@groundcover/browser 2.1.1-rc.1 → 2.2.0-rc.0

package/CHANGELOG.md

@@ -4,11 +4,72 @@ All notable changes to `@groundcover/browser` are documented here. This project
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and the
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format.
 
-## [2.1.1-rc.1] — 2026-10-13
+## [2.2.0-rc.0] — 2026-11-05
 
-Release candidate of `2.1.1`, on top of `2.1.0`. Session replay takes its periodic full snapshot
-every 5 minutes instead of every 30 seconds. No configuration or API changes. Supersedes
-`2.1.1-rc.0`, which tried moving checkouts to idle time instead and was not pursued.
+First release candidate of `2.2.0`. Issues for thrown or rejected values that aren't `Error`s start
+new groups once; see Changed.
+
+### Added
+
+- **Third-party notices.** The package now ships `THIRD_PARTY_NOTICES.md` with the MIT notices of
+  fflate and `@rrweb/packer`, whose code its session-replay compression worker bundles.
+- **Unhandled rejections of Bluebird promises are reported.** Bluebird announces an unhandled
+  rejection with its own `unhandledrejection` event, which the SDK ignored; it is now reported by
+  its reason, like a native one.
+
+### Changed
+
+- **`captureException` accepts any value, not only an `Error`.** A string, object or other value was
+  dropped without a word; it is now reported as an exception with `error_type` `Error`. A string or
+  number is its own message. An object is described by its shape, never its values, so captures of
+  the same kind group as one issue even when a field such as a request id changes:
+  `Object captured as exception with keys: code, requestId`, the class name for a class instance
+  (`Response captured as exception`), and an item count for an array. The value itself is sent in
+  `error_metadata.captured_value` as JSON, redacted field by field and cut at 10,000 characters. An
+  object with a string `message` keeps its own name, message and stack, and a DOM Event, such as an
+  image's `error` event, is described by its type and target
+  (`Event captured as exception (type=error, target=img)`).
+- **`captureException` takes `unknown`.** Existing calls still compile, but a typed stand-in for it
+  written as `(error: Error) => …`, such as a test mock, no longer type-checks.
+- **Thrown objects and rejection reasons that aren't `Error`s are described the same way.** A
+  rejection's reason was reported as its JSON, and a thrown object without a `message` as
+  `Unknown error`; both are now described by their shape
+  (`Object captured as promise rejection with keys: code`), with the value in
+  `error_metadata.captured_value`. Issues for such values start new groups once.
+- **`error_message` is capped at 10,000 characters**, as log messages are. The fingerprint, made
+  from the first 400 characters, is unchanged.
+- **The SDK no longer adds properties to your `Error` objects.** It defined read-only `fileName`,
+  `lineNumber` and `columnNumber` on every uncaught `Error` in Chromium and Safari, and nothing read
+  them.
+- **`maskErrors` is documented as it works.** It redacts error messages and metadata; stack frames
+  are sent as they are.
+- **The package `homepage` is the current documentation URL**, and the package's LICENSE carries its
+  copyright line.
+
+### Fixed
+
+- **An uncaught throw of a non-`Error` value is reported at its throw site.** `throw "boom"` or
+  `throw 0` outside a promise made the SDK's error listener fail, so the error was dropped. It is now
+  an exception with the message `boom` and one stack frame at the location the browser reported.
+- **An uncaught error whose message contains "Script error" is reported.** The SDK dropped every
+  such error, such as RequireJS's `Script error for "<module>"`; it now drops only the browser's
+  muted cross-origin `Script error.`, which carries nothing to report.
+- **An unhandled rejection whose reason can't be serialized is reported.** A rejection with a
+  circular object as its reason made the SDK fail, so it was dropped.
+- **A rejection reason's nested secrets are redacted.** Its JSON was scrubbed as free text, which
+  masked only the first line under a sensitive key such as `token` or `credit_card`; the reason is
+  now redacted field by field.
+- **An `Error` from another frame keeps its name and message as a rejection reason.** A same-origin
+  iframe's `Error` failed the SDK's `instanceof Error` check and was reported as `{}`.
+
+## [2.1.1] — 2026-10-26
+
+Stable release of `2.1.1-rc.1`. Session replay takes its periodic full snapshot every 5 minutes
+instead of every 30 seconds. No configuration or API changes from `2.1.0`. `2.1.1-rc.0`, which tried
+moving checkouts to idle time instead, was not pursued.
+
+The type declarations are byte-for-byte those of `2.1.0` and rc.1. The shipped JavaScript differs
+from rc.1 only in the text of the removed-option warnings below.
 
