Merge branch 'main' into updated_remote_settings

lajohn4747 · lajohn4747 · commit cf2f7fdcf684 · 2026-03-24T17:25:28.000-05:00
diff --git a/.github/workflows/cspell.yaml b/.github/workflows/cspell.yaml
@@ -9,8 +9,8 @@ jobs:
   spellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: streetsidesoftware/cspell-action@v8
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: streetsidesoftware/cspell-action@9cd41bb518a24fefdafd9880cbab8f0ceba04d28  # v8
         with:
           # Define glob patterns to filter the files to be checked. Use a new line between patterns to define multiple patterns.
           # The default is to check ALL files that were changed in in the pull_request or push.
diff --git a/.github/workflows/rdme-delete-staging.yml b/.github/workflows/rdme-delete-staging.yml
@@ -15,8 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo 📚
-        uses: actions/checkout@v4
-      - uses: actions/setup-node@v5
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5
         with:
           node-version: 20
           cache: 'npm'
diff --git a/.github/workflows/rdme-docs.yml b/.github/workflows/rdme-docs.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo 📚
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Run `docs` command 🚀
         uses: readmeio/rdme@5d702394cb1fd1dc3fab6e0769b44b56c9d425d1  # rdme version 10.6.0
diff --git a/.github/workflows/rdme-openapi.yml b/.github/workflows/rdme-openapi.yml
@@ -12,8 +12,8 @@ jobs:
   rdme-openapi:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v5
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5
       with:
         node-version: 20.x
     - run: npm ci
diff --git a/.github/workflows/rdme-staging.yml b/.github/workflows/rdme-staging.yml
@@ -20,9 +20,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo 📚
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5
         with:
           node-version: 20
           cache: 'npm'
@@ -76,7 +76,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           sparse-checkout: |
             .github
@@ -85,7 +85,7 @@ jobs:
       # Build PR Comment
       - name: Build PR comment
         id: build-pr-comment
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
         with:
           result-encoding: string
           script: |
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
     # https://github.com/actions/stale
-    - uses: actions/stale@v10.2.0
+    - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f  # v10.2.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-stale: 180
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -16,9 +16,9 @@ jobs:
         node-version: [20.x]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm ci
diff --git a/.github/workflows/vercel-preview.yaml b/.github/workflows/vercel-preview.yaml
@@ -10,7 +10,7 @@ jobs:
   Deploy-Preview:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
       - name: Pull Vercel Environment Information
diff --git a/pages/changelogs/2026-03-24-mixpanel-mcp.mdx b/pages/changelogs/2026-03-24-mixpanel-mcp.mdx
@@ -0,0 +1,36 @@
+---
+title: "Mixpanel MCP: Talk to Your Data"
+slug: "changelog-2026-03-24-mcp-launch"
+hidden: false
+createdAt: "2026-03-24T10:00:00.000Z"
+updatedAt: "2026-03-24T10:00:00.000Z"
+date: "2026-03-24"
+thumbnail: "/changelog/changelog-mcp-launch.png"
+description: "Connect Mixpanel to Claude, ChatGPT, Gemini, Cursor, Notion, and more. Ask product questions, build dashboards, explore Session Replays, and manage Lexicon — all from the tools you already use."
+isAnnouncement: true
+---
+
+<ChangelogPostHeader
+  date="2026-03-24"
+  image="/changelog/changelog-mcp-launch.png"
+  title="Mixpanel MCP: Talk to Your Data"
+/>
+
+Mixpanel MCP brings your product data into the AI tools you already use - Claude, ChatGPT, Gemini, Cursor, Notion, and more. Ask questions in natural language, get answers backed by real data, and take action without switching context.
+
+[Connect your first AI tool →](https://docs.mixpanel.com/docs/mcp)
+
+## What you can do
+
+- Build boards and reports in natural language. Ask a question, get an answer — and a Mixpanel report to go with it.
+- Combine behavioral data with qualitative context in a single conversation. Pull up a specific user's replays alongside their event history to understand not just *what* they did, but *how* they experienced it.
+- Project Owners and Admins can manage event and property metadata directly through MCP — generating descriptions, verifying data, tagging events, and hiding or dropping properties at scale.
+
+## Try these prompts
+
+- *"In the last three months, which channels have driven the most new users?"*
+- *"User X submitted negative feedback on [date]. Analyze their session replays to understand what happened."*
+- *"Show me signup conversion rates by acquisition source for the last 30 days."*
+- *"Generate event descriptions for all of my events in Lexicon."*
+
+[Learn more about Mixpanel MCP →](https://mixpanel.com/blog/mixpanel-mcp/)
diff --git a/pages/docs/session-replay.mdx b/pages/docs/session-replay.mdx
@@ -209,3 +209,7 @@ When you enable Session Replay, use the above proxy metric to determine a starti
 #### Am I able to sample our Session Replay collection rate?
 
