CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

www/matomo 5.11.2

Open Source Web Analytics Software Program

Port info

Maintainer
marko.cupac@mimar.rs
Packages
latest: matomo-php82 5.11.2, matomo-php83 5.11.2, matomo-php84 5.11.2, matomo-php85 5.11.2
Upstream
Higher version available: 5.14.2
Last update
to 5.11.2 · 63b6120db0
Quarterly
2026Q4: matomo-php82 5.11.2, matomo-php83 5.11.2, matomo-php84 5.11.2, matomo-php85 5.11.2
Formerly
www/piwik until 2018-04-06
WWW
https://www.matomo.org/
Links
cgit · VuXML

Install

Package
# pkg install matomo-php82
# pkg install matomo-php83
# pkg install matomo-php84
# pkg install matomo-php85
installs matomo-php82 5.11.2, matomo-php83 5.11.2, matomo-php84 5.11.2, matomo-php85 5.11.2 from latest; from quarterly (2026Q4) matomo-php82 5.11.2, matomo-php83 5.11.2, matomo-php84 5.11.2, matomo-php85 5.11.2
Port
# cd /usr/ports/www/matomo && make install clean
# make -C /usr/ports/www/matomo config  # change options first
Size
16 MiB download · 70 MiB installed
Depends on
archivers/php82-zlib 8.2.35_2, converters/php82-iconv 8.2.35_2, converters/php82-mbstring 8.2.35_2, databases/pecl-memcache 8.2, databases/php82-mysqli 8.2.35_2, databases/php82-pdo 8.2.35_2, databases/php82-pdo_mysql 8.2.35_2, databases/php82-sqlite3 8.2.35_2, devel/php82-intl 8.2.35_2, devel/php82-readline 8.2.35_2, devel/php82-tokenizer 8.2.35_2, ftp/php82-curl 8.2.35_2, graphics/php82-gd 8.2.35_2, lang/php82 8.2.35_2, net/php82-soap 8.2.35_2, net/php82-sockets 8.2.35_2, security/pecl-mcrypt 1.0.7, security/php82-filter 8.2.35_2, sysutils/php82-fileinfo 8.2.35_2, sysutils/php82-posix 8.2.35_2, textproc/php82-ctype 8.2.35_2, textproc/php82-dom 8.2.35_2, textproc/php82-simplexml 8.2.35_2, textproc/php82-xml 8.2.35_2, www/php82-opcache 8.2.35_2, www/php82-session 8.2.35_2, www/php82-tidy 8.2.35_2
License
GPLv3
Options
1 of 2 on in the package: PHPPDOMYSQL
Show the 1 options that are off
PHPMYSQLI
pkg-message
Shown after installing
1) Create a user and an empty database for Matomo to store all
   its tables in (or choose an existing database).

2) Add the following to your Apache configuration, and
   restart the server:

   ### Add the AcceptPathInfo directive only for Apache 2.4.30 or later.
   Alias /matomo /usr/local/www/matomo
   AcceptPathInfo On
   <Directory /usr/local/www/matomo>
     DirectoryIndex index.php
     Options FollowSymLinks
     AllowOverride All
     <IfVersion < 2.4>
        Order allow,deny
        Allow from all
     </IfVersion>
     <IfVersion >= 2.4>
       Require all granted
     </IfVersion>
   </Directory>

3) Visit your Matomo site with a browser (i.e.,
   http://your.server.com/matomo/), and you should
   be taken to the setup script, which will lead
   you through setting up Matomo.

