Notable releases of the Browsonic SDK, its framework adapters and the product. Every published version of every @browsonic package is listed on npm, with the files that shipped.
SDK & adapters
Releases 3.28.0 to 3.32.0, published between 5 and 24 September. Session Replay records more reliably and plays back correctly away from your site, route keys keep readable names, and three opt-in features arrived.
- Session Replay embeds the fonts a page shows (
inlineFonts, on by default), so text and icon fonts play back correctly where your site cannot be reached. Same-origin fonts only, up to 200 KB each; it adds about 50–200 KB to a session's first snapshot.inlineFonts: falseturns it off (3.32.0). setPersona(persona)tags every page view with a user type, such asdealer, so Atlas can split the map by it (3.28.0).captureStorage.redactShapes: truealso masks e-mail, phone, national ID, IBAN and card numbers inside captured storage and cookie values (3.28.0).- Session Replay
inlineImagesandcollectFonts, both off by default: embed same-origin or CORS images, and fonts created with theFontFaceAPI (3.28.0).
- Session Replay masks hidden inputs and scrubs attribute values it used to record in clear, delivers the last segment of a page, respects
pause(), starts recording once consent is given, keeps its duration limit across reloads, and gives a duplicated tab its own recording sequence (3.31.0). - A path segment made only of lowercase words, such as
/settings/common-data-processing-permission, stays a route name at any length instead of becoming:id. Page views recorded before the upgrade keep their:idkeys (3.31.1). - A path segment with an encoded space (
%20), such as a name typed into the URL, becomes:id, so it no longer creates its own Atlas screen (3.30.0). - Session Replay reports itself unhealthy in the SDK diagnostics when its uploads stop reaching the API (3.29.1).
- Batches report the sample rate actually in effect, including the SDK's own back-off, so the console can weight sampled counts correctly (3.29.0).
3.27.0 closes five releases in the first week of September. Sessions now end (30 minutes idle, destroy(), newSession()), a consent gate that has not answered yet holds events instead of dropping them, errors carry their own data and a link to the replay moment, Web Vitals explain themselves, and fifteen tuning options became internal constants so a mistyped number can no longer switch error tracking off.
errorDataon every error — the Error's own properties, HTTP status / url / method, a plain-object rejection reason — and_replay { seq, offsetMs }while the replay plugin records, so an error opens at its moment in the recording.- Web Vitals attribution: LCP element and resource URL, INP target and phases, CLS shift source, TTFB breakdown, plus long-animation-frame breadcrumbs (3.27).
newSession();captureError(error, { handled, mechanism });networkDetailwith method / url / status / duration on network failures; lifecycle breadcrumbs (hidden / visible / online / offline) (3.26–3.27).- Replay reports its mask policy (
X-Replay-Mask) so the console can explain a grey recording instead of guessing (3.24). - A script-tag host can turn Web Vitals on with
trackWebVitals: true(3.23).
- Fifteen settings became internal constants (
flushIntervalMs,maxBatchSize,cooldownMs,maxQueueSize, …). They are still accepted, named once atinit(), and ignored — none had a per-deployment right answer and each one a host got wrong took the SDK down silently (3.25). - Repeats inside the 60-second dedup window are counted and stamped on the next admitted occurrence as
_suppressed; dropped events name their reason in the diagnostics. - Fewer requests: the config pull happens once an hour from a trusted cache, page views ride in batches against a current server, and event bodies are gzipped by default.
- A built-in session / CSRF cookie-name blocklist (
JSESSIONID,PHPSESSID,connect.sid,csrftoken,__Host-*,__Secure-*, …) that no configuration turns off. - Bundle: about 28 kB for
@browsonic/sdk/coreand 46 kB for@browsonic/sdkwith the default collectors, minified and gzipped (measured 27.66 / 46.22 kB on 3.27.0). Session Replay is a separate import.
- Every published version is listed in the npm release history linked at the bottom of this page.
Four releases between 2 and 5 September that made the event self-describing: what the request was, which control the user touched, what the framework already knew, and a stack that actually reaches application code.
- 3.26 —
networkDetailcarries the request (method, url, status); Angular's defaultErrorHandleroutput is recognised;errorTypepreferserror.name; the interaction timeline names the field; storage snapshots skip the SDK's own keys. - 3.25 — user interactions get their own slots in the timeline; a route that resolves to where it already was is no longer a navigation.
