Updates Node.js to patch CVE2026-111497

Source GitHub

New features

Dashboard

• Timeline annotations: pin notes on the overview chart, pick hour and minute, any emoji as icon (#1164, #1173, #1168)

• Saved segments: named, reusable filter sets in the Filter popover (#1165, #1166)

• Date selector overhaul: two-pane picker with typed dates/times, ten-preset rail with hotkeys, and a choice of comparison window (previous period, matching weekdays, same period last year) (#1148, #1151, #1152, #1167)

• Past-minutes navigation; period chart axes no longer end a bucket early (#1130)

• Optimistic dashboard edits, no waiting on save

• Identify User dialog: add, edit, remove user traits

• Dashboard embed: revoke the private embed link

• Frog avatars replace boring-avatars (#1127, #1128, #1138)

• Organizations table shows subscription source with icons

Bot detection

• Detection runs for every site even with blocking off; catches paced distributed crawlers (#1123)

• Site flood detection with per-site traffic baselines refreshed every 15 min

• Bots dashboard names the bot and splits AI crawlers from AI agents (#1147)

• New viewport and screen-dimension signals; single Bot Signal contract module (#1116)

API and auth

• Organization API usage endpoint and Usage cards; clearer rate-limit feedback

• Better Auth 1.7.3 with OAuth provider support

Fixes

• Goals honor page filters and first non-empty UTM attribution (#1177)

• list_sites 401 for org-owned API keys (#1172)

• Previous-period line aligned on week/month buckets (#1169)

• Sub-second event ordering preserved (#1144)

• Untitled pages included in pages table (#1143)

• Event names filtered at row level (#1096)

• Custom UTM traffic without referrer falls back to Referral, not Unknown (#1102)

• Replay click labels resolved per snapshot (#1146)

• Site access cache invalidated after creation (#1142)

• CARTO basemap replaced with OpenFreeMap (#1145)

• Long URLs no longer hide the timestamp (#1100)

• Empty region input in geo lookup; whitespace/non-finite strings preserved in query results

• GSC and PDF export ranges correct in past-minutes mode

• .well-known forwarded to backend in custom Nginx config (#1107)

Performance

• Cut mutation-driven parts-lock contention on the ClickHouse ingest path (#1131)

Source GitHub

What's new in v2.8.0

1. MCP server - Visit to https://rybbit.com/docs/mcp for more details

2. User identification overhaul - Sessions are now keyed per identified user, so people sharing an IP and browser (corporate proxies, VPNs, office networks) no longer collapse into one session. You can also identify users directly from the dashboard now.

3. Bot detection improvements - Client-side signals now have less false positive detections.

4. More traffic exclusions - Exclude traffic by ASN and by query parameters

5. Goals and funnels - Autocapture (button clicks, form events) events now can be used for goals and sessions

6. API - You can now create organization-scoped API keys

7. Tracking - Visitors behind rotating datacenter egress (corporate proxies, Cloudflare WARP, iCloud Private Relay) kept splitting into phantom users as their IP changed mid-visit. Rybbit now buckets IPs for identity and re-attaches an unambiguously-matching fingerprint to its previous identity.

Other improvements

• The live counter counts people rather than active sessions

• Multi-site rollup totals no longer double-count visitors active on more than one day

• Anonymous user profiles no longer show the activity of identified users sharing that device fingerprint

• Embed widgets load under /widget/<hexId> with hex site IDs

• Click tracking is throttled to cut duplicate event noise

• Structured request logging with automatic redaction of sensitive fields

• Docker Compose binds service ports to localhost by default

• Increased backend test coverage

• Fixes: event labels passed to translations, session list crash when no site is selected, inconsistent team-based site access, and a server image crash from the @rybbit/shared symlink

Source GitHub