For more information, see the INSTALL DOCUMENTATION:

  https://matomo.org/docs/installation/
Shown after upgrading
Console upgrade recommended on medium and high traffic sites:

1) Disable Matomo Tracking
    In config/config.ini.php, add the following
    [Tracker]
    record_statistics = 0

2) Disable the Matomo User Interface and APIs
    In config/config.ini.php, add the following
    [General]
    maintenance_mode = 1

3) Run the update

    php /usr/local/www/matomo/console core:update

4) Remove the previously added config.ini parameters

5) Visit the Admin > Diagnostics > System check report and review the report and follow any recommended actions
Note
Size, dependencies, options and messages are those of matomo-php82.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 165.11.25.11.2–
FreeBSD 155.11.25.11.2–
FreeBSD 145.11.25.11.25.11.2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 155.11.25.11.2–
FreeBSD 145.11.25.11.25.11.2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 5.11.2.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (141)

Muhammad Moinur Rahman (bofh) · 5.11.2
*/*php86*: Sunrise

Please DO NOT use this version in production, it is an early test version.

For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING

Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
63b6120db0
Yusuf Yaman (nxjoseph) · 5.11.2
www/matomo: Security update 5.9.0 => 5.11.2

While here, sort USES alphabetically.

Changelogs:
- https://matomo.org/changelog/matomo-5-10-0/
- https://matomo.org/changelog/matomo-5-10-1/
- https://matomo.org/changelog/matomo-5-11-0/
- https://matomo.org/changelog/matomo-5-11-1/
- https://matomo.org/changelog/matomo-5-11-2/

PR:		296126
MFH:		2026Q2
Approved by:	osa, vvd (Mentors, implicit)

(cherry picked from commit 4ae267b525919adecca4362d72731808bb29293c)
3c15c93b2d
Vladimir Druzenko (vvd) · 5.9.0
www/matomo: Update 5.8.0 => 5.9.0

Changelog:
https://matomo.org/changelog/matomo-5-9-0/

PR:		294777
Sponsored by:	UNIS Labs
b77ed2fb45
Xavier Beaudouin (kiwi) · 5.8.0
www/matomo: update to 5.8.0

Changelog: https://matomo.org/changelog/matomo-5-8-0/

PR:	294155
454d1a6edb
Vladimir Druzenko (vvd) · 5.7.1
www/matomo: Update 5.6.2 => 5.7.1

Changelogs:
https://matomo.org/changelog/matomo-5-7-0/
https://matomo.org/changelog/matomo-5-7-1/

While here pet portfmt and portclippy.

PR:	293237
3a5b8718f9
Jochen Neumeister (joneum) · 5.6.2
www/matomo: Update to 5.6.2

Changelog: https://matomo.org/changelog/
Pass Maintainership to submitter

PR:	292271
Sponsored by:	Netzkommune GmbH
e432a776e3
Jochen Neumeister (joneum) · 5.5.1
www/matomo: Update to 5.5.1

Changelog: https://matomo.org/changelog/matomo-5-5-1/

PR:	290422

Sponsored by:	Netzkommune GmbH
480b2dc578
Jochen Neumeister (joneum) · 5.4.0
www/matomo: update to 5.4.0

PR:	289454
Sponsored by:	Netzkommune GmbH
6c0c3dbb46
Jochen Neumeister (joneum) · 5.2.2
www/matomo: Update to 5.2.2

Changelog: https://matomo.org/changelog/matomo-5-2-2/

Sponsored by:	Netzkommune GmbH
978cfba57b
Jochen Neumeister (joneum) · 5.1.2
www/matomo: update to 5.1.2

Changelog: https://matomo.org/changelog/

PR:	280415
Sponsored by:	Netzkommune GmbH
32f716685b
Muhammad Moinur Rahman (bofh) · 4.13.3
*/*: Unbreak with php84

These ports were initially marked to IGNORE with php84 as their runtime
dependencies were BROKEN. As all of the runtime dependencies has been
fixed for ther requirements unmark these ports. Although these ports
build perfectly with php84 but there might still be runtime issues with
these ports with php84. The maintainers are requested to do some runtime
checks for these ports.

