@duckduckgo/autoconsent 16.46.0 → 16.48.0

package/.github/dependabot.yml

@@ -4,6 +4,12 @@ updates:
       directory: '/' # Location of package manifests
       schedule:
           interval: 'weekly'
+      cooldown:
+          default-days: 7
+      ignore:
+          # typescript-eslint and ts-node do not support TypeScript 7 yet.
+          - dependency-name: 'typescript'
+            versions: ['>=7']
       labels:
           - 'category: dependencies'
       groups:

package/.github/labeler.yml

@@ -36,7 +36,7 @@
                 - 'web-test-runner.config.mjs'
 
 # Not a release-note category: exactly one 'category:' label is required per PR.
-'code-update-needed':
+'needs-code-update':
     - changed-files:
           - any-glob-to-any-file:
                 - 'lib/**/*.ts'

package/.github/workflows/release-labels.yml

@@ -16,28 +16,36 @@ permissions:
     issues: write
     pull-requests: write
 
-concurrency:
-    group: release-labels-${{ github.event.pull_request.number }}
-    cancel-in-progress: true
-
 jobs:
-    release-labels:
+    # No concurrency group here: a 'labeled' event right after 'opened' must not cancel this job.
+    path-labels:
+        if: >-
+            ${{
+              github.event.action == 'opened' ||
+              github.event.action == 'reopened' ||
+              github.event.action == 'ready_for_review'
+            }}
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
 
             - name: Apply path-based labels
-              if: >-
-                  ${{
-                    github.event.action == 'opened' ||
-                    github.event.action == 'reopened' ||
-                    github.event.action == 'ready_for_review'
-                  }}
               uses: actions/labeler@v6
               with:
                   repo-token: ${{ secrets.GITHUB_TOKEN }}
                   sync-labels: false
 
+    release-labels:
+        needs: path-labels
+        # Run when path-labels is skipped or fails, so the label check still happens.
+        if: ${{ !cancelled() }}
+        runs-on: ubuntu-latest
+        concurrency:
+            group: release-labels-${{ github.event.pull_request.number }}
+            cancel-in-progress: true
+        steps:
+            - uses: actions/checkout@v4
+
             - name: Use Node.js
               uses: actions/setup-node@v4
               with:

package/AGENTS.md

@@ -147,12 +147,15 @@ shadow root or same-origin iframe.
 - **selfTests are optional.** It is okay to NOT have a self-test, or have it failing as long as the popup is handled correctly. Confirm this with screenshots.
 - Generic rules without a urlPattern MUST have at least two sites in the spec file.
 - If the popup comes in different DOM structures, cover all of them in the spec file.
+- **Keep spec URLs current.** When a site in a spec file no longer uses the rule's CMP (it switched CMPs or dropped its banner), replace it with a site that does, found in `data/coverage.json` or with the `publicwww-search` skill, and check the new site like any other. Do not just delete it: generic rules still need two sites. First check every region the spec runs in; if the popup only stopped showing in some of them, adjust `onlyRegions` or `skipRegions` instead. For a site-specific rule, the site no longer using the CMP means the rule itself may be stale (see Updating existing rules).
 
 ### Breakage in cosmetic rules
 **Prefer a non-cosmetic rule.** A cosmetic (`hide`) rule is a last resort when there is no reject/dismiss path. If cosmetic is unavoidable, verify that hiding the element does not break the page and **report that evidence**. Cosmetic rule without breakage-check evidence is incomplete.
 
 Check each breakage type separately and report a verdict on each, rather than a general "looks fine": **leftover overlay** (a banner remnant or backdrop still covering the page), **blocked scrolling** (a scroll or overflow lock left on html/body or the dialog), **blocked interaction** (clicks or taps not reaching the page), and **reload loop** (the rule still matching after the popup is dismissed and the page is reloaded).
 
+**Check a generic cosmetic rule on every site it applies to, not only the reported one.** A rule without a `urlPattern` hides elements on every site with that CMP, and each site can break differently. Run the breakage check on all known sites (the spec file, `data/coverage.json`, and the publicwww sites you tested), and report the verdicts for each site.
+
 When using `hide`, the CMP may lock scrolling or add overlays. Add fixes AFTER the `hide` step, marked `"optional": true`:
 
 | Problem | Fix |

package/CHANGELOG.md

@@ -1,3 +1,51 @@
+# v16.48.0 (Thu Oct 08 2026)
+
+#### Rules
+
+- Rule update: Tealium [#1626](https://github.com/duckduckgo/autoconsent/pull/1626) ([@daxtheduck](https://github.com/daxtheduck) [@muodov](https://github.com/muodov))
+- Rule update: pmc-privacy-banner [#1621](https://github.com/duckduckgo/autoconsent/pull/1621) ([@daxtheduck](https://github.com/daxtheduck) [@muodov](https://github.com/muodov))
+- Click Decline in the burpee.com rule when the banner has one [#1619](https://github.com/duckduckgo/autoconsent/pull/1619) ([@muodov](https://github.com/muodov))
+
+#### AI / Agent Workflow
+
+- Check generic cosmetic rules for breakage on every site [#1634](https://github.com/duckduckgo/autoconsent/pull/1634) ([@muodov](https://github.com/muodov))
+- Tell agents to keep spec URLs current [#1624](https://github.com/duckduckgo/autoconsent/pull/1624) ([@muodov](https://github.com/muodov))
+
+#### Authors: 2
+
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+
+---
+
+# v16.47.0 (Wed Oct 07 2026)
+
+#### Rules
+
+- Rule update: controlgame [#1616](https://github.com/duckduckgo/autoconsent/pull/1616) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: dalecarnegie [#1617](https://github.com/duckduckgo/autoconsent/pull/1617) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: jpmorgan-chase [#1615](https://github.com/duckduckgo/autoconsent/pull/1615) ([@daxtheduck](https://github.com/daxtheduck))
+
+#### Bug Fixes
+
+- Don't wait for a DOM mutation after an attempt that skipped the heuristic [#1611](https://github.com/duckduckgo/autoconsent/pull/1611) ([@muodov](https://github.com/muodov))
+
+#### Dependencies
+
+- Upgrade TypeScript to 6 and add a 7-day Dependabot cooldown [#1607](https://github.com/duckduckgo/autoconsent/pull/1607) ([@muodov](https://github.com/muodov))
+
+#### CI / Release Automation
+
+- Use needs-code-update label and stop label events from cancelling the labeler [#1609](https://github.com/duckduckgo/autoconsent/pull/1609) ([@claude](https://github.com/claude) [@muodov](https://github.com/muodov))
+
+#### Authors: 3
+
+- Claude ([@claude](https://github.com/claude))
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+
+---
+
 # v16.46.0 (Tue Oct 06 2026)
 
 #### Rules