chore(deps): update all non-major dependencies - #446
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9c4e39b to
5bfebea
Compare
5bfebea to
7804f68
Compare
renovate
Bot
changed the title
7804f68 to
2d975ff
Compare
2d975ff to
0104ff1
Compare
0104ff1 to
8120e32
Compare
8120e32 to
5ec9f5e
Compare
5ec9f5e to
efcb3b7
Compare
efcb3b7 to
1a61aec
Compare
1a61aec to
cf8e7f8
Compare
cf8e7f8 to
2b13cf8
Compare
6132302 to
360e116
Compare
360e116 to
aa97a8b
Compare
aa97a8b to
714cf9d
Compare
714cf9d to
bdbb60c
Compare
bdbb60c to
9343bf3
Compare
9343bf3 to
fb7fea7
Compare
fb7fea7 to
556aaae
Compare
commit: |
![vercel[bot]](https://cdn.github.com/in/8329?s=60&v=4){kind=small}
| "@nuxt/image": "^1.11.0", | ||
| "@nuxt/scripts": "workspace:*", | ||
| "@nuxt/ui": "4.0.0", | ||
| "@nuxt/ui": "4.2.1", |
There was a problem hiding this comment.
| "@nuxt/ui": "4.2.1", | |
| "@nuxt/ui": "^4.2.1", |
The @nuxt/ui dependency is pinned to 4.2.1 without a caret, which is inconsistent with all other dependencies in this file that use flexible versioning with the ^ prefix.
View Details
Analysis
Inconsistent version pinning for @nuxt/ui dependency
What fails: docs/package.json line 20 specifies @nuxt/ui as pinned version 4.2.1 (without caret prefix), while all 13 other dependencies use caret versioning (^) for flexible version constraints within the major version.
How to reproduce:
cat docs/package.json | grep -A 15 '"dependencies"'Result: Shows "@nuxt/ui": "4.2.1" (pinned) while all surrounding dependencies have caret prefix:
"@nuxt/content": "^3.8.2""@nuxt/fonts": "^0.12.1""@nuxthq/studio": "^2.2.1"- All other 10 dependencies also use
^prefix
Expected behavior: According to npm semantic versioning, caret versioning allows compatible updates (minor/patch versions) within a major version. The project consistently uses this pattern for all other dependencies, so @nuxt/ui should be ^4.2.1 to match the established convention and allow patch/minor updates like other dependencies.
Root cause: Automated dependency update (Renovate bot commit 0b37709) preserved the previous pinned format when bumping the version from 4.0.0 to 4.2.1, rather than applying the project's standard caret versioning pattern used throughout the file.
| "posthog-js": "^1.0.0" | ||
| "@types/youtube": "^0.1.2", | ||
| "@unhead/vue": "^2.1.2", | ||
| "posthog-js": "^1.321.2" |
There was a problem hiding this comment.
| "posthog-js": "^1.321.2" | |
| "posthog-js": "^1.0.0" |
The posthog-js peer dependency constraint changed from ^1.0.0 to ^1.321.2, which is unusually restrictive and appears unintentional given the patch version bump in devDependencies (1.321.1 → 1.321.2).
View Details
Analysis
Overly restrictive posthog-js peer dependency breaks backward compatibility
What fails: The posthog-js peer dependency constraint in package.json was changed from ^1.0.0 to ^1.321.2 (commit 1536ad2), restricting supported versions to 1.321.2+ and rejecting all prior versions (1.0.0-1.321.1) that would previously install.
How to reproduce:
# User has posthog-js 1.200.0 installed (legitimate version under old ^1.0.0 constraint)
npm install @nuxt/scripts
# After update, npm now rejects this version because 1.200.0 does not satisfy ^1.321.2Result: npm/pnpm install fails with: "posthog-js@1.200.0 not satisfied by ^1.321.2"
Expected: The peer dependency should remain at ^1.0.0 (or similar permissive constraint) since:
- Code only uses
posthog.init()and basic config options (api_host,capture_pageview,disable_session_recording) available since 1.0.0 - The devDependency update was only a patch bump (1.222.0 → 1.321.2), not a major version requiring API changes
- Peer dependencies should be permissive to maximize compatibility
- Semantic versioning guidance indicates patch/minor version updates within the same major version should be backward compatible
This change appears to be an error from automated dependency update tooling (Renovate) that applied the same pinpoint version to both devDependencies and peerDependencies.
