---
url: https://docs.consentpro.com/changelog/app.md
---
# app

## 2.4.6

### Patch Changes

* Updated dependencies \[e7b804d]
  * consentpro-utils@2.1.5
  * consentpro-dictionary@0.1.15
  * web-components@0.0.11

## 2.4.5

### Patch Changes

* e73fae1: Route Designer site linking and its token handoff to the matching web-app branch preview.
* Updated dependencies \[e73fae1]
  * consentpro-utils@2.1.4
  * consentpro-dictionary@0.1.14
  * web-components@0.0.10

## 2.4.4

### Patch Changes

* a53bedd: Stop calling Webflow for sites that uninstalled Consent Pro or revoked its authorization. A 401 on a stored Webflow token now deletes that token, and the publish webhook ignores sites without a live authorization. Configuration and scan data are kept. Stop accepting debugger tokens signed with the legacy public key from earlier extension bundles; only server-minted tokens open the debugger. The Webflow extension build now packages the private review ZIP (source maps, `package.json` and lockfile) that Marketplace submissions require. Update the Webflow CLI to 2.12.0.
  * consentpro-dictionary@0.1.13
  * consentpro-utils@2.1.3
  * web-components@0.0.9

## 2.4.3

### Patch Changes

* 3f7ccff: Use the replacement page as the shared source for all configured banners when repairing a missing source page. Preserve each banner's settings so the v3 save succeeds with one shared banner source.
* 3f7ccff: Load prefetched regions and page data before opening the dashboard after initial domain selection.
* 3f7ccff: Persist the selected Designer domain in D1 and restore its working context when reopening the app. Switching to staging scans staging while retaining connected proxy mounts for publication.
  * consentpro-dictionary@0.1.12
  * consentpro-utils@2.1.3
  * web-components@0.0.8

## 2.4.2

### Patch Changes

* consentpro-dictionary@0.1.11
* consentpro-utils@2.1.3
* web-components@0.0.7

## 2.4.1

### Patch Changes

* 3a60e4b: Update vulnerable transitive dependencies to patched versions.
* Updated dependencies \[3a60e4b]
* Updated dependencies \[3dc13a0]
  * web-components@0.0.6
  * consentpro-dictionary@0.1.10
  * consentpro-utils@2.1.3

## 2.4.0

### Minor Changes

* 9518dbb: Add Cookie Manager locale purposes and overlay them on preferences and cookie declaration after publish.

  Draft translations live in D1 (`config_tracker_translations`) and are not live on save. Publish writes a per-hostname R2 sibling at `translations/v2/...` and purges it with the runtime cache. Visitors fetch `GET /v3/cdn/translations/:siteId.json` only when opening preferences or hydrating the cookie declaration; banner blocking still uses the inlined purpose.

  **Production:** apply D1 migration `0049_flat_leper_queen` (`wrangler d1 migrations apply DB --env production --remote`) and confirm it with `wrangler d1 migrations list DB --env production --remote` before this Designer UI ships. `GET /v3/projects/:id/languages` has no fallback if `supported_languages` is missing.

### Patch Changes

* ba3ce20: Update Axios and SvelteKit to patched releases and refresh vulnerable transitive dependencies.
* c3fe401: Remove the PostHog browser SDK and the in-app NPS/PMF surveys from the Designer extension. Product analytics are sent to a first-party `POST /v2/events` endpoint, which attributes them to the Webflow session and forwards them to PostHog with `posthog-node`.
* 01a071f: Show the tracker translation toggle immediately, display a loading state in the drawer, and load languages and translations concurrently. Ignore stale responses when the editor closes or reopens.
* c3fe401: Resolve Webflow Marketplace review findings: precompile policy templates at build time so only the Handlebars runtime ships, open the scan timeline WebSocket with a single-use ticket instead of the ID token, remove the migration-testing and PostHog-reset localStorage switches, start scans only from a click instead of a URL parameter, and mint short-lived site-scoped debugger tokens on the server with a server-side secret.
* Updated dependencies \[bb844a5]
* Updated dependencies \[ba3ce20]
* Updated dependencies \[c3fe401]
  * consentpro-utils@2.1.3
  * web-components@0.0.5
  * consentpro-dictionary@0.1.9

