts
- Transactional backup code handling to prevent double-use race conditions

### Session identity stitching

<img width="800px" alt="image" src="https://github.com/user-attachments/assets/91febf4b-c8d9-4170-928d-0e5205953ce9" />

Sessions are now stitched together when a visitor is identified, giving you a complete view of activity across devices and visits.

- Identified sessions are linked for post-identify reads
- Linked ID displayed in the session profile
- Session delete feature for relational databases #2940
- Session modals use full-height layouts with improved mobile behavior

### Session and event property filtering

<img alt="image" src="https://github.com/user-attachments/assets/d3c15514-2416-4662-8fa5-b6fe8b9865e3" />

Filter your data using session and event properties. #2945 #4008

- Property filters across session and event data views
- Unique session data entries enforced at the database level
- Duplicate data types resolved using dominant type logic
- Performance improvements for session activity queries

### Board cloning

Boards can now be cloned, making it easy to duplicate and iterate on dashboards.

### Sparklines

<img alt="image" src="https://github.com/user-attachments/assets/fa333079-bede-48f4-a399-4ddaf8c1ffc0" />

Website, Link, and Pixel tables now display sparklines for a quick visual overview of activity.

### Tracking code workflow

Adding a new website now walks you through installing the tracking code.

### Bounce detection

- Simplified bounce definition for SPA websites
- Optimized bounce detection queries

### Tracker and API improvements

- Tracker build converted to TypeScript with published type definitions
- `recorder.js` CORS header support #4426
- Punycode domain support #2170
- Same-domain referrers are no longer saved and path-only referrers resolve correctly
- IRR (Iranian Rial) added to supported currencies
- Improved Persian (fa-IR) support and Hebrew RTL support
- Organic Facebook traffic channel attribution #4297
- Web app manifest fetched with credentials

## Security

- Server-side validation for website name and domain input
- Hardened event data deletion #4435
- Hardened report references in boards
- Minimum 8-character slug enforced on share link create/update #4376
- Channel metrics literals escaped in queries
- Docker runtime image CVE fixes and bundled npm removed
- 2FA encryption key validation and transactional OTP handling

## Migrations

This release includes schema migrations for session linking, 2FA, and session data:

- `prisma/migrations/21_add_session_link`
- `prisma/migrations/22_add_2fa`
- `prisma/migrations/23_update_session_data`

Migrations run automatically during the build process.

## Fixes

- Funnel validation #4434
- Revenue query filtering #4286
- Board funnel and goal preview
- ComboBox and MultiSelect issues #4355
- Session modal issues on mobile #4358
- Session modals dismiss when clicking outside
- Dashboard empty-state Edit label
- `formatLongNumber` billions calculation
- Custom `CLIENT_IP_HEADER` not parsing `x-forwarded-for` chains
- `GROUP BY` error in event data queries on PostgreSQL
- Identified session ID generation
- Session 404 handling with added test coverage
- Heatmap and session replay mobile layouts #4417
- Heatmap iframe alignment and viewport clipping
- Website transfer state bug
- Dialog context error in language popover
- Docker `ALLOWED_FRAME_URLS` resolved from the runtime environment
- Docker server runs as PID 1 to drop idle launcher processes
- Website events query performance and activity search persistence
- Sidebar navigation accessibility and layout improvements
- Themed overlay scroll areas replacing global scrollbars
- Missing translations for Russian, Korean, Spanish, German, and European Portuguese

## Updates

- Next.js `16.3.0`
- Prisma `7.9.1`
- React Zen component library upgrades
- Tracker type checking added to the build
- Runtime, frontend, and security dependency updates

## Thanks

@boutterudy @Yashh56 @sushant-kataria @maxiride @Niki2k1 @mamal72 @m0sth8 @Sagittarius @luca-seemann @brantsrasmus @imparpaulo01 @sarmah-rup @rogerhmar @ShubhamPathak1 @leonacostaok @Kopaev @daeho-ro @PeterUstinox @Sebasmzt @sebiweise @anvme

**Full Changelog**: https://github.com/umami-software/umami/compare/v3.2.0...v3.3.0