npm(deps): bump mixpanel-browser from 2.72.0 to 2.74.0 in /frontend

[dependabot]

Bumps mixpanel-browser from 2.72.0 to 2.74.0.

Release notes

Sourced from mixpanel-browser's releases.

New masking API, remote settings, and more

New Recorder Masking API

Session recording now supports unmasking inputs, as well as an allow-list based masking API for both inputs and text. New configuration options:

Option	Type	Default	Description
record_mask_all_text	boolean	true	When true, all text is masked by default. Use record_unmask_text_selector to selectively reveal specific elements.
record_mask_text_selector	string | string[]	undefined	CSS selector(s) for elements to mask. Only applies when record_mask_all_text is false.
record_unmask_text_selector	string | string[]	undefined	CSS selector(s) for elements to unmask. Only applies when record_mask_all_text is true.
record_mask_all_inputs	boolean	true	When true, all inputs are masked by default. Use record_unmask_input_selector to selectively reveal specific inputs.
record_mask_input_selector	string | string[]	""	CSS selector(s) for inputs to mask. Only applies when record_mask_all_inputs is false.
record_unmask_input_selector	string | string[]	""	CSS selector(s) for inputs to unmask. Only applies when record_mask_all_inputs is true.

Old record_mask_text_selector configuration options are migrated to the equivalent new config options for compatibility - e.g. record_mask_text_selector: '' will be applied as record_mask_all_text: false

Initial Remote Settings Support

Preparation to support remote settings functionality which will allow customizing session recording configurations (and eventually more) within the Mixpanel UI. The config option remote_settings_mode allows 3 states:

• strict - do not act (for instance, start session recording) unless the remote settings are loaded in a timely manner
• fallback - use fallback configuration values (options set during initialization) if remote settings fail to load in a timely manner
• disabled (default) - do not use or attempt to load remote settings

Remote settings are currently in a CLOSED alpha as of 1/27/2026, and the SDK API could be updated with breaking changes.

Other fixes

• Add missing typescript fields for api_routes (thanks @​rnbrady!)
• Fix issue where Mixpanel import breaks in Safari when cookies are disabled: mixpanel/mixpanel-js#530
• Deleted some outdated example directories

New hooks, extension support, type fixes

This release adds several new hooks for running code and intercepting SDK actions: before_identify, before_register, before_register_once, before_track, before_unregister. It also adds integration code for the Data Inspector browser extension and improves some of the library's type definitions.

Changelog

Sourced from mixpanel-browser's changelog.

2.74.0 (27 Jan 2026)

• New session recording masking configuration options, including the ability to unmask inputs and allowlist-based selector masking.
• Adds initial support for the remote settings API, allowing remote configuration of SDK config options.
• Adds new automated browser test suite that runs in CI and locally in chrome headless. See tests/browser/README.html for more information.
• Fixes type definitions for api_routes
• Removes outdated examples in the examples/ dir

2.73.0 (23 Dec 2025)

• Adds several new hooks: before_identify, before_register, before_register_once, before_track, before_unregister
• Adds instance-initialization notification to allow Data Inspector browser extension to hook into SDK actions
• Fixes and extends type definitions

2.72.0 (14 Nov 2025)

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.
• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

2.71.1 (30 Oct 2025)

• fixes issue with $mp_page_leave events getting tracked when record_heatmap_data is on and there was no session recording taking place.

2.71.0 (2 Oct 2025)

• adds Dead Click ($mp_dead_click) autocapture event: when a click occurs but there is no DOM mutation afterwards
• adds Page Leave ($mp_page_leave) autocapture event: when a page is "left" either by navigation or leaving the tab
• adds additional properties to experiment exposure events for feature flags
• upgrades rrweb fork to fix a hidden input masking issue
• gets rid of package.json exports feature to be less restrictive of what can be imported
• adds type definitions for each build option

2.70.0 (4 Sep 2025)

• Feature flags requests now send params on query string with GET instead of POST for easier caching

2.68.0 (11 Aug 2025)

• Initial rage-click detection support
• Block <audio> tags by default in Session Recording
• Add flags.update_context() method for updating context variables and refetching variants

2.67.0 (17 Jul 2025)

• Use get_api_host() consistently across the SDK
• Include device_id in default Feature Flag context
• Track latency props in $experiment_started event
• Fix async behavior in mixpanel.reset() when a session recording is active
• Fix recorder integration test race conditions

2.66.0 (8 Jul 2025)

• Add api_host configuration option to support different hosts/proxies for different endpoints (thanks @​chrisknu)
• Add types.d.ts from existing public repo
• Fix race condition when calling mixpanel.reset() while a session recording is active

... (truncated)

Commits

• a2ad09e 2.74.0
• 5d75e7c update changelog for 2.74.0
• 8857795 build non-rc
• f773f9b fix dirs
• bb43dbf build rc1
• c0e3a6c weird import fix
• 25edd4a Automated browser test suite POC (#263)
• eeae70f Fix safari localStorage failure
• 15e8e1d delete outdated example dirs (#363)
• 9c87e28 [SR-272] Add remote_settings_mode to fetch server side configuration (#359)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.