## 2.3.7

### Patch Changes

* consentpro-dictionary@0.1.8
* consentpro-utils@2.1.2
* web-components@0.0.4

## 2.3.6

### Patch Changes

* Updated dependencies \[36435b2]
  * consentpro-utils@2.1.2
  * consentpro-dictionary@0.1.7
  * web-components@0.0.3

## 2.3.5

### Patch Changes

* 28b754d: Stop putting the account email address in Finsweet Accounts navigation URLs. The Designer extension
  now links out with a short-lived opaque account reference, which the Consent Pro server resolves
  before redirecting. The destination journey is unchanged.
* Updated dependencies \[9a490af]
* Updated dependencies \[fecdc78]
* Updated dependencies \[8384efa]
* Updated dependencies \[d3e426d]
* Updated dependencies \[d7331e4]
  * web-components@0.0.2
  * consentpro-utils@2.1.1
  * consentpro-dictionary@0.1.6

## 2.3.4

### Patch Changes

* consentpro-dictionary@0.1.5
* consentpro-utils@2.1.0

## 2.3.3

### Patch Changes

* 4a2d1af: chore(deps): clear the `pnpm audit` backlog

  `pnpm audit` went from 17 findings (5 high, 10 moderate, 2 low) to 0 unignored.

  Direct dependency updates:

  * `server`: hono 4.12.34 → 4.13.7, covering three advisories: unbounded dot-notation nesting in `parseBody()`, query parameters read after the URL fragment, and the incomplete `toSSG()` fix for CVE-2026-39408
  * root, `app`, `server`: vitest 4.1.0 → 4.1.11, for the `@vitest/mocker` path traversal

  Transitive pins added via `pnpm.overrides`:

  * `@ai-sdk/provider-utils` → 4.0.51 (uncontrolled resource consumption, via `@ai-sdk/openai`)
  * `@vitest/mocker` → 4.1.11
  * `csv-parse` → 7.0.2 (prototype replacement via `columns`, via `@finsweet/webflow-apps-utils`)
  * `fflate` → 0.4.9 (infinite loop in `unzipSync` on malformed input, via `posthog-js`)
  * `qs` → 6.16.0 (array-limit bypass and attacker-controlled `isBuffer` DoS, via `webflow-api`)

  Existing overrides refreshed, because the versions they pinned were themselves flagged since they were added:

  * `js-yaml` 3.15.1 → 3.15.2 and 4.3.1 → 4.3.2
  * `sharp` 0.35.3 → 0.35.4 (libheif vulnerabilities, via `wrangler` → `miniflare`)

  Two advisories are added to `pnpm.auditConfig.ignoreCves` because no fixed release exists upstream yet. Both are archive-extraction symlink traversals reachable only from build and browser-download tooling, not from any runtime request path:

  * CVE-2026-19693, `extract-zip` <=2.0.1 via `@cloudflare/puppeteer` → `@puppeteer/browsers`
  * CVE-2026-76845, `adm-zip` <=0.6.0 via `@webflow/webflow-cli` → `@module-federation/dts-plugin`

  Both should be removed from the ignore list once upstream ships a fix.

## 2.3.2

### Patch Changes

* Updated dependencies \[f528b4f]
  * consentpro-dictionary@0.1.4
  * consentpro-utils@2.1.0

## 2.3.1

### Patch Changes

* a3d3d4b: Fix the "Run your first scan" action item flashing on sites that have already been scanned.

  Action-item sync started before scan history loaded, so the client sent `hasFirstScan: false` and the first-scan CTA appeared until the next poll. Sync now waits until scan state is hydrated, then sends the real value.

  The Action Items view also no longer sits on its loading state when the sync request fails.

