Matomo 4.0.0 - Analytics Platform

We are proud to announce Matomo 4.0.0: a new major release of Matomo Analytics!

What’s new?

Matomo 4.0.0 has been in the making since January 2020 and we’re proud to finally release this to you all.

There are many changes, including security and privacy improvements and other breaking changes, most notably:

Matomo 4.0.0 requires PHP 7.2.5 (better security and performance)
Log importer now requires Python 3.x (Log analytics)
Auth tokens used to authenticate API calls now need to be generated, and can be revoked. Any existing token_auth in Matomo 3.x will be migrated so any token_auth you already use will still work
Page generation time metrics are now deprecated and replaced by new Page Performance reports
Support for Offline tracking in JS Tracker (beta)
LoginHttpAuth plugin is no longer supported (we welcome someone to fork & maintain the plugin in the future)
Page titles, event names, event category, page URL, etc. are now truncated after 4096 characters (more info) and referrer urls to 1500 characters
Security: More secure storage of tokens: the `token_auth` and session ID are no longer stored in plain text in the database.
Security: When embedding reports (widgets) into a different site, it is no longer possible to use authentication tokens of users with at least write access (more info)
Segments: “Not contains” and “Not equals” segment comparison now behave differently (more info)
PHP tracker client: exceptions are now thrown on errors (more info)
If you use the JavaScript API, or the Reporting API, or if you build plugins for Matomo, please check the developer changelog for a full list of changes in the platform that may affect you.
Database tables will now use UTF8 encoding (utf8mb4) which means for example that emojis will now be correctly tracked in URLs. Existing Matomo 3.x databases will need to be converted to utf8 manually.
The JS tracker is now tracking using “navigator.sendBeacon” by default. If you are using a Content Security Policy header, please adjust your header to also allow “connect-src” see the example in our FAQ. Alternatively, you can disable “sendBeacon” using the JS tracker method _paq.push(["disableAlwaysUseSendBeacon"]);.
Older browsers like IE6 or IE7 are not tracked anymore by the JS Tracker (browsers that don’t support JSON API)
IE 10 browser is not longer supported in the Matomo App user interface (IE 10 is still supported and tracked in JS Tracking)

398 tickets have been closed by more than 35 contributors!

We are grateful for all community members who reported feedback and suggestions, our awesome team of translators for their work, and our Premium features customers and Matomo Cloud hosting customers for their amazing support.

I want to update now, but the updater doesn’t show an update available

We’re introducing a staged release process so that the Matomo 4.0.0 will be deployed to all Matomo instances gradually. So it might take a few hours or days to appear in your instance. If you want to upgrade Matomo right now you have two solutions: 1) you could configure Matomo to use the “Beta” release channel or 2) you could upgrade Matomo manually after downloading the latest version.

Database upgrade

Note: This release contains major database upgrades and upgrading your database will take a long time if you have a lot of data in your database.

Please make sure you read the Update Matomo guide for high traffic instances.

After You Update

Please help us spread the word! Maybe you can write about the project on your blog, website, twitter, talk at conferences or let your friends and colleagues know what is Matomo. Already 1,000,000+ websites are keeping full control of their web analytics with Matomo!
Use the forums if you have any question or feedback (free support),
or purchase a Support Plan to get professional support and guidance.
To improve Matomo in your language consider contributing to translations.
You can also support our efforts by purchasing valuable Premium Features for Matomo or try our Matomo Cloud solution.

Downgrading to Matomo 3

After an upgrade to Matomo 4, it may be possible to downgrade again to Matomo 3 if needed by following instructions in this FAQ.

Security release

This release is rated critical.

We fixed two possible vulnerabilities (Stored XSS and Reflected XSS) which were responsibly disclosed to us by security researchers dhbd (Hung Dao) and lboy.

Our security bug bounty program welcomes & rewards researchers who discover and responsibly report to us any security issues found in Matomo or any of the plugins created by Matomo/InnoCraft.

Platform Changes

Matomo is an open analytics platform. In an effort to help Matomo developers learn about improvements and changes in the core APIs, we document the changes since the last release.

In this 4.0.0 release there are many changes to the API. There are Breaking changes in Matomo JS tracker, Deprecations in Matomo JS tracker, Recommendations for Matomo JS tracker, Breaking changes in HTTP API, New PHP events, Breaking changes in PHP events, Removed methods and constants in PHP Plugin API, New APIs, and Other Breaking changes.

Read more about all changes to the platform and APIs including breaking changes in Platform Changelog for Developers.

Note: the Marketplace showcases more than 64 plugins already compatible with Matomo 4 and this is just the beginning. All plugin authors are encouraged to make their plugins compatible with Matomo 4.0.0.