- 3.24 — the replay plugin reports which rrweb masks were active, so the product can explain a grey screen.
- 3.23 —
trackWebVitals: truefor script-tag hosts; the identity channel (identify) is documented.
- Stack capture that reaches application code: V8 caps
Error.stackatstackTraceLimit(10 frames); the SDK raises it while capturing, and the raw stack string is redacted with the frame-aware rule so URLs stay readable (3.26). - One fault reports once from the framework adapters, the component is named, and action arguments no longer leak (3.23).
- Three collectors stopped reporting things that did not happen; page-view collection no longer collapses a list walk into one view (3.23).
- Published packages are loadable, tree-shake-safe and typed; stale build output no longer ships (3.23).
A sustained pass over what can leave the browser, plus the fix for a regression worth knowing about if you are pinned to an early 3.21.x.
sessionContext— app-defined session-level context with an explicitallowKeysegress policy. An allow list, not a deny list: forgetting to list a key over-redacts and you notice.
- Turkish national IDs (checksum-validated TCKN) and phone / MSISDN shapes are redacted before events leave the browser, matching the server-side scrubber instead of relying on it.
stack,stackFrames[]andlinkedErrors[]go through redaction; symbolication is unaffected because debug ids resolve from the raw frames.- Nested values past the depth bound now fail closed — an over-deep object becomes
[REDACTED_DEPTH_LIMIT]instead of egressing verbatim under scrubbed shallow levels. - Numbers reach the redaction pass at all:
{ msisdn: 905321110001 }used to bypass it because the value was not a string.
- ⚠️ 3.21.0 and 3.21.1 ship no Web Vitals at all. The page-hide flush ran before the plugin enqueued its sample, so LCP / INP / CLS never left the browser and the Performance page went to dashes. Fixed in 3.21.2 — upgrade if you are on either.
The SDK side of Atlas. The map needs no extra code; describing what a user was trying to do does, and this is that API.
atlas.startTask({ task })— a no-throw handle withstep/complete/abandon/fail. Open tasks auto-end as abandoned on page dismissal; flood guards cap events per session and concurrent tasks.atlas.handoff.start({ intent })/close(outcome)— continues one visit across two apps of the same workspace. The ticket travels only in the URL fragment (#bhid=), so it never reaches a server log or a Referer header.- Screen context on page views — a stable screen id, an archetype (
list/detail/form/wizard/ …) and a zone, all optional and validated silently. - Task lifecycle events mirror into a live Session Replay recording as rrweb custom events, so playback lines up with task state.
- The es2015 IIFE build no longer throws at load on engines without regex lookbehind (Safari ≤ 16.3, older Chrome/Firefox) — precisely the legacy audience that artifact exists for.
Page-view telemetry stops being a URL list and starts being a navigation record — and turning it on becomes one flag.
atlas: true— one init flag replaces themanualPageViews+ adapter pairing. Organic tracking runs from first paint and the first templatedtrackPageView()from an adapter takes the channel over automatically.- Navigation Context — the trigger behind each navigation: the interacted element's accessible name, the trigger kind, navigation type, previous route and dwell time.
[data-browsonic-mask]subtrees yield nothing. - Screen names via
trackPageView(route, { name })or a[data-browsonic-screen]annotation. - A maintained self-hosted es2015 IIFE artifact for bundler stacks that cannot parse the ES2020 dist.
- Routes are normalised at source —
/orders/order12345collapses to/orders/order:id, so id-suffixed URLs stop minting unbounded distinct routes. - ⚠️
updateConfig()now refuses runtime changes to collector-snapshot keys such ascaptureDocumentTitle, instead of merging them as a silent no-op. The running collector never honoured them, so the old behaviour was a privacy control that lied. - Page-view sampling is session-consistent: a whole session is kept or dropped, replacing the per-navigation coin flip that put links nobody walked into the Atlas map.
- A transient HTTP 429 no longer permanently loses the rate-limited batch.
- Session Replay's final dismissal flush ships synchronously instead of awaiting a gzip pipe whose reads never complete in a dying page.
Source-side control over what page-view telemetry is produced, and a ceiling on how much a replay recording can cost.
trackPageView(route)plus manual mode, so an adapter can send route templates rather than raw URLs.- Source-side route controls — patterns, a normalisation hook, hash-routing support and sampling.