## 2.3.0

### Minor Changes

* 55656ae: Add optional public hostname and path prefix so reverse-proxied sites publish a hostname.json for the visitor host and expose the site information the runtime uses to compose public URLs.

  The Webflow domain is unchanged. Custom-domain sites publish `publicHostname` and, when mounted under a prefix, `pathPrefix`. The runtime composes these with locale subdirectories and page slugs. Sites without these settings are unaffected.

### Patch Changes

* ba392c6: fix: stop the Designer session from being logged out by a hidden tab

  Chrome stalls a backgrounded tab: `webflow.getIdToken()` stops resolving and `setTimeout` is
  clamped to roughly once a minute, so the 4s guard on the token fetch took ~60s to give up. The
  action items poller kept running every 10s regardless, and a single failed refresh locked the app
  to the re-authorize screen with no way back but the manual retry. Because it happened while the
  tab was hidden, users only saw the lock when they returned, which made it look like idling logged
  them out.

  * Pause the action items poller while the tab is hidden, and run it once as soon as it is visible
    again (opt-in `pauseWhenHidden` on `createPoller`, so the re-authorization poller keeps running
    while the OAuth popup holds focus).
  * Do not lock the app when a token fetch fails while the tab is hidden, including on the
    re-bootstrap after re-authorization, where the OAuth popup leaves the Designer hidden.
  * Clear the lock when a Consent Pro request issued since that lock succeeds, so a recovered session
    unlocks itself without a response from before the lock unlocking a dead one.

* 4afc228: Remove the dictionary-matched-review confirmation step. Trackers matched against our verified database now publish immediately without requiring manual confirmation, reducing steps to live. The "Confirm matched trackers from our verified database" action item group is removed from the UI, and any pre-existing resolved/unresolved rows of this type stop being surfaced.

* Updated dependencies \[55656ae]
  * consentpro-utils@2.1.0
  * consentpro-dictionary@0.1.3

## 2.2.6

### Patch Changes

* 03bd744: chore(deps): resolve open Dependabot PRs and clear the `pnpm audit` backlog

  Direct dependency updates:

  * `app`: axios 1.16.0 → 1.18.0, posthog-js 1.336.1 → 1.417.0
  * `consentpro-v1`: nanoid 5.1.6 → 5.1.16, esbuild 0.27.3 → 0.28.1
  * `consentpro-v2`: esbuild 0.27.3 → 0.28.1
  * `server`: hono 4.12.21 → 4.12.34
  * `consentpro-debugger`: vite 7.3.2 → 7.3.6

  Transitive advisories are pinned to patched versions via `pnpm.overrides` (tar,
  undici, brace-expansion, js-yaml, protobufjs, fast-uri, ip-address, postcss,
  nanoid, form-data, ws, adm-zip, shell-quote, sharp, dompurify, esbuild), taking
  `pnpm audit` from 89 findings (1 critical, 41 high, 35 moderate, 12 low) to 0.

  The posthog-js bump also removes the `@opentelemetry/*` and `protobufjs`
  subtrees, which were never reachable from the shipped extension bundle.
  Telemetry configuration is unchanged and the pinned `defaults: '2025-05-24'`
  still applies, so capture behaviour is identical.

  Two advisories have no published fix and are recorded in
  `pnpm.auditConfig.ignoreCves` rather than resolved — CVE-2026-56876
  (extract-zip, via `@cloudflare/puppeteer`) and CVE-2025-14505 (elliptic, via
  `@webflow/webflow-cli`). Neither is reachable from a shipped artifact.