New and updated SDKs (Tracking API Clients)

The Matomo team offers official SDKs (Tracking API Clients) for measuring your mobile apps and any other kind of apps.

iOS SDK [by @brototyp]
Android SDK [by @d4rken]

List of 398 tickets closed in Matomo 4.0.0

matomo-org/matomo

#6559 Add support for app specific passwords (create and revoke token_auth) [by @tsteur]
#6210 Detect when stats load slowly and explain to user to disable Browser trigger archiving in Admin [by @andrzejewsky, @diosmosis]
#9939 Offline tracking in JavaScript API [by @tsteur]
#15426 Offer feature to anonymise or shorten the referrer [by @diosmosis, @tsteur]
#16258 Allow force disable cookies [by @sgiehl]
#16259 Allow disabling Visitor Profile feature and visits log feature [by @sgiehl]
#16377 Offer possibility to not store IP address at all [by @sgiehl]
#16183 Support PHP 8
#13611 Drop support for PHP 5.x, Require PHP 7.2
#12811 Activate DB-Ip support by default for all users [by @sgiehl]
#8790 Tracking API: track Emoji correctly in page URLs and others [by @sgiehl]
#11974 Allow plugins to generate their reports using historical data (eg. Custom Reports) [by @diosmosis]
#12653 Provide more insights into page performance metrics [by @sgiehl]
#13202 Show “browser” report in goal by dimension report, view conversion rates by browser [by @tsteur]
#13153 Add “Movers and shakers” widget to the default dashboard [by @tsteur]
#13681 JS Tracker: enable alwaysUseSendBeacon by default [by @tsteur]
#9626 Heartbeat / ping requests should only update visit_total_time
#14791 Make Matomo JS Tracker work in strict mode
#16161 New visitor ID generated per action in iframes (SameSite cookie issue)
#16724 SameSite cookie attribute can now be configured in JS tracker [by @fealXX, @tsteur]
#13462 Offer possibility to sync JavaScript tracker with any CDN (new community plugin TrackerJsCdnSync)
#14535 log_visit.referer_url and log_action.name as TEXT instead of VARCHAR cause a lot of tmp table on disk [by @tsteur]
#16192 Add new dimension and segment whether cookies were used or not: “Profilable” [by @tsteur]
#8100 Reporting API: remove the PHP serialization response format [by @sgiehl]
#8566 Reporting API: Make json2 format the default json format (potential BC break) [by @diosmosis]
#16499 ISP detection should support the DB-IP ASN database [by @sgiehl]
#16557 Drop-Down appears on top of lower level [by @sgiehl]
#16738 New diagnotic warning when both auto archiving and browser archiving are enabled [by @tsteur, @diosmosis]
#16521 Use name “segmented visits log” (plural) to be consistent with “Visits log” naming [by @sgiehl]
#16168 Cloudron installation method
#16436 Outlinks icons are not aligned in all reports [by @sgiehl]
#11524 Disable Custom Variables feature by default [by @sgiehl]
#13613 Drop support for IE 10
#15237 When DB user doesn’t have the ‘CREATE TEMPORARY TABLE’ grant, display a clear error message [by @katebutler, @sgiehl]
#15889 allow invalidating plugin archives only and archiving past data for plugins [by @diosmosis]
#4171 Minimise token_auth exposure, hide token_auth from html responses
#12961 update frontend libraries like jquery [by @diosmosis]
#14954 Translate the “Asking for consent” page [by @maxpereira, @sgiehl]
#6265 Content-tracking: I want to be able to disable piwik.php redirect and instead use the link tracking 500ms solution. [by @tsteur]
#16362 Custom opt out screen should not imply tracking consent given
#15681 Check that all Matomo cookies are set with the secure flag [by @tsteur]
#13582 Referrer name should allow more than 70 characters (up to 255 characters) [by @sgiehl]
#15396 Remove LoginHttpAuth submodule [by @tsteur, @sgiehl]
#15736 New page performance reports [by @sgiehl]
#15774 Track seconds instead of days for “days since” dimensions [by @diosmosis]
#16095 New log importer (log analytics) now only supports python3 [by @diosmosis]
#16265 Custom Dimensions available and activated by default
#15440 in Visitors>User IDs, opening a Profile for a given User ID shouldn’t show other visits from User IDs who shared the same computer
#15619 Prevent server gone away error in CronArchive [by @tsteur, @sgiehl]
#13754 When looking at Yesterday’s data, and there is data for today, notify users to try to look at Today [by @tsteur]
#12767 When a user opts-out, do not send any tracking requests to the Tracking API
#13042 Set higher expiry time for the “Ignore tracking” cookie [by @tsteur]
#13056 JS Tracker: Add possibility to turn cookies back on, enableCookies [by @tsteur]
#15182 When signing up for the Matomo newsletter, clarify In the privacy notice that emails are processed by Madmimi [by @sgiehl]
#16017 Do not generate crossdomain link when cookies are disabled [by @tsteur]
#9785 Make Matomo database use utf8mb4 collation by default [by @sgiehl]
#13357 Use random_bytes() instead of uniqid/md5 in Common::generateUniqId() for improved security [by @katebutler]
#15313 JS Tracker: set secure flag for _pk_testcookies
