# What's new

> Every signal set and identifier version so far, and what each one changed.

Source: https://whiskerjs.com/whats-new/ (last updated 2026-10-26)

> **In short:**
>
> Since the first collector (30 components, 7 checks) WhiskerJS has grown to **46 components** in **7 groups**, **14 integrity checks**, a **structuredId** for group-by-group similarity, an **anti-replay binding** with your server’s nonce, and an opt-in **onResult hook**, all with no network calls and no storage. The current versions are **signalsVersion 5** and **idVersion 2**. [See it run in the live demo](https://whiskerjs.com/demo/).

WhiskerJS has three version numbers in every result:

- `version`: the library release (0.1.0, not yet published).
- `signalsVersion`: what is measured: the collectors, the integrity checks and the exclusion table. A bump can change ids (when a stable component changes) and flags.
- `idVersion`: how the visitorId and structuredId are derived. A bump changes every id.

Compare ids only within the same `signalsVersion` and `idVersion`.

## 0.1.0 (in development, not published)

Newest first. The live demo runs the current version.

### signalsVersion 5, idVersion 2 (current, main 1100e48)

- Fixed a false positive in the Firefox resistFingerprinting class: stock Firefox under automation such as Playwright (UTC time zone, screen equal to the viewport) was classed `firefox_rfp` and lost nine components. The class now needs every trait at once (an RFP time zone, now also `Atlantic/Reykjavik`; screen equal to the content area; no taskbar space; pixel ratio 1; window at 0,0) and never applies when `navigator.webdriver` is true.
- Id effect: only for Firefox browsers that were wrongly classed before; their `browser_class` and excluded components change.

### Opt-in result hook (no version change)

- `load({ onResult })`: off by default; called with a copy of every result. The library still sends nothing itself.

### idVersion 2 (with signalsVersion 4)

- New `structuredId`: the idVersion and one 48-bit part per signal group (`gpu`, `audio`, `fonts`, `device`, `browser`, `locale`, `prefs`), so two results can be compared group by group. New exports `ID_GROUPS`, `ID_GROUP_ORDER`, `ID_PART_LENGTH`.
- New anti-replay binding: `collect({ binding: { nonce, timestamp } })` echoes them in `result.binding` with a digest over the whole result; `bindingInput()` gives the exact text. Not a signature.
- The visitorId prefix line is now `whiskerjs/id/2`. Id effect: every visitorId changes.

### signalsVersion 4

- Seven new integrity flags: `engine_mismatch`, `iframe_mismatch`, `impossible_hardware`, `permissions_inconsistent`, `plugins_inconsistent`, `prototype_lie`, `webdriver_writable` (14 in total). A clean `about:blank` iframe realm is used for the cross-checks.
- `automation_globals` knows more tools (CEF, CefSharp, Awesomium, FMiner, Geb, Phantomas, WebdriverIO and older drivers).
- Id effect: none (no collector changed).

### signalsVersion 3

- Six new components (46 in total): `webgpu`, `fonts_canvas` and `font_preferences` (in the visitorId), and `canvas_readback`, `audio_latency`, `content_blockers` (not in the visitorId).
- `fonts_canvas` added to the Brave exclusions.
- Id effect: the three new stable components change nearly every visitorId.

### signalsVersion 2

- Ten new components (40 in total): `ua_client_hints`, `cpu_architecture`, `intl_locale`, `heap_limit`, `apple_pay`, `private_click` (in the visitorId), and `ua_versions`, `permissions`, `keyboard_layout`, `screen_frame` (not in the visitorId).
- `screen_frame` added to the Firefox resistFingerprinting exclusions.
- Id effect: the six new stable components change nearly every visitorId.

### signalsVersion 1, idVersion 1 (first collector)

- `load()` and `agent.collect()`, which never throw; a 1000 ms inner timeout per component, an overall budget (default 5000 ms) and abort support.
- 30 components: `audio`, `browser_class`, `canvas`, `color_depth`, `color_gamut`, `device_memory`, `dynamic_range`, `fonts`, `forced_colors`, `hardware_concurrency`, `languages`, `math`, `media_codecs`, `pdf_viewer`, `pixel_ratio`, `platform`, `plugins`, `prefers_contrast`, `reduced_motion`, `screen_resolution`, `speech_voices`, `storage`, `time_zone`, `touch_support`, `vendor`, `vendor_flavors`, `webgl_image`, `webgl_params`, `webgl_renderer`, `webgl_vendor`.
- Seven integrity flags: `automation_globals`, `automation_webdriver`, `headless_markers`, `headless_user_agent`, `native_tampering`, `navigator_own_property`, `software_renderer`.
- Large values reported only as the first 128 bits of SHA-256.
- visitorId over the stable components with the prefix `whiskerjs/id/1`.
- Exclusion table for Brave farbling and Firefox resistFingerprinting.