## 2.2.5

### Patch Changes

* Updated dependencies \[4d7fcb3]
  * consentpro-dictionary@0.1.2
  * consentpro-utils@2.0.3

## 2.2.4

### Patch Changes

* e40ba4b: fix: clear scan error state in loadScanResultsForScan; ensure scan error is cleared in Manager.svelte
* 172e0fa: allow editable provider even when added by us and remove verified badge
* 2837d26: feat: add expert link to login page

## 2.2.3

### Patch Changes

* ab66bf0: Add a `/v2/checkout` middleman redirect endpoint so the Finsweet Accounts checkout, which lives on a different domain, can still receive the Google Ads click cookies (`_gcl_aw`/`_gcl_au`) for attribution. The app now routes the "upgrade plan" flow through this endpoint instead of linking to Finsweet Accounts directly.
* 9295d27: - Hide the "Global Settings" tab until the site has at least one saved banner configuration. Draft banners on the canvas no longer reveal it, since there is nothing to configure globally yet.
  * Truncate long project domains with an ellipsis at 250px so the domain bar keeps its layout instead of being pushed out by the domain name.
  * consentpro-dictionary@0.1.1
  * consentpro-utils@2.0.3

## 2.2.2

### Patch Changes

* 81c0689: Harden Webflow Designer authentication, site isolation, and administrator permissions while reducing duplicate app boot work.

* 3fb6710: UX improvements: regions, banners, and action items.
  * **"EU Countries & UK"** uses Cloudflare’s EU list (+ UK): https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.is_in_european_union/
  * Create Banner: legislation and country/state filters for recommended banner types
  * Simplify Action items experience for the users
  * Domain management bar; chat-with-expert entry points; remove PMF survey

* 81c0689: Remove site-level notification recipient lists. Scheduled scans again use a per-schedule email, and transactional emails (exports, proofs, scan updates) go to the signed-in session email.

* 27d6762: add site id param to scanner history endpoint

* Updated dependencies \[a0173e0]

* Updated dependencies \[81c0689]

* Updated dependencies \[3fb6710]

* Updated dependencies \[9d4c732]
  * consentpro-dictionary@0.1.0
  * consentpro-utils@2.0.3

## 2.2.1

### Patch Changes

* 2487ddd: feat: runtime unblocking for manually blocked images
  * Added `blocking/images.ts` to the v2 runtime: images holding their URL in `fs-consent-src` with `fs-consent-categories` are loaded automatically once the visitor accepts the required categories, and unloaded again when consent is revoked. Unblock-only by design — a live image `src` fires its request immediately and cannot be intercepted.
  * Emit `image-blocked` / `image-unblocked` events, mirroring iframes.
  * Simplified the Consent Manager image instructions and docs: the manual consent-callback snippet is no longer needed, only the attribute swap.

* caebb9b: Move core activation analytics off the Designer extension onto authenticated server routes so events use a reliable Auth0 sub as distinct_id.

* 2487ddd: feat: report image trackers and cookie attribution

* Updated dependencies \[cb1d15a]
  * consentpro-utils@2.0.2
  * consentpro-dictionary@0.0.11

## 2.2.0

### Minor Changes

* f4ab509: feat: debugger auth

### Patch Changes

* 21ebdad: feat: Update FieldRenderer and GeneralInfoModal components with new styles and functionality
  * Added Button component to FieldRenderer for generating policies and custom item actions.
  * Updated dropdown properties in FieldRenderer for better UX.
  * Refactored input handling in FieldRenderer to use new Input and Checkbox components.
  * Enhanced styling in FieldRenderer to use CSS variables for consistency.
  * Modified GeneralInfoModal to include conditional field rendering based on form data.
  * Increased modal height for better content visibility.
  * Updated border and background styles in GeneralInfoModal for improved aesthetics.
  * Adjusted overflow properties in PolicyTemplateWizard and StepRenderer for better layout management.
  * Set default value for hasDpo in wizard state to 'no'.
  * Minor adjustments to cookie declaration template for better readability.
  * Updated GeneralInformation view background color to use CSS variables.
  * Added changelog entry for server updates.

