[invisit](https://invisit.dev) · [Docs](https://invisit.dev/docs) · [llms.txt](https://invisit.dev/llms.txt) · [llms-full.txt](https://invisit.dev/llms-full.txt)

# SDK changelog

> Every release of @invisitdev/web and @invisitdev/server, newest first, with its date and what changed for code that uses it.

Source: https://invisit.dev/docs/reference/changelog

What changed in each release of the npm packages, newest first. The script tag and the WordPress plugin load the current tracker from invisit on every page, so they are always on the latest release and have nothing to update.

When a site runs a release that has fallen behind, its dashboard says so on the Overview. A release below the oldest one we still recommend gets a yellow notice until the site updates. A newer release gets a quiet one that can be dismissed.

## @invisitdev/web

The browser tracker as an ES module, for apps built with a bundler. [Reference](https://invisit.dev/docs/reference/web.md) · [npm](https://www.npmjs.com/package/@invisitdev/web)

### 0.6.1 (2026-11-10)

**Changed**

- Heartbeats stop after 5 minutes without input, so a tab left open no longer counts as an online visitor.
- A visitor who comes back after the visit lapsed starts a new visit with a page view of the page in front of them.
- Web vitals and other end-of-page measurements are timed at the visitor's last activity, not when the tab finally closes.

**Fixed**

- FCP and LCP leave out paints that happen after the page was first hidden, so tabs opened in the background no longer report huge load times.
- Pages that never shift now report a CLS of 0 instead of no CLS at all.
- Referrers from Android apps (`android-app://`) are kept instead of being counted as direct traffic, with only the app package recorded.
- Script loads aborted by leaving the page are no longer reported as errors.

### 0.6.0 (2026-11-07)

**Added**

- `errors` option in `init()` reports the page's uncaught errors and unhandled rejections; off unless set.
- `captureError(error)` export and `tracker.captureError()` report an error your own code caught, such as one stopped by an error boundary; needs `errors: true`.

### 0.5.0 (2026-11-06)

**Added**

- Debug sessions: opening the site from a dashboard debug link shows an in-page panel listing each event and why any was refused, without the events reaching your reports.

**Changed**

- With `debug: true`, every delivery is logged to the console along with the reason the collector refused anything.

### 0.4.1 (2026-11-05)

**Added**

- `visitId()` export and `tracker.visitId()` return the current visit's id, to pass into a checkout as `invisit_visit_id` metadata for revenue attribution.

**Changed**

- The short link click parameter `ivc` is removed from the address bar once the landing page view is sent.

### 0.4.0 (2026-11-04)

**Changed**

- Events wait up to 3 seconds for the site's settings before going out, so a host the site does not allow sends nothing.

**Fixed**

- `sdk_version` and `tracker.version` report the npm package's own version instead of the script tag tracker's.

### 0.3.1 (2026-11-04)

**Added**

- `pageUrl` option in `init()` rewrites each page address before it is recorded, for example turning `/orders/8121` into `/orders/:id`.

**Fixed**

- Pages whose path `pageUrl` rewrites no longer collect click heatmap data.

### 0.3.0 (2026-11-03)

**Changed**

- Client-side page views wait up to 2 seconds for the router to set the new page title, so they carry the right title.
- Links to the site's own subdomains, parent domain or allowed domains are no longer counted as outbound.
- Browsers driven by automation (`navigator.webdriver`) send nothing unless `debug` is on.

**Fixed**

- LCP, FCP and TTFB on prerendered pages are measured from when the page was shown, not from when it was prerendered.

### 0.2.1 (2026-10-28)

**Changed**

- Packaging only: the repository field points at the public SDK repository.

### 0.2.0 (2026-10-27)

**Breaking**

- The `key` option in `init()` is renamed to `site` and takes the site id.

### 0.1.4 (2026-10-27)

**Changed**

- The package exports with the `default` condition, so `require()` resolves it.
- Option and function docs are JSDoc and show up in editors from `index.d.ts`.

**Fixed**

- The feedback widget's Send button now disables while sending, so a message is no longer sent twice.
- Storage changes in other tabs only restart the tracker when they touch invisit's own keys.

### 0.1.3 (2026-10-26)

**Changed**

- The default `baseUrl` is now `https://api.invisit.dev`.

### 0.1.2 (2026-10-26)

**Changed**

- Packaging only: published with npm provenance.

### 0.1.1 (2026-10-26)

**Changed**

- Documentation only: framework guides in the README.

### 0.1.0 (2026-10-26)

**Added**

- First release of the invisit browser tracker as an ES module, with `init`, `track`, `identify`, `consent`, `feedback`, `sendFeedback` and `flush`.

## @invisitdev/server

The first-party proxy, crawler reads and server-side events. [Reference](https://invisit.dev/docs/reference/server.md) · [npm](https://www.npmjs.com/package/@invisitdev/server)

### 0.4.1 (2026-11-10)

**Added**

- Sends its version with every request, so the dashboard can tell you when an update matters.

### 0.4.0 (2026-11-04)

**Added**

- `respectGpc` option in `createInvisit` leaves out events from visitors whose browser sends Global Privacy Control.

### 0.3.0 (2026-11-02)

**Added**

- `track()` accepts a `visitor` object (`ip`, `userAgent`, `language`, `gpc`) instead of `request`, for work that runs without the visitor's request, such as queue consumers.
- `TrackVisitor` type export.

**Fixed**

- Collector request timeouts work on runtimes without `AbortSignal.timeout`.

### 0.2.1 (2026-10-28)

**Changed**

- Packaging only: the repository field points at the public SDK repository.

### 0.2.0 (2026-10-27)

**Breaking**

- `key` must be an API key with the ingest scope (`invisit_sk_`); server keys (`invisit_ik_`) are rejected.

### 0.1.4 (2026-10-27)

**Changed**

- Calls to the collector time out after 10 seconds.
- The proxy answers 413 to request bodies over 1 MiB.
- Crawler detection uses the `isbot` package, now a dependency, instead of a bundled copy.
- Both entry points export with the `default` condition, so `require()` resolves them.

### 0.1.3 (2026-10-26)

**Changed**

- The default `baseUrl` is now `https://api.invisit.dev`.

### 0.1.2 (2026-10-26)

**Changed**

- Packaging only: published with npm provenance.

### 0.1.1 (2026-10-26)

**Added**

- `ip` option on `proxy()`, `handle()` and `track()` passes the visitor's address for servers with no edge proxy in front.

**Changed**

- `createInvisit` throws a clear error when `key` is empty, which usually means the environment variable is not set.
- `onError` is told once when a proxied visitor arrives without an address.
- `crawlers()` records only GET and HEAD page reads, skipping static assets, RSC and prefetch requests and non-document fetches.
- `crawlers()` never reads the hostname from `X-Forwarded-Host`, and the Node adapter drops `X-Forwarded-Host` and `X-Forwarded-Proto` unless the proxy is trusted.
- `track()` rejects with `USER_AGENT_MISSING` when the request has no User-Agent.

**Fixed**

- IPv4 visitors on dual-stack sockets (`::ffff:a.b.c.d`) are recognised as the same address.
- The Node `middleware` awaits `next`, so a `next` that returns a promise works.
- The Node `middleware` fails with `BODY_CONSUMED` when a body parser read the tracker request first, instead of silently forwarding an empty event.
- Logged errors are named `InvisitError` instead of a bundler-renamed class name.

### 0.1.0 (2026-10-26)

**Added**

- First release, with `createInvisit` providing `proxy`, `handle`, `crawlers` and `track`, and a Node adapter at `@invisitdev/server/node`.