[3.28.1]
Update umami to 3.4.1
Full Changelog
Upgraded Next.js to 16.4.2 (from 16.3.4 in v3.4.0). This fixes a critical RCE in next/og, SSRF in image optimization, cache poisoning, and an information disclosure issue. #4645
Upgraded React and React DOM to 19.3.1.
Pinned the Docker base image to Node 22.23.4-alpine, which includes the October 2026 Node.js security fixes. Rebuild or re-pull your images to pick this up. #4657
Upgraded @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/client to ^2.3.1. This fixes an OAuth credential leak (GHSA-6qxp-vccf-f47h) along with other advisories. #4645 #4661
Raised the security floors for vulnerable transitive dependencies: vite, undici, sharp, shell-quote, brace-expansion, fast-uri, postcss-selector-parser, and source-map-js. #4645 #4661