Fixed: Gleap.identify with a userHash sent nothing when the browser already held a contact identified with the same user id and data without a hash (identified before identity verification was switched on, or before the app passed a hash). The server never received the hash, so the contact was never marked as verified. The SDK now sends the hashed identify once per contact and browser and skips unchanged identifies again afterwards. Only the user id is remembered, never the hash; logging out with Gleap.clearIdentity() clears it.

Fixed: the launcher could not be reached with the keyboard. It is now a focusable button with a name ("Open support chat" or your button text) and an expanded state; Enter and Space open the messenger and move focus into it, a focus ring shows on keyboard focus, and closing the messenger from inside returns focus to the launcher.
Fixed: hotspot tooltips only appeared after a full reload in apps that navigate without one (Turbo Drive, SPAs). Tooltips now follow URL changes, re-attach to re-rendered elements and are removed when their page rules no longer match. A hotspot no longer shifts the element it points at.

Fixed: a language switch in the app never reached the contact. Gleap.identify and Gleap.updateContact skipped the request when the user data was unchanged, without looking at the language, so apps that change language without a full reload (Turbo, SPAs updating <html lang>) kept the old language on the contact and language-targeted outreach used it. The SDK now sends the update when the active language differs from the contact's.
Fixed: Gleap.clearIdentity() called before the widget UI mounted (a queued call in the async snippet) left the previous contact's cached notifications in place, and a reload showed them to the next visitor. Cached notifications are now cleared regardless and are only shown to the contact that received them.
Fixed: cached notification cards ignored disabled notifications and were still shown.

Fixed: a product tour step whose selector only matched a hidden element (display: none, such as the label of a collapsed menu or the hidden copy of a responsive menu) froze the page. The step pointed at the top-left corner, the overlay blocked every click, a click step had no way forward and reloading brought the step back. Steps now use the first visible match; with none, the tour waits up to 5 s for the element to appear and then ends, like a selector that matches nothing.

New: the widget can switch the visitor to a contact after the "Verify email" workflow step confirmed their email (adopt-session). The SDK checks the handed-over session with the server first and never replaces a user your app identified.
New: custom actions from chat messages and message cards now pass their data to your Gleap.registerCustomAction callback as data (next to name and shareToken), with a Messenger that sends it. Callbacks that only read name keep working.

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs.
Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

New capture experience: when Kai or a teammate asks for a screenshot or recording, the page shows a small frosted capture bar (Enter to capture, Esc to cancel) instead of the dark panel, with a shutter flash and the result flying into the chat card. Recordings can be paused and resumed, show a progress ring toward the time limit, and the default limit is now 2 minutes. The editor keeps all its tools with a cleaner toolbar. Works with older Messenger versions (no fly-in or pause there).

Fixed: the SDK closed its websocket without a close code, so the server logged every page leave and reconnect as an abnormal close (1005); it now closes with 1000. Going back online no longer drops a socket that is still connecting and opens a second one. The keepalive is a single PING text frame every 25 s (was two frames every 10 s), which still keeps idle proxies and load balancers from cutting the connection.

Fixed: a product tour or tooltip selector that is not valid CSS, such as an attribute typed without its brackets (data-test="x" instead of [data-test="x"]), no longer throws. The bracketless form now finds its element; anything else counts as not found, so the tour ends cleanly instead of stopping with an error, copilot tours stop waiting after 5 s, and tooltips keep working.
Fixed: the tour editor's element picker no longer stores ids and classes that Mantine and React 19 generate at runtime (mantine-… ids, «r1» / _r_1_ from useId, Mantine 6 mantine-<hash>, Mantine 7 m_<hash> and __m__-… classes). They changed on the next page load, deploy or Mantine update and silently ended the tour; the picker now prefers stable names such as mantine-Button-root.