LoginSign Up
← Back to all sparks
O

Open Web Analytics

MARKETING
Velocity6.3

Self-hosted web analytics for tracking site visitors

openwebanalytics.com ↗

Open Web Analytics went from one release a year to six in a fortnight.

web-analyticsself-hostedphp-modernizationsecurity-hardeningproject-revival
◆Current state
OWA published more releases in the last two weeks than in the previous two years. The sequence runs security hardening (1.8.2, 1.8.3), then a modernization release that raises the floor to PHP 8.2 and rebuilds the JavaScript toolchain (1.9.0), an emergency patch for a 403 that blocked every fresh install (1.9.1), a structural release completing the PSR-4 migration and repairing the updater (1.10.0), and a cleanup pass that tightens REST responses (1.10.1).
◆Where it's heading
This is a self-hosted analytics project being brought back from stagnation in a compressed burst, and the order of the work says how bad the starting position was: patch the security holes, then make it run on a supported PHP, then fix the fact that installing and updating were themselves broken, then start on structure. Backwards-compatibility shims for modules, templates and themes indicate the maintainers are trying to modernize without stranding the existing installed base. The REST API is where that promise is thinnest — 1.10.1 narrows responses to documented properties, which is correct but will break clients that were reading internals.
◆Prediction
With the runtime, installer and updater repaired and PSR-4 finished, the next work is most likely to continue on the API and the reporting layer, where 1.10.0 already flagged a cluster of e-commerce bugs.

◆Recent moves

  1. 22h ago

    Release 1.10.1

    Nine changes, no features, but one that integrators must read: REST responses now return only an entity's properties, so any client that was depending on internal fields will break. Routes passed in owa_rest_params also resolve properly now instead of being dropped when the do parameter was absent.

    View source ↗
  2. 3d ago

    Release 1.10.0

    Sixteen pull requests repairing the update mechanism, a batch of e-commerce reporting bugs, and two admin endpoints, plus the completion of the PSR-4 migration behind compatibility shims. Structural work delivered without requiring anyone to change their code — the pattern this revival has followed throughout.

    View source ↗
  3. 6d ago

    Release 1.9.1

    An emergency patch: every fresh 1.9.0 install returned 403 at the install URL, reachable only by typing install.php directly, and the same 403 hit the app root afterwards. Shipped a day after the release it repairs.

    View source ↗
  4. 8d ago

    Release 1.9.0

    ⚡ SPARK

    The release that makes OWA installable on a currently supported stack, and the pivot point of this whole burst — everything before it was security triage, everything after is structural cleanup on top of it.

    View source ↗
  5. 12d ago

    Release 1.8.3

    A follow-up security release fixing REST authentication on the siteusers endpoint, published a day after the broader hardening pass. The two together suggest an audit that was still turning up findings as releases went out.

    View source ↗
  6. 13d ago

    Release 1.8.2

    A broad hardening release covering input handling, output escaping, capability checks and query construction across templates, controllers and config, plus a report navigation fix. This is where the current burst of activity starts.

    View source ↗