v3.4.0

[mikecao]

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
umami	Ready	Preview	Sep 17, 2026 3:51am UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
umami-analytics-eu	Ignored	Preview	Sep 17, 2026 3:51am UTC
umami-analytics-us	Ignored	Preview	Sep 17, 2026 3:51am UTC
umami-postgresql	Ignored	Preview	Sep 17, 2026 3:51am UTC

[macroscopeapp]

Macroscope skipped reviewing this pull request. Per-review cost limit exceeded (workspace setting).

This review would cost an estimated $23.81, which exceeds your per-review limit of $10.00.

The top 3 files driving up this estimate:

File	Diff Size	Estimate
src/openapi/operation-descriptions.ts	34.99KB	$1.75
src/openapi/source-analysis.ts	28.22KB	$1.41
packages/api-client/src/client.ts	17.53KB	$0.88

Tip

To get this pull request reviewed, you can:

1. Comment @macroscope-app on this PR to request a manual review (monthly spend limits still apply).
2. Exclude the file(s) above from review by adding a pattern to your .macroscope/ignore.md — note that creating this file replaces Macroscope's built-in default ignores rather than extending them.
3. Raise your cost limit in your workspace billing settings.

^{Turn off this reminder going forward}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no new actionable defects remain, and all previous findings are resolved.

Summary

This release updates Umami to v3.4.0 and substantially expands its public API infrastructure.

• Adds generated OpenAPI contracts and a typed @umami/api-client workspace package.
• Adds an opt-in MCP endpoint and supporting @umami/mcp package.
• Migrates analytics and saved funnel/goal operations to dedicated website APIs while preserving legacy report routes through compatibility rewrites.
• Adds API integration infrastructure, API-key management, annotations, and broad dependency updates.
• The changes since the previous review fix all four prior findings: the advertised API version is now 3.4.0, path parameters are excluded from request bodies, epoch-zero annotation ranges are retained, and the Gitleaks action is pinned to a commit SHA.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Consumer[API consumer] --> SDK["@umami/api-client"]
    MCP["@umami/mcp"] --> SDK
    SDK --> OpenAPI[Generated OpenAPI operations]
    OpenAPI --> WebsiteAPI["/api/websites/:websiteId/*"]
    Legacy[Legacy report consumer] --> Rewrite[Next.js compatibility rewrites]
    Rewrite --> Compat["/compat/api/reports/*"]
    WebsiteAPI --> Analytics[Shared analytics and SQL queries]
    Compat --> Analytics

Loading

_{Reviews (2) · Last reviewed commit: "Fix API client path parameter handling a..."}

[mikecao]

@greptile