chore(deps): bump mixpanel-browser and @types/mixpanel-browser

[dependabot]

Bumps mixpanel-browser and @types/mixpanel-browser. These dependencies needed to be updated together.
Updates mixpanel-browser from 2.64.0 to 2.79.0

Release notes

Sourced from mixpanel-browser's releases.

Feature Flag Variant Persistence and Heatmap Page Views

Flag Variant Persistence

mixpanel.flags can now persist variant assignments to IndexedDB so flag values are available immediately on subsequent page loads. Opt in via a new persistence option on the flags config:

mixpanel.init('TOKEN', {
  flags: {
    persistence: {
      variantLookupPolicy: 'networkFirst',
      persistenceTtlMs: 24 * 60 * 60 * 1000, // optional, defaults to 24h
    },
  },
});

Three lookup policies are supported:

1. networkOnly (default) — Existing behavior. No variants are persisted; every page load fetches from the network. Existing integrations are unaffected.
2. networkFirst— Prioritizes freshness. Always issues a network fetch; persisted variants are used only as a fallback if the fetch fails. Variants older than persistenceTtlMs are discarded.
3. persistenceUntilNetworkSuccess — Prioritizes immediacy. Serves persisted (non-expired) variants synchronously while a network fetch runs in the background. Once the fetch succeeds, the fresh result replaces the cached variants for the rest of the session.

Pageview events with heatmap data

Pageview autocapture is now automatically enabled when record_heatmap_data is on, so heatmaps come with accompanying pageview context without needing to enable pageview autocapture separately.

Miscellaneous fixes

• When using recording_event_triggers, the SDK now waits for remote settings to finish loading (or fail) before deciding whether to start a recording. This prevents missed recordings when a triggering event fires during init.
• All window.localStorage and window.sessionStorage access is now exhaustively guarded with try/catch, so SDK initialization no longer throws in environments where storage access raises (strict privacy modes, sandboxed iframes, etc.).

Feature Flags Utility Updates

• adds loadFlags method to mixpanel.flags to manually refresh feature flags
• adds whenReady method to mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching

Cross-origin iframe recording

Session Replay can now capture content from cross-origin iframes embedded within your page, providing a unified replay experience across parent pages and embedded third-party content. This feature requires explicit domain allowlisting via record_allowed_iframe_origins for security purposes. For example:

On your parent site www.yoursite.com, specify the origins from which recording data is accepted:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://embedded-widget.example.com',
  ],
});

On the child iframe page https://embedded-widget.example.com, add the parent page's origin to record_allowed_iframe_origins:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
</tr></table> 

... (truncated)

Changelog

Sourced from mixpanel-browser's changelog.

2.79.0 (14 May 2026)

• Adds support for feature flag variant persistence: variants can now be cached in IndexedDB with a configurable TTL so flag values stay stable across page loads and remain available before the next fetch completes.
• Enables pageview events for free during session recording when record_heatmap_data is enabled, so heatmaps get accompanying pageview context without separately enabling pageview autocapture.
• Event-triggered session recordings now wait for remote settings to finish loading (or fail) before deciding whether to start, preventing missed recordings when a triggering event fires during init.
• Hardens all window.localStorage and window.sessionStorage access with exhaustive try/catch guards, so SDK initialization no longer throws in environments where storage access raises (e.g., strict privacy modes, sandboxed iframes).

2.78.0 (8 Apr 2026)

• Adds loadFlags method to the mixpanel.flags to manually refresh feature flags.
• Adds whenReady method to the mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching.

2.77.0 (24 Mar 2026)

• Session recording now supports cross origin iframe recording by specifying allowed domains via record_allowed_iframe_origins.
• Added type dependency @​types/json-logic-js for the RulesLogic type introduced in 2.76.0

2.76.0 (18 Mar 2026)

• Added a new network plugin that captures network telemetry during session recordings.
• Added recording_event_triggers configuration option that allows starting a session recording when targeted events that meet specified property filters occur. Property filters are optional and use json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.
• Added mixpanel.enable() public method, complementing the existing disable() method. Re-enables tracking for some or all events after disable() has been called.
• Changed async bundles (e.g., mixpanel-recorder, mixpanel-targeting) loaded via CDN or loader-module-with-async-modules entry points to use hash-based file names for consistent versioning with the main SDK (e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js). For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.
• Fixed event property matching in targeting to respect case sensitivity, consistent with how Mixpanel handles property names.
• Added dependency declaration for @​mixpanel/rrweb-utils, a peer dependency of @​mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.
• Fixed an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.
• Stabilized Safari simulator tests and ported remote settings tests to new test infrastructure.

2.75.0 (24 Feb 2026)

• Adds support for Feature Flags targeting based on events tracked during the current session (Runtime Targeting)
• Fixes memory leaks in Session Recording on sites which create/destroy iframes
• Fixes usage of arrow functions in hooks config

2.74.0 (27 Jan 2026)

• New session recording masking configuration options, including the ability to unmask inputs and allowlist-based selector masking.
• Adds initial support for the remote settings API, allowing remote configuration of SDK config options.
• Adds new automated browser test suite that runs in CI and locally in chrome headless. See tests/browser/README.html for more information.
• Fixes type definitions for api_routes
• Removes outdated examples in the examples/ dir

2.73.0 (23 Dec 2025)

• Adds several new hooks: before_identify, before_register, before_register_once, before_track, before_unregister
• Adds instance-initialization notification to allow Data Inspector browser extension to hook into SDK actions
• Fixes and extends type definitions

2.72.0 (14 Nov 2025)

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.
• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

2.71.1 (30 Oct 2025)

... (truncated)

Commits

• fb2c168 remove workspaces for now (#589)
• 218158e Update CHANGELOG.md
• b930273 2.79.0
• 2a506dd update changelog for 2.79.0
• 59b7a76 non-rc build
• 1e3945f build 2.79.0 RC2
• 07c7254 Add warn to console_with_prefix func (#448)
• 022bdf9 build 2.79.0 RC1
• c3a3e83 Implement flags variant persistence (#433)
• d53f33f Fix failing autocapture tests and errors for 2.79 (#446)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jakub.grz, a new releaser for mixpanel-browser since your current version.

Updates @types/mixpanel-browser from 2.54.0 to 2.66.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		May 15, 2026 9:04am