Changelog
All notable changes to the CookieYes SDK. Follows Keep a Changelog and Semantic Versioning.
November 2026
ui 0.1.1
- Minor
- init can now run without questions, for scripts, CI and AI coding tools: pass the answers as flags.
- Patch
- runBackendConformance reads the server's URL when each check runs, so a server started in beforeAll works.
- Patch
- The npm page of each package now opens with the CookieYes banner image, badges and section links, like the other CookieYes packages.
October 2026
backend 0.1.0
- Minor
- New: @cookieyes/backend, a consent server you run yourself.
- Minor
- Each consent record now says which SDK build sent it and whether the visitor's browser sent Global Privacy Control, so a stored record carries more of the evidence you need to show what the visitor saw.
- Minor
- The banner now works under a strict Content Security Policy when it is server-rendered, "Powered by" is translated, and every control in the opt-out dialog and the reload notice can be styled by part.
- Minor
- The banner's stylesheet, theme tokens and markup now live in one framework-free package, @cookieyes/ui, so every framework draws the same banner.
- Minor
- New: @cookieyes/test/backend, a conformance suite that proves a consent server keeps the contract the SDK's self-hosted mode relies on, whatever language it is written in.
- Minor
- New: @cookieyes/test/conformance, one test suite that proves a banner behaves like every other CookieYes banner, whatever framework drew it.
- Minor
- New: @cookieyes/vanilla, the CookieYes banner for any web page with no framework, or a framework without an adapter yet.
- Patch
- Apps set up in self-hosted mode by cookieyes init now retry a consent record that their server failed to store.
- Patch
- The network blocker compares hosts in linear time, so a host or rule domain ending in a long run of dots can no longer slow it down.
- Patch
- The conformance suite's accessibility check no longer times out on a busy machine.
devtools 0.2.0
- Minor
- The Scanner now recognises Ahrefs Web Analytics, and suggests the ready-made integration for Ahrefs and Hotjar.
- Minor
- Ahrefs Web Analytics now loads only after analytics consent, with one line of configuration.
- Minor
- Hotjar now loads only after analytics consent, and its cookies are deleted when consent is withdrawn.
react 0.13.3
- Minor
- Pages that run the SDK now identify it in the browser, so public technology scanners can recognise sites that use it.
react 0.13.2
- Patch
- The network blocker now stops requests to a denied domain even when the hostname is written with a trailing dot.
devtools 0.1.1
- Patch
- TypeScript projects that load the SDK with require now get type declarations that match the CommonJS build.
- Patch
- The packages are smaller to install, and debugging into them works as before.
devtools 0.1.0: Devtools: see and test what the SDK does in development
- Minor
- The SDK now reports what it is doing in development, so the new @cookieyes/devtools panel can show it.
- Minor
- New package: @cookieyes/devtools, a panel for your dev server that shows what the SDK is doing and lets you test it.
- Patch
- The README on npm now opens with the CookieYes banner, like the other packages.
react 0.12.0: Block videos, maps and other iframes until consent
- Minor
- Block YouTube videos, maps and other iframes until consent, on any site.
September 2026
react 0.11.0: Provable consent records and per-module imports
- Minor
- Every consent record now carries what you need to prove the decision later.
- Patch
- The READMEs now link to the documentation site, [developers.cookieyes.com](https://developers.cookieyes.com).
- Patch
- Apps now download only the parts of @cookieyes/react they use.
react 0.10.0: A modal banner and a close button that only closes
- Minor
- Make the banner modal, give it a close button that only closes, and fix focus and screen-reader gaps in the banner and the opt-out dialog.
react 0.9.0: Accessibility fixes across the banner and dialogs
- Minor
- Fix twelve accessibility defects in the banner and dialogs.
react 0.8.0: Banner CSS in the first response
- Minor
- Fix the stylesheet import for pnpm users: @cookieyes/nextjs now exports its own styles.css and critical.css.
- Minor
- Put the banner's CSS in the first response: <CookieYesStyles /> and a styles-route handler.
- Minor
- Take another 0.66 KB of gzip out of the initial download by loading the custom-theme runtime only when a theme is actually configured: banner + preferences + recall goes from 14.92 KB to 14.26 KB over an empty Next.js app, and the banner alone from 14.37 KB to 13.73 KB.
react 0.7.0: A smaller initial download
- Minor
- Load the integration runner on demand.
- Minor
- The network blocker now ships as its own entry point, @cookieyes/core/network-blocker, so customers who do not use it no longer download it.
- Minor
- Take a further 2.37 KB of gzip out of the initial download: the banner goes from 17.24 KB to 14.87 KB over an empty Next.js app, and banner + preferences + recall from 17.78 KB to 15.41 KB.
