« Changelog History


GoatCounter v2.7.0 Release Notes

Release Date: 2025-12-15 // 6 months ago

  • 2025-12-15 v2.7.0

    🚀 This release contains a number of incremental improvements and fixes. Nothing especially major.

    🐳 Also available on DockerHub: https://hub.docker.com/r/arp242/goatcounter

    🔋 Features

    • 📚 The -geodb flag now accepts -geodb=maxmind:account_id:license to automatically download updates. See goatcounter help serve for the full documentation.

    • Automatically detect secure and sameSite cookie attributes. Previously this relied on the correct usage of the -tls flag, which people often got wrong. Now it's detected from the client connection.

    • 👍 WebSocket support is now detected automatically, without the need to set the -websocket flag (which is now a no-op).

    • Store bot pageviews in a new bots table for 30 days. This table is never accessed, but it can be useful for debugging purposes.

    • 🐧 Read the GOATCOUNTER_TMPDIR environment variable as an alternative way to set TMPDIR. Mainly intended for cases where TMPDIR can't be used (e.g. when the capability bit is set on Linux).

    • ⚡️ Use PostgreSQL 17 in compose.yaml; also update the PostgreSQL settings to be less conservative.

    • The -smtp flag now also supports smtps:// URLs for TLS connections (previously it only supported STARTTLS). To help with debugging you can now also add ?debug=1 to print SMTP traffic to stderr, or use the new Server Management → Email page for testing the SMTP connection.

    • ➕ Add more detailed totals to /api/v0/stats/totals. Previously it would only return the grand totals; now it also returns the totals broken down by hour and day.

    • Allow finding paths by name in the API. Everything that accepts include_paths=.. and exclude_paths=.. now also accepts path_by_name=true to finds paths by the path rather than ID.

    • 👀 Expand filter syntax with some keywords such as at:start and in:path. See the tooltip on the filter input.

    • The JS-based datepicker can be disabled in the user settings.

    • ➕ Add buttons to navigate by year on the dashboard.

    🛠 Fixes

    • 👀 Don't add translate-to=.. to query parameters. Previously it would set this from Google Translate parameters so you could see which languages people were using with that, but I don't think anyone ever used that and it just split paths for no good reason.

    • 👉 Make sure CLI flags with a . such as -user.email can be set from environment (as USER_EMAIL).

    • Adjust screen size categories for more modern devices.

    • API Tokens will now work for all sites the user has access to.

    • 🛠 Fix default combined-vhost and common-vhost log formats from $host:[..] to $host [..].

    • Include all sites in email reports, instead of just the first site that was created.

    • 🛠 Fix merging of multiple paths when more than one path has entries for the same hour.

    • Store Campaign in hits table.

    • 👉 Make sure the visitor counter works for events; previously it only worked for paths.

    • Set CORS headers for API.

    • Pass hideui=1 when redirecting with access-token.

    • 🛠 Fix pagination of Top referrers.

    • 🛠 Fix page count for text table after pagination.

    • ✂ Remove sizes table; was only used for hits.size_id, which is now replaced with hits.width. This indirection didn't really add much.

    • Correctly display error on widgets; previously it would just display errors.errorString Value.

    • Disable daily view if less than 7 days are selected as it just looks weird.


Previous changes from v2.6.0

  • 🚀 This release changes a number of default values. In most cases this shouldn't break anything, but be sure to read the section.

    Compiling GoatCounter requires Go 1.21 or newer.

    🔄 Changes in defaults

    • 0️⃣ The default values for the -listen and -tls flags have changed from -listen=:443 -tls=tls,rdr,acme to -listen=:8080 -tls=none.

    • 0️⃣ The default SQLite database location changed from ./db/goatcounter.sqlite3 to ./goatcounter-data/db.sqlite3. The old file will still be used as a default if it exists, so this shouldn't break any existing setups.

    • 0️⃣ The default ACME secrets location changed from ./acme-secrets to ./goatcounter-data/acme-secrets. The old directory will still be used as a default if it exists, so shouldn't break any existing setups.

    • 🚀 No longer check for window.goatcounter.vars and window.counter in count.js. These were changed a week or so after the initial release over five years ago. AFAIK no one is using them.

    • 0️⃣ No longer store individual pageviews in the hits table by default.

    🔋 Features

    • 👀 Include Dockerfile and publish images on DockerHub. See README for details.

    • 0️⃣ Take default values of CLI flags from environment variables as GOATCOUNTER_«FLAG», where «FLAG» is identical to the CLI flag name. The CLI always takes precedence.

    • Automatically load GeoIP database from ./goatcounter-data/ directory if it exists; it automatically loads the first .mmdb file.

    • 👌 Improve log parsing:

    • 👌 Improve dark theme, and enable by default if set in browser/system preferences.

    • ➕ Add translations for Chinese, Korean.

    • ➕ Add HTTP2 Cleartext (h2c) handler to improve compatibility with some proxies.

    • ➕ Add -base-path flag to allow running GoatCounter under a different path such as example.com/stats.

    • 👍 Allow importing Google Analytics reports. Google Analytics doesn't really offer a meaningful export, but does allow exporting "reports" with the totals per path. We can't show anything useful on the dashboard, but we can use it to show correct totals on the visitor counter.

    • 👷 Sites are no longer soft-deleted for 7 days. The deletion is still as a background job as it may take a while.

    🛠 Fixes

    • 👉 Use img-based fallback if sendBeacon fails in count.js. This helps with some sites that forbid using connect-src from the CSP (e.g. neocities).

    • 🚚 Disable keyboard input on datepicker. Previously the arrow keys would move the date, but this was more annoying than anything else and prevented manually twiddling the text.

    • 👀 Set CORS on the visitor counter (/counter/[..].json) in case of errors. It would only set Access-Control-Allow-Origin if the operation succeeded, but not on errors so you'd never see the error.

    • Strip trailing slash from visitor counter. Trailing slashes are always stripped for paths in the dashboard, so do it in the visitor counter as well.

    • 👍 Better error if SQLite DB directory isn't writable when creating a new database. SQLite doesn't try to create the file until the first SQL command, which happens to be the version check. This would fail with a confusing requires SQLite 3.35.0 or newer; have "" error.

    • 👍 Better styling when printing the dashboard.

    • Correctly populate the languages table when creating a new database. Previously collecting language statistics didn't work correct due to this.