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^3.58.1→^3.65.4^0.1.0→^0.3.0v0.0.9-mp→v0.0.9v10.0.0→v10.4.0^1.0.0→^1.409.51.410.4(+5)^3.0.0→^3.3.0Release Notes
Hebilicious/reproduire (Hebilicious/reproduire)
v0.0.9Compare Source
compare changes
actions/stale (actions/stale)
v10.4.0Compare Source
What's Changed
Bug Fix
only-issue-typesvalidation by @trueberryless in #1338Dependency Updates
New Contributors
Full Changelog: actions/stale@v10.3.0...v10.4.0
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
v10.2.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.2.0
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
PostHog/posthog-js (posthog-js)
v1.409.5Compare Source
1.409.5
Patch Changes
6c500f1Thanks @ablaszkiewicz! - Fail open when an error tracking suppression rule cannot be evaluated, so an unknown operator or a key outside$exception_types/$exception_valuesno longer drops the exception.(2026-07-31)
v1.409.4Compare Source
1.409.4
Patch Changes
c458807Thanks @turnipdabeets! - Fix canvases staying blank after seeking in session replay by re-sending one frame per canvas after each full snapshot(2026-07-31)
v1.409.3Compare Source
1.409.3
Patch Changes
4729871Thanks @darkopia! - Fix hosted (external) surveys with URL prefill: the auto-submitted response now includes caller-provided event properties (extra URL query params), and a later manual submit no longer clears the prefilled answer from the partial-response merge.(2026-07-31)
v1.409.2Compare Source
1.409.2
Patch Changes
4b8867cThanks @marandaneto! - Avoid redacting session replay network bodies when timestamps or UUID fragments resemble social security or credit card numbers.(2026-07-31)
4b8867c]:v1.409.1Compare Source
1.409.1
Patch Changes
4b36c44Thanks @dustinbyrne! - Add the browser-v1 client adapter for shared extensions, including analytics, request, persistence, replayed remote-config outcomes, and synchronous best-effort cleanup.(2026-07-31)
6b48a59]:v1.409.0Compare Source
1.409.0
Minor Changes
6e7f3aeThanks @ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as$release_idon$exceptionevents, so PostHog can attach exceptions to a release without joining through symbol sets. AddsgetInjectedReleaseId()to@posthog/core. The property is only attached when an injected release id can be read.(2026-07-30)
Patch Changes
6e7f3ae]:v1.408.3Compare Source
1.408.3
Patch Changes
#4327
232b06aThanks @github-actions! - Refresh campaign parameters after SPA URL changes.(2026-07-30)
#4328
95a3d02Thanks @marandaneto! - Fixidentify()creating a person profile when the supplied ID already matches an anonymously persisted distinct ID.(2026-07-30)
v1.408.2Compare Source
1.408.2
Patch Changes
3bd8a2dThanks @marandaneto! - Fix dead-click false positives on WebKit when the SDK uses an iframe-sourced MutationObserver fallback.(2026-07-30)
3bd8a2d]:v1.408.1Compare Source
1.408.1
Patch Changes
3b02a78Thanks @ksvat! - The replayer can now yield to the event loop while fast-forwarding to a seek target, via the new opt-inseekYieldBudgetMsplayer config. Seeking in a long, event-dense recording rebuilds the target frame by re-applying every event since the last full snapshot in one uninterrupted main-thread pass, which can block the page for many seconds and trigger the browser's "Page Unresponsive" dialog; when a yield budget is set, the rebuild runs in time-budgeted chunks instead, and a newer seek cancels any rebuild still in flight so rapid scrubbing only pays for the last seek. A superseded rebuild also resets the machine'slastPlayedEventso the next seek performs a full rebuild rather than trusting a partially-applied history. The default (0) keeps the previous fully-synchronous behavior.(2026-07-30)
v1.408.0Compare Source
1.408.0
Minor Changes
#4270
92427a1Thanks @turnipdabeets! - Add canvas mask regions to session replay canvas capture:session_recording.canvasCapture.maskRegionsFnis called once per canvas per captured frame, and the returned regions (CSS pixels, relative to the canvas) are painted black in the captured frame before it is encoded — letting apps that render into canvas (e.g. Flutter web via CanvasKit) mask content that DOM-based masking cannot see.The return value decides what happens to that canvas's frame:
