Track upstream rrweb changes to pull in

[pauldambra]

Track upstream rrweb changes to pull in

We vendor a fork of rrweb-io/rrweb under packages/rrweb/* (moved into this monorepo from the retired PostHog/posthog-rrweb in #3510). This issue tracks upstream changes worth pulling into our fork, and replaces the old split tracking in PostHog/posthog-rrweb#155 (open PRs) and #147 (merged PRs), which are now stranded in the old repo.

Fork point: upstream 2.0.0-alpha.18 (2024-12-06).
Upstream now: 2.1.5 (2026-09-17). 2.1.5 contains #1652, a recording-time mutation-processing performance refactor. It is a should pull in item: our fork still uses the older secondary add-list path and lacks the corresponding accessor helpers. The other 2.1.5 package releases are version/dependency-only for this assessment. Adoption in flight: #5010. Upstream released 2.1.2, 2.1.3 and 2.1.4 on the same day. Release by release since our fork point: 2.0.0 mostly re-published pre-alpha.18 PRs we already have; 2.0.1 added one fix (#1854); 2.1.0 added #1864 + #1865; 2.1.1 has no code changes (version bumps only); 2.1.2 added #1712 + #1769; 2.1.3 added #1921 + #1771; 2.1.4 has no code changes (version bumps only, plus the #1904 console-plugin fix in that package).

2.1.3 is the first release since our fork point that contains a fix we both need and do not have. All the same, the release train is still not where the interesting changes are — the genuinely-new surface is PRs merged after 2024-12-06 plus the currently-open PRs.

Prioritisation lens: recording performance (CPU/memory cost on the customer's page while recording) outranks everything else — replay fixes, masking gaps, and framework compat all queue behind it. Recording-perf items are ranked first in the adoption plan (see comments).

This is a comprehensive scan: every merged-since-fork and open PR was triaged, and each "adopt"/"already-have" call was verified by grepping our fork. Items marked * are PostHog-authored upstream PRs that aren't in our fork yet — adopting them early means vendoring our own not-yet-landed work; they're also tracked in the contribute-back issue (#3766).

Trustworthiness criteria

• High — core maintainers (Juice10, eoghanmurray, juliecheng, YunFeng0817), PostHog authors (pauldambra, d0ugal, daibhin, megboehlert, billyvg, benjackwhite, marandaneto, kevinatown), or APPROVED PRs.
• Medium — known/repeat contributors, or PRs with substantive review.
• Low — unknown/community/no-review (validate before adopting).

---

Merged upstream since our fork — clean cherry-picks (not yet in our fork)

PR	Author	Trust	Theme	Priority	Why it matters
#1769	heathdutton	High	replay	Reconcile, don't cherry-pick	Merged 2026-09-08, shipped in 2.1.2. Upstream deletes the case EventType.Custom skip outright, so every custom event re-fires on seek. Our fork already fixes the same bug more narrowly: shouldCastInSyncMode (rrweb/src/replay/index.ts:835) re-casts only the rrweb/fullscreen custom event and keeps the rest skipped. Decide deliberately whether to widen to upstream's behaviour or keep ours — and if we keep ours, it becomes a contribute-back item (#3766).
#1865	eoghanmurray	High	css	Medium	Preserve the URL #fragment when converting absolute->relative CSS urls (e.g. url(#filter)); real correctness gap in our absolutifyURLs.
#1763	wfk007	Low	framework compat	Low	Use untainted ownerDocument so shadow-DOM detection works under wujie/micro-frontends that patch ownerDocument.
#1864	eoghanmurray	High	replay	Low	Fix getCurrentTime() stuck in liveMode after the last event; our timer.ts has diverged (rafCheck, guarded timeOffset) so this needs a careful manual port.

The 2.1.3 / 2.1.4 batch is done (2026-09-10) — #1921 via #4837, #1771 via #4861, #1904 via #4862, all merged to main. Only #1865, #1763 and #1864 remain as pending cherry-picks, and all three predate the 2.1.x releases.

#1854 is done — adopted in #4128 (merged 2026-07-15) with a deliberate divergence (page-lifetime keepalive rather than upstream's teardown removal); see utils/src/index.ts keepIframeAttached. It is no longer a pending cherry-pick.

Every other substantive merged-since-fork PR is already in our fork (verified — see below) or CI/release noise.

---

Open PRs — Should adopt (High)

PR	Author	Trust	Theme	Why it matters (+ review state)
#1320	eoghanmurray	High	performance	Standout. Fixes replay 500ms-timeout stall on large dependent node trees (~200 cascading <tr>); 11 lines, we provably lack the rootNexts logic.
#1673	eoghanmurray	High	replay	pause is not a function throw when a site (Squarespace) dispatches media events on non-media elements; cheap guard + try/catch.
#1745	jakewski	Medium	masking/privacy	maskAllInputs doesn't mask type=hidden inputs — can leak tokens/PII. (Re-spin of #1610.)
#1934 (supersedes #1812)	Juice10, from juliecheng	High	stability	New 2026-09-08 — adopt this instead of #1812. Recovers a native Proxy from the shared untainted iframe and caches it, so sites whose libraries overwrite global Proxy (old jsPDF) do not break the stylesheet observers. Our fork calls bare new Proxy(...) in 10 places (9 in rrweb/src/record/observer.ts, 1 in rrweb/src/utils.ts) and has no getUntaintedProxy — so every one of those sites is exposed today. Maintainer-authored, carries #1812 forward, and adds tests on Chromium + WebKit. Read the packages/utils part against our #1854 divergence before porting — see the note below.
#1469 *	daibhin	High (PostHog)	defensive	Wrap createImageBitmap in callbackWrapper so bitmap errors route through the configured errorHandler instead of bubbling. (Overlaps our #3527.)
#1635 *	megboehlert	High (PostHog)	framework compat	Chrome iframes with custom web components defined in <body> never load on replay; rewrites blank-frame detection.
#1641 *	megboehlert	High (PostHog)	css	Virtual-DOM: adopted styles from removed nodes lost for surviving nodes sharing a styleId; adds a styleMap backup.
#1642 *	kevinatown	High (PostHog)	masking/privacy	Adds a blockElementFn callback for fine-grained / whitelist blocking policies.
#1686 *	megboehlert	High (PostHog)	css	Optional-chain rule?.styleSheet?.href so a missing styleSheet no longer nullifies _cssText, leaving <style> empty on replay.
#1806 *	d0ugal	High (PostHog)	replay	Fixes playback fully stopping when skipping backwards with virtual DOM (the default). Our fork still has the buggy destroyTree() ordering. Update 2026-07-11: closed unmerged upstream (by author, 2026-06-17, no supersession noted) — the fix now only exists on the closed PR branch; vendor it from there.
#1814 *	megboehlert	High (PostHog)	stability	Use untainted add/remove listener methods in on() so Zone.js-style monkey-patching doesn't break recording.

