Update dependency posthog-js to v1.418.6 - #334
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Author
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/posthog-js-1.x-lockfile
branch
from
August 20, 2026 15:55
cdbe3a2 to
e2b64fa
Compare
renovate
Bot
force-pushed
the
renovate/posthog-js-1.x-lockfile
branch
from
August 20, 2026 21:55
e2b64fa to
65b6061
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.363.6→1.418.6Release Notes
PostHog/posthog-js (posthog-js)
v1.418.6Compare Source
1.418.6
Patch Changes
#4578
bae46bfThanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event.(2026-08-20)
#4582
aef2f49Thanks @ablaszkiewicz! - Stop building a stack frame for awindow.onerrorreport that carries no code position, such as theResizeObserverloop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace.(2026-08-20)
Updated dependencies [
bae46bf,aef2f49]:v1.418.5Compare Source
1.418.5
Patch Changes
9701637Thanks @ablaszkiewicz! - Stop counting Chromium<anonymous>stack frames (extension-injected, devtools or string-evaluated code) as in-app code.(2026-08-19)
9701637]:v1.418.4Compare Source
1.418.4
Patch Changes
b564d61Thanks @posthog! - Fix session recording in the full browser bundles.array.full.jsandmodule.full.es.jsonly inlined rrweb, so they still fetched the recorder script at runtime - the request the full bundles exist to avoid. They now inline the whole recorder. Also flags the session with$sdk_debug_recording_script_not_loadedwhen the recorder script fails to load, so a blocked recorder is visible in analytics rather than only in the console.(2026-08-19)
v1.418.3Compare Source
1.418.3
Patch Changes
3f9ba71Thanks @posthog! - Fall back to the synthetic exception stack when a capturedErrorhas no stack, so frameless failures (such as a Firefox networkfetchTypeError) keep their call-site frames and group per call site instead of merging into one issue.(2026-08-19)
3f9ba71]:v1.418.2Compare Source
1.418.2
Patch Changes
#4555
3e0edffThanks @HaynesPostHog! - Fix a Chrome renderer crash (grey "Aw, Snap" tab, "Error code: 5") that could still occur when closing an in-app survey on a heavy page such as a large dashboard.Closing a survey animated the fade-out with
document.startViewTransition, which snapshots the entire page viewport. The survey applied noview-transition-namescoping, so on a heavy host page capturing that whole-page snapshot could exhaust renderer memory and crash the tab. A previous fix addressed a related crash (a snapshot pointing at a removed node) but left the document-level transition — and its whole-page snapshot cost — in place.The survey renders in an isolated shadow root, so it never needed a document-level transition. The close now fades the popup out with a plain CSS opacity transition scoped to the survey's own container, then unmounts it once the fade has run. No whole-page snapshot, no crash, same fade-out UX. (2026-08-19)
v1.418.1Compare Source
1.418.1
Patch Changes
0599fe0Thanks @ablaszkiewicz! - Recognise Firefox and Safari extension frames when filtering extension exceptions, and stop counting Safari's maskedwebkit-masked-url://frames as in-app code.(2026-08-18)
0599fe0]:v1.418.0Compare Source
1.418.0
Minor Changes
1ade666Thanks @marandaneto! - AddcookieWinsOnConflictto keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate__preview_cookie_wins_on_conflict, and enable the new behavior for the2026-08-29defaults.(2026-08-18)
Patch Changes
1ade666]:v1.417.4Compare Source
1.417.4
Patch Changes
8d74821Thanks @ksvat! - Take a full snapshot when session recording wakes from idle if DOM mutations were dropped while idle, so replay no longer shows duplicated or overlapping DOM after an idle period.(2026-08-17)
v1.417.3Compare Source
1.417.3
Patch Changes
ce8fc13Thanks @marandaneto! - Restore exception autocapture compatibility for posthog-js clients through version 1.141.0.(2026-08-17)
v1.417.2Compare Source
1.417.2
Patch Changes
7b61aa4Thanks @posthog! - Fix error tracking coercion reporting the wrong exception type for non-Errorobjects (e.g.TypeError,ReferenceError) that are thrown by browser extensions or other cross-realm code. Previously these always reported as typeError, burying the real type in the message string. Also fixed a localisErrorhelper shadowing the more robust cross-realm-aware implementation, which caused some errors thrown from iframes or extension isolated worlds to be misclassified.(2026-08-17)
7b61aa4]:v1.417.1Compare Source
1.417.1
Patch Changes
#4521
0a0206fThanks @marandaneto! - Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core.(2026-08-14)
#4523
6230b5bThanks @marandaneto! - Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts.(2026-08-14)
#4503
eb05237Thanks @pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidenceThe dead-click detector treated a
visibilitychangeas evidence a click was dead: it measuredMath.abs(clickTimestamp - lastVisibilityChange)and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:
hidden), and a windowfocus/blurobserver is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.$dead_click_visibility_changed_timeoutstays in the payload (always false) for shape compatibility, and a new$dead_click_focus_changed_delay_msis emitted for observability.Updated dependencies [
0a0206f,eb05237]:v1.417.0Compare Source
