Skip to content

v4.9.0

Choose a tag to compare

View all tags
@oli217 oli217 released this 16 Sep 17:00
· 10 commits to main since this release
v4.9.0
a652883
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Privacy fixes

Server-side consent enforcement (full static mode)

Previously, when tracking.consent.enabled was true, consent was enforced only by the JS tracker. A direct call to GET /statamic-analytics/track bypassed the check entirely.

The beacon endpoint now verifies session('analytics_consent') server-side. A beacon is silently dropped (HTTP 204) if the visitor has not consented.

When consent.enabled is active, the beacon participates in the site's existing Laravel session — no additional cookie is set.

Granular geolocation opt-out now enforced server-side

The geolocation toggle in the consent banner was stored in the session but never read by the server. IP geolocation was performed regardless of the visitor's choice.

From v4.9, declining geolocation skips GeolocationService::lookup() entirely — country_code, country_name, city are stored as NULL. The flag is serialised in the job payload so it survives the async queue path.

Analytics metric corrections

Bounce rate

The previous bounce rate was incorrect (ratio of new page URLs per session, not single-page sessions).

Corrected formula: sessions with exactly 1 page view / total sessions

Your dashboard will show different values from v4.9 onward — the new figures are analytically meaningful; the previous ones were not.

Entry pages

Entry pages now uses MIN(id) per session to identify the single first page view. Concurrent beacons in the same second are resolved deterministically by insertion order.

Your entry pages data will show different (more accurate) values from v4.9 onward.

Other fixes

  • JS tracker date consistency — Inline tracker used toISOString() (UTC date) with getHours() (local time), causing incorrect new-day detection around midnight in non-UTC timezones. Both now use local time.
  • analytics:health cache check — Now performs a full read/write/delete cycle and fails if the read returns an unexpected value.

Upgrade

No migrations, no config changes required. See UPGRADE.md for details.

composer require oliweb/statamic-privacy-analytics:^4.9
Assets 2
Loading