{"data":{"id":"magento2-40032","source":"github-pr","sourceRef":"magento/magento2#40032","title":"Added the scp allowlist for Analytics if you only use Google Analytics","pr":{"number":40032,"url":"https://github.com/magento/magento2/pull/40032","author":"JeroenBoersma","mergedAt":"2026-01-16T11:20:14Z","mergeCommit":"81964c0428f7067367e23832eea8e96019546787","headCommit":"0ea76627c5542048f28a10bdb3d8b4cf295b3e1c","baseRef":"2.4-develop","diffSha256":"457996d4cdbfef78f28c40aa5edf6ab48a4727239865c592f484d161c6e85f55"},"issues":[{"number":40051,"url":"https://github.com/magento/magento2/issues/40051","title":"[Issue] Added the scp allowlist for Analytics if you only use Google Analytics","labels":["Area: Analytics / Reporting","Component: GoogleAnalytics","Issue: Confirmed","Priority: P3","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x","Triage: Dev.Experience"],"kind":"pr-derived"}],"fixedIn":"2.4.9","containingTags":["2.4.9"],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"clean","2.4.8-p1":"clean","2.4.8-p2":"clean","2.4.8-p3":"clean","2.4.8-p4":"clean","2.4.8-p5":"clean","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10","2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5"],"components":["magento/module-google-analytics"],"files":[{"path":"app/code/Magento/GoogleAnalytics/etc/csp_whitelist.xml","change":"added","package":"magento/module-google-analytics"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":27,"mergeBatched":false,"excluded":null,"sections":{"description":"Having this module for the Analytics module makes this module work in work alone mode without the adwords module enabled.","stepsToReproduce":"1. Disable the Magento_Adwords module\n2. Enforce CSP (checkout) or manually\n3. The GA code will not be loaded","expectedResult":null,"actualResult":null,"source":"pr"},"signatures":[],"labels":{"area":["Analytics / Reporting"],"component":["GoogleAnalytics"],"priority":"P3","severity":null,"reportedOn":["2.4.x"]},"categories":[],"triage":{"model":"@cf/cloudflare/clef","requestHash":"a550c01164a33284602efbed9247eb6493b39917f095dba8890270470d57cf87","isBugfix":0.758,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.6113,"feature":0.3563,"refactor":0.0146,"tests_only":0.0057,"docs_only":0.0066,"dependency":0.0055},"confidence":0.4011},"scope":{"score":0.2331,"probabilities":{"0":0.8197,"1":0.1276,"2":0.0527},"confidence":0.5364},"risk":{"score":0.1486,"probabilities":{"0":0.8785,"1":0.0945,"2":0.027},"confidence":0.6721},"area":{"choice":"other","probabilities":{"catalog":0.0166,"checkout":0.0894,"customer":0.0132,"admin":0.0476,"graphql_api":0.0111,"framework":0.083,"frontend":0.3513,"other":0.3878},"confidence":0.1903},"securityRelevant":0.3817,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0031,"2.4.0-p1":0.0034,"2.4.1":0.0036,"2.4.1-p1":0.0039,"2.4.2":0.0056,"2.4.2-p1":0.0059,"2.4.2-p2":0.0069,"2.4.3":0.0133,"2.4.3-p1":0.0104,"2.4.3-p2":0.0149,"2.4.3-p3":0.0084,"2.4.4":0.0141,"2.4.4-p1":0.0104,"2.4.4-p10":0.0067,"2.4.4-p11":0.0071,"2.4.4-p12":0.0063,"2.4.4-p13":0.0055,"2.4.4-p14":0.0083,"2.4.4-p15":0.006,"2.4.4-p16":0.0067,"2.4.4-p17":0.0057,"2.4.4-p18":0.0048,"2.4.4-p2":0.0021,"2.4.4-p3":0.0028,"2.4.4-p4":0.0029,"2.4.4-p5":0.0029,"2.4.4-p6":0.0039,"2.4.4-p7":0.0034,"2.4.4-p8":0.0043,"2.4.4-p9":0.0036,"2.4.5":0.0166,"2.4.5-p1":0.0119,"2.4.5-p10":0.0082,"2.4.5-p11":0.0141,"2.4.5-p12":0.0091,"2.4.5-p13":0.0095,"2.4.5-p14":0.0101,"2.4.5-p15":0.0075,"2.4.5-p16":0.007,"2.4.5-p17":0.0083,"2.4.5-p2":0.0031,"2.4.5-p3":0.005,"2.4.5-p4":0.0054,"2.4.5-p5":0.0059,"2.4.5-p6":0.0053,"2.4.5-p7":0.0057,"2.4.5-p8":0.0054,"2.4.5-p9":0.0055,"2.4.6":0.0374,"2.4.6-p1":0.0194,"2.4.6-p10":0.0094,"2.4.6-p11":0.0152,"2.4.6-p12":0.0129,"2.4.6-p13":0.0121,"2.4.6-p14":0.0116,"2.4.6-p15":0.009,"2.4.6-p2":0.0039,"2.4.6-p3":0.0077,"2.4.6-p4":0.0094,"2.4.6-p5":0.0075,"2.4.6-p6":0.0108,"2.4.6-p7":0.0079,"2.4.6-p8":0.0067,"2.4.6-p9":0.0064,"2.4.7":0.0175,"2.4.7-p1":0.0142,"2.4.7-p10":0.0094,"2.4.7-p2":0.0059,"2.4.7-p3":0.0146,"2.4.7-p4":0.02,"2.4.7-p5":0.0139,"2.4.7-p6":0.0131,"2.4.7-p7":0.0145,"2.4.7-p8":0.0108,"2.4.7-p9":0.0075,"2.4.8":0.0215,"2.4.8-p1":0.0189,"2.4.8-p2":0.0213,"2.4.8-p3":0.0174,"2.4.8-p4":0.0179,"2.4.8-p5":0.013,"2.4.9":0.018,"unspecified":0.2128},"confidence":0.0441},"backportWorthy":{"score":1.5041,"probabilities":{"0":0.1156,"1":0.2646,"2":0.6198},"confidence":0.2012}},"curated":{"title":"Fixes Google Analytics being blocked by CSP when the Adwords module is disabled","description":"If you disable the Magento_Adwords module, its csp_whitelist.xml is not read, so when you enforce CSP the Google Analytics code will not be loaded. The GoogleAnalytics module now has its own csp_whitelist.xml with www.google-analytics.com for script-src, connect-src and img-src.","categories":[],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-40032 details"}