chore(deps): bump mixpanel-browser from 2.74.0 to 2.78.0

[dependabot]

Bumps mixpanel-browser from 2.74.0 to 2.78.0.

Release notes

Sourced from mixpanel-browser's releases.

Feature Flags Utility Updates

• adds loadFlags method to mixpanel.flags to manually refresh feature flags
• adds whenReady method to mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching

Cross-origin iframe recording

Session Replay can now capture content from cross-origin iframes embedded within your page, providing a unified replay experience across parent pages and embedded third-party content. This feature requires explicit domain allowlisting via record_allowed_iframe_origins for security purposes. For example:

On your parent site www.yoursite.com, specify the origins from which recording data is accepted:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://embedded-widget.example.com',
  ],
});

On the child iframe page https://embedded-widget.example.com, add the parent page's origin to record_allowed_iframe_origins:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://yoursite.com',
  ],
});

Miscellaneous Fixes:

• Added type dependency @types/json-logic-js for the RulesLogic type introduced in 2.76.0
• Fixed type declaration file name for the loader-module-with-async-recorder import option

Network recording, event-triggered recording, and various improvements

New Features

Network recording plugin for Session Replay

Adds a new network plugin that captures network telemetry during session recordings. This feature is currently in beta and will not show data in the Mixpanel UI until enabled (documentation forthcoming).

Event-triggered session recording

Adds a recording_event_triggers configuration option that allows starting a session recording when the targeted events that meet the specified property filters occur. These property filters are optional and are specified using json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.

mixpanel.enable() method

Adds a new public method mixpanel.enable(), complementing the existing disable method. This re-enables tracking for some or all events after disable() has been called.

Improvements

Immutable async bundles

Async bundles (e.g., mixpanel-recorder, mixpanel-targeting) that are loaded via CDN or loader-module-with-async-modules entry points will now use a hash-based file name to ensure consistent versioning with the main SDK.

e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js. For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.

... (truncated)

Changelog

Sourced from mixpanel-browser's changelog.

2.78.0 (8 Apr 2026)

• Adds loadFlags method to the mixpanel.flags to manually refresh feature flags.
• Adds whenReady method to the mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching.

2.77.0 (24 Mar 2026)

• Session recording now supports cross origin iframe recording by specifying allowed domains via record_allowed_iframe_origins.
• Added type dependency @​types/json-logic-js for the RulesLogic type introduced in 2.76.0

2.76.0 (18 Mar 2026)

• Added a new network plugin that captures network telemetry during session recordings.
• Added recording_event_triggers configuration option that allows starting a session recording when targeted events that meet specified property filters occur. Property filters are optional and use json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.
• Added mixpanel.enable() public method, complementing the existing disable() method. Re-enables tracking for some or all events after disable() has been called.
• Changed async bundles (e.g., mixpanel-recorder, mixpanel-targeting) loaded via CDN or loader-module-with-async-modules entry points to use hash-based file names for consistent versioning with the main SDK (e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js). For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.
• Fixed event property matching in targeting to respect case sensitivity, consistent with how Mixpanel handles property names.
• Added dependency declaration for @​mixpanel/rrweb-utils, a peer dependency of @​mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.
• Fixed an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.
• Stabilized Safari simulator tests and ported remote settings tests to new test infrastructure.

2.75.0 (24 Feb 2026)

• Adds support for Feature Flags targeting based on events tracked during the current session (Runtime Targeting)
• Fixes memory leaks in Session Recording on sites which create/destroy iframes
• Fixes usage of arrow functions in hooks config

2.74.0 (27 Jan 2026)

• New session recording masking configuration options, including the ability to unmask inputs and allowlist-based selector masking.
• Adds initial support for the remote settings API, allowing remote configuration of SDK config options.
• Adds new automated browser test suite that runs in CI and locally in chrome headless. See tests/browser/README.html for more information.
• Fixes type definitions for api_routes
• Removes outdated examples in the examples/ dir

2.73.0 (23 Dec 2025)

• Adds several new hooks: before_identify, before_register, before_register_once, before_track, before_unregister
• Adds instance-initialization notification to allow Data Inspector browser extension to hook into SDK actions
• Fixes and extends type definitions

2.72.0 (14 Nov 2025)

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.
• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

2.71.1 (30 Oct 2025)

• fixes issue with $mp_page_leave events getting tracked when record_heatmap_data is on and there was no session recording taking place.

2.71.0 (2 Oct 2025)

• adds Dead Click ($mp_dead_click) autocapture event: when a click occurs but there is no DOM mutation afterwards
• adds Page Leave ($mp_page_leave) autocapture event: when a page is "left" either by navigation or leaving the tab
• adds additional properties to experiment exposure events for feature flags
• upgrades rrweb fork to fix a hidden input masking issue

... (truncated)

Commits

• 0af87a6 2.78.0 release (#563)
• 73cef39 build dist ts example changes
• fa7c365 2.77.0
• b0ee8c3 2.77.0 RC (#395)
• ccd8f7b chore: pin GitHub Actions to full commit SHAs (#398)
• 5b22a24 chore: add 30-day dependabot cooldown (#399)
• 767fd11 2.76.0
• 15c46e8 update change log
• 42a1384 Merge pull request #383 from mixpanel/2.76.0-rc
• 0872bb4 build release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)