#15390 Store session ID hashed in the DB [by @tsteur]
#16169 Improve host validation: now using the SERVER_NAME and no longer the HOST header [by @tsteur, @diosmosis]
#16263 Only allow widgetize and token usage for view users [by @tsteur]
#16264 When embedding reports (widgets) into a site, it is no longer possible to use authentication tokens of users with at least write access [by @tsteur, @diosmosis]
#16389 Make sure the same 2FA token cannot be used twice [by @tsteur, @diosmosis]
#11115 Reporting API: apply `hideColumns` recursively to nested values by setting `hideColumnsRecursively=1` [by @mattab, @tsteur]
#12575 SQL type FLOAT should not be used for economical data [by @tsteur]
#16429 “Back to content” link overlaps with the logo, fix skip-to-content offset [by @Findus23, @tsteur]
#13256 Mobile: Icons not fully shown and shown not correctly
#14579 JS Tracker: add rtf to list of downloads
#15744 Adds INI setting to disable referrer spam blocklist [by @john357smith, @sgiehl]
#15845 Tracking of visitors without JavaScript (image beacon) does not work with strict referrer-policy [by @tsteur]
#15931 Add more information to system check and be able to copy/paste for debugging purposes [by @tsteur]
#15999 Track ecommerce views as new dimensions instead of custom variables [by @sgiehl]
#16197 Make it possible to detect other clients than Browsers [by @sgiehl]
#16288 prevent vacation messages in response to Email reports [by @Findus23]
#16302 New feature to exclude tracking requests via config file: INI setting exclude_requests [by @tsteur]
#16386 System check: Add Matomo Version History and download feature [by @tsteur, @diosmosis]
#16446 Do not index the opt out iframe in search engines [by @tsteur]
#8505 Visitor map shows info icon but no tooltip when there is no data [by @sgiehl]
#15247 Don’t lock log_visit table to check if privilege is granted [by @tsteur]
#15492 New INI setting delete_logs_unused_actions_max_rows_per_query useful for speeding up deletion process for very large sites [by @toredash, @tsteur]
#15875 Row Evolution PopUp opens after Visitors Log Popup Closed [by @sgiehl]
#15887 Improve performance/memory of archive selection [by @tsteur, @diosmosis]
#15986 Tracker API speed: avoid DB query when recording historical data or other authenticated tracking requests [by @tsteur]
#16092 Allow configuration of a shorter lock wait time in tracker mode (new INI setting innodb_lock_wait_timeout) [by @tsteur, @diosmosis]
#16473 Manage Dimensions: Sorting by ID is not numeric [by @nina-py, @tsteur]
#5341 Move Provider plugin to the Marketplace [by @tsteur]
#15601 Fix VisitorFrequency.get API for idsites=all [by @sgiehl]
#15974 update php-di to latest version 6.x [by @sgiehl]
#15980 JS Tracker: require category and action in trackEvent [by @Findus23, @tsteur]
#16031 Get all our plugins and premium plugins to pass w/ updated frontend libs [by @diosmosis, @tsteur, @sgiehl]
#16087 wrong escaping of cookie path [by @MichaelHeerklotz, @diosmosis, @tsteur]
#15979 no cut-off icons in DataTables [by @Findus23, @sgiehl]
#16238 Segmented Visitor profile: Layout breaks when zooming out
#16354 properly align pre code [by @Findus23, @sgiehl]
#16428 split disabled PHP functions to not break table layout [by @Findus23, @tsteur]
#11572 Document adding Custom JS to tracker via tracker.js / tracker.min.js on https://developer.matomo.org/guides/enrich-js-tracker [by @tsteur]
#16148 Sort Custom dimensions in reporting page alphabetically [by @sgiehl]
#12739 doTrackGoal() in the PHP API should return success or failure response, not tracking GIF [by @tsteur]
#15269 Make segment title clickable and add segment definition to tooltip. [by @diosmosis, @tsteur]
#15444 When closing a popover, leave opened any previously opened popover [by @sgiehl, @tsteur]
#15556 Empty auto complete results in segment editor when changing the segment [by @tsteur, @sgiehl]
#15571 Match white label preview background with customised colour
#15607 Update Intl translations to CLDR 36 [by @sgiehl]
#15828 add a more helpful info to the default matomo.php output [by @Findus23, @tsteur]
#16119 “Password changed” e-mail notification wording doesn’t make sense
#15857 Update codebase doc blocks with new name Matomo [by @sgiehl]
#16030 Update individual libraries through npm [by @diosmosis]
#16032 replace other libraries in libs/ and in plugin directories w/ npm packages
#16165 Matomo 4 first beta release
#11086 Make interaction_position and visit_total_interactions MEDIUMINT to prevent Numeric value out of range: 1264 Out of range value for column interaction_position / visit_total_interactions [by @mattab, @tsteur]
#12067 Replace Bower (and libs/) with npm [by @diosmosis]
#12072 Site Search tracking should not use Custom Variables [by @katebutler, @sgiehl]
#12114 JS Tracker: Prevent possible infinite loop when page is unloading [by @yossicohn, @tsteur]
#12124 Rename `log_link_visit_action.interaction_position` to eg `pageview_position` [by @sgiehl]
