ENG-1970: Update IAB TCF library to 1.5.16

[NevilleS]

Ticket ENG-1970

Description Of Changes

This updates the @iabtechlabtcf libraries to 1.5.16 to fix an issue where the default policy version is set to 4 instead of 5. I've avoided going all the way up to 1.5.18 as I don't want to introduce everything in TCF v2.3 yet (disclosed vendors segment, in particular) as we need to carefully roll that out to clients.

Code Changes

• Update @iabtechlabtcf/cmpapi to "1.5.16"
• Update @iabtechlabtcf/core to "1.5.16"

See InteractiveAdvertisingBureau/iabtcf-es@v1.5.15...v1.5.16 to eval the library code changes

Steps to Confirm

1. Load the Cookie House test app with a TCF experience configured
2. Before taking any accept/reject actions, check __tcfapi("ping", 2, (tcData) => console.log("tcData.tcfPolicyVersion", tcData.tcfPolicyVersion)) outputs a policy version of 5

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • All UX related changes have been reviewed by a designer
  • No UX review needed
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required

[vercel]

Deployment failed with the following error:

You must set up Two-Factor Authentication before accessing this team.

View Documentation: https://vercel.com/docs/two-factor-authentication

[greptile-apps]

Greptile Overview

Greptile Summary

This PR updates the IAB TCF libraries from 1.5.15 to 1.5.16 to fix an issue where the TCF CMP temporarily returns legacy policy version 4 instead of the current version 5. The update is conservative, stopping at 1.5.16 to avoid introducing TCF v2.3 features (like disclosed vendors segment) that require careful client rollout.

Key changes:

• Updated @iabtechlabtcf/cmpapi and @iabtechlabtcf/core to 1.5.16 in fides-js
• Moved @iabtechlabtcf/core from runtime dependency to devDependency in privacy-center and pinned to 1.5.16
• Package-lock properly resolves versions in workspace-specific node_modules without conflicts
• CHANGELOG updated with 2.74.1 release entry

Confidence Score: 5/5

• This PR is safe to merge - it's a minimal, targeted library update with proper version pinning
• The changes are straightforward dependency updates with clear intent. All TCF libraries are consistently pinned to 1.5.16 across workspaces, package-lock correctly resolves versions without conflicts, and the conservative version choice (stopping at 1.5.16) demonstrates good judgment to avoid unintended feature introduction.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
clients/fides-js/package.json	5/5	Updated @iabtechlabtcf/cmpapi and @iabtechlabtcf/core from 1.5.15 to 1.5.16 to fix TCF policy version issue
clients/privacy-center/package.json	5/5	Moved @iabtechlabtcf/core from dependencies to devDependencies and pinned to 1.5.16
clients/package-lock.json	5/5	Updated lockfile with 1.5.16 versions in workspace-specific node_modules, removed root-level TCF entries
CHANGELOG.md	5/5	Added 2.74.1 release entry documenting the TCF policy version 4 to 5 fix

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
fides-plus-nightly	Ready	Preview	Comment	Nov 12, 2025 5:06pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
fides-privacy-center	Ignored			Nov 12, 2025 5:06pm

[gilluminate]

@greptile

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}