matomo - Debian Package Tracker

general

source: matomo (main)
version: 5.8.0-1
maintainer: Debian-matomo-maintainers (archive) (DMD)
uploaders: William Desportes [DMD] [DM] – Utkarsh Gupta [DMD]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 5.3.1+dfsg-1
unstable: 5.8.0-1

versioned links

5.3.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.8.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

matomo (1 bugs: 0, 0, 1, 0)

action needed

1 binary package has unsatisfiable dependencies high

The dependencies of matomo=5.8.0-1 cannot be satisfied in unstable on amd64 because: unsatisfied dependency on libphp-phpmailer (< 7~~)

Created: 2026-09-10 Last update: 2026-10-28 12:02

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:01:05
Last run: 2026-10-22T01:08:38.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:03:17
Last run: 2026-01-31T12:40:55.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:02:17
Last run: 2026-07-18T07:08:15.000Z
Previous status: unknown

Created: 2026-01-31 Last update: 2026-10-28 11:01

A new upstream version is available: 5.14.2 high

A new upstream version 5.14.2 is available, you should consider packaging it.

Created: 2026-04-23 Last update: 2026-10-28 07:32

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-78850: An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

Created: 2026-10-16 Last update: 2026-10-27 07:33

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-78850: An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

Created: 2026-10-16 Last update: 2026-10-27 07:33

lintian reports 3 errors and 13 warnings high

Lintian reports 3 errors and 13 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-11-09 Last update: 2026-10-16 15:00

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-04-13 Last update: 2026-10-28 12:02

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 5.8.0-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit ab09507c49381bd15fa8580df44a7d6078c23b47
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Oct 20 14:36:28 2026 +0200

    d/copyright: fix licence mismatches and document third-party assets
    
    Corrections backed by the files or their upstream licences:
    
    * libs/MaxMindGeoIP is LGPL-2.1, not GPL-2.0;
    * kartograph.min.js is LGPL-2.1, not GPL-2.0 (which would have been
      GPL-3 incompatible);
    * core/View/MethodCallExpression.php is a modified Twig 1.x file and
      is BSD-3-clause, not Expat; split it from the ConsoleFormatter
      stanza;
    * make the shared BSD-3-clause text generic instead of naming
      Michael Stapelberg as the holder;
    * fix the GPL-2.0 text that claimed "version 2.1";
    * cover libs/jqplot/plugins/*.js and jqplot-custom.min.js, which the
      anchored libs/jqplot/jqplot.* glob missed although
      jqplot-custom.min.js is the file actually used;
    * credit normalize.css in bootstrap.css and add the jQuery UI
      autocomplete stylesheet.
    
    Document assets described in LEGALNOTICE that had no stanza: the
    Morpheus icon fonts, the Material-derived icons, the CC-BY-SA thumbs,
    idea.png, the tahoma.ttf holders and the third-party brand logos.
    
    Co-authored-by: DeepSeek <noreply@deepseek.com>

commit c74a04c79c835830487f9bb7c2d081a688565de4
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Oct 20 14:14:52 2026 +0200

    d/copyright: update for 5.14.1 and drop non-free assets
    
    Exclude the non-free ExampleUI planet icon set from the upstream
    tarball and cover the 5.14.1 bundles:
    
    * add the root piwik.js/matomo.js tracker copies and js/LICENSE.txt;
    * update the CoreVue polyfills stanza to DOMPurify 3.4.14 plus the
      bundled core-js, tslib and abortcontroller-polyfill, and include
      the .min.js file;
    * cover CorePluginsAdmin.umd.min.js and the mathjs 10.6.4
      dependencies;
    * document the Google Ads logo in the advertising promotion image;
    * refresh the debian/* copyright years.
    
    Tests and VCS metadata are removed from the imported tree by the
    gbp filter, so they are not listed in Files-Excluded.
    
    Co-authored-by: DeepSeek <noreply@deepseek.com>

commit 6038e024b2f2cef86d75ee801919b91a2081359c
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Oct 20 13:23:58 2026 +0200

    d/ch

commit 48594239172bc7f84003dc996edee449c5dc9202
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Oct 20 13:23:38 2026 +0200

    Remove downgrade to phpmailer patch
    
    Closes: #1149621

commit 6159213bce376247f24dbd1c352644f296acb329
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Jul 11 17:17:20 2026 +0200

    Use Architecture instead of the deprecated skip-not-installable
    
    The selenium test needs chromium-driver, which is built only on amd64,
    arm64, armhf, i386 and ppc64el; list exactly those (lintian's
    recommended replacement for skip-not-installable).
    
    The remaining architectures are excluded because chromium is not built
    there:
    
    - riscv64: a working build patch exists but is not accepted yet
      (#1051998); the nearest candidate to add later
    - s390x: fails to build ("Unknown CPU: s390x"), needs upstream work
      (#1053767)
    - armel: also requested in #1053767, but no longer a release architecture
    - mips64el: not supported by chromium
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Created: 2026-10-19 Last update: 2026-10-24 10:33

debian/patches: 5 patches to forward upstream low

Among the 28 debian patches available in version 5.8.0-1 of the package, we noticed the following issues:

5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2025-01-30 Last update: 2026-03-19 07:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

testing migrations

excuses:
- Migrates after: wine
- Migration status for matomo (- to 5.8.0-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ matomo/amd64 has unsatisfiable dependency
- ∙ ∙ matomo/arm64 has unsatisfiable dependency
- ∙ ∙ Updating matomo would introduce bugs in testing: #1149621
- ∙ ∙ Build-Depends(-Arch): matomo wine (not considered)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/m/matomo.html
- ∙ ∙ Autopkgtest skipped on amd64: not installable
- ∙ ∙ Autopkgtest skipped on arm64: not installable
- ∙ ∙ Autopkgtest skipped on armhf: not installable (which is allowed)
- ∙ ∙ Autopkgtest skipped on i386: not installable (which is allowed)
- ∙ ∙ Autopkgtest skipped on ppc64el: not installable (which is allowed)
- ∙ ∙ Autopkgtest skipped on riscv64: not installable (which is allowed)
- ∙ ∙ Autopkgtest skipped on s390x: not installable (which is allowed)
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 223 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-03-18] Accepted matomo 5.8.0-1 (source) into unstable (William Desportes) (signed by: Thorsten Alteholz)
[2026-03-10] matomo REMOVED from testing (Debian testing watch)
[2025-11-15] matomo 5.5.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-11-10] Accepted matomo 5.5.1+dfsg-3 (source) into unstable (William Desportes)
[2025-11-08] Accepted matomo 5.5.1+dfsg-2 (source) into unstable (William Desportes)
[2025-10-25] Accepted matomo 5.5.1+dfsg-1 (source) into unstable (William Desportes) (signed by: Alexandre Detiste)
[2025-04-25] matomo 5.3.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-04-14] Accepted matomo 5.3.1+dfsg-1 (source) into unstable (Utkarsh Gupta)
[2025-02-07] matomo 5.2.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted matomo 5.2.2+dfsg-1 (source) into unstable (Utkarsh Gupta)
[2025-01-29] Accepted matomo 5.2.1+dfsg-2 (source) into unstable (Utkarsh Gupta)
[2025-01-29] Accepted matomo 5.2.1+dfsg-1 (source all) into unstable (Debian FTP Masters) (signed by: Utkarsh Gupta)

bugs [bug history graph]

all: 3
RC: 1
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (3, 13)
buildd: logs, debcheck
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.8.0-1ubuntu2
1 bug
patches for 5.8.0-1ubuntu3