Before 1.0.0-beta7 Subscription Manager attached the current user's subscription to every page as drupalSettings.subscriptionManager.currentUser.subscription (plan ID, status, connector, remote subscription ID, expiry). The attachment declared no cacheability, so on a route whose other content did not vary by user, Dynamic Page Cache could serve one user's subscription to another user with the same permissions, and a new subscription did not appear in the blob until the cached page expired (#3629912: The current user's subscription in drupalSettings is served to other users from Dynamic Page Cache; remove the attachment).
From beta7 the attachment is removed. Declaring it per user would have fixed the leak at the cost of one Dynamic Page Cache entry per user per route and an invalidation of every user's pages whenever any subscription changed, for data nothing in the module reads.
What to change
JavaScript that read drupalSettings.subscriptionManager.currentUser.subscription should fetch GET /subscription-manager/api/my-subscription instead. It returns {"subscription": false}, or the subscription (plan_id, status, billing_state, connector_plugin_id, subscription_id, expiry) with its plan (plan_id, name, prices); it requires the Manage own subscriptions permission and is never cached. The field names match the old blob's, so a reader needs only the fetch.
fetch('/subscription-manager/api/my-subscription', {credentials: 'same-origin'}) .then(r => r.json()) .then(data => { /* data.subscription is false or the subscription */ });
Sites that never read the setting have nothing to do. Connectors are unaffected.