- Session Replay idle / max-duration auto-stop and rrweb throttles.
- Error-event
url/referrergo through the full URL sanitiser rather than the weaker string redactor.
The React, Vue, Svelte, Next.js, Astro and Remix adapters were first published on npm on 7 May (Angular on 4 May), together with source-map upload: build plugins for Vite, Webpack and Rollup, and the @browsonic/cli upload command.
First public release of the SDK on npm, under the Apache 2.0 licence. It was previously distributed privately as @leguides/browsonic-sdk (latest internal version 2.1.1); the public API and the /v1/events wire format did not change.
- Package name:
@leguides/browsonic-sdk→@browsonic/sdk. - Registry: GitHub Packages → public npm.
- Licence: proprietary → Apache 2.0.
Platform
Fixes to how plans, invitations and data windows behave, shipped on 5 September.
- Every paid plan is metered against its own monthly event limit. A bug had applied the Free limit to every workspace.
- Invitations work for people who already have an account: accept on the invitation page with your password (and authenticator code), or sign in and open
/accept-invite. Removed teammates can be invited again, and the only owner of a workspace cannot leave it. - Reads reach the full plan retention: Professional and Enterprise can look back 90 and 365 days in Issues, URLs, Events and Performance instead of 30.
- Session Replay recordings take the plan's retention on every plan change, and the SDK is told when a workspace's replay storage is nearly full or full, so it stops recording what the API would refuse.
- The Performance page groups by route template (
/orders/:id), and its headline error rate covers the whole window, not only the routes on the current page.
- Notification webhook endpoints (error storms, quota alerts, security events), with a signed test delivery.
- Noise filters can be changed only by workspace owners, and every change is recorded in the audit log.
Call identify({ msisdn }) with the person's phone number in each of your apps, and the User timeline shows that person's errors and warnings from all of them, in order — the error in the billing app and the failed step in the self-service app become one story instead of two unrelated incidents. Professional and Enterprise.
identify({ msisdn, userId })in@browsonic/sdk3.22.0 — the SDK half.- The User timeline in the console: one person's events across every app in the workspace.
- The SDK's
atlas.handoffticket links two apps within one visit;identify()links them across visits.
Export Atlas screens and paths into Figma as a design file, with Figma Styles, Variables and a DTCG token file. Re-importing updates the same pages instead of duplicating them, so an export can be repeated as the app changes. It runs through the Browsonic plugin in the Figma desktop app: 5 exports a month on Professional, unlimited on Enterprise.
- A Figma plugin fed by a single-use export code.
- Styles + Variables + DTCG tokens, not just flattened images.
With a catalog of your screens and journeys, Task Flows finds a journey by the names in your menu and walks its screens. Professional and Enterprise. The outcome and completion rates it showed at first were removed in September 2026: Atlas is for finding and understanding how people move through your app, not for grading it.
- Journeys from your catalog, found by their menu names, with the screens people pass through.
Alert rules on an app's error count over a 5-, 15- or 60-minute window, delivered as a signed webhook. Included from Starter upward.
- Rule builder with thresholds and windows; signed webhook delivery.
- Noise filters drop a known-loud source on the server before it is stored.
- Slack, PagerDuty and Linear are not available.
A map of your application built from the page views the SDK already sends, so it needs no extra code. Screen captures are rendered from Session Replay recordings, so they need the replay plugin. Professional and Enterprise; it opens from Atlas in the console sidebar, at atlas.browsonic.com.
- The Product Map, built from page views — no extra code.
- Screen captures rendered from Session Replay recordings.
DOM-level session recordings that play back next to the stack trace. Opt in via sessionReplayPlugin from the @browsonic/sdk/replay sub-path, registered before init(). Professional and Enterprise, with masking on by default.
@browsonic/sdk/replay— opt-insessionReplayPlugin.- Masking on by default:
maskAllText,maskAllInputs,blockAllMedia— password inputs always masked. - Playback in the console, and Admin → Session Replay for the recording rate, retention and storage.
Full release history
Every published version of every @browsonic/* package has its own entry on npm:
- npm version history — @browsonic/sdk — every published version, with the files and integrity hash that shipped. Releases from 3.21.2 onward carry no npm provenance attestation; the security page lists which versions do, and what to check instead.