v2.10.0

2.10.0 (2026-08-17)

Features

• web-sdk: forward LCP resource details and LoAF-based INP attribution in web vitals measurements (#2187) (557e94d)

Bug Fixes

• core: keep config.paused in sync with pause and unpause (#2196) (dd2f505)
• core: make removeBeforeSendHooks remove the hooks (#2208) (4378883)
• deps: bump vulnerable transitive deps (#2193) (41065ec)
• deps: update dependency web-vitals to v6 (#2164) (42f154f)
• deps: update npm-dependencies (#2154) (9bc88e6)
• replay: strip query string and fragment from rrweb Meta event href (#2127) (fd0fa45)
• replay: use fixed-length mask for input values (#2126) (80dac72)
• security/high/packages/react: update dependency react-router to v7.18.2 [security] (#2214) (635bee6)
• security/high/: update dependency brace-expansion to v5.0.9 [security] (#2204) (ffc90b0)
• security/medium/: update dependency postcss to v8.5.23 [security] (#2205) (23894be)
• web-sdk: measure the keepalive budget in bytes (#2199) (c68f22d)
• web-sdk: stop stack parsing from stalling on large error payloads (#2197) (12f3a39)
• web-tracing: stop injecting traceparent while Faro is paused (#2198) (bb09041)
• web-tracing: type the full set of fetch and xhr instrumentation options (#2200) (4b90404)