Pull Request Explorer

Summary

Fix Dark Mode label contrast in scheduled reports

Improves readability of scheduled report edit form in dark mode, ensuring users can see labels.

Health Assessment

• • Single small change with quick review, minimal friction, but longer cycle time due to scheduling.

Summary

Bound ecommerce money values and improve aggregation resilience

Prevents large numeric values from breaking archiving, ensuring reliable ecommerce data processing and avoiding downtime. This safeguards analytics accuracy and system stability for merchants.

Health Assessment

• • The PR addressed a critical numeric overflow issue, required multiple commits to refine bounds and tests, but was reviewed quickly and merged after a single approval, indicating efficient collaboration.

Summary

Validate empty pattern for non-manual goals

Adds server and client validation for empty goal patterns, preventing generic errors. Improves user experience by providing clear inline error messages.

Health Assessment

• • Quick turnaround with single commit and minimal review, indicating straightforward bugfix.

Summary

Validate empty pattern for non-manual goals

Adds server-side and client-side validation to prevent empty patterns for non-manual goals, providing a clear error message instead of a generic error.

Health Assessment

• • The PR has a clear and focused change, with both server-side and client-side validation added.
• • The author has provided thorough testing, including integration and UI tests, and has validated the changes locally.

Summary

Fix aggregation of archives spanning multiple sites

Resolves broken results in multi-site archives and fixes silent data loss and cross-site subtable collisions.

Health Assessment

• • The PR fixes critical issues with multi-site archives, including crashes and data loss. The changes are well-tested and reviewed.

Summary

Serve flat Actions reports from pre-flattened archive

Improves performance by serving top-level flat Actions reports directly from the pre-flattened archive record

Health Assessment

• • The PR has a clear and well-structured description, making it easy to understand the changes
• • The addition of tests for serving flat Actions reports from the flat record ensures the functionality is properly validated

Summary

Isolate password verification from shared authentication object

Hardens authentication by isolating password checks, preventing nested token creation, and ensuring failed attempts are correctly attributed, reducing security risks and improving user control.

Health Assessment

• • The PR was reviewed immediately and merged within 55 hours, indicating efficient collaboration and low friction.

Summary

Fix Dark Mode label contrast in scheduled reports

Improves readability of scheduled report labels in dark mode, enhancing user experience for report configuration.

Health Assessment

• • Quick fix with minimal changes, resolved within a day, indicating efficient review and low risk.

Summary

Bound ecommerce money values and improve aggregation resilience

This change enforces upper bounds on ecommerce monetary values, preventing extreme inputs from breaking data aggregation and ensuring reliable revenue reporting. It also safeguards existing data by handling out-of-range values gracefully during archiving.

Health Assessment

• • The PR was reviewed and merged within a day, indicating efficient review and low friction. The change addresses a critical data integrity issue by bounding monetary values, preventing archiving failures.

Summary

Add no data banner to AI report page

Adds a no data banner to the realtime AI report page when there is no data present, improving user experience.

Health Assessment

• • The PR was reviewed and approved within a reasonable timeframe, indicating a smooth development process.

Summary

Add test coverage for campaign and AI assistant filtering

Ensures accurate attribution of ecommerce orders from AI assistant visits, improving reporting reliability for marketing and revenue analysis.

Health Assessment

• • The PR added a single test file with moderate changes, received a single review after ~24 hours, and merged within 2 days, indicating a smooth, low‑risk process.

Summary

Add test coverage for campaign & AI assistant filtering

Adds system test for ecommerce orders from AI-assistant visits, ensuring correct attribution to Campaign or AI Assistant channels.

Health Assessment

• • The PR was reviewed and merged quickly, with a cycle time of 1.8 hours, indicating a smooth review process.

Summary

Clean PHPStan level 0 and 2 violations

Removes low‑level PHPStan violations to keep the codebase clean and maintainable, ensuring future upgrades run smoothly.

Health Assessment

• • Fast turnaround with minimal rework; a single commit addressed all static‑analysis issues, indicating low friction and a straightforward technical debt fix.

Summary

Bump dompurify to 3.4.12

Updates the dompurify library to the latest patch, addressing security and bug fixes for safer DOM sanitization.

Health Assessment

• • Dependabot auto-generated PR with minimal code changes, merged after a single review cycle.

Summary

Improve Login controller request handling

Enhances security and reliability of login redirects and invitation acceptance, reducing potential attack vectors and ensuring correct form processing.

Health Assessment

• • Fast cycle time and single review round suggest low complexity and minimal risk.

Summary

Reject conflicting authentication parameters in bulk API requests

Prevents nested bulk API requests from changing the authentication context, improving security and consistency.

Health Assessment

• • The PR was merged quickly, indicating a straightforward review process. The changes are focused on improving security and consistency, with a clear and well-structured description.

Summary

Reject conflicting authentication parameters in nested bulk API requests

Hardens API.getBulkRequest by validating nested request auth parameters against the outer request's context, preventing silent changes to the authentication context.

Health Assessment

• • The PR was reviewed and merged quickly, with a cycle time of 92.6 hours and a time to first review of 1.1 hours, indicating a smooth review process.

Summary

Improve Login controller request handling

Enhances security by standardizing redirect URLs and ensuring invitation forms are only processed on POST, reducing potential misuse.