Approved by:	portmgr (blanket)
6373a1df1f
Muhammad Moinur Rahman (bofh) · 4.13.3
*/*: Mark IGNORE_WITH_PHP=84

These ports are currently not compatible with php84 and is only a limited
set of ports. There might be more ports which has runtime issues. Please
check if your ports are compatible with php84 and if not pleae mark them
IGNORE_WITH_PHP=84

Approved by:	portmgr (blanket)
c00a7b36df
Muhammad Moinur Rahman (bofh) · 4.13.3
*/*: Remove merged or non-existent USE_PHP directives

- Remove USE_PHP=hash which is available in default php installation of
  all versions of php
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
  all versions of php
  * devel/pear-PHPTAL: Remove OPTION JSON
  * www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
  and later and has been replaced with sqlsrv module which is Windows
  only
  * www/codeigniter: Remove OPTION MSSQL
  * www/moodle311: Remove OPTION MSSQL
  * www/moodle39: Remove OPTION MSSQL
  * www/moodle40: Remove OPTION MSSQL
  * www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
  of all versions of php
  * databases/phpmyadmin: Remove OPTION OPENSSL
  * databases/phpmyadmin5: Remove OPTION OPENSSL
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
  * www/nextcloud: Remove OPTION SSL
  * www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
  all versions of php
  * sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
  following ports
  * www/typo3-11
  * www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
  * databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
  all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
  Windows only php module
  * www/typo3-11: Remove OPTION SQLSRV
  * www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected

Sponsored by:	Bounce Experts

Approved by:	portmgr(blanket)
0ac3a69555
Jochen Neumeister (joneum) · 4.13.3
www/matomo: Update to 4.13.3

PR:	269087
Sponsored by:	Netzkommune GmbH
85b4b6d57a
Jochen Neumeister (joneum) · 4.13.0
www/matomo: Update to 4.13.0

Changelog: https://matomo.org/changelog/matomo-4-13-0/

Sponsored by:	Netzkommune GmbH
39ab33fb15
Alexey Dokuchaev (danfe) · 4.12.3
www/matomo: the port had been updated to version 4.12.3

Remove vestiges of the old project name and fix couple of
noticed typos in the installation instructions while here.

PR:		266843
Submitted by:	Oleg Ginzburg
Approved by:	maintainer (joneum: timeout)
9c97a6d632
Jochen Neumeister (joneum) · 4.11.0
www/matomo: Udate to 4.11.0

Changelogs: https://matomo.org/changelog/

PR:	266497
Sponsored by:	Netzkommune GmbH
f712204488
Stefan Eßer (se) · 4.7.1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 4.7.1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Jochen Neumeister (joneum) · 4.7.1
www/matomo: Update to 4.7.1

Sponsored by:	Netzkommune GmbH
29483520e3
Jochen Neumeister (joneum) · 4.6.2
www/matomo: Update to 4.6.2

PR:	260675
Sponsored by:	Netzkommune GmbH
7bc5b0d6ab
Matthias Fechner (mfechner) · 4.5.0
www/matomo: update to 4.5.0

I also added a patch to supress the file integrity warning caused by the shebangfix to misc/log-analytics/import_logs.py and changed the pkg-message (change to the recommended apache config + upgrade message)

Changelog:
https://matomo.org/changelog

Major Changes:

* The `logme` method for [automatic logins](https://matomo.org/faq/how-to/faq_30/) is now disabled by default for new installations. For existing installations it will be enabled automatically on update. If you do not need it please consider disabling it again for security reasons by setting `login_allow_logme = 0` in `General` section of `config.ini.php`.
* The redirect using the `url` param for the automatic login action `logme`, will no longer do redirects to untrusted hosts. If you need to do redirects to other URLs on purpose, please add the according hosts as `trusted_hosts` entry in `config.ini.php`

* When determining the client IP address from proxy headers like X-Forwarded-For, Matomo will by default look at the first IP in the list. If you need to read the last IP instead, the new INI config option `[General] proxy_ip_read_last_in_list` be set to `1`. Using the last IP can be more secure when you are using proxy headers in combination with a load balancer.
* Matomo logs can now be written into "errorlog" (logs using the error_log() php function) and "syslog" (logs to the syslog service) (to complement existing log writers: "screen", "file", "database"). [Learn more.](https://matomo.org/faq/troubleshooting/faq_115/)

* Added new command `core:version` which returns the Matomo version number.

