Repository navigation
build: ship compiled ESM/CJS output and prepare 0.2.0 - #16
Merged
Merged
Conversation
Publish dist built with tsup instead of raw TypeScript sources. Export subpaths and peer ranges are unchanged. Also move to pnpm 10 with a 7-day minimum release age and no dependency build scripts.
Publish via npm trusted publishing with provenance; @latest only from a v*.*.* tag on main matching package.json and CHANGELOG.md. Canary on main push when CANARY_ENABLED is true or by manual dispatch. Add CONTRIBUTING.
…user ids getConsentFromCookie matched any cookie whose name ended with the consent cookie name, so a look-alike cookie could grant consent. track() and identify() now ignore empty or non-string names instead of recording them.
This was referenced Oct 31, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the next stable (0.2.0) without publishing it.
Package
src/*.ts(even forrequire), so it only worked when the consumer's bundler transpilednode_modules. A tsup build now emits ESM, CJS and type declarations indist;.and./reactkeep their names and peer range;./package.jsonis exported. Code splitting keeps one shared analytics state across both entries.getConsentFromCookiematched the cookie name unanchored, so a cookie namedevil-vllnt-consent=1granted consent; now anchored (the oldit.failstest is now two real tests).track("")andidentify("")are ignored instead of recording junk.Supply chain / CI
@latestonly from a pushedvX.Y.Ztag onmainmatchingpackage.jsonand the CHANGELOG; npm trusted publishing with provenance, no token. Canary still publishes on every push tomain(and by manual run). TheRELEASE_PATsecret is no longer used.maxWorkers: 2, ESLint cache, incrementaltsc --noEmit).Verification: clean install, lint, typecheck, 123 tests at 100% coverage, build; packed tarball imports via ESM and
requireand type-checks underbundlerandnodenext.Remaining known advisory: minimatch GHSA-g3hv-75wg-m249 (moderate, dev-only via ESLint plugins; fix only in a new major released this week).