@coralogix/browser 3.23.6 → 4.0.0

package/CHANGELOG.md

@@ -1,3 +1,54 @@
+# 4.0.0 (2026-09-27)
+
+### ⚠️  Breaking Changes
+
+- The npm package is now published as ES2022 instead of ES5. If you support browsers older than ES2022, transpile `@coralogix/browser` as part of your own build, or load the ES5 CDN bundle instead — that bundle is unchanged
+- The default CDN bundle is now built to ES2022, up from ES2015. Use the ES5 CDN bundle if you support older browsers
+- The HTTP attributes on network spans are renamed onto the stable OpenTelemetry semantic conventions: `http.method` → `http.request.method`, `http.url` → `url.full`, `http.status_code` → `http.response.status_code`, `http.host` → `server.address`. This affects you only if you read the raw OpenTelemetry span attributes, which reach you through a `tracesExporter` callback. `network_request_context` — what `beforeSend` receives — keeps the same fields and values, apart from `status_text` below
+- `status_text` now reports the standard reason phrase for the status code — `Service Unavailable` for 503 — rather than the phrase the server sent, because HTTP/2 and HTTP/3 carry no reason phrase on the wire at all
+- `response_content_length` is now a `number` instead of a `string`
+
+### 🚀 Features
+
+- Upgrade OpenTelemetry to 2.x, moving network spans onto the stable HTTP semantic conventions
+- Report `response_content_length` from the `Content-Length` header, so cross-origin requests are now covered; it is unset when the server omits the header
+
+### 🩹 Fixes
+
+- Report a `status_text` for XHR requests that fail outright — offline, blocked by CORS, aborted or timed out — where it was previously left empty. XHR carries no reason for such a failure, so these report `Unknown`; a failed `fetch` reports the browser's own message, as before
+- Ignore a malformed `Content-Length` header instead of reporting a misleading response size
+
+## 3.24.0 (2026-09-23)
+
+### 🚀 Features
+
+- Take an extra screenshot for Coralogix Product Analytics when a user action leads to a meaningful application state — a dialog, drawer or menu opening, a view being replaced — on top of the screenshots already taken on the first click and one random later click of each view. On by default whenever session recording is running; set `sessionRecordingConfig.captureScreenshotOnDomChange: false` to turn it off. Expect a small rise in upload volume: one to four extra screenshots per page view, measured on real applications
+- List the actions available on the captured view in each Product Analytics screenshot event (`screenshot_context.actions`, up to 100 names): the page's `data-cx-action-name` values first, then the same names a click on the page's controls would report as `resolved_name`
+
+### 🩹 Fixes
+
+- In `onlyWithErrorConfig` mode, hold automatic Product Analytics screenshots until the session has an error. Previously the screenshot payload was uploaded straight away while the event describing it was withheld, so sessions that never errored paid for screenshots that could not be queried
+
+## 3.23.8 (2026-09-17)
+
+### 🩹 Fixes
+
+- Report a clicked button's own text as its interaction name (`resolved_name`) when the button sits inside a container that has an `aria-label`, such as a `role="dialog"` panel. The container's label was reported instead
+- Name a click on an SVG chart shape by the shape's own `<text>` label instead of by the text of the whole page section around the chart
+- Stop naming an icon-only control after the labels of the other buttons in its toolbar; such controls now take their `title` or `alt` attribute, and report no name when they have neither
+- Name a `<select>` by its first option instead of by all its options joined together, and name `<input type="submit">`, `"button"` and `"reset"` by their `value`
+- Exclude text under a masked element (`maskClass`) from `resolved_name` instead of leaking it when the clicked control contains masked content
+- Cap `resolved_name` and `element_inner_text` at 100 characters, ending with ` [...]` when cut, so a container's content can no longer produce a very long interaction name
+- Run only the first SDK copy loaded on a page: a second copy (another bundle importing the SDK, or a CDN script next to an npm install) no longer replaces `window.CoralogixRum`, and its `init` is ignored with a debug message
+
+## 3.23.7 (2026-09-14)
+
+### 🩹 Fixes
+
+- Mask a page URL segment as `{id}` only when the whole segment is digits, so route names such as `/apm-v2` and `/oauth2` keep their real value
+- Run your own `pageUrlBlueprinters` after the built-in ID masking, so the SDK defaults no longer overwrite them
+- Keep the fragment when masking a numeric segment: `/user/123#details` now reports as `/user/{id}#details`
+
 ## 3.23.6 (2026-09-09)
 
