Merge branch 'main' of https://github.com/mParticle/mparticle-web-sdk into refactor/logger-interface

# Conflicts:
#	src/batchUploader.ts
#	src/sdkRuntimeModels.ts

Author: alexs-mparticle

AGENTS.md

@@ -55,6 +55,13 @@ mParticle is a Customer Data Platform that collects, validates, and forwards eve
 - **No Unnecessary Features**: Don't add error handling for scenarios that can't happen
 - **Trust Internal Code**: Only validate at system boundaries (user input, external APIs)
 
+### Logging and PII Obfuscation
+
+**PII (Personally Identifiable Information)** is data that can identify a specific person, for example: email, name or phone number, and similar attributes. Logging raw payloads can expose PII in production.
+
+- Use `obfuscateDevData(data, isDevelopmentMode)` from `utils` to log payloads - shows raw data in development mode, obfuscates in production.
+- Use `obfuscateData(data)` from `utils` when you need to obfuscate a specific field.
+
 ### Testing Requirements
 
 - Run the full test suite before committing

CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.60.1](https://github.com/mParticle/mparticle-web-sdk/compare/v2.60.0...v2.60.1) (2026-03-25)
+
+
+### Bug Fixes
+
+* update getSession to use non deprecated method ([#1227](https://github.com/mParticle/mparticle-web-sdk/issues/1227)) ([af259c2](https://github.com/mParticle/mparticle-web-sdk/commit/af259c254e51bccac7d61b5f4f51824659cf3d50))
+
+# [2.60.0](https://github.com/mParticle/mparticle-web-sdk/compare/v2.59.0...v2.60.0) (2026-03-24)
+
+
+### Features
+
+* Obfuscate potential PII in logs ([#1219](https://github.com/mParticle/mparticle-web-sdk/issues/1219)) ([ccc2cd7](https://github.com/mParticle/mparticle-web-sdk/commit/ccc2cd7ae5446ae052ae30e8913e8670324a4d0d))
+
 # [2.59.0](https://github.com/mParticle/mparticle-web-sdk/compare/v2.58.0...v2.59.0) (2026-03-16)
 
 

dist/mparticle.common.js

@@ -1,6 +1,6 @@
 {
     "name": "@mparticle/web-sdk",
-    "version": "2.59.0",
+    "version": "2.60.1",
     "description": "mParticle core SDK for web applications",
     "license": "Apache-2.0",
     "keywords": [

dist/mparticle.esm.js

@@ -1,10 +1,9 @@
 import { Batch } from '@mparticle/event-models';
 import Constants from './constants';
 import { SDKEvent, SDKEventCustomFlags } from './sdkRuntimeModels';
-import { ILogger } from './logger';
-import { convertEvents } from './sdkToEventsApiConverter';
+import { convertEvents} from './sdkToEventsApiConverter';
 import { MessageType, EventType } from './types';
-import { getRampNumber, isEmpty } from './utils';
+import { getRampNumber, isEmpty, obfuscateDevData } from './utils';
 import { SessionStorageVault, LocalStorageVault } from './vault';
 import {
     AsyncUploader,
@@ -80,17 +79,11 @@ export class BatchUploader {
 
         if (this.offlineStorageEnabled && !noFunctional) {
             this.eventVault = new SessionStorageVault<SDKEvent[]>(
-                `${mpInstance._Store.storageName}-events`,
-                {
-                    logger: mpInstance.Logger,
-                }
+                `${mpInstance._Store.storageName}-events`
             );
 
             this.batchVault = new LocalStorageVault<Batch[]>(
-                `${mpInstance._Store.storageName}-batches`,
-                {
-                    logger: mpInstance.Logger,
-                }
+                `${mpInstance._Store.storageName}-batches`
             );
 
             // Load Events from Session Storage in case we have any in storage
@@ -261,15 +254,16 @@ export class BatchUploader {
             return;
         }
 
-        const { Logger } = this.mpInstance;
-
         this.eventsQueuedForProcessing.push(event);
         if (this.offlineStorageEnabled && this.eventVault) {
             this.eventVault.store(this.eventsQueuedForProcessing);
         }
 
-        Logger.verbose(`Queuing event: ${JSON.stringify(event)}`);
-        Logger.verbose(`Queued event count: ${this.eventsQueuedForProcessing.length}`);
+        if (this.mpInstance.Logger.isVerbose()) {
+            const eventToLog = obfuscateDevData(event, this.mpInstance._Store.SDKConfig.isDevelopmentMode);
+            this.mpInstance.Logger.verbose(`Queuing event: ${JSON.stringify(eventToLog)}`);
+            this.mpInstance.Logger.verbose(`Queued event count: ${this.eventsQueuedForProcessing.length}`);
+        }
 
         if (this.shouldTriggerImmediateUpload(event.EventDataType)) {
             this.prepareAndUpload(false, false);
@@ -413,7 +407,6 @@ export class BatchUploader {
         this.batchesQueuedForProcessing = [];
 
         const batchesThatDidNotUpload = await this.uploadBatches(
-            this.mpInstance.Logger,
             batchesToUpload,
             useBeacon
         );
@@ -433,8 +426,8 @@ export class BatchUploader {
             // therefore NOT overwrite Offline Storage when beacon returns, so that we can retry
             // uploading saved batches at a later time. Batches should only be removed from
             // Local Storage once we can confirm they are successfully uploaded.
+            
             this.batchVault.store(this.batchesQueuedForProcessing);
-
             // Clear batch queue since everything should be in Offline Storage
             this.batchesQueuedForProcessing = [];
         }
@@ -444,10 +437,7 @@ export class BatchUploader {
         }
     }
 