#12832 UI_CONTROL_MULTI_SELECT does not work as expected
#13604 Rename CustomPiwikJs plugin to CustomMatomoJs (or CustomTrackerJs) [by @sgiehl]
#14094 Change “days since last …” dimensions to save second duration instead of days and compute in PHP [by @diosmosis]
#14841 use a modern PHP library for sending emails and SMTP [by @diosmosis, @sgiehl]
#15117 Refactor cron archiving for simplicity [by @diosmosis]
#15709 year is incorrectly counted in GDPR Overview [by @tsteur]
#15125 Add support for up to 4 fields to multipairfield [by @MichaelHeerklotz, @sgiehl]
#15248 Make BulkTracking plugin always activated [by @katebutler, @tsteur]
#15370 Save concatenated less file on compiling error so we can better debug issues. [by @diosmosis, @tsteur]
#15472 Use safemode when running CLI commands [by @diosmosis, @tsteur]
#15503 Removes deprecated console param –piwik-domain [by @sgiehl, @tsteur]
#15508 Fix archiving with console on SELinux: use `ps x` instead of `ps ex` [by @leftmostlane, @tsteur]
#15836 Refactors the way segments are configured in dimensions [by @sgiehl]
#15847 Document how to use Dependency Injection
#15866 Removes deprecated event Live.getAllVisitorDetails [by @sgiehl, @diosmosis]
#15957 Allow using matomo prefixed parameters for campaigns such as matomo_campaig/mtm_campaign [by @sgiehl, @diosmosis]
#15998 Date factory test when date object is passed [by @tsteur]
#16001 Remove code tagged with `@deprecated` [by @tsteur, @sgiehl]
#16261 Document new archiving process [by @diosmosis]
#16337 Let plugin developers modify the password confirmation view: new Template.confirmPasswordContent event [by @dominik-th, @tsteur]
#10733 Transition plugin can’t handle named characters in URL [by @sgiehl]
#11068 Make sure users with an older PHP can’t upgrade to Matomo 4 [by @tsteur]
#12035 Ecommerce Product average price may be incorrect, review implementation without using Custom Variables [by @katebutler, @sgiehl]
#12227 Content tracking doesn’t track interaction correctly when using multiple trackers but track as outlink
#13417 multi_server_environment INI setting should disable update via GUI module but it doesn’t [by @tsteur]
#13785 Segments using “Event category is not X” or “Page URL does not contain” etc. will list visits with these actions in the Visits log [by @sgiehl]
#14308 Visitor Profile with more than 100 visits shows negative visits
#14362 csv export for VisitsSummary.getVisits with idSite=all and non-superuser not working [by @sgiehl]
#14485 A fatal error occurred – The string to escape is not a valid UTF-8 string [by @sgiehl]
#14934 JS Tracker: trackEvent bug, event value is truncated [by @tsteur]
#14978 JS tracker: visitor cookie is set before configuration [by @tsteur]
#15193 Compare to: previous year (day) goes back two years [by @sgiehl]
#15194 Compare to: previous year always returning a range [by @sgiehl]
#15264 Check site permission should check if site actually exists [by @tsteur]
#15307 Visits log fails without any error [by @tsteur]
#15385 String not loaded in javascript while Feedback plugin is disabled
#15458 Update davaxi/sparkline composer dependency [by @sgiehl]
#15506 Ensure to only show enabled reports in “Goals By” view [by @sgiehl, @tsteur]
#15518 fix: change description for segments visitEndServer* [by @toredash, @tsteur]
#15529 Content interaction tracking fails if banner is enclosed by A element with external link
#15534 Missing crossorigin attribute in manifest link [by @tsteur]
#15647 Reporting API – API.get calls may return zeroed data instead of empty [by @sgiehl]
#15775 Fix error in InvalidateReportData command on PHP 7.4 [by @sgiehl]
#15781 “Last Successful Archiving Completion” is missing command “console”
#15805 Fix comparing segments doesn’t work with condition startsWith [by @john357smith, @sgiehl]
#16072 The display problem of piwik-siteselector in asia language environment [by @sgiehl]
#16172 Fix behaviour for segments using “not equals” or “not contains” on an action dimension [by @sgiehl, @tsteur]
#16249 SQL error: Data too long for column ‘user_id’
#16270 Bug: Copying a dashboard to another user – special characters are being urlencoded [by @sgiehl]
#16281 Make sure confirmPassword uses the currently active login plugin, not always “Login”. [by @diosmosis, @tsteur]
#16294 Warning in sparklines: Argument 1 passed to Piwik\\Plugins\\CoreVisualizations\\Visualizations\\Sparkline::ensureValuesEvenIfEmpty() must be of the type array, boolean given [by @sgiehl]
#16341 Use relative URLs for svgBasePath so proxy url doesn’t need to be configured to make real time map work [by @tsteur, @sgiehl]
#16358 Marketplace search broken in Reports
#16466 Do not cache core updater oneClickUpdate page in browser [by @tsteur]
#16475 Replaced ‘Piwik’ with ‘Matomo’ in console output when creating extra Custom Dimensions [by @nina-py, @tsteur]
#8415 Update our Develop guides for Matomo 4.0.0 [by @tsteur]
#12073 Document how plugins can extend Visitor Log and Visitor Profile [by @sgiehl]
