chore(deps): update faro-web-sdk monorepo to v2 (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@grafana/faro-react (source)	^1.19.0 → ^1.19.0 || ^2.0.0
@grafana/faro-web-sdk (source)	^1.19.0 → ^1.19.0 || ^2.0.0
@grafana/faro-web-tracing (source)	^1.19.0 → ^1.19.0 || ^2.0.0

---

Release Notes

grafana/faro-web-sdk (@​grafana/faro-react)

v2.3.1

Compare Source

• Fix (@grafana/faro-web-sdk): Prevent infinite recursion in session meta sync when session
  attributes contain values not surviving JSON serialization such as undefined (#​1956).

• Chore (@grafana/faro-*): Updated multiple dependencies to address security vulnerabilities
  (#​1948, #​1941).

v2.3.0

Compare Source

• Feature (@grafana/faro-web-sdk): Fetch transport now supports async dynamic header values.
  Each header value can be a function returning Promise<string>, resolved at request time
  (e.g. for token refresh). Sync dynamic headers (() => string) continue to work (#​1490).

• Feature (@grafana/faro-core): Add optional fingerprint attribute to exception events for
  custom error grouping. The fingerprint can be passed via pushError options or set in the
  beforeSend hook.

• Feature (@grafana/faro-instrumentation-replay): Enable full input and text
  masking by default (maskAllInputs: true, maskTextSelector: '*') (#​1926).

• Feature (@grafana/faro-instrumentation-replay): Add samplingRate option to
  ReplayInstrumentationOptions to decouple replay coverage from global session sampling (#​1919).

• Chore (@grafana/faro-*): Updated multiple dependencies to address security vulnerabilities
  (#​1931, #​1922, #​1930).

v2.2.4

Compare Source

• Feature (@grafana/faro-instrumentation-replay [experimental]): Add recordAfter option
  to configure replay recording start timing (DOMContentLoaded or load), with load
  as the default.

• Chore (@grafana/faro-*): Updated multiple dependencies including OpenTelemetry v0.212.0 and
  npm-run-all2 v7 (#​1900, #​1899, #​1891, #​1902).

• Chore (demo): Updated dependency react-router to v7.12.0 to address security vulnerability (#​1834).

v2.2.3

Compare Source

• Feature (@grafana/faro-react): Add createReactRouterV7Options and
  createReactRouterV7DataOptions helper functions for easier React Router v7
  configuration (#​1879).

• Fix (@grafana/faro-react): Migrated from new JSX transform (react-jsx) to classic JSX transform
  (react) to prevent bundling react/jsx-runtime with the package. This fixes compatibility issues
  with React 19 and older React versions where bundled JSX runtime could cause breakage. React and
  react-dom are now properly treated as external peer dependencies in all bundle formats (#​1878).

• Fix (@grafana/faro-web-tracing): Fixed a race condition where faro.tracing.* events were
  always sent via the global Faro instance instead of the SDK instance associated with the
  FaroTraceExporter. This caused events to be incorrectly attributed in multi-instance setups
  (#​1874).

• Chore (@grafana/faro-core, @grafana/faro-web-sdk): SDK name
  (meta.sdk.name) is now included in payload metadata alongside
  version. The SDK name is set to faro-web
  in web-sdk configuration. If web sdk meta was included manually previously,
  it could potentially be breaking as instrumentation metas are removed
  and sdk name changed from @grafana/faro-coretofaro-web (#​1865).

v2.2.2

Compare Source

• Chore (@grafana/faro-web-sdk): Pin ua-parser-js package version (#​1867).

v2.2.1

Compare Source

• Fix (@grafana/faro-core): Buffered items are now correctly sent when a user action is cancelled
  (#​1861).

• Chore (@grafana/faro-*): Updated multiple dependencies to address security vulnerabilities
  (#​1855).

• Chore (@grafana/faro-*): Updated multiple otel dependencies (#​1856).

v2.2.0

Compare Source

• Feature (@grafana/faro-web-sdk): Fetch transport now supports dynamic header values.
  Each header can be a static string or a function returning a string, resolved at request
  time (#​1490).

• Feature (@grafana/faro-transport-otlp-http [experimental]): OLTP HTTP transport now supports
  dynamic header values. Each header can be a static string or a function returning a string,
  resolved at request time (#​1490).

• Fix (@grafana/faro-web-sdk): Console instrumentation now correctly handles multiple SDK
  instances (#​1825).

• Chore (@grafana/faro-*): Updated multiple dependencies to address security vulnerabilities.

v2.1.0

Compare Source

• Feature (@grafana/faro-react): support for React 19 and React Router 7

• Fix (@grafana/faro-web-sdk): CSP violation events now correctly capture all SecurityPolicyViolationEvent
  attributes. Previously, properties like blockedURI, documentURI, and others were missing because
  native browser event properties are getters on the prototype chain, not own enumerable properties (#​1491)

• Fix (@grafana/faro-web-sdk): circular dependency between events and userActions APIs (#​1793)

v2.0.2

Compare Source

• Breaking (@grafana/faro-web-sdk): User action events now have a standardized event name
  (faro.user.action), with the specific user action name moved to a parameter for improved
  consistency and filtering capabilities.
  Migration note: If you previously filtered user action events by event name, update your
  queries to use the new event name (faro.user.action) and filter by the userActionName
  attribute for the specific action.

• Breaking (@grafana/faro-web-sdk): Web vitals now always tracks attribution data. The
  trackWebVitalsAttribution and webVitalsInstrumentation.trackAttribution configuration flags have
  been removed. Attribution data is now collected by default and cannot be disabled.
  Migration note: If you were using trackWebVitalsAttribution: false or
  webVitalsInstrumentation: { trackAttribution: false } to disable attribution, remove these options
  from your configuration. Attribution data will now always be included in web vitals measurements.

• Breaking (@grafana/faro-web-sdk): Removed the trackUserActionsPreview option from Faro
  configuration. User actions instrumentation is now always enabled by default (#​1772).
  Migration note: If you previously used trackUserActionsPreview: true or left it unset,
  simply remove this option - no further action is required. If you had set
  trackUserActionsPreview: false to disable user actions tracking, you now need to exclude the
  UserActionInstrumentation from your instrumentations array manually.

• Feature (@grafana/faro-web-sdk) [experimental]: Added navigation instrumentation to track soft
  navigations (same-document navigations). The instrumentation monitors URL changes, DOM mutations,
  HTTP requests, and user interactions to automatically detect and report navigation events with
  details including fromUrl, toUrl, and duration. Enable by setting experimental.trackNavigation: true
  in the configuration.

• Fix (@grafana/faro-web-sdk): Fixed an issue where custom severity and custom trigger properties
  were not being included in user action attributes (#​1551)

• Fix (@grafana/faro-web-sdk): Fixed an error when initializeFaro is called without any window
  object present (#​1643)

---

Configuration

📅 Schedule: Branch creation - "after 5pm every weekday,every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
helix-ai	Skipped		Feb 9, 2026 1:10pm