v3.32.3

3.32.3 (2026-11-11)

Bug Fixes

• build: preserve sourcemaps and guard escaped non-ascii (#1816) (51f2b6e)
• deps-dev: bump lodash-es (#1753) (df53b4b)
• deps-dev: bump lodash-es from 4.17.21 to 4.18.1 in /kits/facebook (#1758) (2107a95)
• deps-dev: bump lodash-es in /kits/mixpanel/mixpanel-2 (#1763) (ea8a4bf)
• deps-dev: bump vite from 6.4.1 to 6.4.5 in /kits/rokt (#1675) (73bc8c8)
• deps-dev: bump vite from 6.4.4 to 6.4.5 in /kits/roktpayplus (#1737) (80d159b)
• deps: bump @vitest/mocker, @vitest/coverage-v8 and vitest (#1676) (024bb88)
• deps: bump brace-expansion in /kits/doubleclick (#1674) (a07ac65)
• deps: bump fast-uri from 3.0.1 to 3.1.9 in /kits/id5/id5-1 (#1690) (bac0091)
• deps: bump qs and body-parser in /kits/taplytics (#1698) (bdfdea8)
• deps: bump serialize-javascript and mocha in /kits/onetrust (#1689) (b87b443)
• deps: bump the babel group across 1 directory with 20 updates (#1779) (f43c529)
• deps: bump undici from 7.24.6 to 7.30.1 in /kits/rokt (#1688) (8078426)
• leanplum: load a pinned Leanplum SDK with Subresource Integrity (#1792) (b9c7a66)
• mixpanel: take MIXPANEL_CUSTOM_LIB_URL only when it is a string (#1794) (f1a391a)
• optimizely: check the Full Stack SDK with Subresource Integrity (#1793) (3d6f09f)
• page-url: find route segments in one pass (#1796) (e921c07)
• persistence: take the API key from init alone, never from storage (#1795) (844fe3c)
• rokt: wait for the start-up identify when selectPlacements has no MPID (#1822) (5244fec)
• snippet: force utf-8 for injected sdk scripts (#1820) (f3d03ce)
• web SDK: ignore stale config responses after re-init (#1817) (141f5e2)

Miscellaneous

• call generateUniqueId directly (#1818) (d335189)
• check: enforce ascii-only core bundles in v3 candidate (#1813) (c34665f)
• deps: bump actions/download-artifact from 7 to 8 (#1798) (a5645cb)
• deps: bump actions/setup-java from 5 to 6 (#1801) (700c8c7)
• deps: bump actions/setup-node from 6 to 7 (#1800) (5f32ea7)
• deps: bump actions/upload-artifact from 6.0.0 to 7.0.2 (#1799) (27cfb1a)
• deps: bump codecov/codecov-action from 7.0.0 to 7.1.1 (#1802) (8e4b4c9)
• dist-guard: skip dist folders inside kit node_modules (#1825) (f890296)
• forwarder-utils: add unit tests for the forwarding filter functions (#1814) (db98c08)
• remove nine duplicate test cases (#1815) (9c3c73c)
• uploaders: add unit tests for the uploaders and forwarding stats uploader (#1819) (4638852)
• web SDK: add shared CI-only local Karma browser timeouts across kits (#1826) (3a8d902)
• web SDK: bound Required checks to 5m and pin trigger and needs (#1810) (b84312b)
• web SDK: exclude relative paths in git-dependency regex check (#1811) (324a7cc)
• web SDK: gate advance-staging, guard upload, audit recovery, and wire release-tag (#1807) (c25d587)
• web SDK: harden Android bridge tests with KVM and pinned versions (#1812) (4991720)
• web-sdk: auto-dispatch V3 Step 1 and gate publishing (#1821) (2baa393)
• web-sdk: remove v3-release-publish Environment gate from V3 Step 1 (#1823) (9b1cc92)