#15574 Make all GDPR pages translatable [by @sgiehl]
#15973 add missing link to consent help page [by @Findus23, @tsteur]
#13471 Tracking API: fail with an error when wrong authentication provided when sending custom ip address (instead of using the sender’s ip address) [by @tsteur, @sgiehl]
#9253 UI tests on Travis do not execute UI tests of submodules [by @diosmosis, @sgiehl]
#13301 IgnoreCookie: added support for cookie_domain and ignore cookie signature [by @MichaelHeerklotz, @tsteur]
#13547 Remove user alias from database [by @tsteur]
#13957 Remove GeoIP Legacy Implementation and switch users to Db-ip [by @sgiehl]
#14342 Restrict open-ended require to the major Matomo version it defined [by @sgiehl]
#14553 mark BulkTracking plugin as required, not deactivable [by @katebutler]
#15115 LoadDataInfile Diagnostics Check is done even in config this setting is disabled [by @sgiehl]
#15139 Adds additional system check for CREATE TEMPORARY TABLES permission [by @sgiehl]
#15253 Use rebranded composer components [by @sgiehl, @tsteur]
#15275 Force using DB sessions once Matomo is installed [by @tsteur]
#15286 Refactor search category/count to not use custom variables [by @katebutler, @sgiehl, @diosmosis]
#15413 JS Tracker: remove JSON2 [by @Findus23, @tsteur]
#15465 Use latest davaxi/sparkline release [by @sgiehl]
#15473 Exclude docker files in .gitignore and exclude error_log from the integrity check [by @limitstudios, @tsteur]
#15531 Add support for up to 4 fields to multipairfield [by @sgiehl, @tsteur]
#15541 Adds translation updates action [by @sgiehl, @tsteur]
#15542 Adds action for building tracker js files [by @sgiehl]
#15544 Ensure the number of fraction digits is correct [by @sgiehl]
#15555 Trigger SafeMode if a plugin update is broken [by @sgiehl, @diosmosis]
#15573 Twig 3 upgrade [by @Findus23, @sgiehl]
#15581 Update to PHPUnit 8.5 [by @sgiehl]
#15586 Removes deprecated class Piwik\Translate [by @sgiehl]
#15611 New INI setting to set the absolute path to a PHP binary file in case Matomo cannot detect your PHP binary [by @tsteur, @diosmosis]
#15612 Update documentation how heart beat timer works
#15615 Make sure “Event Category” is translated in Visits log API outputs [by @mattab, @sgiehl]
#15617 Make it possible to run tests against PHP 7.4 [by @sgiehl]
#15632 Remove jquery placeholder [by @pebosi, @sgiehl]
#15636 Replace jscrollpane with native [by @pebosi, @tsteur]
#15649 By default a segment should be visible to all users [by @tsteur, @diosmosis]
#15662 Fix void return used and “improve” isLeap in Date [by @tolbon, @sgiehl]
#15720 Run tests on bionic distribution & run AllTests with PHP 7.4 [by @sgiehl]
#15795 Make sure upgrading from a 3.X or pre- version to 4.X via oneclickupdate works [by @diosmosis]
#15813 Fix fatal error when trying to install Matomo when PHP version is too low [by @tsteur, @sgiehl]
#15814 Make sure to set cookie name before loading any cookie [by @tsteur, @sgiehl]
#15815 Add test to ensure there are no plugin updates for core plugins [by @tsteur]
#15818 Prevent possible notice and hiding actual error in debug trace [by @tsteur, @sgiehl]
#15919 Bind param values manually since PDOStatement::execute() will assume … [by @diosmosis]
#15891 Replace Zend Mail with PHPMailer [by @sgiehl]
#15907 Removes Zend_Validate [by @sgiehl]
#15956 Remove gears detection [by @sgiehl]
#15962 Removes AWS test runner [by @sgiehl]
#15989 Removes director detection [by @sgiehl]
#16052 Rename Piwik -> Matomo in JS tracker where possible [by @tsteur]
#16053 Rename Piwik -> Matomo in cookies [by @tsteur, @diosmosis]
#16054 Rename PHP Events that contain Piwik to Matomo [by @tsteur, @diosmosis]
#16079 run npm update and include node_modules [by @diosmosis]
#16086 Include CustomDimensions plugin in core [by @sgiehl, @tsteur]
#16090 Removes CustomVariables plugin from core [by @sgiehl]
#16091 Delete segments when a site is deleted [by @tsteur, @diosmosis]
#16105 Rename referrer spam list [by @tsteur, @diosmosis]
#16162 GeoLite2-ASN Geolocation not working [by @sgiehl]
#16163 Make geolocation provider work with isp database only [by @sgiehl, @tsteur]
#16181 don’t use create_function() anywhere [by @Findus23, @diosmosis]
#16205 Rename composer package to matomo/matomo [by @sgiehl]
#16212 Fix language selector in mobile menu is not visible [by @tsteur, @diosmosis]
#16216 Delete remembered archived only for one specific site when a site is deleted [by @tsteur, @diosmosis]
#16232 Fix escaping in site selection for anonymous user configuration [by @sgiehl, @diosmosis]
#16235 Avoid API error if invalid idSubtable is given [by @sgiehl, @tsteur]
#16242 Use category display name for segment metadata [by @sgiehl, @tsteur]
#16282 JS Tracker: Fix default value of heart beat timer [by @sgiehl, @tsteur]
#16291 Link to PHP SDK in Reporting Clients developer doc
#16301 url decode value in requestcommand [by @diosmosis]
#16313 don’t log silenced errors in php8 [by @Findus23, @tsteur]