[]— nothing to mask; the frame is recorded as is.null— regions could not be computed; the frame is skipped rather than recorded unmasked.maskRegionsFnnot set — canvases are recorded unmasked and canvas capture behavior is unchanged.Configuring
maskRegionsFnalso disables canvas pixel serialization in DOM full snapshots (rr_dataURL) — that path never sees the mask regions, so skipping it closes the route that could otherwise embed unmasked canvas stills in a snapshot; the canvas repaints from the masked frame stream instead. Every canvas the provider answers — with regions or[]— re-sends an unchanged frame as a keyframe every 30s, so after a full snapshot or a seek an idle canvas repaints within at most 30s.An app whose real provider only exists once its runtime has booted chooses what happens in between by what it declares in
posthog.init: a function covering the whole canvas blacks those frames out,() => nullskips them, and declaring nothing records them. Client-side only, cannot be set via remote configuration. (2026-07-29)Patch Changes
92427a1]:v1.407.8Compare Source
1.407.8
Patch Changes
#4311
c1818e2Thanks @marandaneto! - fix(react): restore CommonJS default import interop in UMD bundlesReact hooks used without a
PostHogProvidernow receive the default PostHog instance again when the UMD build is loaded through CommonJS. (2026-07-29)v1.407.7Compare Source
1.407.7
Patch Changes
#4304
c7099e9Thanks @lucasheriques! - fix(surveys): only wait for feature flags on surveys that repeatSurveys stopped being shown while feature flags were still loading, even when a cached
enabled value for their internal targeting flag was already available. Popover and widget
surveys recovered on the next evaluation, but a survey your own code renders (type
api)is evaluated once, so it was dropped for that page load and never reappeared.
That wait is only needed for surveys that repeat, where stored per-survey state is keyed by
iteration and cannot be relied on to record that someone already answered. Other surveys
keep one stable key that already prevents a repeat display, so they are now evaluated
against the cached flag right away. (2026-07-29)
Updated dependencies [
c7099e9]:v1.407.6Compare Source
1.407.6
Patch Changes
b4250a7Thanks @marandaneto! - Fix extension bundles when used with the slim no-external browser build.(2026-07-29)
v1.407.5Compare Source
1.407.5
Patch Changes
a19ba65Thanks @marandaneto! - Fix paused replay seeks at an exact full snapshot timestamp so the snapshot frame is rebuilt before playback pauses.(2026-07-28)
v1.407.4Compare Source
1.407.4
Patch Changes
a08c226Thanks @marandaneto! - Send session recording request timestamps in request bodies instead of query strings.(2026-07-28)
v1.407.3Compare Source
1.407.3
Patch Changes
#4214
f7399a0Thanks @felipeatom! - FixcanRenderSurvey/canRenderSurveyAsyncreporting a survey as renderable before its event/action activation trigger has fired. Surveys gated on a "User sends events" filter are now only eligible once the trigger event is received.(2026-07-27)
#4231
eabe2efThanks @marandaneto! - Send analytics request timestamps in capture bodies while retaining query timestamps for session recordings.(2026-07-27)
#4102
fa4844bThanks @marandaneto! - Send SDK library identity in feature flag person properties instead of URL query parameters.(2026-07-27)
#4220
11330b3Thanks @SegFaultZero! - fix(replay): prevent server timings from dropped ingestion requests causing an endless capture loop(2026-07-27)
Updated dependencies [
7210789]:v1.407.2Compare Source
1.407.2
Patch Changes
ba7042bThanks @turnipdabeets! - Fix session replay recordings being unplayable after the session rotated in a tab with no user interaction. When a session expired and rotated (for example in a long-lived background tab), a recorder that had not yet seen user interaction kept attributing snapshots — including full snapshots — to the previous session, so the new session never received a playable full snapshot. The recorder now restarts on rotation in this state, re-syncs its session id from the session manager if they ever diverge, and flushes its buffer on the normal cadence before the first user interaction instead of holding data until the next rotation or page unload.(2026-07-23)
