chore(deps): bump mixpanel-browser and @types/mixpanel-browser

[dependabot]

Bumps mixpanel-browser and @types/mixpanel-browser. These dependencies needed to be updated together.
Updates mixpanel-browser from 2.64.0 to 2.76.0

Release notes

Sourced from mixpanel-browser's releases.

Network recording, event-triggered recording, and various improvements

New Features

Network recording plugin for Session Replay

Adds a new network plugin that captures network telemetry during session recordings. This feature is currently in beta and will not show data in the Mixpanel UI until enabled (documentation forthcoming).

Event-triggered session recording

Adds a recording_event_triggers configuration option that allows starting a session recording when the targeted events that meet the specified property filters occur. These property filters are optional and are specified using json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.

mixpanel.enable() method

Adds a new public method mixpanel.enable(), complementing the existing disable method. This re-enables tracking for some or all events after disable() has been called.

Improvements

Immutable async bundles

Async bundles (e.g., mixpanel-recorder, mixpanel-targeting) that are loaded via CDN or loader-module-with-async-modules entry points will now use a hash-based file name to ensure consistent versioning with the main SDK.

e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js. For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.

Case-sensitive event targeting properties

Event property matching in targeting now respects case sensitivity, consistent with how Mixpanel handles property names.

Bug Fixes

rrweb-utils dependency: adds a dependency declaration for the @mixpanel/rrweb-utils which is a peer dependency for @mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.

AbortController compatibility check: fixes an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.

Feature Flags runtime events support

This release adds support for Runtime Event Targeting in the Feature Flags subsystem: see https://docs.mixpanel.com/docs/featureflags/runtime-events. This feature does not require any SDK configuration changes.

Additional fixes included:

• Fix for using arrow functions in hooks configuration
• Session Recording: fix for memory leaks on pages which create and destroy iframes

New masking API, remote settings, and more

New Recorder Masking API

Session recording now supports unmasking inputs, as well as an allow-list based masking API for both inputs and text. New configuration options:

Option	Type	Default	Description
record_mask_all_text	boolean	true	When true, all text is masked by default. Use record_unmask_text_selector to selectively reveal specific elements.
record_mask_text_selector	string | string[]	undefined	CSS selector(s) for elements to mask. Only applies when record_mask_all_text is false.
record_unmask_text_selector	string | string[]	undefined	CSS selector(s) for elements to unmask. Only applies when record_mask_all_text is true.
record_mask_all_inputs	boolean	true	When true, all inputs are masked by default. Use record_unmask_input_selector to selectively reveal specific inputs.
record_mask_input_selector	string | string[]	""	CSS selector(s) for inputs to mask. Only applies when record_mask_all_inputs is false.
record_unmask_input_selector	string | string[]	""	CSS selector(s) for inputs to unmask. Only applies when record_mask_all_inputs is true.

Old record_mask_text_selector configuration options are migrated to the equivalent new config options for compatibility - e.g. record_mask_text_selector: '' will be applied as record_mask_all_text: false

... (truncated)

Changelog

Sourced from mixpanel-browser's changelog.

2.76.0 (18 Mar 2026)

• Added a new network plugin that captures network telemetry during session recordings.
• Added recording_event_triggers configuration option that allows starting a session recording when targeted events that meet specified property filters occur. Property filters are optional and use json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.
• Added mixpanel.enable() public method, complementing the existing disable() method. Re-enables tracking for some or all events after disable() has been called.
• Changed async bundles (e.g., mixpanel-recorder, mixpanel-targeting) loaded via CDN or loader-module-with-async-modules entry points to use hash-based file names for consistent versioning with the main SDK (e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js). For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.
• Fixed event property matching in targeting to respect case sensitivity, consistent with how Mixpanel handles property names.
• Added dependency declaration for @​mixpanel/rrweb-utils, a peer dependency of @​mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.
• Fixed an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.
• Stabilized Safari simulator tests and ported remote settings tests to new test infrastructure.

2.75.0 (24 Feb 2026)

• Adds support for Feature Flags targeting based on events tracked during the current session (Runtime Targeting)
• Fixes memory leaks in Session Recording on sites which create/destroy iframes
• Fixes usage of arrow functions in hooks config

2.74.0 (27 Jan 2026)

• New session recording masking configuration options, including the ability to unmask inputs and allowlist-based selector masking.
• Adds initial support for the remote settings API, allowing remote configuration of SDK config options.
• Adds new automated browser test suite that runs in CI and locally in chrome headless. See tests/browser/README.html for more information.
• Fixes type definitions for api_routes
• Removes outdated examples in the examples/ dir

2.73.0 (23 Dec 2025)

• Adds several new hooks: before_identify, before_register, before_register_once, before_track, before_unregister
• Adds instance-initialization notification to allow Data Inspector browser extension to hook into SDK actions
• Fixes and extends type definitions

2.72.0 (14 Nov 2025)

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.
• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

2.71.1 (30 Oct 2025)

• fixes issue with $mp_page_leave events getting tracked when record_heatmap_data is on and there was no session recording taking place.

2.71.0 (2 Oct 2025)

• adds Dead Click ($mp_dead_click) autocapture event: when a click occurs but there is no DOM mutation afterwards
• adds Page Leave ($mp_page_leave) autocapture event: when a page is "left" either by navigation or leaving the tab
• adds additional properties to experiment exposure events for feature flags
• upgrades rrweb fork to fix a hidden input masking issue
• gets rid of package.json exports feature to be less restrictive of what can be imported
• adds type definitions for each build option

2.70.0 (4 Sep 2025)

• Feature flags requests now send params on query string with GET instead of POST for easier caching

2.68.0 (11 Aug 2025)

• Initial rage-click detection support

... (truncated)

Commits

• 767fd11 2.76.0
• 15c46e8 update change log
• 42a1384 Merge pull request #383 from mixpanel/2.76.0-rc
• 0872bb4 build release
• a6cbfec build rc2
• 674fe26 Properties in event targeting should support case sensitivity (#393)
• 2bb12f1 add retries and timeout to bundle compat tests
• 7ef2894 Immutable async bundles (#388)
• 65c4b51 Added strict dependency (#390)
• 8f7c32a Check for the existing of isRecording before calling it (#386)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jakub.grz, a new releaser for mixpanel-browser since your current version.

Updates @types/mixpanel-browser from 2.54.0 to 2.66.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Mar 20, 2026 9:05am

[dependabot]

Superseded by #1664.