fix(analytics): mute Umami on tech/finance/commodity while upstream #4183 is open#3841
Merged
Conversation
is unresolved Upstream bug: `umami-software/umami#4183` (open since 2026-04-19, OP and a second reporter both running self-hosted v3.1.0 against Postgres). A race in `prisma.sessionData.updateMany()` returns HTTP 500 from `/api/send` with `Unique constraint failed on the fields: (session_data_id)` for ~4-8% of requests. Maintainer acknowledged 2026-04-22; suggested fix is to add a `(sessionId, dataKey)` composite unique and switch to `upsert`, but no commit has landed on master (22 commits since 3.1.0 — all dependency bumps + a chart canvas tweak, none touch sessionData). Self-hosted on Railway runs `umamisoftware/umami:3.1.0` against `postgres.railway.internal` — Railway service source pinned to that tag in a separate API change so the rolling `postgresql-latest` can't drift back onto the same broken digest. Until a tagged release ships the fix, drop the three variants currently reporting 500-storm symptoms from `data-domains` in `index.html:121`: `tech.worldmonitor.app`, `finance.worldmonitor.app`, `commodity.worldmonitor.app`. Umami's tracker self-disables when the current hostname isn't in `data-domains` — same mechanism that's been keeping `energy.worldmonitor.app` quiet (it was never added). Kept active intentionally: - `worldmonitor.app` (main host, residual analytics signal) - `happy.worldmonitor.app` (low-traffic, near-zero 500 volume) If you want the Grafana error-rate metric flat at 0%, drop those too — this PR preserves them deliberately so the analytics product isn't fully blacked out for the ~days-to-weeks window before upstream ships 3.1.1 (or whatever tagged release contains #4183's fix). CSP `connect-src` / `script-src` still allow `abacus.worldmonitor.app` because the script still loads on the kept hosts; only the data-domains allowlist shrinks. No hash regeneration needed (the 4 sha256 hashes in `script-src` cover inline scripts elsewhere in the document, not the external Umami script which loads via origin allowlist). To restore: add the three subdomains back to `data-domains` once umami-software/umami releases a tag containing the sessionData race fix (track via the linked issue).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Greptile SummaryReduces the Umami
Confidence Score: 5/5Safe to merge — the change removes three hostnames from a single HTML attribute and cannot affect any code path other than analytics collection on those variants. The diff touches one attribute value in one script tag. Umami's domain-filtering is a well-understood client-side mechanism: the tracker reads data-domains at load time and skips the POST /api/send call entirely when the current hostname is absent. The three dropped domains will go fully quiet; the two kept domains retain existing behaviour. The inline comment records the upstream issue link, affected version, error rate, and restoration steps, so the change is self-documenting and easily reversible. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Browser loads page] --> B{Is hostname in data-domains?}
B -- "Yes (worldmonitor.app, happy.worldmonitor.app)" --> C[Umami script fires POST /api/send]
B -- "No (tech / finance / commodity / energy)" --> D[Umami self-disables, no request sent]
C --> E{Upstream Umami v3.1.0 race condition}
E -- "~4-8% of requests" --> F[HTTP 500 - prisma.sessionData.updateMany Unique constraint failed]
E -- "~92-96% of requests" --> G[Analytics event recorded]
D --> H[Zero 500s from silenced variants]
Reviews (1): Last reviewed commit: "fix(analytics): mute Umami tracker on te..." | Re-trigger Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
POST https://abacus.worldmonitor.app/api/sendreturns 500 for ~4-8% of requests ontech,finance, andcommodityvariants. Grafana shows the error rate climbing steadily; p99 response time spikes to 25s during the storm.Root cause is upstream, not us:
umami-software/umami#4183— a race inprisma.sessionData.updateMany()returnsUnique constraint failed on the fields: (session_data_id)for concurrent same-session events. Logs from our Railway-hosted Umami confirm the exact stack trace + Prisma client version (7.6.0) called out in the upstream report.Maintainer Maxime-J acknowledged the bug on 2026-04-22 with a proposed fix (composite unique on
(sessionId, dataKey)+ switch toupsert), but no commit has landed on master. 22 commits since 3.1.0 — all dependency bumps + a chart canvas fix; none touchsessionData. There is no upgrade target.What this PR does
Reduces
data-domainsinindex.html:121from 5 hosts to 2. Umami's tracker self-disables when the current hostname isn't indata-domains— same mechanism that's been keepingenergy.worldmonitor.appquiet (it was never enrolled).Dropped:
tech.worldmonitor.appfinance.worldmonitor.appcommodity.worldmonitor.appKept:
worldmonitor.app(main, residual analytics signal)happy.worldmonitor.app(low traffic, near-zero 500 volume)Companion change (already shipped, not in this diff)
Railway service
umamihadsource.image = umamisoftware/umami:2.13.2in config but was actually runningumamisoftware/umami:postgresql-latest(resolved digest =latest=3=3.1=3.1.0, from a manual redeploy on 2026-05-01). The rolling tag was free to drift back to a broken digest on the next redeploy. I pinned source toumamisoftware/umami:3.1.0viaserviceInstanceUpdate— no redeploy triggered since the digest is identical to what's already running.Tradeoff
worldmonitor.app+happy.worldmonitor.appwill still produce a small 500 stream — same root cause, just lower volume. Drop them too if you want the metric flat at 0%; I kept them so the analytics product isn't fully blacked out for the days-to-weeks window before upstream ships a tagged fix.Test plan
https://tech.worldmonitor.app/(or whichever variant the preview maps to) → DevTools Network → confirmPOST .../api/sendis absent (tracker silenced itself)https://worldmonitor.app/→ confirmPOST .../api/sendstill fires (kept active)Request Error Rateon the Umami service should drop materially within minutes of the deploy reaching productionTo restore
Add the three subdomains back to
data-domainsonceumami-software/umamiships a tagged release containing the #4183 fix. Subscribe to the issue to be notified.