Feature Flags Utility Updates

• adds loadFlags method to mixpanel.flags to manually refresh feature flags
• adds whenReady method to mixpanel.flags, which returns a Promise that resolves when feature flags are done fetching

Cross-origin iframe recording

Session Replay can now capture content from cross-origin iframes embedded within your page, providing a unified replay experience across parent pages and embedded third-party content. This feature requires explicit domain allowlisting via record_allowed_iframe_origins for security purposes. For example:

On your parent site www.yoursite.com, specify the origins from which recording data is accepted:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://embedded-widget.example.com',
  ],
});

On the child iframe page https://embedded-widget.example.com, add the parent page's origin to record_allowed_iframe_origins:

mixpanel.init('YOUR_PROJECT_TOKEN', {
  record_sessions_percent: 100,
  record_allowed_iframe_origins: [
    'https://yoursite.com',
  ],
});

Miscellaneous Fixes:

• Added type dependency @types/json-logic-js for the RulesLogic type introduced in 2.76.0
• Fixed type declaration file name for the loader-module-with-async-recorder import option

Network recording, event-triggered recording, and various improvements

New Features

Network recording plugin for Session Replay

Adds a new network plugin that captures network telemetry during session recordings. This feature is currently in beta and will not show data in the Mixpanel UI until enabled (documentation forthcoming).

Event-triggered session recording

Adds a recording_event_triggers configuration option that allows starting a session recording when the targeted events that meet the specified property filters occur. These property filters are optional and are specified using json-logic syntax, but this option is mainly intended to be used by remote settings (closed beta). Allows session replays to start on a trigger if a session replay is not already in progress. Does not affect any active recording sessions.

mixpanel.enable() method

Adds a new public method mixpanel.enable(), complementing the existing disable method. This re-enables tracking for some or all events after disable() has been called.

Improvements

Immutable async bundles

Async bundles (e.g., mixpanel-recorder, mixpanel-targeting) that are loaded via CDN or loader-module-with-async-modules entry points will now use a hash-based file name to ensure consistent versioning with the main SDK.

e.g. mixpanel-recorder.min.js => mixpanel-recorder-bIS4LMGd.min.js. For customers who already proxy these files individually from the CDN, we recommend proxying everything under cdn.mxpnl.com/libs/* for reliability.

Case-sensitive event targeting properties

Event property matching in targeting now respects case sensitivity, consistent with how Mixpanel handles property names.

Bug Fixes

rrweb-utils dependency: adds a dependency declaration for the @mixpanel/rrweb-utils which is a peer dependency for @mixpanel/rrweb-plugin-console-record. This was causing errors for users with strict peer dependencies enabled.

AbortController compatibility check: fixes an error thrown when disabling recording from remote settings and AbortController is not supported in the browser.

Feature Flags runtime events support

This release adds support for Runtime Event Targeting in the Feature Flags subsystem: see https://docs.mixpanel.com/docs/featureflags/runtime-events. This feature does not require any SDK configuration changes.

Additional fixes included:

• Fix for using arrow functions in hooks configuration
• Session Recording: fix for memory leaks on pages which create and destroy iframes

New masking API, remote settings, and more

New Recorder Masking API

Session recording now supports unmasking inputs, as well as an allow-list based masking API for both inputs and text. New configuration options:

Option	Type	Default	Description
record_mask_all_text	boolean	true	When true, all text is masked by default. Use record_unmask_text_selector to selectively reveal specific elements.
record_mask_text_selector	string | string[]	undefined	CSS selector(s) for elements to mask. Only applies when record_mask_all_text is false.
record_unmask_text_selector	string | string[]	undefined	CSS selector(s) for elements to unmask. Only applies when record_mask_all_text is true.
record_mask_all_inputs	boolean	true	When true, all inputs are masked by default. Use record_unmask_input_selector to selectively reveal specific inputs.
record_mask_input_selector	string | string[]	""	CSS selector(s) for inputs to mask. Only applies when record_mask_all_inputs is false.
record_unmask_input_selector	string | string[]	""	CSS selector(s) for inputs to unmask. Only applies when record_mask_all_inputs is true.

Old record_mask_text_selector configuration options are migrated to the equivalent new config options for compatibility - e.g. record_mask_text_selector: '' will be applied as record_mask_all_text: false

Initial Remote Settings Support

Preparation to support remote settings functionality which will allow customizing session recording configurations (and eventually more) within the Mixpanel UI. The config option remote_settings_mode allows 3 states:

• strict - do not act (for instance, start session recording) unless the remote settings are loaded in a timely manner
• fallback - use fallback configuration values (options set during initialization) if remote settings fail to load in a timely manner
• disabled (default) - do not use or attempt to load remote settings

Remote settings are currently in a CLOSED alpha as of 1/27/2026, and the SDK API could be updated with breaking changes.

Other fixes

• Add missing typescript fields for api_routes (thanks @rnbrady!)
• Fix issue where Mixpanel import breaks in Safari when cookies are disabled: #530
• Deleted some outdated example directories

New hooks, extension support, type fixes

This release adds several new hooks for running code and intercepting SDK actions: before_identify, before_register, before_register_once, before_track, before_unregister. It also adds integration code for the Data Inspector browser extension and improves some of the library's type definitions.

Miscellaneous updates and bugfixes

Additions:

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.

Fixes:

• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

Fix $mp_page_leave over-tracking

Fixes an issue where the $mp_page_leave is automatically captured when record_heatmap_data is on and there is no session recording taking place.

$mp_page_leave events will be excluded from Mixpanel billing for the month of October.

Autocapture Updates

New autocapture events are now available:

• Dead Click ($mp_dead_click): when a click occurs but there is no DOM mutation afterwards
• Page Leave ($mp_page_leave): when a page is "left" either by navigation or leaving the tab

Dead Click event tracking is ON in the default autotrack configuration, but Page Leave tracking must be turned on explicitly (with the config option {autocapture: {page_leave: true}}.

This release also includes several other updates:

• adding additional properties to experiment exposure events for feature flags
• upgrade rrweb fork to fix a hidden input masking issue
• getting rid of package.json exports feature to be less restrictive of what can be imported
• adding type definitions for each build option

rrweb upgrade and stricter disable_persistence

• Upgraded rrweb to use a Mixpanel-maintained fork containing performance fixes from the rrweb team (https://github.com/mixpanel/rrweb)
• Added additional handling for disable_persistence so that sessionStorage and IndexedDB are not modified
• Fixed TypeScript imports for custom builds