npm / @grafana/faro-web-sdk
@grafana/faro-web-sdk
What changed in @grafana/faro-web-sdk 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
2 security2 new APIs and options1 performance7 behavior and defaults25 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@grafana/faro-web-sdk 237 changes
Security 2
Fetch keepalive handling was hardened.
Caps stack-frame line length to bound regex backtracking.
New APIs and options 2
Expose controls for pausing session replay recording.
User actions gain a configurable initial activity timeout.
Performance 1
FetchTransport now supports gzip request compression.
Behavior and default changes 7
Reliable Fetch transport becomes the default transport.
Session replay uses Grafana privacy classes by default.
Preserve recording identity when handing off between tabs.
Reconcile session ownership before capturing telemetry.
Trace context is omitted for unsampled sessions.
Web vitals measurements now forward LCP resource details and LoAF-based INP attribution.
The SDK includes the git commit hash in app metadata.
Fixes and other changes 25
Sessions start only after prerender activation.
Session sampling uses stronger randomness.
Sampling state is preserved when session metadata is updated.
Signals added during a BatchExecutor flush are no longer dropped.
Discard recorder attempts that have been invalidated.
Bind session invalidation to the identity of the request.
Page errors are no longer logged as session replay errors.
Clicks on nested child elements now trigger user actions.
Transient Faro delivery failures are retried.
Keeps config.paused in sync when pause and unpause are called.
The full set of fetch and xhr instrumentation options is now typed.
Input values are masked using a fixed-length mask.
The keepalive budget is measured in bytes.
Calling removeBeforeSendHooks now removes the hooks.
The href in rrweb Meta events no longer includes the query string or fragment.
Stack parsing no longer stalls on large error payloads.
Traceparent is no longer injected while Faro is paused.
Performance timestamps are derived from the wall clock so they remain usable after system suspend.
A background tab no longer emits an expired session ID.
The signal that triggers session rotation is now attributed to the new session.
BatchExecutor can now run in worker scopes.
Service worker time is reported as 0 when no service worker is used.
Uses crypto.getRandomValues to generate short IDs.
Fixes an incomplete regular expression for hostnames.
Metro bundle id resolution falls back to window when resolving the id.