* fc2af36: chore: use posthog reverse proxy

* 9eaafdc: fix(app): make purpose for data collection optional in privacy policy wizard
  feat(app): add folder icon to folder options in select-page dropdown

* 1f19ea2: fix: allow no animations

* 5407450: fix cookie declaration hydration

* c0d06e0: fix(app): persist company country and policy language in general info store

* e46032c: fix: Polish policy status transitions
  * Regenerating a policy now clears the persisted `last_status`, so policies that previously showed the **Not Found** status correctly transition back to **Ready to Publish** / **Published** once the element is re-injected onto the canvas.
  * Clicking **Save as Draft** on an already-generated policy (e.g. one with status **Ready to Publish**) now reverts the document to **Draft** state by clearing `generated_at` and `last_status`.
  * Policies flagged as **Not Found** are now automatically re-verified against the canvas when the Policies view loads. If the user restored a deleted element outside the view (e.g. via Webflow's undo), the status resets to the resolved value (Ready to Publish / Published / Update Needed) without requiring manual action.

* a75b3d6: Prepopulate cross-policy page link fields in the policy generation wizard (has page, page type, site page select, or external URL) from sibling policies that already exist under the same profile.

* fa75381: Enhance policy generator

* 6a29109: chore: resolve dependency to latest and update utils usage

* Updated dependencies \[494b74c]

* Updated dependencies \[73a3472]

* Updated dependencies \[5407450]
  * consentpro-dictionary@0.0.10
  * consentpro-utils@2.0.1

## 2.1.10

### Patch Changes

* fc2af36: chore: use posthog reverse proxy

## 2.1.9

### Patch Changes

* Updated dependencies \[e5d2aad]
  * consentpro-dictionary@0.0.9
  * consentpro-utils@2.0.1

## 2.1.8

### Patch Changes

* Updated dependencies \[353af98]
  * consentpro-dictionary@0.0.8
  * consentpro-utils@2.0.1

## 2.1.7

### Patch Changes

* ded7f80: update namings in usages of `consent-pro-**` to `consentpro-**`
* 73aa49f: feat: consent pro debugger
* Updated dependencies \[ded7f80]
* Updated dependencies \[73aa49f]
  * consentpro-dictionary@0.0.7
  * consentpro-utils@2.0.1

## 2.1.6

### Patch Changes

* 2ad5e11: chore: update dependencies
* 7ca34d9: chore: Enhance DatePicker component with tooltip wrapper.

## 2.1.5

### Patch Changes

* 7618a58: chore: improve login errors + track in posthog
* ef22755: chore: preserve manually added trackers
* Updated dependencies \[ef22755]
* Updated dependencies \[9cf51bd]
  * consentpro-utils@2.0.1
  * consentpro-dictionary@0.0.6

## 2.1.4

### Patch Changes

* ee6765d: fix: UI typo

## 2.1.3

### Patch Changes

* 8c82ca4: Update dependencies with Modal update from utils package to resolve safari bug
* Updated dependencies \[1a79dde]
  * consentpro-dictionary@0.0.5
  * consentpro-utils@2.0.0

## 2.1.2

### Patch Changes

* Updated dependencies \[1a79dde]
  * consentpro-dictionary@0.0.4
  * consentpro-utils@2.0.0

## 2.1.1

### Patch Changes

* 42dc7a9: chore: add more posthog event properties
* 298f5f6: fix configurator disabled message for language prop

## 2.1.0

### Minor Changes

* 6509630: feat: disable scroll behavior controls

### Patch Changes

* consentpro-dictionary@0.0.3
* consentpro-utils@2.0.0

## 2.0.1

### Patch Changes

* 683eeb0: chore: Update dependencies to latest versions across all packages and fix pnpm audit issues

## 2.0.0

### Major Changes

* e9bd587: NEW: Consent Pro V2 with Geolocation, Improved GTM handling and Instances Support

### Patch Changes

* 6029a6c: Update display time for scan schedule to be based on user timezone
* 5396021: Improved scan schedule feature plus posthog exeption tracking for schedule failures
* 2b400f7: Update scan schedule UI experience, introduce an email recipient field
* 2b400f7: feat: implement ConfirmScheduleModal for managing scan schedules
* c008017: chore: register PostHog events as Consent Pro for better segmentation
* dbc3aaf: fix: `app-visits` PostHog event
* 6029a6c: chore: add support for scheduling scans on a specific date
* Updated dependencies \[e9bd587]
* Updated dependencies \[6029a6c]
  * consentpro-utils@2.0.0
  * consentpro-dictionary@0.0.2