* Added new command `core:create-security-files` which creates some web server security files if they haven't existed previously (useful when using for example Apache or IIS web server).

* Before the JS tracker method, `enableLinkTracking` did not follow the DOM changes, from this version when the DOM updates, Matomo automatically adds event listeners for new links on the page. It makes it easier to track clicks on links in SPAs. From this version, if we use the `addListener` method to add event listener manually after the DOM has changed and the `enableLinkTracking` is turned on we will track the click event for that element twice.

* Before every JS error was tracked, from this version the same JS error will be only tracked once per page view. If the very same error is happening multiple times, then it will be tracked only once within the same page view. If another page view is tracked or when the page reloads, then the error will be tracked again.
* It's no longer possible to store any class instances directly in the session object. Please use arrays or plain data instead.

* In Matomo 4.3.0 we have added a 'passwordConfirmation' parameter to the CorePluginsAdmin.setSystemSettings API method. It is currently optional, but will become mandatory in version 4.4.0. Plugin developers and users of the API should make sure to update their plugins and apps before this happens.

* The `password_hash_algorithm`, `password_hash_argon2_threads`, `password_hash_argon2_memory_cost` and `password_hash_argon2_time_cost` INI config options have been added to allow using specific `password_hash` algorithms and options if desired.
* The `enable_php_profiler` INI config option was added. This must now be set to 1 before profiling is allowed in Matomo.

PR:		259850
Approved by:	maintainer timeout
190142ee29
Matthias Fechner (mfechner) · 4.2.1
www/matomo: Update to 4.2.1

Matomo 4.2.0

New config.ini.php settings
A config setting geolocation_download_from_trusted_hosts was introduced. Downloading GeoIP databases will now be limited to those configured hosts only.

Matomo 4.1.1
Changed config.ini.php settings
The config settings login_password_recovery_email_address and login_password_recovery_name have been removed to avoid possible smtp problems when sending recovery mails. noreply_email_address and noreply_email_name will be used instead.

All changes:

https://github.com/matomo-org/matomo/compare/4.1.0...4.2.1

PR:		254157
Approved by:	joneum (maintainer timeout 5 month)
adc00abc06
Mathieu Arnold (mat) · 4.1.0_1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 4.1.0_1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Jochen Neumeister (joneum) · 4.1.0_1
Make matomo.js and piwik.js writeable

PR:		252830
Reported by:	mfechner
Sponsored by:	Netzkommune GmbH
5b786cfd4d
Jochen Neumeister (joneum) · 4.1.0
Update to 4.1.0

Changelogs: https://github.com/matomo-org/matomo/compare/3.14.0...4.1.0

PR:		252632
Reported by:	Andrej Ebert <andrej@ebert.su>
Sponsored by:	Netzkommune GmbH
81516e32df
Jochen Neumeister (joneum) · 3.14.0
Update to 3.14.0

Sponsored by:	Netzkommune GmbH
dad100a8f0
Jochen Neumeister (joneum) · 3.13.6
Update to 3.13.6

Sponsored by:	Netzkommune GmbH
835de8303e
Jochen Neumeister (joneum) · 3.13.5
Update to 3.13.5

Sponsored by:	Netzkommune GmbH
13441bc4b5
Jochen Neumeister (joneum) · 3.13.4
Update to 3.13.4

Sponsored by:	Netzkommune GmbH
f003415e06
Jochen Neumeister (joneum) · 3.13.1
Update to 3.13.1

