Appearance

app ​

2.3.5 ​

Patch Changes ​

  • 28b754d: Stop putting the account email address in Finsweet Accounts navigation URLs. The Designer extension now links out with a short-lived opaque account reference, which the Consent Pro server resolves before redirecting. The destination journey is unchanged.
  • Updated dependencies [9a490af]
  • Updated dependencies [fecdc78]
  • Updated dependencies [8384efa]
  • Updated dependencies [d3e426d]
  • Updated dependencies [d7331e4]
    • web-components@0.0.2
    • consentpro-utils@2.1.1
    • consentpro-dictionary@0.1.6

2.3.4 ​

Patch Changes ​

  • consentpro-dictionary@0.1.5
  • consentpro-utils@2.1.0

2.3.3 ​

Patch Changes ​

  • 4a2d1af: chore(deps): clear the pnpm audit backlog

    pnpm audit went from 17 findings (5 high, 10 moderate, 2 low) to 0 unignored.

    Direct dependency updates:

    • server: hono 4.12.34 → 4.13.7, covering three advisories: unbounded dot-notation nesting in parseBody(), query parameters read after the URL fragment, and the incomplete toSSG() fix for CVE-2026-39408
    • root, app, server: vitest 4.1.0 → 4.1.11, for the @vitest/mocker path traversal

    Transitive pins added via pnpm.overrides:

    • @ai-sdk/provider-utils → 4.0.51 (uncontrolled resource consumption, via @ai-sdk/openai)
    • @vitest/mocker → 4.1.11
    • csv-parse → 7.0.2 (prototype replacement via columns, via @finsweet/webflow-apps-utils)
    • fflate → 0.4.9 (infinite loop in unzipSync on malformed input, via posthog-js)
    • qs → 6.16.0 (array-limit bypass and attacker-controlled isBuffer DoS, via webflow-api)

    Existing overrides refreshed, because the versions they pinned were themselves flagged since they were added:

    • js-yaml 3.15.1 → 3.15.2 and 4.3.1 → 4.3.2
    • sharp 0.35.3 → 0.35.4 (libheif vulnerabilities, via wrangler → miniflare)

    Two advisories are added to pnpm.auditConfig.ignoreCves because no fixed release exists upstream yet. Both are archive-extraction symlink traversals reachable only from build and browser-download tooling, not from any runtime request path:

    • CVE-2026-19693, extract-zip <=2.0.1 via @cloudflare/puppeteer → @puppeteer/browsers
    • CVE-2026-76845, adm-zip <=0.6.0 via @webflow/webflow-cli → @module-federation/dts-plugin

    Both should be removed from the ignore list once upstream ships a fix.

2.3.2 ​

Patch Changes ​

  • Updated dependencies [f528b4f]
    • consentpro-dictionary@0.1.4
    • consentpro-utils@2.1.0

2.3.1 ​

Patch Changes ​

  • a3d3d4b: Fix the "Run your first scan" action item flashing on sites that have already been scanned.

    Action-item sync started before scan history loaded, so the client sent hasFirstScan: false and the first-scan CTA appeared until the next poll. Sync now waits until scan state is hydrated, then sends the real value.

    The Action Items view also no longer sits on its loading state when the sync request fails.

2.3.0 ​

Minor Changes ​

  • 55656ae: Add optional public hostname and path prefix so reverse-proxied sites publish a hostname.json for the visitor host and expose the site information the runtime uses to compose public URLs.

    The Webflow domain is unchanged. Custom-domain sites publish publicHostname and, when mounted under a prefix, pathPrefix. The runtime composes these with locale subdirectories and page slugs. Sites without these settings are unaffected.

Patch Changes ​

  • ba392c6: fix: stop the Designer session from being logged out by a hidden tab

    Chrome stalls a backgrounded tab: webflow.getIdToken() stops resolving and setTimeout is clamped to roughly once a minute, so the 4s guard on the token fetch took ~60s to give up. The action items poller kept running every 10s regardless, and a single failed refresh locked the app to the re-authorize screen with no way back but the manual retry. Because it happened while the tab was hidden, users only saw the lock when they returned, which made it look like idling logged them out.

    • Pause the action items poller while the tab is hidden, and run it once as soon as it is visible again (opt-in pauseWhenHidden on createPoller, so the re-authorization poller keeps running while the OAuth popup holds focus).
    • Do not lock the app when a token fetch fails while the tab is hidden, including on the re-bootstrap after re-authorization, where the OAuth popup leaves the Designer hidden.
    • Clear the lock when a Consent Pro request issued since that lock succeeds, so a recovered session unlocks itself without a response from before the lock unlocking a dead one.