---

Open PRs — Should adopt (Medium)

PR	Author	Trust	Theme	Why it matters
#1164	mydea	High	masking/privacy	Mask option/radio/checkbox values under maskAllInputs — real PII leak today. (CHANGES_REQUESTED upstream.)
#1097	mdellanoce	Medium	masking/privacy	Make text-mask settings apply to inputs + mask <textarea> content; fixes maskInputFn missing from initial snapshot.
#1257 *	billyvg	High (PostHog)	masking/privacy	maskAttributesFn to mask/unmask arbitrary attributes. Framed as an RFC — API may still shift.
#1610	ababik	Low	masking/privacy	Hidden-input masking (companion to #1745).
#1313	VladimirMilenko	Low	stability	Fix "Maximum call stack exceeded" from recursive hookSetter — a real crash; 25 lines, self-contained.
#1357	jaj1014	Medium	replay	Styles from insertRule() lost when a <style> is moved during virtual-dom diff (we have the consumer side but not the population).
#1483	eoghanmurray	High	css	Generalize <link rel=stylesheet> attribute-mutation handling + href updates. Hot area for us.
#1586	jaj1014	Medium	css	Chrome mis-serializes grid-template-areas; rebuild cssText from rule.style.
#1735	KuznetsovRoman	Medium	css	Strip empty prop: ; declarations that cause CssSyntaxError: Unclosed string on rebuild. Sits next to our fixSafariColons.
#1428	p-mazhnik	Medium	canvas	Canvas in iframes + shadow DOM (we cover shadow but not iframe contentWindow). APPROVED; supersedes #1413.
#1463	colingm	Medium	framework compat	Patched methods return original toString() so frameworks (Stencil) don't detect a polyfill and break recording.
#1718	arivyiii	Medium	replay	Fix diffChildren early-exit that drops sibling elements/styles on a node-type mismatch — real replay corruption.
#1740	eoghanmurray	High	replay	createCDATASection throws on HTML docs; switch to a text node. (Different approach from our old empty-CDATA guard — see contribute-back.)
#1737	QuentinLowe	Low	recording	image.currentSrc?.startsWith — currentSrc can be undefined and throw during rebuild.
#1830	eoghanmurray	High	replay	Record canvas intrinsic dimensions even without recordCanvas:true so an unrecorded <canvas> doesn't collapse layout.
#1798	dhaval-valotia	Low	replay	Guard media events on non-media elements (Lottie) during replay.
#1624	salomita	Low	stability	Replayer guard: don't append a #document to a non-iframe parent (prevents whole-replay-blank crash).
#1679	econte-sprig	Low	security	Configurable postMessage target origin instead of '*' for cross-origin-iframe recording.
#1726	ppsreejith	Medium	recording	emitFromIframe so a middle iframe can record directly (nested-iframe case).
#558	eoghanmurray	High	recording	Enforce weakly-ascending event timestamps so a delayed mousemove can't reorder before a click.
#1784	eoghanmurray	High	bundle size	Tree-shake postcss out of record-only bundles (our build differs — needs adaptation).

---

Open PRs — Adopt-low / watch

Lower-confidence or niche; adopt opportunistically. Several are tied to features we don't currently use (assets, closed shadow DOM).

Expand (29 PRs)

PR	Author	Theme	Note
#294	eoghanmurray	framework	record inside same-domain iframe via window.top; superseded conceptually by #1023
#389	eoghanmurray	stability	explicit destructor + optional DOM cleanup
#768	champkeh	css	absolutify url(...) in compact inline-style diff path (CHANGES_REQUESTED)
#960	Yuyz0112	recording	count Custom events toward checkout (author says it changes behaviour)
#1023	samber	framework	inject a custom Window (record from any iframe)
#1140	eoghanmurray	replay	render full snapshot on scrub to t=0
#1212	FANCaipei	masking	per-selector mask-fn rules (overlaps our maskText config)
#1235	davidleon	canvas	canvas in shadow-DOM'd iframes (rough impl; #1428 is the cleaner superset)
#1256	BeichenPlus	stability	safeCrossOrigin guard for cross-origin access errors
#1300	mdellanoce	performance	benchmark + naive worst-case processMutations fix (pairs with #1302/#1320)
#1322	eoghanmurray	css	failing test only for var() shorthand serialization — this is the acceptance test for our #3542 contribute-back
#1336	ababik	packer	expose pako compression level
#1392	navaneethsdk	css	one-char regex fix so chrome-extension:// (hyphen-scheme) URLs resolve
#1439	xujiujiu	recording	smooth-scroll trailing-call captures stale Y (mobile); messy impl
#1465	colingm	recording	parent posts message to force cross-origin iframe snapshot
#1466	eoghanmurray	recording	test coverage for history pushState URL resolution
#1475	eoghanmurray	css/perf	large assets-events feature; off-main-thread stylesheet serialization
#1480	eoghanmurray	css	replay :hover by mutating live stylesheets (no postcss); author lists open TODOs
#1534	eoghanmurray	api	export isBlocked alongside rrweb.record
#1616	wfk007	performance	mergeEvents util (+602 lines, no review)
#1638	mikeyagner	replay	handle node whose parent is missing in one mutation iteration
#1681	EricLLLLLL	css	avoid "Regular expression too large" on big :hover stylesheets (only if we ship that plugin)
#1733	godky	css	absolutifyURLs wrong for hash-route SPAs (CHANGES_REQUESTED)
#1739	eoghanmurray	recording	record {mode:'closed'} shadow DOM — author flags it as a privacy footgun
#1766	KristianGrafana	masking	optional CSP attribute on the replay iframe
#1796	alailsonko	replay	preserve duplicate class tokens in hoverElements for CSS attribute selectors
#1800	dhaval-valotia	masking	allowedIframeOrigins allowlist instead of postMessage('*')
#1239	Juice10	feature	Asset event type + capture assets (large feature; CHANGES_REQUESTED) — adopt only as a deliberate feature
#1897	hi-ogawa	replay	new 2026-07-02: support more user-action pseudo-classes (:active, :focus, ...) on rebuild; replay-side only

---

New upstream PRs still open

Triaged against our fork on 2026-09-08. Items that merged into 2.1.3 / 2.1.4 have moved up to the cherry-pick table.