-    // TODO: Refactor to use logger as a class method
-    // https://go.mparticle.com/work/SQDSDKS-5167
     private async uploadBatches(
-        logger: ILogger,
         batches: Batch[],
         useBeacon: boolean
     ): Promise<Batch[] | null> {
@@ -458,8 +448,11 @@ export class BatchUploader {
             return null;
         }
 
-        logger.verbose(`Uploading batches: ${JSON.stringify(uploads)}`);
-        logger.verbose(`Batch count: ${uploads.length}`);
+        if (this.mpInstance.Logger.isVerbose()) {
+            const uploadsToLog = obfuscateDevData(uploads, this.mpInstance._Store.SDKConfig.isDevelopmentMode);
+            this.mpInstance.Logger.verbose(`Uploading batches: ${JSON.stringify(uploadsToLog)}`);
+            this.mpInstance.Logger.verbose(`Batch count: ${uploads.length}`);
+        }
 
         for (let i = 0; i < uploads.length; i++) {
             const fetchPayload: IFetchPayload = {
@@ -483,20 +476,20 @@ export class BatchUploader {
                     const response = await this.uploader.upload(fetchPayload);
 
                     if (response.status >= 200 && response.status < 300) {
-                        logger.verbose(
+                        this.mpInstance.Logger.verbose(
                             `Upload success for request ID: ${uploads[i].source_request_id}`
                         );
                     } else if (
                         response.status >= 500 ||
                         response.status === 429
                     ) {
-                        logger.error(
+                        this.mpInstance.Logger.error(
                             `HTTP error status ${response.status} received`
                         );
                         // Server error, add back current batches and try again later
                         return uploads.slice(i, uploads.length);
                     } else if (response.status >= 401) {
-                        logger.error(
+                        this.mpInstance.Logger.error(
                             `HTTP error status ${response.status} while uploading - please verify your API key.`
                         );
                         //if we're getting a 401, assume we'll keep getting a 401 and clear the uploads.
@@ -513,7 +506,7 @@ export class BatchUploader {
                         );
                     }
                 } catch (e) {
-                    logger.error(
+                    this.mpInstance.Logger.error(
                         `Error sending event to mParticle servers. ${e}`
                     );
                     return uploads.slice(i, uploads.length);

dist/mparticle.js

@@ -6,7 +6,7 @@ import {
     IFetchPayload,
 } from './uploaders';
 import { CACHE_HEADER } from './identity-utils';
-import { parseNumber, valueof } from './utils';
+import { obfuscateData, parseNumber, valueof } from './utils';
 import {
     IAliasCallback,
     IAliasRequest,
@@ -277,9 +277,17 @@ export default function IdentityAPIClient(
                             message += ' - ' + errorMessage;
                         }
 
-                    } else {
-                        message = 'Received Identity Response from server: ';
-                        message += JSON.stringify(identityResponse.responseText);
+                    } else if (Logger.isVerbose()) {
+                        const responseText = identityResponse.responseText;
+                        const { isDevelopmentMode } = mpInstance._Store.SDKConfig;
+                        let responseToLog = responseText;
+                        if (!isDevelopmentMode && responseText?.matched_identities) {
+                            responseToLog = {
+                                ...responseText,
+                                matched_identities: obfuscateData(responseText.matched_identities)
+                            };
+                        }
+                        message = 'Received Identity Response from server: ' + JSON.stringify(responseToLog);
                     }
 
                     break;
@@ -306,7 +314,9 @@ export default function IdentityAPIClient(
             mpInstance._Store.identityCallInFlight = false;
             mpInstance._Store.identityCallFailed = false;
 
-            Logger.verbose(message);
+            if (message) {
+                Logger.verbose(message);
+            }
             if (mpInstance._RoktManager?.isInitialized) {
                 const requestCount = mpInstance._Store.identifyRequestCount;
                 mpInstance.captureTiming(`${requestCount}-identityRequestEnd`);

package-lock.json

@@ -61,6 +61,10 @@ export class Logger implements ILogger {
         }
     }
 
+    public isVerbose(): boolean {
+        return this.logLevel === LogLevelType.Verbose;
+    }
+
     public setLogLevel(newLogLevel: LogLevelType): void {
         this.logLevel = newLogLevel;
     }