  • 4afc228: Remove the dictionary-matched-review confirmation step. Trackers matched against our verified database now publish immediately without requiring manual confirmation, reducing steps to live. The "Confirm matched trackers from our verified database" action item group is removed from the UI, and any pre-existing resolved/unresolved rows of this type stop being surfaced.

  • Updated dependencies [55656ae]

    • consentpro-utils@2.1.0
    • consentpro-dictionary@0.1.3

2.2.6 ​

Patch Changes ​

  • 03bd744: chore(deps): resolve open Dependabot PRs and clear the pnpm audit backlog

    Direct dependency updates:

    • app: axios 1.16.0 → 1.18.0, posthog-js 1.336.1 → 1.417.0
    • consentpro-v1: nanoid 5.1.6 → 5.1.16, esbuild 0.27.3 → 0.28.1
    • consentpro-v2: esbuild 0.27.3 → 0.28.1
    • server: hono 4.12.21 → 4.12.34
    • consentpro-debugger: vite 7.3.2 → 7.3.6

    Transitive advisories are pinned to patched versions via pnpm.overrides (tar, undici, brace-expansion, js-yaml, protobufjs, fast-uri, ip-address, postcss, nanoid, form-data, ws, adm-zip, shell-quote, sharp, dompurify, esbuild), taking pnpm audit from 89 findings (1 critical, 41 high, 35 moderate, 12 low) to 0.

    The posthog-js bump also removes the @opentelemetry/* and protobufjs subtrees, which were never reachable from the shipped extension bundle. Telemetry configuration is unchanged and the pinned defaults: '2025-05-24' still applies, so capture behaviour is identical.

    Two advisories have no published fix and are recorded in pnpm.auditConfig.ignoreCves rather than resolved — CVE-2026-56876 (extract-zip, via @cloudflare/puppeteer) and CVE-2025-14505 (elliptic, via @webflow/webflow-cli). Neither is reachable from a shipped artifact.

2.2.5 ​

Patch Changes ​

  • Updated dependencies [4d7fcb3]
    • consentpro-dictionary@0.1.2
    • consentpro-utils@2.0.3

2.2.4 ​

Patch Changes ​

  • e40ba4b: fix: clear scan error state in loadScanResultsForScan; ensure scan error is cleared in Manager.svelte
  • 172e0fa: allow editable provider even when added by us and remove verified badge
  • 2837d26: feat: add expert link to login page

2.2.3 ​

Patch Changes ​

  • ab66bf0: Add a /v2/checkout middleman redirect endpoint so the Finsweet Accounts checkout, which lives on a different domain, can still receive the Google Ads click cookies (_gcl_aw/_gcl_au) for attribution. The app now routes the "upgrade plan" flow through this endpoint instead of linking to Finsweet Accounts directly.
  • 9295d27: - Hide the "Global Settings" tab until the site has at least one saved banner configuration. Draft banners on the canvas no longer reveal it, since there is nothing to configure globally yet.
    • Truncate long project domains with an ellipsis at 250px so the domain bar keeps its layout instead of being pushed out by the domain name.
    • consentpro-dictionary@0.1.1
    • consentpro-utils@2.0.3

2.2.2 ​

Patch Changes ​

  • 81c0689: Harden Webflow Designer authentication, site isolation, and administrator permissions while reducing duplicate app boot work.

  • 3fb6710: UX improvements: regions, banners, and action items.

  • 81c0689: Remove site-level notification recipient lists. Scheduled scans again use a per-schedule email, and transactional emails (exports, proofs, scan updates) go to the signed-in session email.

  • 27d6762: add site id param to scanner history endpoint

  • Updated dependencies [a0173e0]

  • Updated dependencies [81c0689]

  • Updated dependencies [3fb6710]

  • Updated dependencies [9d4c732]

    • consentpro-dictionary@0.1.0
    • consentpro-utils@2.0.3

2.2.1 ​

Patch Changes ​

  • 2487ddd: feat: runtime unblocking for manually blocked images

    • Added blocking/images.ts to the v2 runtime: images holding their URL in fs-consent-src with fs-consent-categories are loaded automatically once the visitor accepts the required categories, and unloaded again when consent is revoked. Unblock-only by design — a live image src fires its request immediately and cannot be intercepted.
    • Emit image-blocked / image-unblocked events, mirroring iframes.
    • Simplified the Consent Manager image instructions and docs: the manual consent-callback snippet is no longer needed, only the attribute swap.

  • caebb9b: Move core activation analytics off the Designer extension onto authenticated server routes so events use a reliable Auth0 sub as distinct_id.

