@decocms/blocks 7.62.3 → 7.62.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.62.3",
+  "version": "7.62.4",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/sdk/urlUtils.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { cleanPathForCacheKey, isTrackingParam } from "./urlUtils";
+
+describe("tracking params that used to fragment the cache key", () => {
+  // Each of these was measured missing the edge cache on every route probed on a
+  // production storefront, because it was absent from UTM_PARAMS.
+  const cases = [
+    ["GA4 campaign id", "utm_id"],
+    ["GA4 source platform", "utm_source_platform"],
+    ["Google Ads source", "gad_source"],
+    ["Google Ads iOS click id", "gbraid"],
+    ["Google Ads web-to-app click id", "wbraid"],
+    ["GA cross-domain linker", "_gl"],
+    ["Instagram", "igshid"],
+    ["Pinterest", "epik"],
+    ["Marketo", "mkt_tok"],
+    ["Yandex", "yclid"],
+  ] as const;
+
+  for (const [label, param] of cases) {
+    it(`strips ${label} (${param})`, () => {
+      expect(isTrackingParam(param)).toBe(true);
+      expect(cleanPathForCacheKey(`https://x.com/aneis?color=ouro&${param}=abc`)).toBe(
+        "/aneis?color=ouro",
+      );
+    });
+  }
+
+  it("still keeps functional params", () => {
+    for (const p of ["page", "order", "map", "PS", "filter.color", "skuId", "q"]) {
+      expect(isTrackingParam(p)).toBe(false);
+    }
+  });
+});

package/src/sdk/urlUtils.ts

@@ -25,6 +25,27 @@ const UTM_PARAMS = new Set([
   "mc_eid",
   "ttclid",
   "srsltid",
+  // GA4's newer campaign params. The five classic `utm_*` above predate them,
+  // so a GA4-tagged campaign was still fragmenting the cache key.
+  "utm_id",
+  "utm_source_platform",
+  "utm_creative_format",
+  "utm_marketing_tactic",
+  // Google Ads click ids that replaced bare `gclid` for privacy-restricted
+  // traffic (iOS/Safari), plus the source tag now appended to essentially every
+  // Google Ads click. Measured on a production storefront: each of these missed
+  // the edge cache on 3/3 routes probed, deterministically.
+  "gad_source",
+  "gad_campaignid",
+  "gbraid",
+  "wbraid",
+  // Google Analytics cross-domain linker. Sites already strip this by hand in
+  // client code, which is the tell that it shows up in real URLs.
+  "_gl",
+  "igshid",
+  "epik",
+  "mkt_tok",
+  "yclid",
 ]);
 
 /**