 ### Changed
 
@@ -20,6 +81,11 @@ every 5 minutes instead of every 30 seconds. No configuration or API changes. Su
   send 10× fewer full snapshots. Every recording still starts with a full snapshot. A player that
   seeks from the nearest earlier full snapshot may fetch more data to reach a point deep in a long
   recording.
+- **The warnings for removed options point to this package's README on npm.** The console warnings
+  for `enableMasking`, `maskFields` and `eventSampleRate` now name the README section to read
+  ("Migrating to 1.0.0" or "Migrating from 1.x to 2.0.0") and link to the npm package page, instead
+  of a GitHub link.
+- `package.json` no longer has `repository` and `bugs` fields.
 
 ## [2.1.0] — 2026-10-12
 
@@ -252,7 +318,7 @@ golden wire format, `attributes.location` intact, zero console errors).
 
 ### Fixed
 
-- **Fetch response bodies are now hardened like request bodies (FE-12851).** Responses are classified
+- **Fetch response bodies are now hardened like request bodies.** Responses are classified
   by content-type (binary → placeholder, no mojibake) and their read is bounded by a timeout, so a
   slow or never-ending response stream can no longer stall the network event. An over-cap response is
   placeholdered instead of emitting an unredactable truncated slice.
@@ -325,6 +391,3 @@ These shipped ahead of 1.0.0 and are part of this major:
   worker, with a transparent main-thread fallback under strict CSP / sandboxed iframes / SSR.
 - **Configurable, lazily-enforced `sessionMaxDuration`** (default 4h, range 1 min–8h) plus 30-minute
   inactivity-gap session rotation.
-
-[1.0.1]: https://github.com/groundcover-com/rum/releases/tag/1.0.1
-[1.0.0]: https://github.com/groundcover-com/rum/releases/tag/1.0.0

package/LICENSE

@@ -1,5 +1,7 @@
 MIT License
 
+Copyright (c) 2025 groundcover
+
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
 the Software without restriction, including without limitation the rights to

package/README.md

@@ -15,7 +15,7 @@ application — with privacy masking **on by default**.
 
 > Session replay is powered by [**rrweb**](https://github.com/rrweb-io/rrweb) under the hood.
 
-See the [groundcover RUM documentation](https://docs.groundcover.com/capabilities/real-user-monitoring-rum/)
+See the [groundcover RUM documentation](https://docs.groundcover.com/investigate/real-user-monitoring-rum)
 for the full product guide.
 
