Code refactoring, internal improvements and dependency updates to bring the codebase up to date with the latest versions and features of Node.js and MongoDB (fixes #377).

Changed

• Ackee now requires Node.js 24 or newer

Fixed

• Vercel deployments and serverless functions (#401, #385)

Changed

• Several dependencies have been updated to their latest versions to bring in security patches and improvements

Fixed

• ackee-tracker has been updated to fix an issue where visits were not recorded when the website had an empty document.referrer. You might have seen lower visit counts since version 3.5.0 when your website had no referrer, e.g., when visiting it directly or via bookmarks.

Small fixes, internal improvements and dependency updates.

Changed

• Ackee now requires Node.js 22 or newer (fixes #343)
• The official Docker image is now based on Node.js 22 (fixes #343)
• Netlify builds use Node.js 22 (fixes #343)
• URLs without protocols (e.g., example.com) are now rejected by the API. The official ackee-tracker client sends window.location.href with protocol, so this only affects custom API clients sending malformed URLs as siteReferrer and siteLocation.

Fixed

• ReDOS vulnerability of is_js, the request-ip dependency (thanks @marek629, #392)

Changed

• Adjust Docker to run as non-root user (thanks @rjhancock, #309, #337)

Fixed

• Rendering issue in Safari

Fixed

• Build failing on Netlify (thanks @adityatelange, #333)
• Vercel not attaching CORS headers because of unsupported multiValueHeaders (thanks @birjj, #330)
• ACKEE_AUTO_ORIGIN not attaching CORS headers (thanks @birjj, #330)

Added

• Support for Node.js 17 (#302)
• Cache preflight requests (via Access-Control-Max-Age) (#261)
• Automatically add CORS headers for domains that have fully qualified domain names as titles (ACKEE_AUTO_ORIGIN) (#271)

Changed

• MongoDB 4.4 or newer is now required, but older versions still may work

You will see a lower unique visitor count after updating. This release contains a fix for the unique visitor count and anonymisation that was broken since 3.2.0. The recorded visits were still anonymous, but Ackee tracked the visit path of each visitor. Data that Ackee normally removes. Data tracked since 3.2.0 are all counted as unique, even if they were not.

Fixed

• Unique visitor count and anonymisation (#304)

Added

• Docker support for linux/arm64 and linux/arm/v7 (#298)

Changed

• Switch to official Node.js Docker image
• Updated dependencies, including mongoose (thanks @suda, #291)

Fixed

• "Float cannot represent non numeric value: NaN" when visiting a new installation of Ackee