Version 2.8.0

@freshjuice/zest@2.8.0 fixes a config-plumbing bug that made every data-* attribute silent when auto-init was on, adds the documented-but-missing data-mode attribute, and exposes updateConsent() and resolveGeo() on the full build.

Fixed

data-* attributes were ignored when auto-init was on

Auto-init passed only window.ZestConfig to init(), skipping the data-attribute merge entirely. If you loaded Zest as a plain <script> with data-theme, data-position, data-accent, or any other data-* option, it did nothing — unless you also disabled auto-init. The merged config (window config + data attributes) now feeds init() in every path.

data-mode is now actually parsed

The docs have shown data-mode="safe" on the script tag since 2.4, but the parser never read it. It works now, and invalid values fall back to safe instead of silently disabling mode-based blocking:

<script
  src="https://cdn.jsdelivr.net/npm/@freshjuice/zest"
  data-mode="strict"
></script>

updateConsent() and resolveGeo() on the full build

Both were documented in the API reference and available on the headless build, but missing from window.Zest — calling them on zest.min.js threw undefined is not a function. Both are now attached to the full build.

npm run lint passes

The repo had no eslint.config.js (required since ESLint v9), so lint exited with code 2 on every run. Added a flat config with browser globals. Closes #16.

Removed

Dead src/api/public-api.js module

Never imported by any build since the initial commit — the public API lives in src/index.js. No behavior change.

Changed

Dev dependencies

eslint 10.10.0, rollup 4.63.1, vitest 5.0.0. Dependabot now covers the Astro and Eleventy plugin packages too.