Sponsored by:	Netzkommune GmbH
5ab283e815
Sunpoet Po-Chuan Hsieh (sunpoet) · 3.11.0_1
Bump PORTREVISION for dependency change of USE_PHP=memcache in r521466
3c00e4deb6
Rene Ladan (rene) · 3.11.0
Remove IGNORE_WITH_PHP=71 and add IGNORE_WITH_PHP=74 where relevant.
a6e27105b6
Mathieu Arnold (mat) · 3.11.0
Convert to UCL & cleanup pkg-message (categories w)
a400cfc5f4
Jochen Neumeister (joneum) · 3.11.0
Update to 3.11.0

PR:		239422
Reported by:	geoffroy desvernay <dgeo@centrale-marseille.fr>
Sponsored by:	Netzkommune GmbH
1c81740bb0
Jochen Neumeister (joneum) · 3.10.0
Update to 3.10.0

Changelog: https://matomo.org/changelog/matomo-3-10-0/

Sponsored by:	Netzkommune GmbH
e09fac8c84
Sunpoet Po-Chuan Hsieh (sunpoet) · 3.9.1_1
Update devel/readline to 8.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://tiswww.case.edu/php/chet/readline/CHANGES
PR:		236156
Exp-run by:	antoine
40c9c7f7eb
Jochen Neumeister (joneum) · 3.9.1
Update to 3.9.1

Changelog:
 - https://matomo.org/changelog/matomo-3-9-1/
 - https://matomo.org/changelog/matomo-3-9-0/

Sponsored by:	Netzkommune GmbH
59b5772b9d
Antoine Brodin (antoine) · 3.8.1
Ignore with php 7.1
b1c85a57b5
Jochen Neumeister (joneum) · 3.8.1
Update from 3.7.0 to 3.8.1

Changelog:
 - https://matomo.org/changelog/matomo-3-8-1/
 - https://matomo.org/changelog/matomo-3-8-0/

PR:		235463
Reported by:	pi
MFH:		2019Q1
Sponsored by:	Netzkommune GmbH
d116d4aeb1
Jochen Neumeister (joneum) · 3.7.0
Update to 3.7.0

Changelog: https://matomo.org/changelog/matomo-3-7-0/

MFH:		2018Q4
Sponsored by:	Netzkommune GmbH
0833585adc
Jochen Neumeister (joneum) · 3.6.1
Update to 3.6.1

Changelog: https://matomo.org/changelog/matomo-3-6-1/

MFH:		2018Q4
Security:	44864c84-d3b8-11e8-b3cb-00e04c1ea73d
Sponsored by:	Netzkommune GmbH
d18a4ac3e9
Jochen Neumeister (joneum) · 3.6.0
Fix changes in pkg-messages.in - Piwik is now Matomo

Sponsored by:	Netzkommune
e63a1b88a2
Jochen Neumeister (joneum) · 3.6.0
Update to 3.6.0

Changelog: https://matomo.org/changelog/matomo-3-6-0/

Sponsored by:	Netzkommune
2b887e6ee7
Jochen Neumeister (joneum) · 3.5.1
www/matomo: Update to 3.5.1

Changelog: https://matomo.org/changelog/matomo-3-5-1/
d5351e856e
Jochen Neumeister (joneum) · 3.5.0
Take Maintainer ship
0be20f2c51
Torsten Zuehlsdorff (tz) · 3.5.0
www/matomo: Update from 3.4 to 3.5

Changelog: https://matomo.org/changelog/matomo-3-5-0/

Also drop MAINTAINER-ship
4044fe067e
Torsten Zuehlsdorff (tz) · 3.4.0_2
www/matomo: switch from piwik to matomo in pkg-descr

PR:		228104
Submitted by:	joneum
7064dcd3dc
Torsten Zuehlsdorff (tz) · 3.4.0_2
www/matomo: Fix wrong entries in pkg-plist

Some "www" strings where replaced with %%%WWWDIR%%% causing build failures,
if %%%WWWDIR%%% is something other than "www".

PR:           226668
Submitted by: freebsd-bugs@cklie.de
MFH:          2018Q2
87b983713d