PR	Author	Trust	Theme	Verdict
#1934	Juice10, from juliecheng	High	stability	Adopt (High) — supersedes #1812. See the adopt-high table above. Also touches packages/utils/src/index.ts, where we already diverge (#1854 / #4128).
#1933	eoghanmurray	High	recording performance	Adopt (High), validate carefully. New 2026-09-08. Collapses repeat text mutations against the same node while the buffer is frozen or throttled, so only the final value is emitted — replay state is unchanged because the replayer applies every text mutation in order anyway. Also replaces the attributes array + attributeMap WeakMap pair (from #1343) with a single Map. Our fork has exactly that shape: texts: textCursor[] pushed per mutation (record/mutation.ts:170, :716) and the attributes / attributeMap pair (:171, :172). This is the same recording-CPU theme as batch 1, from a maintainer. It changes emit contents, so port it with the mutation-flood fixture and check the integration snapshots.
#1907	eoghanmurray	High	replay	Adopt (High). Extends the DOMException guard around remove-mutations to rrdom (whose exceptions don't inherit from DOMException) and to appendChild. Our replay/index.ts:1738 still has the narrow instanceof DOMException check, so degenerate replay state can still abort a whole mutation.
#1912	carlosdanieltt	Low (validate)	masking/privacy	Adopt (Medium). Masks placeholder on <input>/<textarea> through maskInputValue() when input masking is on. Our fork does not mask placeholders — real leak when apps build placeholders from user data. Supersedes closed #1898/#1911. Fits batch 3.
#1905	yashrao2607	Low (validate)	replay	Adopt (Medium). Skip srcdoc when rebuilding an iframe — the browser's own async parse of srcdoc races rrweb's reconstruction of the same document. rrdom/src/diff.ts:360 already skips srcdoc; rrweb-snapshot/src/rebuild.ts does not, so the two paths disagree.
#1927	Juice10	High	canvas	Adopt (Medium). Observe canvas APIs on same-origin iframe windows and serialize drawImage arguments across realms. Same gap as #1428 from the canvas side.
#1917	creasty	Medium	replay/css	Watch. Makes the replayer's implicit hackCss rewriting of <style> text mutations configurable. Low urgency, replay-side.
#1920	creasty	Medium	css	Not applicable. Fixes applyCssSplits/splitCssText rule-boundary splitting — our fork never vendored splitCssText (verified absent).
#1914	eoghanmurray	High	plugin	Ignore — click-track/heatmaps plugin; posthog-js has its own heatmaps and autocapture.
#1900, #1909, #1928	—	—	packages we don't ship	Ignore — popup plugin, web-extension uploads, rrweb-player annotations.
#1892, #1926	Juice10 / yashrao2607	—	build/metadata	Ignore — plugin dependency metadata, PR package previews.

Merged upstream on 2026-09-08 and NOT relevant to us: #1903 (repository.directory metadata), #1906 + #1931 (css regression tests for the #1734/#1692 fixes — take the cases if we touch that area), #1891 / #1923 / #1924 / #1929 / #1930 / #1932 / #1935 / #1939 (CI, vitest, playwright, changelog, release, RelativeCI bundle reporting).

Closed upstream (drop from our lists): #1239 (asset events — was already "features we don't ship"), #1898 / #1911 (placeholder masking, superseded by #1912), #1895, #1656 (CI).

Note — #1934 overlaps our #1854 divergence

Read this before porting #1934. Both our fork and upstream keep the untainted-prototype iframe attached on WebKit, but the scope differs:

• Ours (utils/src/index.ts:113–:146, from fix(rrweb): keep untainted-prototype iframe attached on Safari (adopt upstream #1854) #4128) retains the iframe for every key in BasePrototypeCache — Node, ShadowRoot, MutationObserver, Element — for the lifetime of the page, with no cleanup hook.
• Upstream main retains per key too, but registers an untaintedBaseIframeCleanup[key] remover, which we deliberately left out.
• fix: dont mangle some surveys properties #1934 narrows retention to MutationObserver only, because that is the one case that needs a live ScriptExecutionContext (webkit.org/b/179224). Other constructors do not need a live context after retrieval.

Upstream is right here, and it makes our version look over-broad: we can hold up to four hidden iframes on WebKit where one is enough. Take upstream's narrower condition when we port #1934, and keep our page-lifetime choice only for MutationObserver. This also weakens the "novel" claim on that row in #3766 — updated there.

---

Already in our fork (verified — do not re-adopt)

Confirmed present by grepping packages/rrweb. Listed so we don't re-litigate them.

Merged upstream & already vendored: #1580, #1593, #1597, #1614, #1618, #1631, #1695, #1705, #1731, #1758, #1774, #1775, #1777, #1837, #1854 (via #4128), #1712 (verified at rrweb/src/replay/index.ts:298 — this.warn(e); merged upstream 2026-09-04, shipped in 2.1.2), #1921 (via #4837 — record/mutation.ts:735 tagNameLower), #1771 (via #4861 — rrweb-snapshot/src/rebuild.ts:444, plus a divergence upstream lacks, see below), #1904 (via #4862 — plugins/rrweb-plugin-console-record/src/index.ts:198 and :240).

#1771 carries a deliberate divergence. Upstream sets autocomplete="off" at rebuild time only, so a recorded attribute mutation can set it back to a real value or remove it, re-enabling the viewer's autofill mid-replay. Our fork also skips autocomplete mutations on <input>/<textarea> in the replayer (rrweb/src/replay/index.ts:2064). That guard is not in upstream #1771 — it is tracked as a contribute-back item in #3766.
Open upstream but already in our fork (incl. our own ported PRs): #724, #1413, #1462, #1633, #1688, #1691, #1711, #1755, #1770, #1802, #1825, #1826, #1873 (via #4129), #1302 (via #4130), #1697 (via #4131). (Update 2026-07-11: #1825 and #1826 were closed unmerged upstream on 2026-06-17 — #1826 superseded by the merged #1854, #1825 superseded by equivalent maintainer work on the stylesheet-assets branch. Both remain in our fork; no action.)
Solved differently in our fork: #1791 (we have our own iframe memory-leak cleanup).

