Upgrading from 3.7.x to 3.10.x

A concise upgrade guide for consumers on 3.7.0 jumping directly to 3.10.x. Every change between these versions is backward-compatible — no API breaks, no required code edits. This guide tells you what's new and what's worth adopting.

TL;DR

The upgrade is a one-line dependency bump:

pnpm up @tantainnovative/ndpr-toolkit@^3.10.3
# or
bun add @tantainnovative/ndpr-toolkit@^3.10.3
# or
npm install @tantainnovative/ndpr-toolkit@^3.10.3

Every release between 3.7.0 and 3.10.3 is backward-compatible. Your existing imports, props, and adapters keep working — adopting the new APIs is optional.

Why 3.10.3 specifically?

Releases 3.8.0, 3.8.1, 3.9.0, and 3.10.0 had a broken publish pipeline — their git tags and GitHub releases shipped, but the npm publish workflow failed at the entry-points check before the tarball reached the registry. As a result, npm stayed on 3.7.0 for several weeks while the GitHub side advanced.

3.10.1 fixed the build script. 3.10.2 fixed the npm-rendered README header. 3.10.3 fixes a related miss: four subpath exports (/headless, /lawful-basis/lite, /cross-border/lite, /ropa/lite) shipped in the dist tarball but were missing from the published exports map, so consumers got resolution errors when importing them. 3.10.3 wires them up.

From 3.7.0, jump straight to 3.10.3 — it carries every feature from the intermediate versions plus the publish-pipeline and exports fixes.

New APIs available after upgrade

Every item below is opt-in. Don't feel obligated to adopt any of it — your 3.7.0 code keeps working.

From 3.8.0 — Lite Manager variants

Read-only versions of the three heaviest Manager components, useful for audit dashboards and compliance reports where the full editing UI is overkill. They skip form, validation, and write callbacks — and the cross-border-lite variant also skips the 124 KB country-adequacy dataset.

import { LawfulBasisTrackerLite } from '@tantainnovative/ndpr-toolkit/lawful-basis/lite';
import { CrossBorderTransferManagerLite } from '@tantainnovative/ndpr-toolkit/cross-border/lite';
import { ROPAManagerLite } from '@tantainnovative/ndpr-toolkit/ropa/lite';

See Lite vs Full managers for bundle-size comparisons and the full feature matrix.

From 3.8.1 — onSubmitSuccess on DSR preset

Typed counterpart to the existing onSubmitError. Receives the parsed JSON body so you can route to a confirmation page with the server-issued reference.

<NDPRSubjectRights
  submitTo="/api/dsr"
  onSubmitSuccess={({ response, data, body }) => {
    const ref = (body as { referenceId?: string })?.referenceId;
    if (ref) router.push(`/dsr-confirmation?ref=${ref}`);
  }}
  onSubmitError={({ error, response }) => {
    console.error('DSR submit failed', error, response?.status);
  }}
/>

From 3.9.0 — Runnable example apps

The full SSR pattern is documented at Server-Side Storage (SSR).

From 3.10.0 — NDPRThemeProvider

A typed React Context that injects --ndpr-* CSS variables from a JavaScript theme object. Syntactic sugar over the existing CSS-variable theming — unset fields fall through to defaults.

import { NDPRThemeProvider, type NDPRTheme } from '@tantainnovative/ndpr-toolkit';

<NDPRThemeProvider theme={{ colors: { primary: '22 163 74' }, radius: { base: '0.75rem' } }}>
  <App />
</NDPRThemeProvider>

Full reference: Theming with NDPRThemeProvider.

From 3.10.0 — /headless subpath

Alias of /hooks under a more discoverable name for headless-UI consumers. Same exports — pick whichever name fits.

import { useConsent, useDSR } from '@tantainnovative/ndpr-toolkit/headless';
// identical to: from '@tantainnovative/ndpr-toolkit/hooks'

Note: this subpath was missing from the published exports map until 3.10.3 — if you tried to use it on 3.10.0 / 3.10.1 / 3.10.2 you would have hit a resolution error. The dist files were always present; only the exports wiring was broken.

From 3.10.0 — Production DSR backend reference

examples/dsr-backend-reference — a Next.js 15 / React 19 reference wiring NDPRSubjectRights to Prisma persistence and Resend email confirmation, both behind dual-mode shims so it runs without infrastructure. Full walkthrough: Production DSR backend.

Things that did NOT change

Sanity-check list of things you might worry about — none of these break between 3.7.0 and 3.10.3:

  • Prop types on NDPRConsent, NDPRSubjectRights, NDPRBreachReport, NDPRPrivacyPolicy, NDPRDPIA, NDPRComplianceDashboard — additive only.
  • Hook signatures — useConsent, useDSR, useDPIA, useBreach, useLawfulBasis, useCrossBorderTransfer, useROPA — unchanged.
  • Storage adapters — localStorageAdapter, sessionStorageAdapter, cookieAdapter, apiAdapter, memoryAdapter, composeAdapters — same interface.
  • The /server RSC-safe entry — still zero React, same validator and scoring exports.
  • The stylesheet at /styles — all --ndpr-* CSS variables you may have overridden are preserved.
  • The compliance score engine — getComplianceScore() takes the same input shape.

After the bump — verify checklist

  1. App still typechecks (tsc --noEmit) — no new prop or hook errors.
  2. Consent banner still renders, accept / reject / customize still work, storage still persists where it used to.
  3. If you submit DSR / Breach / DPIA forms to your own backend, the request body shape is unchanged.
  4. If you import from /headless, /lawful-basis/lite, /cross-border/lite, or /ropa/lite, those resolutions now work (they would have failed on 3.10.2 and earlier).