StackPrism

umami-software/umami dependency check

View on GitHub (opens in a new tab)39,284 stars

Umami is a privacy-first analytics platform. Traffic, campaigns, behavior, conversions, and revenue in one place — no cookies, no surveillance, self-hosted or in the cloud.

umami-software/umami: 1 critical finding, fixed by upgrading next to 16.3.8. Plus 3 warnings.

Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub and npm.

4 things your coding agent doesn’t know about this repo

umami-software/umami on GitHub (opens in a new tab)

1 critical3 warnings19 low priority

One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Checked 92 packages and 3 base images from package.json, pnpm-lock.yaml, docker-compose.yml and Dockerfile against:

Add this badge to your README

It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.

StackPrism dependency check badge for umami-software/umami
[![StackPrism](https://stackprism.ai/badge/github/umami-software/umami.svg)](https://stackprism.ai/check/github/umami-software/umami)

What next

Get alerts when this changesConnect GitHub (free) and StackPrism re-checks this repo every day, with an in-app alert when a new critical finding turns up.Connect GitHubSee the whole stack as a diagramMap the repo into an architecture diagram with health on every part, then hand your coding agent a brief to build from.Map this repo

Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps

Ask Prism Agent about umami-software/umami

Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.

Ask Prism AgentCheck another repo

How this report works

StackPrism read package.json, pnpm-lock.yaml, docker-compose.yml and Dockerfile from the default branch of umami-software/umami and checked its 92 packages and 3 base images against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub and npm. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.

Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.

This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.