1.417.0
Minor Changes
8bc63c3Thanks @dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add astrict_script_versioning: 'fallback'mode.(2026-08-13)
Patch Changes
8bc63c3]:v1.416.1Compare Source
1.416.1
Patch Changes
#4443
b2c6830Thanks @arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):0to disable) and directrrweb.record()consumers keep unbounded inlining unless they opt in._cssTextatomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.pagehide; residual failure modes are counted via$sdk_debug_replay_deferred_stylesheets_failed/_abandoned.insertRuleoutput,adoptedStyleSheets) no longer charge the budget, since deferring<link>sheets buys those pages nothing.$sdk_debug_replay_discarded_duration_samples). (2026-08-13)Updated dependencies [
c9086de,b2c6830]:v1.416.0Compare Source
1.416.0
Minor Changes
#4495
e4b9947Thanks @marandaneto! - feat(browser): addrewriteRequestPathto customize API, feature flag, and asset paths for reverse proxies(2026-08-12)
#4493
e34ebf9Thanks @marandaneto! - Add reset options for applying bootstrapped identity, feature flag, and session values afterposthog.reset()while preserving the legacy boolean argument.(2026-08-12)
Patch Changes
e4b9947,e34ebf9]:v1.415.7Compare Source
1.415.7
Patch Changes
847d963Thanks @dustinbyrne! - Migrate browser feature flags to the shared extension lifecycle while preserving the public feature flag facade, persistence compatibility, request behavior, and event enrichment.(2026-08-12)
v1.415.6Compare Source
1.415.6
Patch Changes
#4500
d773405Thanks @ksvat! - Fix session recording starting from arbitrarily old persisted configs.Recording configs persisted by SDK versions before 1.347.2 carry no
cache_timestamp. The core freshness check treated these undated configs as always fresh, so the recorder started immediately under their settings. A device whose stored config predated a customer's config change kept recording under the old triggers, sample rate, and masking settings indefinitely.The core now treats undated persisted configs as stale. Recording waits for a fresh remote config before it starts, the same path every dated config older than one hour already takes. The lazy recorder bundle is unchanged: it still accepts undated configs, because old cores that load the latest bundle cannot recover from a rejected config (INC-749). (2026-08-11)
v1.415.5Compare Source
1.415.5
Patch Changes
#4497
d62e42eThanks @hpouillot! - Fix a Chrome renderer crash (grey "Aw, Snap" tab) that could occur when closing an in-app survey.The survey close path wrapped the survey container's DOM removal in
document.startViewTransition. Removing the element inside the transition callback left the captured snapshot pointing at a removed node, which on heavy SPAs triggered a Chromium renderer crash and took down the whole tab.The close path now only animates a fade-out inside the transition and lets React tear the container down once the transition settles. It also guards against overlapping transitions (a second close while one is animating) and always settles the popup state if the transition is skipped or interrupted, so the survey can never be left visible with a stale reference. (2026-08-11)
v1.415.4Compare Source
1.415.4
Patch Changes
deb6bb0Thanks @marandaneto! - fix(types): accept current and legacy Segment Analytics SDK types in the Segment integration config(2026-08-11)
deb6bb0]:v1.415.3Compare Source
1.415.3
Patch Changes
#4488
23db844Thanks @TueHaulund! - fix(replay): never ship a buffer swapped in by a re-entrant session rotation mid-flush(2026-08-11)
#4474
e06bf52Thanks @dependabot! - dependencies updates: - Updated dependencydompurify@^3.4.13↗︎ (from^3.4.12, independencies) (2026-08-11)#4435
1cbbe6aThanks @arnohillen! - fix(replay): stop dropping adopted stylesheets that arrive before the host's shadow root is attached. When the recorder's full snapshot races a web component's hydration, the AdoptedStyleSheet event can be recorded before the mutation that attaches the host's shadow root. The replayer silently dropped those styles for the rest of the page view, so components styled viashadowRoot.adoptedStyleSheets(Stencil, Lit) rendered completely unstyled. The replayer now constructs the stylesheet even when the shadow root does not exist yet and keeps retrying adoption until it is attached.(2026-08-11)
v1.415.2Compare Source
1.415.2
Patch Changes
f999394Thanks @dustinbyrne! - Support removing multiple persisted properties in one operation.(2026-08-11)
f999394]:v1.415.1Compare Source
1.415.1
Patch Changes
6f9adf8Thanks @TueHaulund! - fix(replay): don't open a recording that holds only idle lifecycle markers(2026-08-10)
v1.415.0Compare Source
1.415.0
Minor Changes
#4436
80f15a3Thanks @jakesciotto! - feat(surveys): optional intro screen shown before the first questionSurveys can now display an intro screen before question 1, configured via the new
displayIntroScreen,introScreenHeader,introScreenDescription,introScreenDescriptionContentType, andintroScreenButtonTextappearance fields.The intro is dismissed with a button and records no response, does not affect
completion or partial-response metrics, does not re-fire "survey shown", and is
skipped when a survey is resumed with answers in progress. Intro copy is
translatable like the thank-you message.