v1.407.1Compare Source
1.407.1
Patch Changes
33f0bd7Thanks @marandaneto! - Send ISO feature flag timestamps in request bodies, use numericsent_atquery timestamps for capture POSTs, and preserve_cache busting for dynamic GET requests.(2026-07-23)
v1.407.0Compare Source
1.407.0
Minor Changes
#4222
0f2407bThanks @turnipdabeets! - feat: add a default-value option toisFeatureEnabledisFeatureEnabled(key, { defaultValue: false })now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows toboolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. WithoutdefaultValue, behavior is unchanged:boolean | undefined. (2026-07-22)Patch Changes
#4203
90e7483Thanks @posthog! - fix(conversations): let users start a new conversation while a ticket is still openThe support widget now surfaces the ticket list navigation (and its "New conversation"
button) whenever the user has any ticket, instead of only when they have multiple tickets
or a single resolved one. Previously a user sitting on one open, unresolved ticket was
locked into that conversation with no way to raise a second issue. (2026-07-22)
#4221
da6e082Thanks @posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callableThe wrapped
window.onerror,window.onunhandledrejection, andconsole.errorhandlerschained to the page's original handler using optional chaining, which only guards against
null/undefined. When a page had one of these set to a truthy non-callable value (e.g.via
Object.defineProperty, or clobbered by another script/extension), our wrapper threw aTypeErrorfrom inside its own handler. We now check the original handler is actuallycallable before invoking it and fall back to
falseotherwise. (2026-07-22)#4209
569fc62Thanks @posthog! - Session recording no longer emits an uncaughtTypeError: Illegal invocationfrom the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronousoriginal.set.call(this, value)still ran with a non-nativethis(a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-nativethisis skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler andgetInputTypeare similarly guarded against reading native accessors on a non-nativethis.(2026-07-22)
#4068
d5e1188Thanks @posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.(2026-07-22)
#4205
de3ad61Thanks @posthog! - Warn when session recording masking options inposthog.initshadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.(2026-07-22)
Updated dependencies [
0f2407b]:v1.406.2Compare Source
1.406.2
Patch Changes
#4206
a3112d9Thanks @posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flagRecurring surveys could re-display and record a duplicate response when the eligibility
check ran against a cached internal targeting flag before fresh flags had loaded. The
display loop now waits for feature flags to actually load before trusting the internal
targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
promptly. (2026-07-21)
v1.406.1Compare Source
1.406.1
Patch Changes
220fa2cThanks @sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts(2026-07-21)
v1.406.0Compare Source
1.406.0
Minor Changes
d39b903Thanks @dustinbyrne! - Move shared browser utility implementations into@posthog/browser-commonand consume them directly fromposthog-js.(2026-07-21)
Patch Changes
ba977d0Thanks @turnipdabeets! - Keep autocapture off when a remote config response omitsautocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.(2026-07-21)
d39b903]:v1.405.3Compare Source
1.405.3
Patch Changes
91505baThanks @pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches(2026-07-21)
v1.405.2Compare Source
1.405.2
Patch Changes
fbfc84fThanks @pauldambra! - feat: make the pending session recording trigger buffer interval configurable(2026-07-20)
fbfc84f]:v1.405.1Compare Source
1.405.1
Patch Changes
dec8fe7Thanks @turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.(2026-07-20)
