# Version 2.3.0 > Two new interceptor layers (network + element-level setter patches) plus a timing fix that lands interceptors before any defer/async tracker can fire Source: https://zest.freshjuice.dev/changelog/v2.3.0/ Date: 2026-05-19 `@freshjuice/zest@2.3.0` closes three real gaps surfaced while auditing HubSpot CMS, Cloudflare Zaraz, and server-side GTM sites. See the [full release on GitHub](https://github.com/freshjuice-dev/zest/releases/tag/v2.3.0). > **Zero runtime change for v2.2 consumers.** Every default is preserved. Interceptors now install slightly earlier (script eval instead of `DOMContentLoaded`), which is strictly more protective. ## Highlights ### Fixed: interceptors install on script eval, not on `DOMContentLoaded` The previous full-build entry waited for `DOMContentLoaded` before calling `Zest.init()`. That meant **all** interceptors (cookies, storage, scripts) installed AFTER `defer` and `async` tracker scripts had already executed. So HubSpot, GTM, and similar `defer`-loaded trackers got to fire their pre-consent calls before our hooks were in place. `init()` now runs synchronously when the bundle is evaluated. Only the UI mount (banner / widget, which needs ``) is deferred until the DOM is ready. **No config change required.** Sites that inline or load Zest at the top of `` (the documented setup) immediately get the interceptor coverage they always thought they had. ### Added: network interceptor Patches `window.fetch`, `XMLHttpRequest`, and `navigator.sendBeacon`. Matches every outbound URL against the same `blockedDomains` + mode-based tracker list that the script blocker already uses. Blocked requests resolve as: | API | Blocked behavior | |-----|------------------| | `fetch(url)` | Resolves to `Response` with status `204` and empty body | | `XMLHttpRequest` | Fires `error` event with `readyState=4`, `status=0` | | `navigator.sendBeacon(url, data)` | Returns `false` (spec's "not queued" signal) | ```javascript Zest.init({ blockedDomains: [ { domain: 'track-eu1.hubspot.com', category: 'analytics' } ] }); ``` The HubSpot scriptloader at `/hs/scriptloader/{portalId}.js` still loads (first-party path, not blockable by hostname) — but its runtime beacons to `track-eu1.hubspot.com` are now caught. Same pattern applies to Cloudflare Zaraz (`/cdn-cgi/zaraz/`), server-side GTM custom subdomains, Shopify, Webflow. **No replay.** Network requests are one-shot and time-sensitive — replaying a stale beacon after consent would create duplicate data. Blocked requests are dropped, not queued. ### Added: element interceptor (synchronous setter patches) The `MutationObserver`-based script blocker fires asynchronously. By the time the observer runs, the browser has already kicked off the fetch for any ` ```