 ---
@@ -351,7 +351,7 @@ and static page text stay visible; use `[data-private]` / `maskSelectors` to mas
 | `maskNetworkBodies` | `boolean` | `true` | Redact network request/response bodies. |
 | `maskNetworkQueryParams` | `boolean` | `true` | Redact URL query params. |
 | `maskLogs` | `boolean` | `true` | Redact console/log messages and attributes. |
-| `maskErrors` | `boolean` | `true` | Redact error messages, metadata and stack-frame URLs. |
+| `maskErrors` | `boolean` | `true` | Redact error messages and metadata. Stack frames are sent as they are. |
 | `sensitiveKeys` | `string[]` | — | Extra case-insensitive key substrings treated as sensitive, merged with built-ins. |
 | `redact` | `(field) => value \| undefined` | — | Per-leaf custom redactor for non-replay events. Return `undefined` to defer to the SDK default. |
 | `replay.maskTextFn` | `(text, el) => string` | — | rrweb `maskTextFn` pass-through (replay only). |
@@ -545,7 +545,7 @@ All methods are available on the default export and on `window.groundcover`.
 | `init(config)` | Initialize the SDK and install instrumentation once; calls after successful initialization are ignored. |
 | `identifyUser(user)` | Attach user identity to subsequent events. |
 | `sendCustomEvent({ event, attributes })` | Emit a custom business event. |
-| `captureException(error, metadata?)` | Capture a handled error with optional context. |
+| `captureException(error, metadata?)` | Capture a handled error (any value) with optional context. |
 | `logger.{log,info,warn,error,debug,trace}(message, attributes?)` | Structured logging (see below). |
 | `updateConfig({ options?, user?, … })` | Update config at runtime (merges nested groups one level deep). |
 | `startNavigation(metadata)` / `endNavigation(metadata)` | Manual navigation spans (when `navigation` isn’t auto-tracked). |
@@ -587,6 +587,22 @@ groundcover.captureException(new Error("Payment failed"), {
 });
 ```
 
+`captureException` accepts any value, not only an `Error`. A string or number becomes the message.
+An object is described by its shape, never its values, so captures of the same kind group as one
+issue: `Object captured as exception with keys: code, reason`, the class name for a class instance
+(`Response captured as exception`), or an item count for an array. The value itself is sent in
+`error_metadata.captured_value` as JSON, redacted field by field and cut at 10,000 characters. An
+object with a string `message` keeps its own name, message and stack, and a DOM Event is described
+by its type and target (`Event captured as exception (type=error, target=img)`):
+
+```ts
+groundcover.captureException("Payment failed");
+groundcover.captureException({ code: 500, reason: "timeout" });
+```
+
+Pass an `Error` when you can: a value that isn't one carries no stack trace of its own, so the
+reported stack starts inside the SDK.
+
 ---
 
 ## Migrating from 1.x to 2.0.0

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,68 @@
+# Third-party notices
+
+`@groundcover/browser` is licensed under the MIT License (see [LICENSE](LICENSE)).
+
+The session-replay compression worker, which ships inlined in `dist/`, contains code from the
+open-source projects below, whose notices follow.
+
+The package's npm dependencies (`rrweb`, `@rrweb/packer`, `fflate`, `error-stack-parser` and
+`web-vitals`) are installed alongside it under their own licenses and are not covered here.
+
+## fflate
+
+<https://github.com/101arrowz/fflate>. The worker calls it directly (0.8), and `@rrweb/packer`
+carries its own copy (0.4). The two releases carry the same license, with copyright years 2023
+and 2020 respectively.
+
+```
+MIT License
+
+Copyright (c) 2023 Arjun Barrett
+Copyright (c) 2020 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## @rrweb/packer
+
+<https://github.com/rrweb-io/rrweb>, the package the worker uses to pack session-replay events.
+
+```
+MIT License
+
+Copyright (c) 2018 Contributors (https://github.com/rrweb-io/rrweb/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/dist/index.d.mts

@@ -134,7 +134,7 @@ interface PrivacyOptions$1 {
     maskNetworkQueryParams?: boolean;
     /** Redact console log messages and attributes. Default on unless `level` is `'allow'`. */
     maskLogs?: boolean;
-    /** Redact error messages, metadata and stack-frame URLs. Default on unless `level` is `'allow'`. */
+    /** Redact error messages and metadata (not stack frames). Default on unless `level` is `'allow'`. */
     maskErrors?: boolean;
     /** Extra case-insensitive key substrings treated as sensitive, merged with the built-in patterns. */
     sensitiveKeys?: string[];
@@ -447,7 +447,7 @@ declare class SessionManager {
     }): void;
     startNavigation(metadata: Record<string, unknown>): void;
     endNavigation(metadata: Record<string, unknown>): void;
-    captureException(error: Error, metadata?: Record<string, unknown>): void;
+    captureException(error: unknown, metadata?: Record<string, unknown>): void;
     emitLog(message: string, level: LogLevel, attributes?: Record<string, unknown>): void;
     getSessionId(): string;
     setSessionId(newSessionId?: string): Promise<void>;
@@ -490,7 +490,7 @@ declare function sendCustomEvent(params: {
     event: string;
     attributes: Record<string, unknown>;
 }): void;
-declare function captureException(error: Error, metadata?: Record<string, unknown>): void;
+declare function captureException(error: unknown, metadata?: Record<string, unknown>): void;
 declare function updateConfig(params: SDKConfigUpdate): void;
 declare function startNavigation(metadata: Record<string, unknown>): void;
 declare function endNavigation(metadata: Record<string, unknown>): void;

package/dist/index.d.ts

@@ -134,7 +134,7 @@ interface PrivacyOptions$1 {
     maskNetworkQueryParams?: boolean;
     /** Redact console log messages and attributes. Default on unless `level` is `'allow'`. */
     maskLogs?: boolean;
-    /** Redact error messages, metadata and stack-frame URLs. Default on unless `level` is `'allow'`. */
+    /** Redact error messages and metadata (not stack frames). Default on unless `level` is `'allow'`. */
     maskErrors?: boolean;
     /** Extra case-insensitive key substrings treated as sensitive, merged with the built-in patterns. */
     sensitiveKeys?: string[];
@@ -447,7 +447,7 @@ declare class SessionManager {
     }): void;
     startNavigation(metadata: Record<string, unknown>): void;
     endNavigation(metadata: Record<string, unknown>): void;
-    captureException(error: Error, metadata?: Record<string, unknown>): void;
+    captureException(error: unknown, metadata?: Record<string, unknown>): void;
     emitLog(message: string, level: LogLevel, attributes?: Record<string, unknown>): void;
     getSessionId(): string;
     setSessionId(newSessionId?: string): Promise<void>;
@@ -490,7 +490,7 @@ declare function sendCustomEvent(params: {
     event: string;
     attributes: Record<string, unknown>;
 }): void;
-declare function captureException(error: Error, metadata?: Record<string, unknown>): void;
+declare function captureException(error: unknown, metadata?: Record<string, unknown>): void;
 declare function updateConfig(params: SDKConfigUpdate): void;
 declare function startNavigation(metadata: Record<string, unknown>): void;
 declare function endNavigation(metadata: Record<string, unknown>): void;