Merge release 8.8.0 into master

.github/workflows/ci.yml

@@ -9,16 +9,23 @@ jobs:
       contents: read
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "lts/*"
           cache: 'npm'
       - name: Install node dependencies
         run: npm ci --timing
       - name: Lint javascript
         run: npm run lint
+      - name: Verify minification uses script
+        run: |
+          npm run minify
+          git diff --exit-code Universal-Federated-Analytics-Min.js Universal-Federated-Analytics-Min.js.map
+      - name: Install browser for Puppeteer
+        # Installs the matching version of Chrome required by your specific Puppeteer version
+        run: npx puppeteer browsers install
       - name: Run tests
         # aa-exec applies Ubuntu's AppArmor profile for stable Chrome binaries to the Chrome for Testing binary downloaded by Puppeteer
         # Without it, Puppeteer fails with error "No usable sandbox!"

Dockerfile

@@ -1,6 +1,6 @@
 FROM nginx
 ARG DAP_ENV='dev'
 ENV DAP_ENV=${DAP_ENV}
-COPY test_site Universal-Federated-Analytics-Min.js Universal-Federated-Analytics.js Federated.js.map /usr/share/nginx/html/
+COPY test_site Universal-Federated-Analytics.js Universal-Federated-Analytics-Min.js Universal-Federated-Analytics-Min.js.map /usr/share/nginx/html/
 COPY nginx-test.conf.template /etc/nginx/conf.d/
 RUN envsubst '${DAP_ENV}' < /etc/nginx/conf.d/nginx-test.conf.template > /etc/nginx/conf.d/default.conf

README.md

@@ -14,7 +14,7 @@ The latest version 8.6 of DAP GA code contains GA4 tracking only. DAP UA data co
 
 * [`Universal-Federated-Analytics.js`](Universal-Federated-Analytics.js) (full)
 * [`Universal-Federated-Analytics-Min.js`](Universal-Federated-Analytics-Min.js) (minified)
-* [`Federated.js.map`](Federated.js.map) (source map)
+* [`Universal-Federated-Analytics-Min.js.map`](Universal-Federated-Analytics-Min.js.map) (source map)
 
 ### DAP Code Implementation
 
@@ -94,7 +94,7 @@ This means that, barring the compromise of GitHub's systems or the CDN's systems
 
 The Digital Analytics Program Javascript code must be applied to public-facing websites. Public-facing websites are defined as websites whose primary intended users are not Federal government employees or contractors.
 
-#### Authenticated or "Priviledged" Pages
+#### Authenticated or "Privileged" Pages
 
 Agencies are expected to add DAP code to sign-in pages that serve as the entry point to authenticated content on public-facing sites. Implementation of the DAP code beyond this entry point on authenticated pages is permitted on a case-by-case basis only, with DAP's approval and testing as a prerequisite.
 
@@ -129,6 +129,14 @@ This repo uses Eslint for code static analysis. Run the linter with:
 npm run lint
 ```
 
+#### Minification
+
+This repo uses Terser for minification. After making changes to Universal-Federated-Analytics.js, regenerate the minified file by running:
+
+```bash
+npm run minify
+```
+
 #### Run integration tests
 
 Start up the test site at http://localhost:8080/ with one of the following:

Universal-Federated-Analytics.js

@@ -1,7 +1,7 @@
 /***********************************************************************************************************
 U.S. General Services Administration (GSA).
 Digital Analytics Program Government Wide Site Usage Measurement and Tracking. 
-02/07/2025 Version: 8.7
+07/01/2026 Version: 8.8
 ***********************************************************************************************************/
 
 /**
@@ -34,7 +34,7 @@
       ANONYMIZE_IP: !0,
       AGENCY: "",
       SUB_AGENCY: "",
-      VERSION: "20250702 v8.7 - GA4",
+      VERSION: "20260107 v8.8 - GA4",
       SITE_TOPIC: "",
       SITE_PLATFORM: "",
       SCRIPT_SOURCE: "",
@@ -98,7 +98,7 @@
    * library. More details are provided here:
    * https://developers.google.com/tag-platform/gtagjs/reference
    *
    * @param {string} command the name of the gtag command. Valid commands are:
    * "js", "config", "get", "set", "event", "consent"
    * @param {...*} commandParameters parameters passed to the gtag command. These
    * vary according to the command.
@@ -276,8 +276,15 @@
       (function () {
         var WVscript = document.createElement('script');
         WVscript.src = 'https://dap.digitalgov.gov/web-vitals/dist/web-vitals.attribution.iife.js';
+        // Inherit the crossorigin setting from the DAP script tag so the
+        // dynamically injected web-vitals script also loads on pages that set
+        // Cross-Origin-Embedder-Policy: require-corp. See #167.
+        var dapTag = document.getElementById('_fed_an_ua_tag');
+        if (dapTag && dapTag.hasAttribute('crossorigin')) {
+          WVscript.setAttribute('crossorigin', dapTag.getAttribute('crossorigin'));
+        }
         /**
         * Adds listeners for web vitals events
         */
         WVscript.onload = function () {
           webVitals.onCLS(sendToGoogleAnalytics);
@@ -290,7 +297,7 @@
         document.head.appendChild(WVscript);
       })();
 
        /**
        * This function send core web vitals data to GA4 4 using _sendEvent funtion.
        */
       function sendToGoogleAnalytics({name, delta, value, id, entries, rating, attribution}) {