 Yes, you can configure the percentage of total replays that our SDK will capture as a sampling rate or manually trigger/end replay capture.
+
+#### Can I record cross-origin iframes within my page?
+
+Yes, Session Replay supports recording cross-origin iframes embedded within your page (Web only, SDK v2.77.0+). Both the parent page and child iframe must have the Mixpanel SDK initialized with `record_allowed_iframe_origins` configured to include each other's origins. For detailed setup instructions, see [Cross-Origin Iframe Recording](/docs/tracking-methods/sdks/javascript/javascript-replay#cross-origin-iframe-recording).
diff --git a/pages/docs/tracking-methods/sdks/javascript/javascript-replay.mdx b/pages/docs/tracking-methods/sdks/javascript/javascript-replay.mdx
@@ -269,14 +269,66 @@ List of currently supported remote settings:
 Settings that are not yet supported, will not appear in the remote configuration. These non-included options will use the value that was initially set by the user for all `remote_settings_mode` options.
 
 **Example Usage**
-
 ```javascript
 mixpanel.init('YOUR_PROJECT_TOKEN', {
     record_sessions_percent: 100,
     remote_settings_mode: 'fallback'
 });
 ```
 
+## Cross-Origin Iframe Recording
+
+<Callout type="info">
+Cross-origin iframe recording requires SDK version 2.77.0 or later.
+</Callout>
+
+Session Replay can capture content from cross-origin iframes embedded within your page, providing a unified replay experience across parent pages and embedded third-party content. This is useful when your application embeds widgets, checkout flows, or other cross-origin content that you want to include in your replays.
+
+The SDK handles the communication between parent and child frames automatically using a secure handshake mechanism.
+
+### Configuration
+
+Both the parent page and the child iframe page must be configured to allow cross-origin recording.
+
+#### Parent Page Setup
+
+On your parent page, add the origins of any iframes you want to record to the `record_allowed_iframe_origins` array:
+
+```javascript
+mixpanel.init('YOUR_PROJECT_TOKEN', {
+    record_sessions_percent: 100,
+    record_allowed_iframe_origins: [
+        'https://embedded-widget.example.com',
+        'https://partner-checkout.example.com'
+    ]
+});
+```
+
+#### Child Iframe Page Setup
+
+On the child iframe page, add the parent page's origin to `record_allowed_iframe_origins`:
+
+```javascript
+mixpanel.init('YOUR_PROJECT_TOKEN', {
+    record_sessions_percent: 100,
+    record_allowed_iframe_origins: [
+        'https://yoursite.com'
+    ]
+});
+```
+
+### Origin Format Requirements
+
+Origins must be specified in the format `protocol://domain[:port]`. The SDK performs exact matching, so ensure your origins are formatted correctly.
+
+| Format | Example | Valid |
+|--------|---------|-------|
+| HTTPS domain | `https://example.com` | ✓ |
+| HTTP with port | `http://localhost:3000` | ✓ |
+| No protocol | `example.com` | ✗ |
+| With path | `https://example.com/page` | ✗ |
+| Wildcard | `https://*.example.com` | ✗ |
+
 ## Replay ID
 
 When a replay capture begins, a Replay ID is generated by the SDK and is attached as an event property (`$mp_replay_id`) to events tracked by the SDK during the capture session. Events containing the same `$mp_replay_id` will appear in the same Replay.
diff --git a/public/changelog/changelog-mcp-launch.png b/public/changelog/changelog-mcp-launch.png