#16333 show correct transitions info in “Did you know?” section [by @Findus23, @tsteur]
#16344 Disable some core updater actions if auto update is not enabled [by @tsteur]
#16387 Add more debug information for some specific archiving errors [by @tsteur]
#16392 Update/Add documentation about App specific tokens
#16401 Documentation generator: remove duplicate assignment [by @l2dy, @tsteur]
#16411 Better describe the brute force IP list behaviour [by @tsteur, @diosmosis]
#16420 add documentation to the GetLanguage and GetLanguageCode reports [by @Findus23, @tsteur]
#16463 Help user configure correct GeoIP DB url by checking for protocol [by @tsteur]
#16467 We are hiring a senior PHP and JavaScript software developer (HIRING.md) [by @mattab, @tsteur]
#16468 Prevent upgrade error should a plugin get disabled during the Matomo 4 upgrade [by @tsteur]
#16478 Remove unused URL parameter from newsletter sign up [by @tsteur]
#16572 Broken link to performance report online guide [by @sgiehl]
#16682 Update campaign builder with new parameters group and placement [by @sgiehl]
#16692 use “Matomo” in user agent used for outgoing HTTP requests [by @Findus23, @tsteur]
#16349 Setting parameters rows_to_display is not allowed
#16462 Segments: Segments created in real time using API
#16464 Percent symbol fails JavaScript matomo code [by @tsteur]
#16501 Getting an error when loading “Email eports” page when a segment no longer exists [by @tsteur]
#16505 Content reports: don’t show option to view table with all columns [by @tsteur]
#16522 Piecharts aren’t shown at full width [by @sgiehl]
#16560 Global list of Excluded IPs shows only one IP [by @sgiehl]
#16569 Matomo may track a page view even though it was a different request when a plugin was disabled [by @tsteur]
#16587 IP exclusion segment produces error when used in eCommerce report [by @sgiehl]
#16611 Hide the relative % value in the “Browser Plugins” report [by @sgiehl]
#16726 Goal conversions wrongly formatted when using German language
#15920 Announce LTS for Matomo 3
#16488 Document the new Page Performance reports in a FAQ [by @sgiehl, @mattab]
#16645 Add PR template [by @tsteur]
#12519 Rename our composer packages [by @sgiehl]
#14444 simplified cookies [by @Findus23, @tsteur]
#15274 Don’t set session.gc_probality=1, instead read value from config
#15970 JS Offline tracking [by @tsteur, @diosmosis]
#16379 Better documentation of Proxy setup
#16413 Rename login_whitelist_ip config to login_allowlist_ip [by @tsteur]
#16442 Add dimension “Action URL” [by @tsteur]
#16480 The value for session.gc_probability now comes from the config files [by @nina-py, @tsteur]
#16507 Always set consent removed cookie even when cookies are disabled [by @tsteur]
#16520 Throw exception if dividend or divisor is not a number for easier troubleshooting [by @tsteur]
#16535 Fix selectable metrics in pie/bar charts for Events and Contents reports [by @sgiehl]
#16547 By default use https during installation in website setup [by @tsteur, @diosmosis]
#16564 Generate segment string even if label value is 0 [by @tsteur]
#16565 Custom reports: show server hours in site’s timezone [by @tsteur]
#16582 Fixes downloading files in chunks when not using curl [by @stevenseeley, @sgiehl]
#16600 MobileMessaging twig fix for ‘Variable “ajax” does not exist.’ [by @Findus23, @tsteur]
#16601 Allow overwriting rows_to_display property to ensure storing viewDatable settings works [by @sgiehl, @tsteur]
#16614 Update tag manager submodule [by @tsteur, @sgiehl]
#16615 Automatically add phpunit group name to a plugin php test [by @tsteur, @sgiehl]
#16618 Mention DB Lite DB will be automatically updated (filename etc)
#16639 [automatic translation update] Updated 30 strings in 3 languages (da el sq) [by @github-actions[bot], @sgiehl]
#16640 require PIWIK_PRINT_ERROR_BACKTRACE for exception backtraces in logs [by @diosmosis]
#16641 read from the task timetable option more often when executing tasks… [by @diosmosis, @tsteur]
#16659 Replace whitelist/blacklist terms in the UI
#16660 Add timezone version to php informational system check output [by @tsteur]
#16677 Download GeoIP files always to tmp directory [by @sgiehl]
#16680 Fix spelling of “Pie chart” [by @danielmcclure, @sgiehl]
#16683 Keep track of last activate/deactivate date for plugins [by @diosmosis, @tsteur]
#16687 Added whitespace to the bottom of email template [by @nina-py, @tsteur]
#16690 Show invalidation information in system check [by @tsteur]
#16691 update cacert.pem [by @Findus23, @tsteur]
#16695 Add link to PR template to a security checklist [by @tsteur]
#16696 Add hash equals method [by @tsteur]
#16713 DB-IP URL is automatically updated in the options [by @nina-py, @tsteur]
#16718 Make it clear that tracking ISP data requires Provider plugin [by @sgiehl, @tsteur]
#16723 Updates iso region mapping [by @sgiehl, @tsteur]
#16727 Add convenience method for rescheduling archiving for a single plugin. [by @diosmosis]