v1.405.0Compare Source
1.405.0
Minor Changes
#4172
9621830Thanks @haacked! - send minimal$feature_flag_calledevents when the server enables itWhen the v2
/flagsresponse carriesminimalFlagCalledEvents: true(or, for posthog-node local evaluation, the flag-definitions payload carriesminimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false),$feature_flag_calledevents are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties,$set/$set_once, the$feature/<key>enumeration,$active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags,has_experimentunknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration.before_sendruns after the filter and may re-add stripped properties. (2026-07-20)Patch Changes
9621830]:v1.404.1Compare Source
1.404.1
Patch Changes
66c1666Thanks @turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.(2026-07-17)
v1.404.0Compare Source
1.404.0
Minor Changes
607bf54Thanks @pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as$dead_swipeevents, surfacing failed navigations on touch devices. Configurable viacapture_dead_swipes(defaulttrue) andswipe_threshold_px(default30) on thecapture_dead_clicksconfig. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load viamax_dead_swipes_per_page_load(default10).(2026-07-16)
Patch Changes
df17ddcThanks @posthog! - Catch synchronous throws from a monkey-patchedwindow.fetchso they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking.(2026-07-16)
607bf54]:v1.403.0Compare Source
1.403.0
Minor Changes
#4159
fad6d9aThanks @haacked! - add$feature_flag_has_experimentto$feature_flag_calledevents$feature_flag_calledevents now carry a$feature_flag_has_experimentboolean sourced from the server'shas_experimentflag metadata (the/flags?v=2response for remote evaluation, the/api/feature_flag/local_evaluationdefinitions for posthog-node local evaluation). The property is only sent when the server explicitly reportshas_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)Patch Changes
fad6d9a]:v1.402.3Compare Source
1.402.3
Patch Changes
#4157
4a2ecf5Thanks @posthog! - Session recording no longer emits an uncaughtNotAllowedError("Sharing constructed stylesheets in multiple documents is not allowed") when a page assigns aCSSStyleSheetconstructed in a different document toadoptedStyleSheets. That assignment is the host page's own invalid operation, but the recorder's patched setter sat on the call stack, so the exception was attributed to rrweb and churned fingerprints in error tracking. The recorder now contains this specific rejection (matched by its standardizedNotAllowedErrorname, so it works even when the setter throws from an iframe realm) and skips recording those sheets, while still re-throwing any other native-setter error so host-page behaviour is preserved.(2026-07-15)
#4158
0dc389eThanks @posthog! - fix(replay): session recording no longer throwsTypeError: Converting circular structure to JSONwhen replay event data contains a circular reference. The circular-reference guard now also detects cycles that pass through an array, and affected events are captured with[Circular]markers instead of surfacing an unhandled error and being dropped.(2026-07-15)
Updated dependencies [
fc2cb2e]:v1.402.2Compare Source
1.402.2
Patch Changes
81adbfdThanks @posthog! - Session recording no longer emits an uncaughtTypeError: Illegal invocationwhen a programmatic input-value change happens on an object that is not a genuine native input element (for example a proxy on the element prototype chain). The recorder drops that one replay update instead of throwing.(2026-07-15)
v1.402.1Compare Source
1.402.1
Patch Changes
#4117
1eddff7Thanks @DanielVisca! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alphaBackend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup:
Samples aggregate in memory and flush as OTLP/JSON to
/i/v1/metrics(one data point per series per window). Pending metrics are flushed onshutdown(). Core gains_sendMetricsBatchonPostHogCoreStateless(same outcome contract as_sendLogsBatch) and a sharedresolveMetricsConfig, so any core-based SDK can hostPostHogMetrics. (2026-07-15)Updated dependencies [