Health Assessment

• • The PR was reviewed after 21 hours and required only one quick commit, but the overall cycle time of 111 hours indicates a slow initial review process.

Summary

Prepare for Matomo 6 development

Prepares the repository for Matomo 6 development by updating version, plugin submodules, and removing deprecated APIs.

Health Assessment

• • The PR has a large scope with many files changed, but the review process was relatively smooth with a low friction level.

Summary

Update Spanish translations via Weblate

Adds updated Spanish translations for the PrivacyManager plugin, improving localization coverage.

Health Assessment

• • Quick review and merge with minimal changes, indicating a straightforward translation update.

Summary

Explicit null returns for nullable methods

Improves code quality and static analysis compliance without changing runtime behavior, ensuring clearer contracts for developers.

Health Assessment

• • Minimal code changes were reviewed quickly, resulting in a smooth merge and removal of obsolete PHPStan baseline entries.

Summary

Ignore Twig CVE-2026-49981 in composer audit

Matomo is not vulnerable to Twig CVE-2026-49981 due to not using Twig's sandbox, so this PR ignores the advisory in composer audit.

Health Assessment

• • This PR was quickly reviewed and merged, indicating a straightforward and low-risk change.

Summary

Revert submodule markers to 5.x-dev

Ensures plugin submodule markers remain compatible with the 5.x-dev branch, maintaining stable integration for downstream users.

Health Assessment

• • The PR was reviewed and merged within 22 hours with only two line changes, indicating a straightforward maintenance update with minimal risk.

Summary

Require password confirmation when granting the admin role

Adds a mandatory password confirmation step when assigning the admin role, tightening security for high‑privilege changes.

Health Assessment

• • The PR added a large number of lines across backend and frontend, but the review cycle was quick and required only a single approval, indicating a smooth process.

Summary

Bump version after RC release

This PR updates the software version to the next release, ensuring accurate versioning for downstream deployments.

Health Assessment

• • Fast review and merge with minimal changes; no AI involvement; low risk.

Summary

Fix flaky Dashboard UI test due to ellipsis

This change stabilizes the Dashboard UI test by adding a tolerance for ellipsis truncation. It reduces false failures, improving test reliability and developer confidence.

Health Assessment

• • Quick resolution with minimal rework, indicating a straightforward fix.

Summary

Clear dimension column cache on table recreation

Ensures reliable test runs and stable tracking by resetting dimension cache when tables are recreated, preventing intermittent failures.

Health Assessment

• • Quick fix with minimal changes, resolved in a single commit, no major risk.

Summary

Docblock quality cleanup: widen property types

Aligns documentation with actual code behavior, eliminating false positives in static analysis. Improves maintainability and developer confidence.

Health Assessment

• • Quick turnaround with minimal changes; no major blockers; PR merged within 6.6 hours.

Summary

Narrow actions_pages_tooltip_help UI test to the help box only

This PR narrows a UI test to capture only the report headline and help box, eliminating redundant screenshots and improving test efficiency.

Health Assessment

• • The PR was reviewed quickly with minimal changes, indicating a straightforward test update.

Summary

Fix flaky test by avoiding subpixel rendering

This PR stabilizes UI tests by making data table column widths deterministic, eliminating flaky screenshots caused by subpixel rendering. It reduces test failures and maintenance effort, ensuring reliable analytics dashboards for users.

Health Assessment

• • The PR took about 40 hours from opening to merge, with a single review after a long review period. The moderate number of changes and a single review round suggest a straightforward bugfix with some UI test maintenance.

Summary

Correct stale docblock types

Corrects @return/@param/@var docblocks to match code behavior, improving documentation quality.

Health Assessment

• • The PR was reviewed and validated with multiple tools, ensuring code quality and reducing potential risks.

Summary

Update translations via Hosted Weblate

This PR updates all language files to reflect the latest translations, ensuring users see accurate localized content.

Health Assessment

• • Quick turnaround with minimal changes; single commit and review indicates smooth process.

Summary

Fix structurally broken PHPDoc annotations

Improves code quality by cleaning malformed PHPDoc annotations, ensuring static analysis tools run smoothly and reducing future maintenance overhead.

Health Assessment

• • Fast review and merge cycle (1.6h), minimal rework, and clean static analysis results indicate a low-risk, high-quality refactor.

Summary

Docblock quality fixes (chunk 22)

Improves code quality and maintainability by correcting docblocks, enabling static analysis tools to run cleanly and reducing future technical debt. This ensures developers have accurate documentation and reduces errors in future development.

Health Assessment

• • Rapid iteration with no review needed; quick merge within 3 hours; minimal risk due to documentation-only changes.

Summary

Escape query-string characters in AJAX URLs

Ensures URLs are correctly parsed, preventing malformed requests that could break analytics tracking and improve reliability.

Health Assessment

• • Fast turnaround with minimal rework; comprehensive tests added to guard against future regressions.

Summary

Move AIAgents UI screenshots to LFS

Aligns screenshot storage with core, ensuring LFS usage for AI Agents UI tests.

Health Assessment

• • Quick change with minimal review, indicating low complexity and risk.

Summary

Bump submodule versions across plugins

Updates four plugin submodules to newer commits, ensuring compatibility and bug fixes.

Health Assessment

• • Quick merge with minimal changes, typical dependency bump.