Software 44972 Published by

Matomo, the self-hosted analytics platform that keeps your data off third-party servers, released version 5.14.1 on October 4. It's a corrective patch that refreshes the plugin Marketplace to run in the background, patches a CSRF nonce race condition, and makes AWS Bedrock AI calls safer. Like 5.14.0, it ships without a major database upgrade, so existing installs can move over without a painful migration. The 5.x line is now quietly entering maintenance mode as the project advances toward its 6.0.0 beta.



Matomo Releases 5.14.1, a Patch That Cleans Up More Than It Adds

The free, self-hosted analytics platform that has spent nearly two decades building a case against Google Analytics by keeping your data off third-party servers released version 5.14.1 on October 4. It's a patch. That single word does most of the explaining here.

The 5.14.1 tag landed on the project's GitHub repository. Matomo calls it "a patch release with general fixes," which is a tidy way of saying it sweeps up the bugs people hit after the feature-heavy 5.14.0 baseline shipped on September 21.

There's nothing new to install. What you get instead is a cleaner, more reliable version of the same 5.14 suite. Keep in mind that this one ships without a major database upgrade, so moving from an earlier 5.14 build shouldn't drag you through a painful schema migration.

screenshot_from_2026_08_17_06_07_43.webp?ver=1786940806153

The Marketplace gets a refresh (and its own page)

The most visible changes land in the plugin Marketplace. First, it now polls for updates continuously in the background instead of refreshing once per hour. That was a genuine nuisance: after installing a plugin you'd sit and watch a stale list for up to an hour. 

Then there's the redesign. Each plugin now gets a dedicated details page rather than being jammed into a single crowded listing.

Not a seismic shift. But Marketplace staleness is the kind of thing that only registers once it's biting you.

The fixes you won't see are probably the more important ones. Matomo patched a race condition in nonce validation. Nonces are those number-used-once tokens that fend off cross-site request forgery, and there was a timing bug in how Matomo checked them. Small hole. Closed it.

On the AI front, the platform keeps rolling out generative features under its "Matomo AI" umbrella. This patch makes sure AWS Bedrock temperature parameters only get sent to models that actually support them. Feed that parameter to the wrong foundation model and you get an error. It's the sort of cleanup that only matters once the integration layer gets complicated, and this one is getting so.

The rest is trim work. Goal recommendation UI was cleaned up with the page now reloading automatically after you create a goal. The add-to-cart modal footer got a consistency pass. And trigger-based in-app promotions were added, giving operators finer control over guided tours.

Six contributors touched this build. chippison, snake14, mneudert, lachiebol, AltamashShaikh, and maxtaube all show up in the commit history. That's the open-source model working the way it's supposed to.

Why this matters for the privacy crowd

Here's the context that makes the 5.14 line worth watching at all. Its headline feature from September was aggregated real-time counters when the Visits Log is disabled. Privacy-minded organizations frequently turn off the Visits Log to avoid tracking individuals, but that move used to gut the Live dashboard, which normally shows individual visits. 5.14.0 solved it by showing real-time counts with zero individual-visit detail. That's squarely the "privacy by design" pitch that gets Matomo recommended by bodies like France's CNIL and the European Commission.

For the record, Matomo has been making that argument for a long time. It started as a student side project: Matthieu Aubry, then an engineering student in London, founded it in 2007 under the name Piwik. It got renamed in 2018 to dodge a trademark dispute. Nearly two decades later, BuiltWith places it on more than 1.4 million websites across 190+ countries, and it accounts for roughly 6 percent of top-10,000 global sites with a known analytics provider.

Upgrade caution still applies. Matomo advises a full backup before updating and points at its Updating Matomo guide for the walkthrough. If you'd rather not babysit your own servers, the same feature set runs through the hosted Matomo Cloud.

As for the 5.x branch, it's quietly winding down. Since the 5.14.1 tag landed, roughly 292 commits have moved toward the 6.0.0 beta that first surfaced in September 2026. The 5.x line is entering maintenance mode while 6.0 takes shape.

Head here to grab the update from the Matomo website, or pull the raw build off the GitHub releases page, which shipped ten downloadable assets. Back up first, then update.

Install Matomo on Debian 13: Complete Self-Hosted Analytics Guide

This tutorial walks through installing the latest Matomo version on Debian 13, bypassing the outdated repository release to access features like AI chatbot detection, Dark Mode, and improved segment management.

Install Matomo on Debian 13: Complete Self-Hosted Analytics Guide