---

Can ignore

CI / build / release / docs / deps / version-bump noise

Merged: #1554, #1568, #1600*, #1605, #1615*, #1621, #1625, #1629, #1630, #1636, #1640, #1643, #1646, #1647, #1651, #1657, #1696, #1719, #1760, #1761, #1762, #1779, #1780, #1782, #1783, #1787, #1788, #1804, #1805, #1807, #1827, #1831, #1832, #1836, #1838, #1845, #1846, #1847, #1849, #1850, #1851, #1853, #1855, #1858, #1860, #1866.
(*#1600/#1615/#1640 fix the splitCssText feature, which our fork never vendored.)

Open: #661, #863, #1015, #1046, #1149, #1238, #1255, #1259, #1290, #1416, #1448, #1477, #1656, #1676 (empty PR), #1709, #1722, #1730, #1732, #1744, #1748, #1768, #1789, #1790, #1792, #1809, #1810, #1811, #1828, #1839, #1841, #1843, #1848, #1856, #1859, #1861, #1867, #1868.

Features we don't ship

• Network-capture plugin (feat: Add new rule to guarantee events are tracked as passive #1689) — PostHog captures network separately.
• Asset capture (A lot of console errors when using posthog and @angular/cdk/drag-drop #1239, feat: export PostHogProviderProps type #1829, [BUG] persistence cookie cause request 400 #1833, chore: skip if Array.from is missing #1475 partial) — not used.
• @rrweb/browser-client (feat: Screen dimensions and UA as person property #1840, feat: lazy load sampling code #1861), @rrweb/cutter (chore: upgrade rrweb to alpha-13 #1149) — packages we don't vendor.
• rrvideo / rrweb-player / web-extension PRs (feat: Deprecate sanitize_properties #1632, fix(flags): Add a shorter configurable timeout for flag requests #1046, chore: missing changelog entry #1290, fix: no keep alive for large payloads #1416, chore(deps): Bump posthog-js from 0.0.0 to 1.63.0 in /react #661, ...) — dropped from our fork.

---

Summary

• All merged-since-fork PRs + all open PRs triaged, every adopt/already-have call verified against our fork.
• Batch 1 has landed (fix(rrweb): keep untainted-prototype iframe attached on Safari (adopt upstream #1854) #4128–fix(rrweb): don't let media autoplay unfreeze a frozen page (adopt upstream #1697) #4131, merged 2026-07-15): revert: feat: always include stack trace parsing #1854, feat: Only capture vitals on http and https #1873, feat: add url_ignorelist for autocapture config #1302 and feat: deprecate featureFlags.override in favor of featureFlags.overrideFeatureFlags, a new function that supports overriding flags and flag payloads #1697 are now vendored. refactor: Remove/deprecate/rename old options #1694, fix(segment): Posthog can identify after segment identifies a user, not just during bootstrap. #1373 and feat: use gzip compression for decide #1356 were explicitly declined — see the batch-1 comment.
• 3 merged clean cherry-picks still not vendored: fix: survey feedback button anchoring to trigger #1865, chore: support inherit font family on surveys #1763, feat: Add autocapture playground page #1864 — all predating the 2.1.x releases. Plus Typescript build errors from @rrweb and rrweb-snapshot packages using posthog-js V 1.224.0 #1769, which upstream merged into 2.1.2 but which our fork already solves more narrowly — a reconcile decision, not a cherry-pick.
• ~11 open "adopt-high", ~21 open "adopt-medium", 29 "adopt-low/watch", plus 11 still-open PRs from the 2026-09-08/09-10 scans (2 of that batch, chore: survey 10kb win #1921 and B.extendPostHogWithExceptionAutocapture is not a function #1904, have since merged upstream and been adopted).
• ~35 already in our fork; the remainder is CI/release noise or features we don't ship.
• Top 3 to do next: fix: dont mangle some surveys properties #1934 (native Proxy recovery, replaces chore: add new question index to id map #1812 as the batch-2 opener, and settles our revert: feat: always include stack trace parsing #1854 divergence), Downside / upside of importing posthog outside of react functions while using the React SDK #1933 (text-mutation collapsing — the batch-1 recording-CPU theme, from a maintainer), fix: Fix response based branching for open choice questions #1907 (replay mutation abort on degenerate state). All three are still open upstream, so these are adaptations rather than cherry-picks.
• The 2.1.x release batch is closed (2026-09-10): chore: survey 10kb win #1921 → fix(replay): ignore autoplay mutations regardless of tag name case #4837, feat: capture console errors #1771 → fix(replay): disable autofill on inputs rebuilt for replay #4861, B.extendPostHogWithExceptionAutocapture is not a function #1904 → fix(replay): bind console log wrapper to the logger it patched #4862, all merged. Two were live bugs in our fork rather than missing features. fix(replay): disable autofill on inputs rebuilt for replay #4861 landed one divergence upstream does not have (see Track posthog-js rrweb divergences to contribute back upstream #3766).

* PostHog-authored upstream PRs are also tracked in #3766 (contribute back).

Generated from a comprehensive scan of upstream rrweb-io/rrweb on 2026-06-08; re-verified against upstream (releases + every listed PR's state) and against our fork on 2026-07-11 and again on 2026-09-08, first for 2.1.2 and then for the 2.1.3 / 2.1.4 releases; adoption state re-verified against main on 2026-09-10. The open-PR list will drift, so re-verify status before acting on an individual row.

[eoghanmurray]

Hi Paul, this is a great motivating list! I'm hoping to get some time this month to focus on rrweb PRs as we've the 2.0 release done; it's easier to be more bold now that we can increment versioning properly for each change.
Thanks also to posthog for supporting us in OpenCollective each month; if you guys have extra budget for this particular PR then earmarking a once off payment referencing this would make things easier for me in terms of invoicing for any work I do on this. Cheers!

