Skip to main content
The tag pins one tracker version, and the browser checks the file against the tag’s integrity value. Nothing on your pages changes unless you change the tag: the service has no “latest” URL and never updates a released file. This page explains how to move to a newer version.

What a version is

Each release is one file, https://in.analytics.example/v/<version>/sdk.js, and one SHA-384 hash. The list of releases, with their sizes and hashes, is packages/tracker/releases/manifest.json; a released file is never rebuilt or replaced. Released so far:

Steps

  1. Open the site’s Snippet page in the console and choose the new version in Tracker version. The newest is marked. The page shows the new tag, its release date and its size.
  2. Replace the whole tag on your pages with the new one. Both src and integrity change; copying only one of them makes the browser refuse the file. Keep any attributes you added yourself (data-auto-track, data-domains and so on).
  3. Deploy, then check one page as in the quickstart: sdk.js with the new version answers 200 and the pageview answers 202.
Moving from 1.0.0 to 1.1.0 changes only these two attributes:
Versions can be mixed: pages still carrying the old tag keep working while you roll out the new one, and all pages count into the same dashboard. For the React Router and Next.js layouts, update the src and integrity values in the element. With the npm package, install the new exact version. A self-hosted copy needs the new file at a new path as well.

Checking a file yourself

Before you trust a new version, you can compare the file with the published hash and, once the release pipeline signs releases, with its signature: docs/security/verify-tracker.md.

Revoked versions

If a released version turns out to have a security problem, it is revoked: the gateway answers 410 Gone for its file, the console stops offering it, and pages that still load it from the gateway send nothing until their tag is replaced. A revoked version is listed in revoked.json with the reason. No version has been revoked so far. Because the tracker is pinned, the service cannot fix a problem on your pages without you: watch the repository’s releases and replace the tag when a version you use is revoked.