probo/packages/cookie-banner/CHANGELOG.md

Changelog

All notable changes to the @probo/cookie-banner SDK will be documented in this file.

Unreleased

[0.10.1] - 2026-07-28

Fixed

• Grant all Google Consent Mode types when the banner config is unavailable (discovery mode), so GTM-managed tags can fire and be detected instead of staying blocked by the eager deny-all bootstrap

[0.10.0] - 2026-06-19

Changed

• Local storage, IndexedDB, and cache-storage trackers without an expiry now display a localized "persistent" duration rather than "session"

[0.9.3] - 2026-06-12

Fixed

• Hold the page scroll lock on sites using JS-driven smooth-scroll libraries (e.g. Lenis, as used by Framer) that bypass overflow: hidden. The body is now pinned with position: fixed (scroll position saved and restored) to remove the viewport's scroll distance entirely, with capture-phase wheel/touch cancellation as defense-in-depth for inner scroll containers; the preference panel's own list can still scroll

[0.9.2] - 2026-06-11

Changed

• References updated to probo.com

[0.9.1] - 2026-06-10

Fixed

• Lock page scroll while the preference panel is open and add overscroll-behavior: contain to the category list, so wheel events at panel edges no longer chain to the host page
• Exclude the SDK's own served bundle URL from tracker initiator attribution and from the resource detector, so third-party/extension writes are no longer misattributed to cookie-banner.iife.js when the SDK is served from a CDN distinct from the API host

[0.9.0] - 2026-06-05

Added

• Support Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Turkish, Ukrainian, and Chinese

[0.8.0] - 2026-06-03

Added

• Expose tracker type on CookieItem and render it in the headless cookie list and themed banner

[0.7.0] - 2026-05-27

Added

• Re-export public domain types (BannerConfig, Category, Regulation, ConsentAction, ConsentRecord, CookieItem, VisitorConsent) from the package entry point

[0.6.0] - 2026-05-26

Added

• Eagerly bootstrap GCM (deny all consent types before config fetch) to close the gap where gtag could track during async config loading
• Track source (script/pre-existing) on detected storage trackers (localStorage, sessionStorage, indexedDB, cacheStorage)
• Mark page-world extension writes with a new EXTENSION source

Changed

• Overhaul extension-activity detection: add synchronous DOM hooks (IDL setters, setAttribute, HTML-parsing entry points, fetch/XHR/sendBeacon) and drop ineffective isExtensionCaller() wraps

Removed

• Remove the PostHog integration (use data-cookie-consent script blocking instead)

Fixed

• Disconnect the previous MutationObserver in load()'s error path so failing loads no longer leak observers

[0.5.0] - 2026-05-20

Added

• Expose a programmatic consent API via a ConsentManager singleton (@probo/cookie-banner/consent ESM entrypoint and window.Probo.consent on the IIFE), so customers can read and react to consent state from their own bundled JavaScript — unblocking third-party SDKs that initialize programmatically and cannot be gated via data-cookie-consent attributes
• ConsentManager exposes a subscribe() method (unifying onReady + onChange with immediate replay) and getAll() now returns a cached, referentially stable snapshot, making it safe to use with React's useSyncExternalStore
• Share the ConsentManager singleton across bundles on globalThis so multiple copies of the SDK on the same page see the same state

[0.4.1] - 2026-05-13

Changed

• Skip the /consents/:id fetch for first-time visitors (no visitorId in localStorage); the visitor ID is now created lazily on the first consent action instead of triggering a guaranteed-404 request on every initial page load

[0.4.0] - 2026-05-12

Added

• ResourceDetector (renamed from ThirdPartyDetector) now picks up everything the browser loads via a single PerformanceObserver: tracking pixels, cross-origin stylesheets and web fonts, fetch / XHR / sendBeacon / ping calls, and <video> / <audio> / <embed> / <object> media — closing a real gap with headless cookie scanners that previously missed beacons fired after script teardown
• Detect registered service workers (reported as a SERVICE_WORKER tracker resource) and Cache Storage buckets (reported as a CACHE_STORAGE tracker)
• Detect HTTP-header cookies on Chromium browsers via the CookieStore change event (new http cookie source)
• Capture the script initiator URL on detected cookies and storage writes by walking the synchronous call stack, enabling per-vendor attribution

Changed

• Collapse the three detectors (cookies, storage, resources) onto a single shared ReportQueue: one debounced POST instead of up to three, type-namespaced dedup keys (c: / s: / r:) that cannot collide across detectors, and a tab-close drain via sendBeacon (with keepalive-fetch fallback) so the last debounce window of detections is no longer lost on unload
• Report full origin+pathname for detected scripts and iframes (query string stripped) so resources served from the same domain but different paths can be distinguished
• Rename ThirdPartyDetector to ResourceDetector to match what it actually emits (breaking for SDK consumers importing it by name)

Fixed

• Always attempt sendBeacon on flush so pending reports are no longer dropped during page unload when an async flush is in flight
• Keep pending entries queued until the transport confirms delivery, so transient network errors and bfcache restores no longer silently drop detection reports

[0.3.1] - 2026-05-08

Fixed

• Reopen the banner instead of the preference panel for OPT_OUT regulations (e.g. CCPA) when clicking the settings widget, since users only need Accept/Reject choices
• ProboRejectButton and ProboCustomizeButton now auto-hide when their corresponding text key is empty in the server config, so headless SDK consumers no longer need regulation-aware layout logic

[0.3.0] - 2026-05-07

Added

• Expose detected privacy regulation (GDPR, CCPA, etc.) on BannerConfig, via CookieBannerClient getter, and in the probo-ready event detail so themed-banner consumers can adapt their UI per regulation
• Adapt banner texts and button visibility per regulation (opt-out notice for CCPA, simple notice when no regulation applies); buttons whose text is empty are now hidden

Fixed

• Defer banner button validation until config is loaded so required-button checks reflect the active consent mode

[0.0.0] - 2026-04-27

Added

• Initial scaffold of the cookie banner SDK with web components, headless and themed entrypoints, settings link element, Google Consent Mode v2 integration, PostHog consent plugin, Global Privacy Control (GPC) support, internationalization with default translations for English, French, German, and Spanish, and graceful config fetch failure handling.