matomo-org/matomo-log-analytics

#267 Python 3 support [by @sgiehl, @diosmosis]
#219 import_logs.py fails with “got more than 100 headers” [by @sgiehl]
#280 Support both AWS Application and Elastic Load Balancer log formats [by @tabascoterrier, @diosmosis]
#284 When printing response in an error message, make sure we’re using a string. [by @diosmosis, @tsteur]
#287 Import *.gz files: UnboundLocalError: local variable ‘file’ referenced before assignment [by @sgiehl]
#288 Fix importing compressed log files [by @sgiehl, @diosmosis]
#292 explicitly sort glob results for an implicit progress bar [by @Prinzhorn, @sgiehl]
#254 Compatibility with app specific tokens [by @tsteur, @sgiehl]
#260 Use new performance metric for server generation time [by @sgiehl]
#262 Remove Gears detection [by @sgiehl]
#265 Removes director detection [by @sgiehl]
#266 add Zabbix and GoogleStackdriverMonitoring agents [by @Neo2SHYAlien, @sgiehl]
#274 always disable queued tracking when sending requests from log import [by @sgiehl, @tsteur]

matomo-org/matomo-php-tracker

#81 Release new Matomo PHP Tracker 3.0.0 for compatibility with Matomo 4.0.0 [by @diosmosis]
#26 Add methods for custom dimensions [by @sgiehl]
#43 POST when using PiwikTracker instead of GET to prevent token_auth showing in access_log
#64 Adds method to set page performance metrics [by @sgiehl]
#65 cURL error should throw an exception to ease debug [by @sgiehl, @tsteur]
#66 Remove Gears detection [by @sgiehl]
#67 Removes director detection [by @sgiehl]
#68 Track ecommerce views not as custom variables [by @sgiehl]
#72 Allow switching between request methods and post token by default [by @tsteur]
#79 handle new cookie values now that tracking cookies changed in Matomo 4 [by @diosmosis]

matomo-org/tag-manager

#210 When publishing a new version, and the version name is auto generated, make sure the update button is active [by @tsteur, @diosmosis]
#257 TagManager _mtm dataLayer is an object not an array -> use Array for dataLayer
#185 Tag Manager Preview UI tries to encode circular structure as JSON
#214 Report Forms variable typo [by @tsteur]
#218 Umlauts in Event (category|action|name), probably other fields, too, destroy variable strings in the same field [by @tsteur]
#221 Unable to attach event listener to element if theres already an event listener that stops bubbling
#230 Tag names are not encoded
#248 Matomo Configuration: Using variable in Matomo URL results in validation error
#277 JS error in Tag Manager preview mode [by @tsteur]
#224 Removes deprecated class Piwik\Translate [by @sgiehl]
#235 Fix possible error on PHP 7.4 [by @sgiehl, @tsteur]
#238 etracker Configuration update – cookieless tracking by default [by @ben-dw, @tsteur]
#240 etracker wrapper function added for single page applications compatibility [by @ben-dw, @tsteur]
#243 implements event to define plugins database tables [by @sgiehl]
#244 better CSS Selector help [by @Findus23, @tsteur]
#251 Ensure a date and period is set even if $_POST might be empty [by @tsteur, @diosmosis]
#255 Fail if writing to file fails [by @tsteur]
#261 Set idSite on tracker already when creating the tracker [by @tsteur, @diosmosis]
#264 Document scroll reach only triggered once [by @tsteur]
#274 Fix issue in EtrackerTag.web.js [by @ben-dw, @tsteur]
#282 When using _paq.push([‘trackPageView’]); in a Custom HTML tag (with bundled and default tracker in configuration), no tracking request is fired
#226 idSite trough lookup table failing to load
#279 Fix etracker Tag (Version 4) [by @ben-dw, @tsteur]
#283 Offer possibility to only initialise the tracker without tracking any data [by @tsteur]