1eddff7]:v1.402.0Compare Source
1.402.0
Minor Changes
0e8ad14Thanks @robbie-c! - Stamp the current hostname as$snapshot_hoston every$snapshotevent the session recorder sends. The value is derived from the page URL after it passes through the existing replay URL masking pipeline (maskCapturedNetworkRequestFn/ deprecatedmaskNetworkRequestFn, hash stripping, personal-data query-param masking), so it cannot bypass a customer's masking config. When masking removes the URL or the masked result doesn't parse as a URL, the property is omitted entirely. This gives ingestion consumers a per-message host signal even for mid-session snapshot batches that contain no URL-bearing events.(2026-07-15)
v1.401.0Compare Source
1.401.0
Minor Changes
800af7cThanks @pauldambra! - feat: addsession_recording.attributeFilteroption that passes an attribute allowlist through to the native MutationObserver, so mutations to unlisted attributes (e.g. animation-driven inlinestylechurn) never cost recording CPU (port of upstream rrweb #1873)(2026-07-15)
Patch Changes
800af7c]:v1.400.1Compare Source
1.400.1
Patch Changes
6dd8827Thanks @lucasheriques! - chore: survey seen-key and repeat-activation helpers now live in @posthog/core, shared by the web and React Native SDKs. Core's survey enums are now const-object literal unions (matching the web SDK's existing pattern), so the same values type-check across both SDKs. No behavior change. Type-level note: enum members no longer work as standalone type annotations (e.g.SurveyType.Popoveras a type); use the exported union types instead. Runtime values are unchanged.(2026-07-14)
6dd8827]:v1.400.0Compare Source
1.400.0
Minor Changes
dc2aa5bThanks @posthog! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now readsexceptionRateLimiterRefillRate/exceptionRateLimiterBucketSizeonerror_tracking, with the previous double-underscore__exceptionRateLimiterRefillRate/__exceptionRateLimiterBucketSizeoptions deprecated but still honoured as a fallback. The option shape (ExceptionRateLimiterConfig) and default-resolution logic (resolveExceptionRateLimiterConfig) now live in@posthog/coreand are shared between the browser and Node SDKs.(2026-07-14)
Patch Changes
1eabd30Thanks @turnipdabeets! - HandlesendBeaconquota rejections instead of silently dropping events. A beacon rejected by the browser (over the page's shared ~64KiB in-flight keepalive quota) is now split in half and re-sent recursively so the batch delivers as far as the quota allows; a rejected payload that cannot be split falls back to a non-keepalive fetch and logs a warning. Previously the boolean return ofsendBeaconwas ignored and an over-quota unload batch was lost with no signal.(2026-07-14)
dc2aa5b]:v1.399.5Compare Source
1.399.5
Patch Changes
#4134
ab10064Thanks @posthog! - Bound autocapture's DOM ancestor walks against abnormal host-page DOM trees.autocapturePropertiesForElementandshouldCaptureElementnow stop climbing theparentNodechain after 1000 ancestors or if they revisit a node (only possible when a page patchesparentNode, since native DOMs cannot contain cycles), instead of walking indefinitely. WhenshouldCaptureElementcannot finish checking ancestors forph-no-capture/ph-sensitive, it fails closed and reports the element as not capturable. Behavior on normal DOM trees is unchanged.(2026-07-14)
#4141
17d956cThanks @posthog! - Log network-level fetch failures from posthog-js's own request layer (ad blocker, dropped connection, CORS, page teardown) atwarninstead oferror. The browser rejects these with a genericTypeError(Failed to fetch, Firefox'sNetworkError..., or Safari'sLoad failed); they are already caught and retried by the request queue, so they are expected noise rather than SDK errors —_fetchnow gives them the samewarntreatment as our own timeout aborts. Genuine, unexpected errors still log aterror.(2026-07-14)
v1.399.4Compare Source
1.399.4
Patch Changes
7c339beThanks @turnipdabeets! - Encode uncompressedsendBeaconbodies as base64 form data so the beacConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.