Dependency upgrade and SBOM release assets

• Publishes a CycloneDX Software Bill of Materials (SBOM) as a release asset.
• Bumps the transitive postcss and nanoid dependencies to patched versions. The published bundle is unchanged — a fresh install already resolved to the patched versions.

[validation] attach-at-creation proof — SBOM on an immutable release

Demonstrates that a CycloneDX SBOM attached in the gh release create command survives on an IMMUTABLE release — the fix for PR #626. Not a real release; safe to delete after review. Tag is intentionally non-v* so it does not trigger the current SBOM workflow.

Network recording and OpenFeature updates

• Fixes a bug where response bodies were often empty in session recording network telemetry.
• Adds fallback_reason (FLAG_NOT_FOUND, NOT_READY, or BACKEND_ERROR) to feature flag variants when variant_source is 'fallback'. @mixpanel/openfeature-web-provider now reports the specific cause instead of always reporting FLAG_NOT_FOUND.

Node 26 compatibility and OpenFeature fix

• Removes the engines field from package.json so npm no longer prints an engine warning on newer Node.js versions. CI now runs on current Node.js LTS versions.
• @mixpanel/openfeature-web-provider: fixes fallback detection so FLAG_NOT_FOUND is reported correctly

Capture phase for Autocapture listeners

• Registers autocapture click/change/submit listeners in the capture phase, so events are reliably observed even when downstream handlers call stopPropagation().
• Fixes a session recording bug where record_min_ms could be bypassed after a page navigation or an idle period, causing short recordings to be uploaded. Elapsed time is now measured from the first rrweb event timestamp rather than wall-clock time, so the minimum-duration check stays accurate across navigations.
• Fixes a malformed first-time-events request URL that contained a double slash (//) before the flag ID. The URL is now built cleanly regardless of whether the base ends in /.

Feature Flag Variant Persistence and Heatmap Page Views

Flag Variant Persistence

mixpanel.flags can now persist variant assignments to IndexedDB so flag values are available immediately on subsequent page loads. Opt in via a new persistence option on the flags config:

mixpanel.init('TOKEN', {
  flags: {
    persistence: {
      variantLookupPolicy: 'networkFirst',
      persistenceTtlMs: 24 * 60 * 60 * 1000, // optional, defaults to 24h
    },
  },
});

Three lookup policies are supported:

1. networkOnly (default) — Existing behavior. No variants are persisted; every page load fetches from the network. Existing integrations are unaffected.
2. networkFirst— Prioritizes freshness. Always issues a network fetch; persisted variants are used only as a fallback if the fetch fails. Variants older than persistenceTtlMs are discarded.
3. persistenceUntilNetworkSuccess — Prioritizes immediacy. Serves persisted (non-expired) variants synchronously while a network fetch runs in the background. Once the fetch succeeds, the fresh result replaces the cached variants for the rest of the session.

Pageview events with heatmap data

Pageview autocapture is now automatically enabled when record_heatmap_data is on, so heatmaps come with accompanying pageview context without needing to enable pageview autocapture separately.

Miscellaneous fixes

• When using recording_event_triggers, the SDK now waits for remote settings to finish loading (or fail) before deciding whether to start a recording. This prevents missed recordings when a triggering event fires during init.
• All window.localStorage and window.sessionStorage access is now exhaustively guarded with try/catch, so SDK initialization no longer throws in environments where storage access raises (strict privacy modes, sandboxed iframes, etc.).

Feature Flags Utility Updates

• adds loadFlags method to mixpanel.flags to manually refresh feature flags
• adds whenReady method to mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching

Cross-origin iframe recording

Session Replay can now capture content from cross-origin iframes embedded within your page, providing a unified replay experience across parent pages and embedded third-party content. This feature requires explicit domain allowlisting via record_allowed_iframe_origins for security purposes. For example:

On your parent site www.yoursite.com, specify the origins from which recording data is accepted:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://embedded-widget.example.com',
  ],
});

On the child iframe page https://embedded-widget.example.com, add the parent page's origin to record_allowed_iframe_origins:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://yoursite.com',
  ],
});

Miscellaneous Fixes:

• Added type dependency @types/json-logic-js for the RulesLogic type introduced in 2.76.0
• Fixed type declaration file name for the loader-module-with-async-recorder import option

Network recording, event-triggered recording, and various improvements

New Features

Network recording plugin for Session Replay

Adds a new network plugin that captures network telemetry during session recordings. This feature is currently in beta and will not show data in the Mixpanel UI until enabled (documentation forthcoming).

Event-triggered session recording

Adds a recording_event_triggers configuration option that allows starting a session recording when the targeted events that meet the specified property filters occur. These property filters are optional and are specified using json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.

mixpanel.enable() method

Adds a new public method mixpanel.enable(), complementing the existing disable method. This re-enables tracking for some or all events after disable() has been called.

Improvements

Immutable async bundles

Async bundles (e.g., mixpanel-recorder, mixpanel-targeting) that are loaded via CDN or loader-module-with-async-modules entry points will now use a hash-based file name to ensure consistent versioning with the main SDK.

e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js. For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.

Case-sensitive event targeting properties

Event property matching in targeting now respects case sensitivity, consistent with how Mixpanel handles property names.

Bug Fixes

rrweb-utils dependency: adds a dependency declaration for the @mixpanel/rrweb-utils which is a peer dependency for @mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.

AbortController compatibility check: fixes an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.

Feature Flags runtime events support

This release adds support for Runtime Event Targeting in the Feature Flags subsystem: see https://docs.mixpanel.com/docs/featureflags/runtime-events. This feature does not require any SDK configuration changes.

Additional fixes included:

• Fix for using arrow functions in hooks configuration
• Session Recording: fix for memory leaks on pages which create and destroy iframes