[pauldambra]

Re-verification (2026-07-11) + prioritised adoption plan

Re-checked every listed PR against upstream and our fork (fork unchanged since the 2026-06-08 scan, so all adopt/already-have calls still hold). Body updated. What changed upstream in the last month:

• Upstream released 2.1.0 (2026-06-27) — only feat: Add autocapture playground page #1864 (rrweb) and fix: survey feedback button anchoring to trigger #1865 (rrweb-snapshot), both already in our cherry-pick table. Everything else in the release window was docs/build/browser-client noise.
• Three of our own upstream PRs were closed unmerged on 2026-06-17: feat: remote image masking #1826 (superseded by the merged revert: feat: always include stack trace parsing #1854), chore: allow push to main in GH actions #1825 (superseded by equivalent maintainer work on the stylesheet-assets branch), and fix: handle non Error objects being passed to captureException #1806 (closed by author, no supersession — the backward-skip playback fix now exists only on the closed PR branch, so vendoring it means cherry-picking from that branch).
• New open PR #1873 (attributeFilter passed through to native MutationObserver.observe()) — added to adopt-high. This is the single biggest recording-performance lever on the list: filtered attributes never fire the observer callback at all, so inline-style animation floods cost zero recording CPU. Our ignoreCSSAttributes only intercepts CSSOM setProperty, not attribute mutations — verified we have nothing covering this path.
• New fix: refactor canRenderSurvey and move logic to SurveyManager #1897 (replay pseudo-class rebuild) added to watch. All other adopt-list PRs: state unchanged.

---

Adoption plan — recording performance first

Ordering principle: cost on the customer's page while recording > everything else. Replay-side fixes run on our infrastructure and queue last. "Not adopting" is an explicit, acceptable outcome — deferred items are listed with reasons.

Batch 1 — recording CPU/memory (do first)

• #1854 — Safari/WebKit keepalive for the untainted iframe so MutationObserver callbacks aren't silently dropped. Not a perf win per se, but silently-dropped mutations = broken recordings, it regresses our own feat(Surveys): Enable partial survey responses #1597 fix, it's merged + released upstream (2.0.1), and it's a clean cherry-pick. Cheapest, highest-confidence item.
• #1873 — native attributeFilter. Small diff but low-trust author: review line-by-line, add tests, and decide the posthog-js exposure (config option, ideally remote-config-settable so we can relieve animation-heavy customer sites without an SDK code change). Opt-in, so zero default-behaviour risk. Trade-off to document: filtering style drops all style-attribute mutations from replay.
• #1694 — per-element mutation-emission throttling (eoghanmurray). The fidelity-preserving companion to feat: Only capture vitals on http and https #1873: throttles floods instead of dropping them. Adopt the mechanism; pick defaults conservatively (off unless configured).
• #1302 — 7-line addedSet reorder fix; cuts worst-case mutation-processing cost and fixes emit order.
• #1697 — background video/canvas/font autoplay no longer auto-unfreezes a frozen page; stops wasted recording work on backgrounded tabs.
• Evaluate #1356 (native setTimeout under zone.js — Angular CPU pegging). CHANGES_REQUESTED upstream and we already carry Zone workarounds; adopt only if it covers a path ours doesn't.
• Evaluate #1373 (null maskTextClass/blockClass skips per-class regex). Only worth it if posthog-js can actually pass null given our masking defaults — check before porting.
• Watch (don't adopt yet): feat: add new google crawler #1300 (benchmark harness — steal the benchmark even if not the fix), PostHog.init() always returns a value, TS types are misleading #1616 (mergeEvents, +602 unreviewed lines).

Verification for this batch: each item lands as its own posthog-js PR with before/after numbers from a mutation-flood scenario (e.g. an animated-carousel fixture in the playground) — events/sec emitted, observer-callback time, and bundle-size delta. Perf claims don't merge on trust.

Batch 2 — cheap stability guards that keep recording alive

Small, self-contained crash fixes; a crashed recorder is the worst perf outcome. #1812 (native Proxy cache), #1313 (hookSetter stack overflow), #1737 (currentSrc guard), #1463 (patched-method toString), #558 (ascending timestamps — touches event ordering, test carefully).

Batch 3 — masking/privacy gaps

Real PII leaks, but per our priority call they queue behind perf: #1745/#1610 (hidden inputs under maskAllInputs), #1164 (option/radio/checkbox), #1097 (text-mask settings on inputs/textarea). Defer #1257 (maskAttributesFn) until the upstream RFC API settles.

Batch 4 — replay-side (our infra, lowest urgency)

#1320 (500ms-stall fix — best item here), #1806 (vendor from the closed PR branch), #1718, #1673+#1798, #1740, #1830, #1769, #1771, #1624, then the remaining CSS-fidelity fixes (#1865, #1483, #1586, #1735, #1357) and #1864, plus the PostHog-authored replay/css items (#1635, #1641, #1686, #1469, #1642, #1814, #1712 — confirm #1712 is already in fork before porting).

Explicitly not adopting (for now)

• chore(): set all github actions to run on ubuntu-22.04 #1784 (postcss tree-shake) — our packaging already keeps postcss out of the record bundle via subpath exports; adaptation cost exceeds benefit.
• fix: silence noisy surveys logging #1679 / Bot traffic (Google Lighthouse) not filtered out #1800 / feat: override exception capture clientside #1726 / chore(deps): bump cookie from 0.6.0 to 0.7.0 in /playground/nextjs #1465 / chore: Rework SDK initialisation #1023 / Bump ansi-regex from 5.0.0 to 5.0.1 in /react #294 — niche cross-origin-iframe configurations we have no customer demand for.
• feat(web-analytics): Handle set_once latest props in a cross-subdomain way #1739 — closed-shadow-DOM recording; the author himself flags it as a privacy footgun.
• Asset capture (A lot of console errors when using posthog and @angular/cdk/drag-drop #1239, chore: skip if Array.from is missing #1475, feat: export PostHogProviderProps type #1829, [BUG] persistence cookie cause request 400 #1833), browser-client/cutter/player/rrvideo PRs — features/packages we don't ship.
• Everything in the body's "can ignore" lists.

