tarteaucitron.js 1.35.0 was released on September 23, 2026. This update adds four services, improves existing integrations and introduces changes involving Consent Mode, serverSide behavior and URL security.
Details are available in the official GitHub release.
Four new services
The list of supported services continues to grow. This release adds:
- Statable, contributed by @key-arg.
- UserWay, contributed by @lemaximedu66.
- Slido Event, contributed by @lucmuller.
- TidyCal, contributed by @lbresler.
These integrations allow their loading to be managed through the tarteaucitron.js consent mechanism.
As always, a service being included in the library does not mean it is automatically loaded. It must be explicitly integrated into the website.
Piwik Consent Mode support
Version 1.35.0 adds support for Piwik Consent Mode.
Consent Mode allows a service to receive information about consent preferences and adapt its behavior accordingly.
It is important to distinguish consent signaling from actually blocking scripts. The final behavior also depends on the configuration of the third-party service and the processing it performs.
This change provides another integration option for websites using Piwik.
Excluding services from serverSide mode
A new option makes it possible to exclude certain services from serverSide mode.
This feature was contributed by @SW-Vincent. It provides additional flexibility for configurations using this mode.
Not every service necessarily requires identical handling. Being able to define exceptions helps adapt the configuration to specific integration requirements.
The option should be used with consideration for the actual behavior of the services involved and the applicable consent requirements.
Additional URL security
A defense-in-depth security fix concerns URLs used for privacy links, read-more links and source links.
The contribution from @arpitjain099 adds URL sanitization to reduce risks associated with unsafe values.
Links displayed in a consent interface may originate from different configuration sources. Validating URLs before using them in the DOM is therefore important.
This change strengthens the defensive handling of URLs in tarteaucitron.js.
Crisp and interface text fixes
The Crisp service has been updated to adjust its integration.
Another fix concerns the message displayed before the cookie list in the tarteaucitron.js interface.
These changes complement the functional and security improvements included in this release.
Updating tarteaucitron.js
Version 1.35.0 is available on GitHub.
I recommend updating, particularly to benefit from the additional URL protection. Websites using Piwik, Crisp or serverSide mode can also check whether the new options apply to their configuration.
Thanks to the contributors involved in this release.
