umami-software/umami v3.4.1 on GitHub

Umami v3.4.1 is mainly a security hotfix. It updates vulnerable dependencies and the Docker base image. All self-hosted users should upgrade.

Security

Upgraded Next.js to 16.4.2 (from 16.3.4 in v3.4.0). This fixes a critical RCE in next/og, SSRF in image optimization, cache poisoning, and an information disclosure issue. #4645
Upgraded React and React DOM to 19.3.1.
Pinned the Docker base image to Node 22.23.4-alpine, which includes the October 2026 Node.js security fixes. Rebuild or re-pull your images to pick this up. #4657
Upgraded @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/client to ^2.3.1. This fixes an OAuth credential leak (GHSA-6qxp-vccf-f47h) along with other advisories. #4645 #4661
Raised the security floors for vulnerable transitive dependencies: vite, undici, sharp, shell-quote, brace-expansion, fast-uri, postcss-selector-parser, and source-map-js. #4645 #4661

CI now runs the required checks for pull requests from forks, and the Gitleaks scan still works when the previous commit is not available. #4663

None.

Full Changelog: v3.4.0...v3.4.1