matomo-org/matomo-icons

#23 Missing icon for wearable devices

matomo-org/device-detector

#6396 New major release 4.0.0 [by @sgiehl]
#6366 Brand Model Detection Suggestions 2020-09-10
#6367 Detect new brands: Ziox, iDroid, Aoson, Cloudfone, Oyyu, Primux, iMars, Logic, Vsmart and Detect new apps: Viber, Siri, LinkedIn, Twitter, and Detect devices for existing brands: Vertu, Amigoo, Aligator, Google, Phicomm, Alcatel, Realme, TLS, Xiaomi, Umax, Sony, Lava, OnePlus, Yu, Amazon, Cherry Mobile, ZTE, Mobiistar, MyPhone, Medion, Lenovo, Qilive, Ulefone, Highscreen [by @sanchezzzhak, @sgiehl]
#6368 Console script find free IDs for new brands [by @sanchezzzhak, @sgiehl]
#6369 Detect new brands: Ovvi, iBrit, Alcor, Fero and Detect devices for existing brands: Oppo, AllCall, Luna, Itbis, Ziox, Bq, Ginzzu, iPro, Lenovo, Odys, Highscreen [by @sanchezzzhak, @sgiehl]
#6379 Brand Xoro model HMT390Q what type of device?
#6380 Detect new brands: meanIT, MAXVI, Kenxinda, X-BO, Xgody and Detect devices for existing brands: Alcatel, Mpman, Nokia, Lenovo, Motorola, Neffos, Nomi, Mito, Oppo, Samsung, AllDocube, Huawei, LG, Meizu, ZTE, Highscreen, Krüger&Matz, Positivo BGH, Leagoo, Logicom, Yes, TrekStor, Cloudfone, Mixzo, Karbonn, TCL, Advan, Aiwa, Acer, Wolder, Neomi, Xoro, Blu, Fujitsu, Hoffmann, Maxwest, Aligator [by @sanchezzzhak, @sgiehl]
#6382 Detect browser: Opera when it disguises itself as Firefox and fixes parser for Gecko version [by @sanchezzzhak, @sgiehl]
#6386 Detect devices for existing brands: Blu, Gigaset, Samsung, Soundmax [by @sanchezzzhak, @sgiehl]
#6387 Add missing Bot ‘PRTG Network Monitor’
#6388 Add ‘PRTG Network Monitor’ [by @fakhamatia, @sgiehl]
#6389 Strict regular expressions for [);/ ] [by @sanchezzzhak, @sgiehl]
#6391 Detect new brands: 8848, Transpeed and Detect devices for existing brands: ZTE, Realme, Oppo, Vivo, Meitu, Chuwi, Motorola, Asus, Sony, Huawei, Xiaomi [by @sanchezzzhak, @sgiehl]
#6394 Detect devices for existing brands: Logicom, Orange, Acer, Vivax, Lang Rover, Sony, Oukitel, Nextbit, Maze, Asus, Samsung, Huawei, Kyocera, Fujitsu, Lenovo, NEC, ZTE, HTC, Sharp, LG [by @sanchezzzhak, @sgiehl]
#6398 iPad iOS > 12 detected as MacOS
#6399 Deprecate usage of short names [by @sgiehl]
#6405 Detect new brands: Artel, A1, Swisstone and Detect devices for existing brands: RCA Tables, ZTE, Digma, Wiko, Vivo, Google, Tone, CUBOT, OPPO, Aligator, Blu, Logicom, Huawei [by @sanchezzzhak, @sgiehl]
#6410 Detect new brands: P-UP, iVooMi, Pixelphone and Detect devices for existing brands: Asus, Huawei, Xiaomi, Sony, Samsung, Casper, Blu, Alcatel, Fujitsu, Kyocera, Realme, Oppo, OnePlus, LG, Sharp, Fero, Runbo, Unihertz, Cherry Mobile, Krüger&Matz, CUBOT, Telefunken, Philips, Motorola [by @sanchezzzhak, @sgiehl]
#6411 Adds Postman requester as “library” [by @Pierre-Lannoy, @sanchezzzhak]
#6414 Detect new browser: Monument Browser, Japan Browser and Detect Improvement Yandex Browse and Detect new brands: Iris and Detect devices for existing brands: Logicom, Asus, Neffos, Motorola, Elephone, Pixus, Vivax, Vontar, Oukitel, Huawei, AIS, teXet, BQ, DEXP, Highscreen, Inoi, Jinga, DNS, Hyundai, MicroMax, Irbis, LG, Advan, Aligator, Condor, Woxter [by @sanchezzzhak, @sgiehl]
#6418 Parsing mismatches between versions
#6419 Improves detection of Advan devices and Android [by @sanchezzzhak, @sgiehl]
#6420 Fix detection of Mint (OS) [by @sgiehl, @sanchezzzhak]
#6421 Adds detection for Sprinklr crawler [by @sgiehl, @sanchezzzhak]
#6424 Improve/simplify detection of Jezz devices [by @sgiehl, @sanchezzzhak]
#6425 Rename GALAXY model to Galaxy for the Samsung brand [by @sanchezzzhak, @sgiehl]
#6427 Linux distribution `ROSA`
#6428 Detect os: Rosa, MRE and Detect browser MAUI WAP Browser and Detect new brands: Xtouch, Fonos, Conquest and Detect devices for existing brands: Bush, Cat, DEXP, Lava, Explay, Artel, Pixus, Acer, Ark, MAXVI, Videocon, MicroMax, Huawei, Asus, Realme, Aligator, Unihertz, NOA, Maxtron, Alcatel, Irbis, Lenovo, Oukitel, Invin, Black Fox, Xiaomi, Ulefone, BQ, Wiko, Vestel, Odys, Kivi, Multilaser, Blackview, Haier, Nomu, Vertex, Coolpad [by @sanchezzzhak, @sgiehl]
#6432 fix invalid yaml [by @Findus23, @sgiehl]
#6434 Introduce Yaml Lint check to prevent errors in yml files [by @sgiehl]
#6435 Improves detection for Allview devices [by @liviuconcioiu, @sanchezzzhak]
#6436 Improves detection for OPPO devices [by @liviuconcioiu, @sanchezzzhak]
#6437 Adds detection for Okapia devices [by @liviuconcioiu, @sanchezzzhak]
#6438 Improves detection for Yaani Browser [by @liviuconcioiu, @sanchezzzhak]
#6364 Detect bots: Vercelbot, Grammarly, Robozilla, Domains Project, Petal Bot, Serendeputy Bot, ADmantX Service Fetcher, Semantic Scholar Bot, Velen Public Web Crawler [by @sanchezzzhak, @sgiehl]
#6365 Detect new brands: TurboKids, SQOOL, Jinga, Nomu. Twoe, iTruck, Torex, Doffler and Detect devices for existing brands: Alcatel, Oysters, Kyocera, Telego, ArmPhone, Karbonn, Majestic, E2, Digma, Megafon, Highscreen, Kivi,Turbo-X, 4Good, Jiay, NUU Mobile, Oukitel, Navon, Essentielb, Huawei, Turbo, Vestel, Ergo, MLS, HTC [by @sanchezzzhak, @sgiehl]
#6370 feat(device) detect Samsung GALAXY Note 20 5G [by @pongee, @sgiehl]
#6371 Added a few Android devices [by @GregOriol, @sanchezzzhak]
#6372 Roblox Android App with unusual User Agent Format
#6373 Added Roblox and GOG Galaxy App detection [by @nickperkins, @sgiehl]

matomo-org/component-network

#15 Makes it possible to fully anonymize a IPv6 address [by @sgiehl]

matomo-org/referrer-spam-list

#1224 Proposal to rename this referrer-spam-list
#1238 Add prizesk.com [by @JayVii, @spmedia]
#1241 Add eecz.org [by @ericguirbal, @spmedia]
#1242 Add darcysassoon.top [by @ericguirbal, @spmedia]
#1243 Add aimiot.net [by @ericguirbal, @spmedia]
#1244 Add meroyharte.top [by @ericguirbal, @spmedia]
#1245 Added own-ahrefs.com (same spammer as semalt.com) [by @Steltek, @spmedia]

We are together creating the best open analytics platform in the world. You can help make Matomo even more awesome by getting involved in Matomo!