@emplugins/emprivacy 3.2.0 → 3.2.1

package/README.md

@@ -27,7 +27,7 @@
 
 ## Requirements
 
-- **EmDash** `^1.0.1` (**tested with `1.0.1`**). EmDash 0.x is not supported.
+- **EmDash** `^1.0.1` (**CI-tested with `1.0.1` and `1.4.0`**). EmDash 0.x is not supported.
 - **Node.js** `>= 22.16` (matches EmDash’s engine requirement).
 - Register as a **native** plugin in **`astro.config`** via `plugins: []` (not `sandboxed: []`). EmPrivacy uses `page:fragments` for the public banner and `componentsEntry` for embed placeholders. See [Page fragments](https://docs.emdashcms.com/plugins/creating-native-plugins/page-fragments/) and [Plugin overview](https://docs.emdashcms.com/plugins/overview/).
 

package/dist/index.mjs

@@ -1927,7 +1927,7 @@ function buildVendorList(cfg) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "3.2.0";
+const VERSION = "3.2.1";
 //#endregion
 //#region src/runtime.ts
 /** Soft cap for anonymous consent POSTs per trusted client address per UTC hour. */
@@ -2267,7 +2267,7 @@ function createPlugin() {
 }
 async function buildSettingsPage(ctx) {
 	const [cfg, latestPublished] = await Promise.all([loadConfig(ctx), fetchLatestPublishedVersion({ fetch: ctx.http?.fetch ?? globalThis.fetch })]);
-	const installedVersion = ctx.plugin?.version ?? "3.2.0";
+	const installedVersion = ctx.plugin?.version ?? "3.2.1";
 	const analyticsText = cfg.analyticsScriptUrls.map((src) => {
 		const i = cfg.scriptIntegrity[src];
 		return i ? `${src} ${i}` : src;

package/docs/DEVELOPMENT.md

@@ -21,11 +21,11 @@ pnpm run build
 
 ## `pnpm audit` and the Kysely override
 
-`pnpm run audit` runs **`pnpm audit --prod`**, so it reflects **published runtime** dependencies only (currently `zod` 4.6.5).
+`pnpm run audit` runs **`pnpm audit --prod`**, so it reflects **published runtime** dependencies only (currently `zod` 4.6.7).
 
 The full install (including the `emdash` **dev** tree) can report transitive advisories from EmDash’s tooling stack. Those are owned by the site’s EmDash upgrade path, not by EmPrivacy’s published tarball.
 
-**This repository pins Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.6`, aligned with EmDash 1.0.1). Regenerate the lockfile with `pnpm install` after changing overrides.
+**This repository pins Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.6`). EmDash 1.x declares Kysely as `^0.29.0`. Regenerate the lockfile with `pnpm install` after changing overrides.
 
 ## Deprecation warnings you may still see
 

package/docs/RELEASES.md

@@ -55,7 +55,7 @@ In Cursor, ask to publish a minor (or patch) release. The agent follows [`.curso
 3. Merge the **Version Packages** PR as soon as it opens. Its own CI often sits at `action_required` (the Release workflow opened it with `GITHUB_TOKEN`). `pnpm release:publish` on `main` is the publish-time test gate.
 4. Treat `+ @emplugins/emprivacy@<version>` in the Release log as a successful publish. The npm registry can 404 that version for several minutes while it scans the tarball. Poll `https://registry.npmjs.org/@emplugins/emprivacy/<version>` for up to 15 minutes. Do not publish again during that window.
 
-Requires **`NPM_TOKEN`** secret on the repo (publish rights for `@emplugins/emprivacy` on the [emplugins](https://www.npmjs.com/org/emplugins) org). Details: [maintainer-release.md](./maintainer-release.md).
+Release publishes with npm trusted publishing from `release.yml`. Details: [maintainer-release.md](./maintainer-release.md).
 
 ### Local (fallback)
 

package/docs/RELEASE_NOTES.md

@@ -6,6 +6,15 @@
 
 No unreleased changes.
 
+# emprivacy v3.2.1
+
+## Changes
+
+- **EmDash 1.4.0** — CI-tested with EmDash `1.0.1` and `1.4.0`. Peer dependency stays `emdash@^1.0.1`. No plugin API change.
+- **zod 4.6.7** — Runtime dependency updated from 4.6.5 so production audit clears GHSA-mrhx-c7xc-m3w5 (oversized constrained collections).
+- **Policy links on EmDash 1.2+** — Root-relative privacy and cookie policy paths resolve with `ctx.url()`, which follows the configured site origin (site URL setting, then the address the site was set up on). A site that moves domain sees the new origin in those links after the server restarts.
+- **Install hook** — EmDash 1.2+ runs `plugin:install` once for a plugin registered in `plugins: []`. EmPrivacy seeds default settings only when none are stored.
+
 # emprivacy v3.2.0
 
 ## Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "SPDX-License-Identifier: MIT",
   "name": "@emplugins/emprivacy",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Cookie consent, gated embeds, and privacy notices for EmDash (GDPR, CCPA/CIPA-oriented configuration)",
   "type": "module",
   "main": "dist/index.mjs",
@@ -42,11 +42,11 @@
     "emdash": "^1.0.1"
   },
   "dependencies": {
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "emdash": "^1.0.1",
+    "emdash": "^1.4.0",
     "tsdown": "^0.23.0",
     "typescript": "^5.9.3",
     "vitest": "^5.0.1"
@@ -66,7 +66,7 @@
   "pnpm": {
     "overrides": {
       "kysely": "0.29.6",
-      "zod": "4.6.5"
+      "zod": "4.6.7"
     }
   },
   "scripts": {