ThumbmarkJS Files

Highlights

• api_endpoint now supports custom paths. If the configured api_endpoint has no path, /thumbmark is appended as before (backwards compatible). If it has a path, it's used as-is. A trailing slash explicitly means "use this exact endpoint, don't append /thumbmark". (#137)
• New simple_request option. When true, the API call is sent as a CORS "simple request" — Content-Type: text/plain with no x-api-key/Authorization headers — so it avoids a CORS preflight. Intended for setups that route through a proxy which injects the real API key. The call-trigger gate was relaxed so a dummy api_key is no longer required to fire the request. (#139)
• api_key is no longer included in the request body. It is sent only via the x-api-key header (normal mode) or injected by the proxy (simple_request mode). (#139)

Maintenance

• Security: bumped transitive dev deps form-data → 4.0.6 (CRLF injection, HIGH) and @babel/core → 7.29.7 (arbitrary file read, LOW), resolving two Dependabot alerts. (#142)
• Packaging: test files (*.test.ts) are no longer shipped in the npm tarball. (#143)

Note on fingerprint stability

The fingerprint output is unchanged from 1.9.1. Components that had been experimentally graduated (intl, mediadevices, mathml) were rolled back before this release — mediadevices was far too slow on real hardware (~166 ms/call) and intl/mathml added negligible entropy — so existing fingerprint hashes remain stable across this upgrade.