• Add support for account update events DataDomeAccountUpdateEvent
• Add support for password update events DataDomePasswordUpdateEvent
• Add optional session, user, and authentication to the login and registration events
• Add display_name, description, external_urls, picture_urls, payment_method_updated to the user model

Breaking changes

• Remove GraphQL and JS Tag injection features
• Remove responseProvider function
• Restore onClientRequest and onClientResponse functions
• Remove EW_DD_CLIENT_SIDE_KEY, EW_DD_JS_URL and EW_DD_JS_OPTIONS variables

Other changes

• Map enriched headers into user-defined variables through the property manager

• Add handlers optional parameter to allow overriding fields in payloads sent to the Bot Protect API
• Exclude empty fields from payloads sent to the Bot Protect API

• Allow parsing of GraphQL queries when the Content-Type header contains additional directives like charset and is not strictly equal to application/json
• Disable follow mode for redirects on Bot Protect API responses to forward them to clients

• Fix CVE-2025-4802, CVE-2025-31484 and CVE-2025-32990

• Fix an iOS bug that prevents a request from being retried after a challenge resolution

• Fix an iOS bug that prevents a request from being retried after a challenge resolution

• Add support of activation and expiration dates for custom rules
• Update dependencies to fix vulnerabilities

• Add GraphQL support

• Add support for account update events
• Add support for password update events
• Add EventID and Score to the response model
• Add optional Session, User, and Authentication to login and registration events
• Add DisplayName, Description, ExternalURLs, PictureURLs, PaymentMethodUpdated to the user model
• Add Client Hints headers to the payload
• Add useForwarded configuration to handle the Forwarded request header