ThumbmarkJS Files

Highlights

• Experimental signals now come from a CDN payload instead of the bundle. When the sampled logging path fires (at most 0.01% of runs, and never more than once per browser session), the library fetches a small script from experimental.thumbmarkjs.com, evaluates it, and includes the result in the anonymous sample. Signals still under evaluation can now be iterated without an npm release — a new signal ships by publishing a new artifact, with no version bump and no integrator upgrade. They are not part of the fingerprint hash and are never returned to the caller. Set logging: false to disable both the sample and the fetch. The script is published in readable, non-minified form alongside the minified build the library loads, so you can read exactly what runs: experimental.js (experimental.thumbmarkjs.com). See Sampled logging in the README. (#148, [#149])
• The bundle got smaller. gzip 11,908 → 11,213 B (−5.8%), raw 32,194 → 30,316 B. The bundled mathml component is removed and replaced by a smaller fetch module; the payload itself is fetched at runtime and never enters the bundle.

Breaking changes

Both concern the opt-in experimental surface rather than documented fingerprinting, which is why this is a minor release.

• ThumbmarkResponse.experimental has been removed. TypeScript consumers reading it will get a compile error.
• options.experimental no longer has any effect. It is still accepted, so passing it is not an error, and is now marked @deprecated — it will be removed in 2.0. Previously it resolved the bundled components and returned them to the caller without logging them, so the signals never reached us.
• The mathml component has been deleted. It was the only bundled experimental component and was never exported from the public API.

Maintenance

• Security: patched five high-severity advisories in transitive dev dependencies — js-yaml → 3.15.1, fast-uri → 3.1.5, brace-expansion → 1.1.18 / 2.1.4. All development-scoped, so none reached the published bundle. npm audit reports 0 vulnerabilities. (#147)
• The README now documents sampled logging, including the remote fetch and evaluation, what it does and does not collect, and how a Content Security Policy affects it. (#149)

Note on fingerprint stability

The fingerprint output is unchanged from 1.10.1. Experimental signals never entered the hash, so existing thumbmark hashes remain stable across this upgrade.