  • 2487ddd: feat: report image trackers and cookie attribution

  • Updated dependencies [cb1d15a]

    • consentpro-utils@2.0.2
    • consentpro-dictionary@0.0.11

2.2.0 ​

Minor Changes ​

  • f4ab509: feat: debugger auth

Patch Changes ​

  • 21ebdad: feat: Update FieldRenderer and GeneralInfoModal components with new styles and functionality

    • Added Button component to FieldRenderer for generating policies and custom item actions.
    • Updated dropdown properties in FieldRenderer for better UX.
    • Refactored input handling in FieldRenderer to use new Input and Checkbox components.
    • Enhanced styling in FieldRenderer to use CSS variables for consistency.
    • Modified GeneralInfoModal to include conditional field rendering based on form data.
    • Increased modal height for better content visibility.
    • Updated border and background styles in GeneralInfoModal for improved aesthetics.
    • Adjusted overflow properties in PolicyTemplateWizard and StepRenderer for better layout management.
    • Set default value for hasDpo in wizard state to 'no'.
    • Minor adjustments to cookie declaration template for better readability.
    • Updated GeneralInformation view background color to use CSS variables.
    • Added changelog entry for server updates.

  • fc2af36: chore: use posthog reverse proxy

  • 9eaafdc: fix(app): make purpose for data collection optional in privacy policy wizard feat(app): add folder icon to folder options in select-page dropdown

  • 1f19ea2: fix: allow no animations

  • 5407450: fix cookie declaration hydration

  • c0d06e0: fix(app): persist company country and policy language in general info store

  • e46032c: fix: Polish policy status transitions

    • Regenerating a policy now clears the persisted last_status, so policies that previously showed the Not Found status correctly transition back to Ready to Publish / Published once the element is re-injected onto the canvas.
    • Clicking Save as Draft on an already-generated policy (e.g. one with status Ready to Publish) now reverts the document to Draft state by clearing generated_at and last_status.
    • Policies flagged as Not Found are now automatically re-verified against the canvas when the Policies view loads. If the user restored a deleted element outside the view (e.g. via Webflow's undo), the status resets to the resolved value (Ready to Publish / Published / Update Needed) without requiring manual action.

  • a75b3d6: Prepopulate cross-policy page link fields in the policy generation wizard (has page, page type, site page select, or external URL) from sibling policies that already exist under the same profile.

  • fa75381: Enhance policy generator

  • 6a29109: chore: resolve dependency to latest and update utils usage

  • Updated dependencies [494b74c]

  • Updated dependencies [73a3472]

  • Updated dependencies [5407450]

    • consentpro-dictionary@0.0.10
    • consentpro-utils@2.0.1

2.1.10 ​

Patch Changes ​

  • fc2af36: chore: use posthog reverse proxy

2.1.9 ​

Patch Changes ​

  • Updated dependencies [e5d2aad]
    • consentpro-dictionary@0.0.9
    • consentpro-utils@2.0.1

2.1.8 ​

Patch Changes ​

  • Updated dependencies [353af98]
    • consentpro-dictionary@0.0.8
    • consentpro-utils@2.0.1

2.1.7 ​

Patch Changes ​

  • ded7f80: update namings in usages of consent-pro-** to consentpro-**
  • 73aa49f: feat: consent pro debugger
  • Updated dependencies [ded7f80]
  • Updated dependencies [73aa49f]
    • consentpro-dictionary@0.0.7
    • consentpro-utils@2.0.1

2.1.6 ​

Patch Changes ​

  • 2ad5e11: chore: update dependencies
  • 7ca34d9: chore: Enhance DatePicker component with tooltip wrapper.

2.1.5 ​

Patch Changes ​

  • 7618a58: chore: improve login errors + track in posthog
  • ef22755: chore: preserve manually added trackers
  • Updated dependencies [ef22755]
  • Updated dependencies [9cf51bd]
    • consentpro-utils@2.0.1
    • consentpro-dictionary@0.0.6

2.1.4 ​

Patch Changes ​

  • ee6765d: fix: UI typo

2.1.3 ​

Patch Changes ​

  • 8c82ca4: Update dependencies with Modal update from utils package to resolve safari bug
  • Updated dependencies [1a79dde]
    • consentpro-dictionary@0.0.5
    • consentpro-utils@2.0.0

2.1.2 ​

Patch Changes ​

  • Updated dependencies [1a79dde]
    • consentpro-dictionary@0.0.4
    • consentpro-utils@2.0.0

2.1.1 ​

Patch Changes ​

  • 42dc7a9: chore: add more posthog event properties
  • 298f5f6: fix configurator disabled message for language prop

2.1.0 ​

Minor Changes ​

  • 6509630: feat: disable scroll behavior controls

Patch Changes ​

  • consentpro-dictionary@0.0.3
  • consentpro-utils@2.0.0

2.0.1 ​

Patch Changes ​

  • 683eeb0: chore: Update dependencies to latest versions across all packages and fix pnpm audit issues