Process

• One upstream change per posthog-js PR, referencing this issue and the upstream PR; batch-1 PRs carry perf evidence.
• For upstream-open PRs we adopt, note the vendoring on the upstream PR where useful, and track the divergence in Track posthog-js rrweb divergences to contribute back upstream #3766 if we deviate.
• Re-verify a row's upstream state immediately before starting it (this list drifts — three of our rows changed state in the last month).
• Separately worth considering (per @eoghanmurray's comment above): an earmarked OpenCollective contribution to help land the upstream-open items we care about (Option to disable sending events and only log them #1320, refactor: Remove/deprecate/rename old options #1694), which shrinks our fork instead of growing it.

[github-actions]

AI triage for #3765

Conclusion: Valid session-replay maintenance tracker; keep open and handle each upstream rrweb change independently.
Confidence: 96%
Suggested labels: enhancement, feature/replay

Keep this umbrella tracker open. The current checkout confirms that it remains relevant, but several adoption-status claims should be re-verified immediately before work: native attributeFilter support is present, while the concrete rrweb#1921 tag-name mismatch, the console-plugin binding issue, and bare Proxy usage remain present in the fork.

Please continue with one upstream change per PR, a focused regression test, and no bulk sync. Recording-side changes should include a real-browser or integration assertion where practical and must explicitly assess recording-volume/fidelity impact. The rrweb#1921 fix is a suitably narrow next item: normalize the tag name at the comparison boundary and retain a test that fails with native uppercase HTML tagName values.

Investigation

• The repository explicitly vendors and publishes its rrweb copy for use by posthog-js, so this tracker is directly relevant to the Session Replay SDK.
• Native mutation observer filtering has already landed: RecordOptions exposes attributeFilter, record/observer.ts forwards a non-empty list to MutationObserver.observe(), and focused tests cover unset, populated, and empty filter behavior.
• ignoreAttribute() in rrweb-snapshot/src/snapshot.ts compares only lowercase video and audio, while rrweb/src/record/mutation.ts supplies target.tagName; this preserves the reported uppercase-HTML-tag mismatch for autoplay mutations.
• The fork still uses bare new Proxy(...) in rrweb/src/record/observer.ts and rrweb/src/utils.ts, with no getUntaintedProxy helper found.
• The console recorder plugin wraps methods in an arrow function, calls original.apply(this, args), and invokes original(...) in its error path; both calls can lose the original console receiver.
• No autocomplete="off" rebuild handling was found in the inspected vendored TypeScript sources, so the privacy-oriented input/textarea replay change described in the issue does not appear to be present.

Relevant files: packages/rrweb/README.md, packages/rrweb/rrweb-snapshot/src/snapshot.ts, packages/rrweb/rrweb/src/record/mutation.ts, packages/rrweb/rrweb/src/record/observer.ts, packages/rrweb/rrweb/src/utils.ts, packages/rrweb/plugins/rrweb-plugin-console-record/src/index.ts, packages/rrweb/rrweb/src/types.ts, packages/rrweb/rrweb/test/record/attribute-filter.test.ts

Fix assessment

• Straightforward: no
• Risk: medium
• Reason: The issue deliberately groups many independent upstream changes with different semantics, compatibility requirements, and risks to recorder CPU, capture fidelity, privacy, and replay reconstruction. A broad synchronization would be speculative. Individual candidates such as the tag-name normalization are small, but they should be submitted and tested separately rather than treated as a fix for this tracker.

Fix PR skipped: feature requests require an explicit trusted fix command or mode: fix before opening a draft PR

Pi session

The resumable JSONL pi session for this run was saved to a private gist: https://gist.github.com/marandaneto/bb1db3191457f837023dcad345ac5194

Download it locally, then fork it into your own pi session:

pi --fork path/to/session.jsonl

Saved session:

• call-1-1-2026-09-08T14-14-32-897Z_01a0815e-dcc1-7d2c-b4c2-d73e64c481a9.jsonl

Close proposal

None. No issue close action was taken.

---

Generated by posthog-watcher-action using pi.

[pauldambra]

Batch 1 executed (2026-07-11)

Four adoption PRs are open, each ported with line-by-line review rather than blind cherry-picking, with tests, and verified against the existing rrweb suites (record / integration / replayer / shadow-dom):

Upstream	Our PR	Notes
#1854	#4128	Safari MutationObserver keepalive. Deliberate divergence: page-lifetime keepalive instead of upstream's teardown cleanup — our per-document observer teardown and stop/restart cycles would otherwise detach the shared iframe while live observers still depend on it (worth feeding back upstream, → #3766). Iframe tagged rr-block and ph-no-capture since our blockClass differs from upstream's default.
#1873	#4129	Native attributeFilter → new opt-in session_recording.attributeFilter. Review found two gaps fixed in our port: upstream misses shadow roots (wired through bypassOptions), and an empty array would silently disable all attribute recording (treated as unset). Both worth commenting on the upstream PR.
#1302	#4130	addedSet DOM-order fix; one integration snapshot resequenced (verified equivalent — adds carry parentId/nextId).
#1697	#4131	Autoplay/canvas/font events no longer unfreeze a frozen page. Hoisted the per-event source list into a Set (upstream allocates per emit — also worth feeding back). Inert until we use freezePage, adopted for parity + future backgrounded-tab work.

Decided NOT to adopt (from batch 1)

• #1694 (mutation emission throttling) — three reasons: (1) posthog-js already ships an SDK-level MutationThrottler (support-tunable via __mutationThrottlerRefillRate/__mutationThrottlerBucketSize); (2) feat: Only capture vitals on http and https #1873 now covers the animation-flood case at zero cost instead of merely throttling it; (3) upstream's implementation wraps the same emit() that unlock()/unfreeze() rely on as a synchronous flush right after full snapshots — throttling it changes checkout flush semantics in ways upstream hasn't resolved (the PR is still open). Revisit only if upstream lands it with that addressed.
• #1373 (null maskTextClass/blockClass) — no benefit to us: posthog-js hard-codes blockClass: 'ph-no-capture' / maskTextClass: 'ph-mask', so the null fast-path is unreachable in our configuration.
• #1356 (native setTimeout under zone.js) — deferred: CHANGES_REQUESTED upstream, and our fork already has its own Zone unpatched-original detection covering the worst of the Angular cost. Re-evaluate if Angular CPU reports persist after batch 1 ships.

Batch 2 (stability guards: #1812, #1313, #1737, #1463, #558) is next once these merge.

