v12

[adriaandotcom]

Summary

Fixes #97

Prepare public script v12:

• Fix invalid bot detection with window.phantom.solana
• Always expose sa_pageview for ignore-pages integrations
• Include the changes tracked in Only compare non-www with non-www domains for uniques #41 and Illegal invocation with sendBeacon and URL has an error #42
• Handle the Cloudflare under-attack parameter
• Collect only the names of non-empty query parameters in the compact k payload field, never their values
• Let sites opt out with ignoreMetrics: querykeys or data-ignore-metrics="querykeys"

Before merging, update beta.js as well or inform customer team 13489e0b-295c-476b-b955-46389fe10895.

Security implications

• No security impact
• Has security impact - described as:
  • Query parameter values are never collected by this addition.
  • Name collection is limited to parameters with non-empty values and can be disabled.

Testing

• Frozen pnpm install passed with Node.js 24.18.0
• Rebuilt all distribution files
• Full unit suite passed: 16 tests
• Focused pageview query suite passed: 4 tests
• Prettier check passed for the edited source and unit test
• BrowserStack workflow passed

Checklist

• Linked to an issue
• Tested
• Asked for a review