2.0.0 ​

Major Changes ​

  • e9bd587: NEW: Consent Pro V2 with Geolocation, Improved GTM handling and Instances Support

Patch Changes ​

  • 6029a6c: Update display time for scan schedule to be based on user timezone
  • 5396021: Improved scan schedule feature plus posthog exeption tracking for schedule failures
  • 2b400f7: Update scan schedule UI experience, introduce an email recipient field
  • 2b400f7: feat: implement ConfirmScheduleModal for managing scan schedules
  • c008017: chore: register PostHog events as Consent Pro for better segmentation
  • dbc3aaf: fix: app-visits PostHog event
  • 6029a6c: chore: add support for scheduling scans on a specific date
  • Updated dependencies [e9bd587]
  • Updated dependencies [6029a6c]
    • consentpro-utils@2.0.0
    • consentpro-dictionary@0.0.2

1.0.20 ​

Patch Changes ​

  • 05189c5: fix: update handling for domains list in a project
  • Updated dependencies [05189c5]
    • consentpro-utils@1.0.16

1.0.19 ​

Patch Changes ​

  • 8368c66: add posthog
  • Updated dependencies [8368c66]
    • consentpro-utils@1.0.15

1.0.18 ​

Patch Changes ​

  • 1d12e86: add script async option with a todo

1.0.17 ​

Patch Changes ​

  • 808c3d0: chore: fix global banner state

1.0.16 ​

Patch Changes ​

  • Updated dependencies [f8e135b]
    • consentpro-utils@1.0.14

1.0.15 ​

Patch Changes ​

  • a64945c: chore: update wf analytics and add a flag to reset scripts scan category
  • a3820e4: fix: ensure footer open prefs is able to toggle the banner

1.0.14 ​

Patch Changes ​

  • Updated dependencies [31fbd7c]
    • consentpro-utils@1.0.13

1.0.13 ​

Patch Changes ​

  • c89966b: chore: global banner updates and animation library
  • Updated dependencies [c89966b]
    • consentpro-utils@1.0.12

1.0.12 ​

Patch Changes ​

  • 8a9a493: add feature to support externally hosted banners and global banners with CSS imports
  • Updated dependencies [8a9a493]
    • consentpro-utils@1.0.11

1.0.11 ​

Patch Changes ​

  • d8d52c0: chore: skip finsweet webflow apps scripts from scanner

1.0.10 ​

Patch Changes ​

  • a37ec60: chore: update consent pro api to support legacy components api for cookie consent targets
  • Updated dependencies [a37ec60]
    • consentpro-utils@1.0.10

1.0.9 ​

Patch Changes ​

  • 28a6a2d: Cleanup an update release runtime branch name
  • Updated dependencies [28a6a2d]
    • consentpro-utils@1.0.9

1.0.8 ​

Patch Changes ​

  • 4804467: feat: update consent pro for new migration
  • Updated dependencies [4804467]
    • consentpro-utils@1.0.8

1.0.7 ​

Patch Changes ​

  • 077f9a4: cleanup console message
  • Updated dependencies [077f9a4]
    • consentpro-utils@1.0.7

1.0.6 ​

Patch Changes ​

  • aa8257a: chore: update release sync branches ci with a release-runtime-v** naming strategy
  • Updated dependencies [aa8257a]
    • consentpro-utils@1.0.6

1.0.5 ​

Patch Changes ​

  • b5be59c: chore: update release
  • Updated dependencies [b5be59c]
    • consentpro-utils@1.0.5

1.0.4 ​

Patch Changes ​

  • 1b689fc: chore: update release pipeline for branch auto sync
  • Updated dependencies [1b689fc]
    • consentpro-utils@1.0.4

1.0.3 ​

Patch Changes ​

  • c20f5c9: chore: improve legacy config management and handling
  • Updated dependencies [c20f5c9]
    • consentpro-utils@1.0.3

1.0.2 ​

Patch Changes ​

  • 3152bd4: chore: update webflow hooks, configurator handling and runtime scripts
  • Updated dependencies [3152bd4]
    • consentpro-utils@1.0.2

1.0.1 ​

Patch Changes ​

  • 675a6e2: remove Instance name fields from builder
  • 734f061: chore: release updates
  • Updated dependencies [734f061]
    • consentpro-utils@1.0.1

1.0.0 ​

Major Changes ​

  • 5b7551a: initial setup for consent pro and migration of cc into consent pro

Patch Changes ​

  • 65a0083: update consent pro and include whitelist feature
  • Updated dependencies [5b7551a]
  • Updated dependencies [65a0083]
    • consentpro-utils@1.0.0

1.0.0 ​

Major Changes ​

  • a7345fa: Initialize Consent Pro

Patch Changes ​

  • 7ac1289: add tests