[pauldambra]

Re-verification for upstream 2.1.2 (2026-09-08)

What the release actually contains

• 2.1.1 (2026-07-21) — no code changes at all. Dependency and version bumps only.
• 2.1.2 (2026-09-08) — exactly two code changes:
  • #1712 (pauldambra, merged 2026-09-04) — the approved console.warn → suppressible warn fix. Already in our fork (rrweb/src/replay/index.ts:298), so nothing to pull in. Marked done in Track posthog-js rrweb divergences to contribute back upstream #3766.
  • #1769 (heathdutton, merged 2026-09-08) — custom events on seek. Not a cherry-pick for us: our fork already fixes this bug, more narrowly. Upstream deletes the case EventType.Custom skip so every custom event re-fires on every seek; our shouldCastInSyncMode (replay/index.ts:835) re-casts only rrweb/fullscreen, which is the one that carries DOM state, and keeps side-effect-free signals skipped. Needs a deliberate call: widen to upstream's behaviour, or keep ours and offer it upstream as a refinement (now tracked in Track posthog-js rrweb divergences to contribute back upstream #3766).

So the release train delivered nothing we need to vendor.

Corrections to the body — batch 1 had landed but the tables didn't say so

Verified against the fork today, not from the PR list:

• revert: feat: always include stack trace parsing #1854 — vendored via fix(rrweb): keep untainted-prototype iframe attached on Safari (adopt upstream #1854) #4128, utils/src/index.ts keepIframeAttached. It was the body's top "do first" item and it is done.
• feat: Only capture vitals on http and https #1873 — vendored via feat(rrweb): attributeFilter option for native MutationObserver filtering (adopt upstream #1873) #4129, rrweb/src/types.ts:66 + record/observer.ts:109. Also done.
• feat: add url_ignorelist for autocapture config #1302 — vendored via perf(rrweb): keep re-added nodes in DOM order in mutation addedSet (adopt upstream #1302) #4130, record/mutation.ts:947.
• feat: deprecate featureFlags.override in favor of featureFlags.overrideFeatureFlags, a new function that supports overriding flags and flag payloads #1697 — vendored via fix(rrweb): don't let media autoplay unfreeze a frozen page (adopt upstream #1697) #4131, record/index.ts:81.

Still absent, still worth doing: #1865 (absolutifyURLs drops the #fragment — rrweb-snapshot/src/utils.ts:1044), #1763 (raw ownerDocument at shadow-dom-manager.ts:62 and observer.ts:1128), #1864 (our timer.ts has diverged, manual port).

New upstream PRs since the 2026-07-11 scan

16 opened; the body now carries the full triage table. The one worth acting on:

• #1921 — ignoreAttribute() compares against lowercase 'video'/'audio' while the attribute-mutation path passes the native uppercase tagName, so autoplay mutations are never ignored during recording. Confirmed present in our fork: rrweb-snapshot/src/snapshot.ts:268 vs rrweb/src/record/mutation.ts:797. Small fix, and it is pure recording noise we are paying for today.

Also newly relevant: #1907 (replay mutation abort on degenerate state — our guard is still the narrow instanceof DOMException), #1912 (placeholder masking, batch 3), #1905 (srcdoc rebuild race — rrdom/src/diff.ts already skips it, rebuild.ts doesn't), #1904 (this binding in the console plugin, which we do ship), #1927 (canvas in same-origin iframes). #1920 does not apply — we never vendored splitCssText.

Plan

Batch 1 is closed out. Batch 2 (stability guards) is next: #1812, #1313, #1737, #1463, #558 — with #1921 pulled in front of it as a one-liner with a verified in-fork reproduction.

Separately, adopting batch 1 produced three upstream review comments we never sent (#1873 shadow-root plumbing + empty-array guard, #1697 per-emit allocation). Those are now rows in #3766 and are the cheapest contribute-back we have.

Upstream releases, every listed PR's state, and each in-fork claim above re-verified 2026-09-08.

[pauldambra]

#1921 is now adopted in #4837 — the autoplay tag-name case bug, with a jsdom MutationBuffer regression test verified to fail without the fix. Next in the batch-2 order: #1812, #1313, #1737, #1463, #558.

[pauldambra]

Re-verification for 2.1.3 and 2.1.4 (2026-09-08)

Upstream cut three releases today. 2.1.2 was a non-event for us (see the comment above). 2.1.3 is not.

2.1.3 — the first release since our fork point with a fix we need and do not have

• #1921 — merged and released. This is the live bug I flagged in the last scan, and it is still live in our fork: ignoreAttribute() compares against lowercase 'video'/'audio' (rrweb-snapshot/src/snapshot.ts:268) but the attribute-mutation path passes the native uppercase tagName (rrweb/src/record/mutation.ts:797), so autoplay mutations are never ignored while recording. Upstream also lowercases the neighbouring 'IFRAME' and 'INPUT' comparisons (ours at mutation.ts:768 / :791); those are not bugs in HTML documents, but they do harden XHTML and SVG, where tagName keeps its case.
• #1771 — merged and released. Sets autocomplete="off" on rebuilt <input>/<textarea>, so the viewer's browser autofill cannot put the viewer's own data into a replay. 5 lines. Verified absent from our fork. It moves from the adopt-high open list to the cherry-pick table.

2.1.4 — no code changes

Version bumps only. The one real change in that batch is #1904, released in @rrweb/rrweb-plugin-console-record@2.1.4: the plugin wraps each console method in an arrow function, so original.apply(this, …) passes undefined instead of the console, and the error path calls original(...) unbound. Both are still live in our fork (plugins/rrweb-plugin-console-record/src/index.ts:195 and :237), and we ship this plugin.

So three merged, released, verified-absent items now: #1921, #1771, #1904. Two of them are live bugs rather than missing features.

Two new open PRs, both worth taking

• #1934 (Juice10, carrying juliecheng's work forward) — supersedes chore: add new question index to id map #1812, which was our batch-2 opener. Recovers a native Proxy from the shared untainted iframe and caches it. Our fork calls bare new Proxy(...) in 10 places (9 in record/observer.ts, 1 in rrweb/src/utils.ts) and has no getUntaintedProxy, so every one of those sites breaks today if a page overwrites window.Proxy. Adopt fix: dont mangle some surveys properties #1934 rather than chore: add new question index to id map #1812: same fix, maintainer-authored, plus Chromium and WebKit tests.
• #1933 (eoghanmurray) — collapses repeat text mutations against the same node while the buffer is frozen or throttled, and replaces the attributes array + attributeMap WeakMap pair with a single Map. Our fork has exactly the shape it refactors (record/mutation.ts:170–:172, :716). This is the batch-1 recording-CPU theme again, from a maintainer. It changes what gets emitted, so port it against the mutation-flood fixture and re-check the integration snapshots.