 ### 🩹 Fixes

package/LICENSE

@@ -199,3 +199,68 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
+
+================================================================================
+THIRD-PARTY NOTICES
+================================================================================
+
+This distribution contains code derived from the projects below. Their notices
+are reproduced here as their licenses require for binary distribution; the code
+itself is vendored into this package rather than installed as a dependency.
+
+--------------------------------------------------------------------------------
+shimmer 1.2.1 — https://github.com/othiym23/shimmer
+Vendored at src/tools/cx-shimmer.ts
+--------------------------------------------------------------------------------
+
+Copyright (c) 2013-2019, Forrest L Norvell
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+--------------------------------------------------------------------------------
+rrweb — https://github.com/rrweb-io/rrweb
+Vendored at src/cx-rrweb/
+--------------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) 2018 Contributors (https://github.com/rrweb-io/rrweb/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -96,6 +96,13 @@
 JavaScript / TypeScript Frameworks: React, Angular, Vue, NextJS and more.<br>
 Flutter (Currently only web).
 
+### JavaScript language level
+
+Version 4.0.0 and later publish the npm package as **ES2022**. Versions up to 3.24.0 published ES5.
+
+If you support browsers older than ES2022, transpile the package as part of your own build, or load
+the [ES5](#es5) CDN bundle instead.
+
 ## Usage
 
 To use Coralogix SDK for Browsers, call `CoralogixRum.init(options)` at the soonest available moment after the page load.
@@ -352,6 +359,18 @@ CoralogixRum.init({
     recordConsoleEvents: true, // Will record all console events from dev tools. Levels: log, debug, warn, error, info, table etc..
     sessionRecordingSampleRate: 100, // Percentage of overall sessions recording being tracked, defaults to 100% and applied after the overall sessionSampleRate.
     immediateFlush: false, // Flush recording events immediately on start to capture short-duration sessions (<10s). Defaults to false.
+    /**
+     * Take an extra screenshot when the page changes in a way that looks like a meaningful
+     * application state, such as a dialog opening or a view being replaced. These are in addition
+     * to the screenshots taken on the first click and one random later click of each view.
+     *
+     * On by default whenever session recording is running. Detection reads the session recorder's
+     * event stream, so with autoStartSessionRecording: false it stays dormant until you call
+     * CoralogixRum.startSessionRecording(). Set it to false to turn it off.
+     *
+     * Available from version 3.24.0.
+     **/
+    captureScreenshotOnDomChange: true, // Defaults to true.
   },
 });
 ```
@@ -702,6 +721,13 @@ CoralogixRum.init({
 });
 ```
 
+The SDK applies its own built-in blueprinting first, then your functions, in the order you list
+them, so your blueprinter has the final word on the URL it returns.
+
+The built-in page blueprinting replaces UUIDs and all-digit path segments with `{id}`, so
+`/orders/1234` becomes `/orders/{id}`. A segment that only happens to contain a digit keeps its
+real value, which leaves route names such as `/apm-v2`, `/oauth2` and `/v1` untouched.
+
 ### Traces
 
 Add trace context propagation in headers across service boundaries
@@ -1282,7 +1308,8 @@ You can choose your desired version.
 
 #### Specific Version (recommended)
 
-By default, the CDN is built using the <b>ES2015 (ES6)</b> standard.<br>
+From 4.0.0 the default bundle is built to the <b>ES2022</b> standard, up from ES2015. If you support
+older environments, use the [ES5](#es5) bundle below.
 
 https://cdn.rum-ingress-coralogix.com/coralogix/browser/[version]/coralogix-browser-sdk.js \
 Replace [version] with a version from [Releases page](https://www.npmjs.com/package/@coralogix/browser?activeTab=versions).

package/index.esm.js

@@ -1,5 +1,4 @@
-export { t as CoralogixEventType, q as CoralogixLogSeverity, p as CoralogixRum, O as OtelNetworkAttrs, P as PerformanceTypes, r as SessionRecordingEventType, U as UrlBasedLabelProvider, u as UrlType } from './index.esm2.js';
-import 'tslib';
+export { x as CoralogixEventType, v as CoralogixLogSeverity, u as CoralogixRum, O as OtelNetworkAttrs, y as PerformanceTypes, w as SessionRecordingEventType, U as UrlBasedLabelProvider, z as UrlType } from './index.esm2.js';
 import '@opentelemetry/sdk-trace-base';
 import '@opentelemetry/sdk-trace-web';
 import '@opentelemetry/instrumentation';
@@ -8,6 +7,7 @@ import '@opentelemetry/instrumentation-fetch';
 import '@opentelemetry/instrumentation-xml-http-request';
 import 'web-vitals/attribution';
 import 'web-vitals';
+import '@opentelemetry/core';
 import '@opentelemetry/api';
 import '@opentelemetry/propagator-b3';
 import '@opentelemetry/propagator-aws-xray';