Skip to content
TrustMyStack, home

analytics

v3.2.1
plausible/analytics

Open source, privacy-first web analytics. Lightweight, cookie-free Google Analytics alternative. Self-hosted or cloud.

Version of plausible/analytics you run

CompareView on GitHub
Maintenance
Active173 commits in 3 months · bus factor 3
License
AGPL-3.0Copyleft · OSI-approved · changed in 2020
Security
1 advisory1 critical · Scorecard 6.7/10
Supported versions
No scheduleendoflife.date does not track this project

29.9k stars · 1.9k forks · 55 open issues · last release 6 months ago · data checked 1 hour ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v1.5.1Jun 18, 2023

    Upgrading Plausible Analytics to v1.5

    In your docker-compose.yml update the image used for plausible to v1.5.1

    plausible:
- image: plausible/analytics:v1.4
+ image: plausible/analytics:v1.5.1

    Please make sure to not use v1.5.0 release which had startup problems: https://github.com/plausible/analytics/issues/2491

    Restart the container

    $ docker compose stop plausible
$ docker compose rm plausible
$ docker compose up -d

    This will boot up the new version of the app.

    • ⚠️ Note that this city level geolocation feature requires extra ~1GB of RAM to work. If you don't have enough RAM available, you might experience slow container startups and restarts.

    Upgrading ClickHouse to 22.6 (Optional, but recommended)

    In your docker-compose.yml update the image used for plausible_events_db to a newer ClickHouse version:

    plausible_events_db:
- image: yandex/clickhouse-server:21.3.2.5
+ image: clickhouse/clickhouse-server:22.6-alpine

    Restart the container

    $ docker compose stop plausible plausible_events_db
$ docker compose rm plausible_events_db
$ docker compose up -d

    This will boot up the new version of ClickHouse.

    Related PR: https://github.com/plausible/hosting/pull/45

    Upgrading PostgreSQL to 14 (Optional, but recommended)

Release history

All releases on GitHub
Atom feed/feed/plausible/analytics
BadgeLatest version of plausible/analytics[![version](/badge/plausible/analytics)](/p/plausible/analytics)

Security related update

This patch release fixes a security vulnerabilityCVE-2026-8467 / GHSA-55hg-8qxv-qj4p affecting the following versions of Plausible Community Edition (image: ghcr.io/plausible/community-edition):

Tags:

  • v3.2
  • v3.2.0
  • v3
  • v3.2.0-rc.0
  • v3.1
  • v3.1.0
  • v3.1.0-rc.1
  • v3.1.0-rc.0
  • v3.0.1
  • v3.0
  • v3.0.0
  • v3.0.0-rc.6
  • v3.0.0-rc.5
  • v3.0.0-rc.4
  • v3.0.0-rc.3
  • v3.0.0-rc.2
  • v3.0.0-rc.1
  • v3.0.0-rc.0

The affected versions expose a HTTP "/storybook" endpoint which, under certain conditions, allows remote code execution with privileges of system user running the application.

This release v3.2.1 of Plausible Community Edition completely removes that endpoint.

Who is affected?

All deployments of Plausible Community Edition running the following versions:

  • v3.2
  • v3.2.0
  • v3
  • v3.2.0-rc.0
  • v3.1
  • v3.1.0
  • v3.1.0-rc.1
  • v3.1.0-rc.0
  • v3.0.1
  • v3.0
  • v3.0.0
  • v3.0.0-rc.6
  • v3.0.0-rc.5
  • v3.0.0-rc.4
  • v3.0.0-rc.3
  • v3.0.0-rc.2
  • v3.0.0-rc.1
  • v3.0.0-rc.0

where HTTP "/storybook" endpoint is exposed to a public or other untrusted network.

Mitigation

All affected versions of Plausible Community Edition should be updated to v3.2.1 as soon as possible.

As an immediate mitigation, it is recommended to block access to HTTP "/storybook" endpoint in your reverse proxy configuration or via other applicable means.

Changes in this release

  • Remove HTTP "/storybook" endpoint along with the associated logic

No other changes are included in this release.

Full release notesCompare with previous