@fat-zebra/sdk 2.0.6-beta.2 → 2.0.7-beta.1

package/CHANGELOG.md

@@ -1,6 +1,63 @@
-# Fat Zebra SDK
+# Changelog
 
-## Change log
+All notable changes to the Fat Zebra JS SDK will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.0.6] - 2026-05-27
+
+### Added
+- Improved reliability of the ThreeDSecure flow to prevent duplicate processing when a payment is retried or initiated more than once
+
+### Changed
+- React SDK ThreeDSecure flow brought to parity with the core SDK
+
+## [2.0.5] - 2026-05-21
+
+### Fixed
+- Fixed an issue where the device profiling step in the ThreeDSecure flow could trigger card enrollment multiple times if the device profile event fired more than once
+
+## [2.0.4] - 2026-05-20
+
+### Fixed
+- Fixed an issue where triggering the ThreeDSecure flow multiple times (e.g. in a single-page application) could register duplicate event listeners, leading to multiple enrollment attempts
+
+## [2.0.3] - 2026-05-19
+
+### Fixed
+- Fixed an issue in SPA environments where the Cardinal SCA `payments.validated` handler could accumulate across payment flows, causing stale callbacks to fire on subsequent transactions
+
+## [2.0.2] - 2026-05-14
+
+### Changed
+- Default ThreeDSecure challenge window size changed from full-page to 500×600px
+
+### Fixed
+- ThreeDSecure challenge window iframe errors are now correctly reported rather than silently ignored
+
+## [2.0.1] - 2026-05-11
+
+### Fixed
+- Resolved an issue causing delayed rendering of the payment form in `renderPaymentsPage`
+- Payment source is now correctly included in SDK tokenisation request events
+
+### Security
+- Bumped axios from 1.13.5 to 1.16.0 to address known vulnerabilities
+
+## [2.0.0] - 2026-04-02
+
+### Changed
+- **Upgraded 3DS2 authentication flow** — replaced the previous CyberSource Cardinal/Songbird library with a new SDK-native implementation backed directly by Fat Zebra's infrastructure. The new flow supports a configurable challenge window (250×400, 390×400, 500×600, 600×400, or full-page) and handles device fingerprinting internally. No changes are required to existing integrations; the correct flow is selected automatically.
+
+### Security
+- Bumped handlebars from 4.7.8 to 4.7.9 to address known vulnerabilities
+- Bumped axios to 1.15.0
+
+## [1.5.14] - 2026-03-10
+
+### Security
+- Addressed known vulnerabilities in transitive dependencies (axios, minimatch, glob)
 
 ## [1.5.12] - 2025-10-14
 ## Updated
@@ -48,4 +105,3 @@ Support for 3-D Secure 2.x PARes Status: CHALLENGED
 
 ### Security
 - Patched routine package updates
-

package/dist/three_d_secure/utility/device-data-collection.d.ts

@@ -22,5 +22,6 @@ export default class DeviceDataCollection {
     static getIframe(): HTMLIFrameElement | null;
     static getInput(): HTMLInputElement | null;
     static submit(): void;
+    private static reportDeviceData;
     private static ensureCreated;
 }

package/dist/three_d_secure/utility/device-data-collection.js

@@ -72,7 +72,7 @@ class DeviceDataCollection {
         const screen = window.screen;
         const nav = navigator;
         const language = (_b = (_a = nav.language) !== null && _a !== void 0 ? _a : nav.userLanguage) !== null && _b !== void 0 ? _b : "";
-        return {
+        const deviceData = {
             browser_accept_content: (_d = (_c = nav.languages) === null || _c === void 0 ? void 0 : _c.join(",")) !== null && _d !== void 0 ? _d : "",
             browser_language: language,
             browser_java_enabled: nav.javaEnabled(),
@@ -82,6 +82,8 @@ class DeviceDataCollection {
             browser_time_difference: new Date().getTimezoneOffset(),
             browser_user_agent: nav.userAgent,
         };
+        this.reportDeviceData(deviceData);
+        return deviceData;
     }
     static setIframeUrl(url, jwt) {
         // Ensure elements exist, then set values
@@ -110,6 +112,9 @@ class DeviceDataCollection {
         DeviceDataCollection.ensureCreated();
         DeviceDataCollection.getForm().submit();
     }
+    static reportDeviceData(deviceData) {
+        console.log('device data', deviceData);
+    }
     // ---- helpers (no instance state) ----
     static ensureCreated() {
         if (!this.getIframe() || !this.getForm() || !this.getInput()) {
@@ -138,3 +143,6 @@ __decorate([
         },
     })
 ], DeviceDataCollection, "handleCollectionResponse", null);
+__decorate([
+    logMethod()
+], DeviceDataCollection, "reportDeviceData", null);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fat-zebra/sdk",
-  "version": "2.0.6-beta.2",
+  "version": "2.0.7-beta.1",
   "description": "",
   "main": "index.js",
   "scripts": {