## 1.0.20

### Patch Changes

* 05189c5: fix: update handling for domains list in a project
* Updated dependencies \[05189c5]
  * consentpro-utils@1.0.16

## 1.0.19

### Patch Changes

* 8368c66: add posthog
* Updated dependencies \[8368c66]
  * consentpro-utils@1.0.15

## 1.0.18

### Patch Changes

* 1d12e86: add script async option with a todo

## 1.0.17

### Patch Changes

* 808c3d0: chore: fix global banner state

## 1.0.16

### Patch Changes

* Updated dependencies \[f8e135b]
  * consentpro-utils@1.0.14

## 1.0.15

### Patch Changes

* a64945c: chore: update wf analytics and add a flag to reset scripts scan category
* a3820e4: fix: ensure footer open prefs is able to toggle the banner

## 1.0.14

### Patch Changes

* Updated dependencies \[31fbd7c]
  * consentpro-utils@1.0.13

## 1.0.13

### Patch Changes

* c89966b: chore: global banner updates and animation library
* Updated dependencies \[c89966b]
  * consentpro-utils@1.0.12

## 1.0.12

### Patch Changes

* 8a9a493: add feature to support externally hosted banners and global banners with CSS imports
* Updated dependencies \[8a9a493]
  * consentpro-utils@1.0.11

## 1.0.11

### Patch Changes

* d8d52c0: chore: skip finsweet webflow apps scripts from scanner

## 1.0.10

### Patch Changes

* a37ec60: chore: update consent pro api to support legacy components api for cookie consent targets
* Updated dependencies \[a37ec60]
  * consentpro-utils@1.0.10

## 1.0.9

### Patch Changes

* 28a6a2d: Cleanup an update release runtime branch name
* Updated dependencies \[28a6a2d]
  * consentpro-utils@1.0.9

## 1.0.8

### Patch Changes

* 4804467: feat: update consent pro for new migration
* Updated dependencies \[4804467]
  * consentpro-utils@1.0.8

## 1.0.7

### Patch Changes

* 077f9a4: cleanup console message
* Updated dependencies \[077f9a4]
  * consentpro-utils@1.0.7

## 1.0.6

### Patch Changes

* aa8257a: chore: update release sync branches ci with a release-runtime-v\*\* naming strategy
* Updated dependencies \[aa8257a]
  * consentpro-utils@1.0.6

## 1.0.5

### Patch Changes

* b5be59c: chore: update release
* Updated dependencies \[b5be59c]
  * consentpro-utils@1.0.5

## 1.0.4

### Patch Changes

* 1b689fc: chore: update release pipeline for branch auto sync
* Updated dependencies \[1b689fc]
  * consentpro-utils@1.0.4

## 1.0.3

### Patch Changes

* c20f5c9: chore: improve legacy config management and handling
* Updated dependencies \[c20f5c9]
  * consentpro-utils@1.0.3

## 1.0.2

### Patch Changes

* 3152bd4: chore: update webflow hooks, configurator handling and runtime scripts
* Updated dependencies \[3152bd4]
  * consentpro-utils@1.0.2

## 1.0.1

### Patch Changes

* 675a6e2: remove Instance name fields from builder
* 734f061: chore: release updates
* Updated dependencies \[734f061]
  * consentpro-utils@1.0.1

## 1.0.0

### Major Changes

* 5b7551a: initial setup for consent pro and migration of cc into consent pro

### Patch Changes

* 65a0083: update consent pro and include whitelist feature
* Updated dependencies \[5b7551a]
* Updated dependencies \[65a0083]
  * consentpro-utils@1.0.0

## 1.0.0

### Major Changes

* a7345fa: Initialize Consent Pro

### Patch Changes

* 7ac1289: add tests