#1934 overlaps our #1854 divergence — and we are the over-broad side

Worth calling out, because it revises a call we made in batch 1. Both our fork and upstream keep the untainted-prototype iframe attached on WebKit. The scope differs:

• Ours (utils/src/index.ts:113–:146, from fix(rrweb): keep untainted-prototype iframe attached on Safari (adopt upstream #1854) #4128) retains it for every BasePrototypeCache key — Node, ShadowRoot, MutationObserver, Element — for the page lifetime, with no cleanup hook.
• fix: dont mangle some surveys properties #1934 narrows retention to MutationObserver only, because that is the one key that needs a live ScriptExecutionContext (webkit.org/b/179224).

Upstream is right. We can hold up to four hidden iframes on WebKit where one is enough. When we port #1934, take its narrower condition and keep our page-lifetime choice only for MutationObserver. This also removes that row from the novel-contribution list in #3766 — upstream reached the same conclusion independently, so what is left to say there is a comment on #1934, not a PR.

Plan

Batch 2 order is now #1921 → #1934 → #1933, then the rest of batch 2 (#1313, #1737, #1463, #558). #1771 and #1904 are small enough to ride along with #1921.

Upstream releases, every PR state, and each in-fork claim above verified 2026-09-08.

[pauldambra]

2.1.x adoption batch closed (2026-09-10)

All three of the merged-and-absent items from the 2.1.3 / 2.1.4 scan are now vendored and on main:

Upstream	Our PR	Landed as	Verified in fork
#1921 autoplay tag-name case	#4837	99b4fc7	record/mutation.ts:735 (tagNameLower), snapshot.ts:269 (Lowercase<string>)
#1771 replay autofill	#4861	61b92f9	rrweb-snapshot/src/rebuild.ts:444 + replay/index.ts:2064
#1904 console receiver	#4862	3278cd0	plugins/rrweb-plugin-console-record/src/index.ts:198, :240

Two of the three were live bugs rather than missing features, so this batch fixed real behaviour: autoplay mutations were never actually being ignored while recording, and the console plugin was calling the customer's console method with no receiver.

#1771 did not land as a straight cherry-pick. Upstream forces autocomplete="off" at rebuild time only, which holds until the first recorded mutation of that attribute — which can set it back to the page's real value or remove it, re-enabling the viewer's autofill part-way through the replay. Our version also skips autocomplete mutations on <input>/<textarea> when applying them. That is a divergence upstream does not have, and it is now the top novel contribute-back candidate in #3766: it completes work upstream already accepted, it is small, and it arrives with tests that fail without it.

Adoption also produced a coverage note worth keeping: rebuild.ts changes are not automatically exercised by the default replay path. Fast-forward passes the RRDocument as doc (replay/index.ts:1845), so a rebuild-time attribute lands on an RRElement and only reaches the real node via diffProps. rrdom/test/diff.test.ts now asserts that round trip, so future rebuild-side adoptions have a place to prove they actually reach the replayed DOM.

Upstream state

No new release since 2.1.4. One PR merged upstream since the last scan — #1939 (RelativeCI bundle reporting), noise for us. #1933, #1934, #1907 and #1912 are all still open, so nothing else has become a cherry-pick.

Plan

Batch 2 is now the whole of the remaining work, and every item in it is an adaptation of an open PR rather than a cherry-pick: #1934 (native Proxy recovery — supersedes #1812, and settles the #1854 iframe-scope divergence in upstream's favour), then #1933 (text-mutation collapsing), then #1907 (replay mutation abort). The three pending merged cherry-picks that remain — #1865, #1763, #1864 — all predate the 2.1.x line and are unchanged in priority.

Adoption verified against main at 3c85b4e; upstream releases and PR states re-checked 2026-09-10.

[posthog]

Assessed rrweb package releases through 2.1.5. The rrweb@2.1.5 release contains #1652 / 5869344: should pull in for recording-time mutation performance. The local fork lacked the root-first traversal and the matching accessor helpers. The rrweb-snapshot@2.1.5, rrweb-player@2.1.5, @rrweb/utils@2.1.5, @rrweb/types@2.1.5 and plugin 2.1.5 tags were version/dependency-only for this assessment. No contribute-back recommendation changed in #3766.

Adopted in #5010 (draft), recreated against our fork rather than cherry-picked:

• packages/rrweb/rrweb/src/record/mutation.ts now serializes each added tree from its root down and each row of siblings from the last one back, so parentId and nextId are known before a node is serialized. The secondary DoubleLinkedList add list and its tail rescans are gone, together with the addedSet re-insertion in genAdds that only existed to make that deferral cheaper.
• packages/rrweb/utils/src/index.ts gains untainted lastChild, nextSibling and previousSibling. Upstream also adds firstChild; nothing calls it, so it was left out.
• Every PostHog divergence is preserved: the emission-time blocked-ancestor recheck, the TEXTAREA short circuit, the pending mirror-removal drain before any add, and the per-emission serialization options.
• The emitted adds list is reordered. Replay is equivalent because the replayer places each node by parentId and nextId; the recording snapshots are updated accordingly.

Chromium mutation benchmarks: deep-nested −27 %, subtree move −28 %, descendant append −24 %, add-and-remove −14 %, plain add −11 %, attribute-only control flat. WebKit and Firefox were not available in that environment, so those runs are still outstanding.

New coverage: test/record/mutation-add-ordering.test.ts asserts that every add resolves both ids against already-known nodes and that replaying the adds yields the same DOM as a fresh checkout snapshot of the mutated page, across nested additions, sibling order, blocked and ignored siblings, pre-existing blocked and ignored nodes, and a moved shadow host. test/record/mutation-blocking.test.ts gains a recorder-driven case for a node blocked after it was queued. Both were checked against deliberately broken implementations to confirm they fail.