- Patch
- Stop shipping deprecation-warning text to visitors.
- Patch
- Re-export registerNetworkBlocker from @cookieyes/react and @cookieyes/nextjs, so the networkBlocker config key on those packages is actually usable from those packages.
- Patch
- Take 1.11 KB of gzip out of the banner, with no visual, behavioural or API change.
react 0.6.1: README corrections
- Patch
- Reconcile the README's accessibility scope with what the automated suite actually covers.
- Patch
- Correct the useConsent() return shape in the README.
- Patch
- Correct the README's SSR-safety claim.
react 0.6.0: Translatable labels, part styling and script presets
- Minor
- Remove three configuration options that were declared in the public types but read by nothing: consentCategories, theme.buttonVariant, and theme.widgetPosition.
- Minor
- Remove the strategy prop from <GatedScript /> and the matching strategy field from ScriptEntry.
- Minor
- Explicit theme colors now survive dark mode, and three new styling tokens.
- Minor
- Make nine previously hardcoded English strings translatable.
- Minor
- Dev-mode console warnings for low-contrast theme colours.
- Minor
- Dev-mode console warning when the installed React version is newer than anything this SDK's CI
- Minor
- Per-part styling for the presets.
- Minor
- Primary buttons now visibly darken on hover instead of only fading.
- Minor
- Add PostHog and Microsoft Clarity integrations.
- Patch
- Correct two inaccuracies in the CLI README.
- Patch
- Give every documentation link a working destination.
- Patch
- State a concrete removal timeline everywhere a deprecation promises one.
- Patch
- resetConsentRuntime() now un-patches fetch, XMLHttpRequest and navigator.sendBeacon before dropping the runtime.
- Patch
- Point the blocked-style console warning at the published CSP documentation instead of a GitHub README anchor.
- Patch
- Export the prop types for <RecallButton />, <GatedScript /> and <GatedFrame /> as RecallButtonProps, GatedScriptProps and GatedFrameProps.
- Patch
- Remove buttonVariant and widgetPosition from the README's theme example.
- Patch
- Fix the "no runtime is registered" error and the "mounted more than once" warning to name initCookieYes(...), the current API, instead of the deprecated createCookieYes().mount() builder they mistakenly still referenced.
August 2026
react 0.5.0: Geo-detection, script integrations and critical CSS
- Minor
- Add optional region-based regulation (geo-detection).
- Minor
- Add consent-gated third-party integrations.
- Minor
- Returning visitors no longer see the banner flash before it disappears
- Minor
- Add @cookieyes/react/critical.css; the paint-critical banner stylesheet
- Minor
- New package: @cookieyes/test; a headless test double for unit-testing consent-dependent code.
- Patch
- Point the generated Next.js layout at the returning-visitor setup
- Patch
- A failing third-party tag can no longer strand the consent banner, or stop the SDK mounting
- Patch
- Add clearScriptRegistry(); an internal, test-only reset for the consent-gated script registry, mirroring the existing clearStopHandlers().
- Patch
- Fix the banner painting unstyled on first load, and replace its slide-in with a fade
- Patch
- The banner no longer fades in twice on slower devices
- Patch
- Minify the shipped stylesheets
react 0.4.0: Consent events, live language switching, restyling
- Minor
- Add a GitHub star nudge to init.
- Minor
- Add a consent event API for reacting to consent changes.
- Minor
- Translations for custom UIs, with live language switching.
- Minor
- Make the components easy to restyle.
July 2026
cli 0.2.1: CLI dependency update
- Patch
- Update runtime dependency @clack/prompts from 1.5.0 to 1.7.0.
react 0.3.0: Custom categories, Consent Mode v2 and strict CSP
- Minor
- Add mode: "cookie-only" as the clearer, self-explanatory replacement for mode: "offline".
- Minor
- Standardize the configuration API across packages with a single canonical
- Minor
- Fix the banner, dialogs, and theme colors breaking under a strict
- Minor
- Make consent categories configurable, and broadcast Google Consent Mode v2 automatically.
- Minor
- Stop tracking safely when consent is withdrawn; without reloading the page.
- Patch
- Overhaul all five package READMEs onto one consistent house template (DEVP-3).
- Patch
- Gate consent-driven content on committed decisions, not live toggles.
- Patch
- Document one recommended way to read consent per platform; useConsent()
- Patch
- Fix keyboard/focus-management and screen-reader gaps in <CookieBanner />,
June 2026
react 0.2.0: Server-rendered banner and smaller bundles
- Minor
- Faster, smaller-footprint, deterministic banner + first-party minified bundles.