From a07ced47ae91bcb918cefadf6d4d4364a039ac5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Tue, 12 May 2026 10:51:26 +0400
Subject: [PATCH] Release @probo/cookie-banner/v0.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 packages/cookie-banner/CHANGELOG.md | 20 ++++++++++++++++++++
 packages/cookie-banner/package.json |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/packages/cookie-banner/CHANGELOG.md b/packages/cookie-banner/CHANGELOG.md
index 48f7b37c9..980c2c8ea 100644
--- a/packages/cookie-banner/CHANGELOG.md
+++ b/packages/cookie-banner/CHANGELOG.md
@@ -4,6 +4,26 @@ All notable changes to the `@probo/cookie-banner` SDK will be documented in this
 
 ## Unreleased
 
+## [0.4.0] - 2026-05-12
+
+### Added
+
+- `ResourceDetector` (renamed from `ThirdPartyDetector`) now picks up everything the browser loads via a single `PerformanceObserver`: tracking pixels, cross-origin stylesheets and web fonts, `fetch` / XHR / `sendBeacon` / `ping` calls, and `<video>` / `<audio>` / `<embed>` / `<object>` media — closing a real gap with headless cookie scanners that previously missed beacons fired after script teardown
+- Detect registered service workers (reported as a `SERVICE_WORKER` tracker resource) and Cache Storage buckets (reported as a `CACHE_STORAGE` tracker)
+- Detect HTTP-header cookies on Chromium browsers via the `CookieStore` change event (new `http` cookie source)
+- Capture the script initiator URL on detected cookies and storage writes by walking the synchronous call stack, enabling per-vendor attribution
+
+### Changed
+
+- Collapse the three detectors (cookies, storage, resources) onto a single shared `ReportQueue`: one debounced POST instead of up to three, type-namespaced dedup keys (`c:` / `s:` / `r:`) that cannot collide across detectors, and a tab-close drain via `sendBeacon` (with keepalive-fetch fallback) so the last debounce window of detections is no longer lost on unload
+- Report full origin+pathname for detected scripts and iframes (query string stripped) so resources served from the same domain but different paths can be distinguished
+- Rename `ThirdPartyDetector` to `ResourceDetector` to match what it actually emits (breaking for SDK consumers importing it by name)
+
+### Fixed
+
+- Always attempt `sendBeacon` on flush so pending reports are no longer dropped during page unload when an async flush is in flight
+- Keep pending entries queued until the transport confirms delivery, so transient network errors and bfcache restores no longer silently drop detection reports
+
 ## [0.3.1] - 2026-05-08
 
 ### Fixed
diff --git a/packages/cookie-banner/package.json b/packages/cookie-banner/package.json
index 0fde66e5c..44ffdc7f3 100644
--- a/packages/cookie-banner/package.json
+++ b/packages/cookie-banner/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@probo/cookie-banner",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Probo cookie consent banner SDK",
   "type": "module",
   "main": "dist/cookie-banner.mjs",