ThumbmarkJS Files

Highlights

• Fixed require() / CommonJS resolution. package.json declares "type": "module", which makes Node parse every .js file in the package as ESM — so the CommonJS build shipped as dist/thumbmark.cjs.js was loaded as ESM and threw ReferenceError: exports is not defined in ES module scope. This broke any consumer resolving through the require condition (CommonJS require(), SSR / target: 'node' bundles, esbuild --format=cjs); bundlers like webpack often hid it, surfacing later as X is not a constructor. The CJS artifact is now correctly named dist/thumbmark.cjs. This has been present in every release since 0.20.6. Not a breaking change — the exports map has no wildcard, so the old path was never importable. Thanks @timofeevAV. (#144)

Maintenance

• Security: pinned transitive dev dep js-yaml → 3.15.0 (quadratic-complexity DoS in merge-key handling, MODERATE) via an npm overrides, resolving a Dependabot alert. (#145)
• Build: declared tslib as a devDependency — it's an undeclared peer requirement of @rollup/plugin-typescript, and a clean npm ci && npm run build failed without it. (#145)
• Release safety: added a prepublishOnly hook that builds and runs the full test suite before every publish, so a stale or broken artifact can no longer be shipped. (#145)
• Added src/packaging.test.ts, which loads the built CommonJS artifact in a real node process to guard the packaging regression above (Jest's own module wrapper masks it). (#144)

Note on fingerprint stability

The fingerprint output is unchanged from 1.10.0. This release is packaging and maintenance only — no component or hashing changes — so existing fingerprint hashes remain stable across this upgrade.