renderSurveysPreviewacceptspreviewPageIndex: -1(exported asINTRO_SCREEN_PREVIEW_INDEX) to preview theintro screen. (2026-08-10)
Patch Changes
80f15a3]:v1.414.0Compare Source
1.414.0
Minor Changes
5bd8b83Thanks @darkopia! - Addposthog.conversations.getUnavailableReason()to expose why the conversations API is unavailable (bundle blocked/failed to load, disabled in project, remote config pending/failed, still initializing, …) instead of collapsing every case intoisAvailable() === false. Lets callers that fall back to another channel record the specific cause.ConversationsUnavailableReasonis exported from the package entry points, so consumers can name the type.(2026-08-07)
v1.413.3Compare Source
1.413.3
Patch Changes
#4414
1b88c2fThanks @marandaneto! - Clear properties registered for a session when the PostHog session rotates.(2026-08-06)
#4374
b39b577Thanks @dustinbyrne! - Persist in-place object and array mutations when properties are re-registered.(2026-08-06)
#4434
75fb719Thanks @arnohillen! - Make the session replay attribute masking options mutually exclusive: when bothmaskAllElementAttributesandmaskAttributeFnare set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask whatmaskAllElementAttributeshides.(2026-08-06)
Updated dependencies [
64ba193,75fb719]:v1.413.2Compare Source
1.413.2
Patch Changes
ee7fab0Thanks @posthog! - Fix a benign network failure (e.g.TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up(2026-08-05)
v1.413.1Compare Source
1.413.1
Patch Changes
#4390
1160403Thanks @posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes.(2026-08-05)
#4286
d108d66Thanks @posthog! - fix(replay): preserve privacy masking for initial network metadataInitial navigation and performance-timing entries are now passed through
maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)Updated dependencies [
d108d66]:v1.413.0Compare Source
1.413.0
Minor Changes
2da12b8Thanks @posthog! - Add attribute-level masking to session replay:maskAttributeFnprovides per-attribute control over the final serialized value, whilemaskAllElementAttributesmasks all source DOM string attributes (including rendering attributes and synthesized form values) at the cost of replay fidelity.(2026-08-05)
Patch Changes
2da12b8Thanks @posthog! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible(2026-08-05)
2da12b8]:v1.412.2Compare Source
1.412.2
Patch Changes
3acadfeThanks @marandaneto! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible(2026-08-05)
v1.412.1Compare Source
1.412.1
Patch Changes
a348fb3Thanks @dependabot! - Update PostCSS to include upstream security fixes.(2026-08-05)
v1.412.0Compare Source
v1.411.0Compare Source
1.411.0
Minor Changes
#4266
43d1850Thanks @posthog! - feat: add opt-incapture_performance.__preview_web_vitals_soft_navsto fix inflated web vitals on single-page appsClient-side route changes in SPAs previously left web vitals (LCP especially) accumulating against the original hard-navigation timestamp, inflating the top tail of Core Web Vitals. Setting
capture_performance: { __preview_web_vitals_soft_navs: true }now scopes metrics to the browser's Soft Navigation entries so each route change starts a fresh measurement window. It's a preview option because it relies on Chrome's experimental Soft Navigation Detection API and loads pinned stable web-vitals 6.x callbacks; when disabled (the default), the existing web-vitals 5.x behavior remains unchanged. (2026-08-04)Patch Changes
d3c4538Thanks @posthog! - Keep$referring_domainand canonicalutm_*/campaign parameters on minimal$feature_flag_calledevents. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics.(2026-08-04)
d3c4538,43d1850]:v1.410.10Compare Source
1.410.10
Patch Changes
#4271
3d4e2fdThanks @felipeatom! - Fix inline surveys rendering an empty container when a stale persisted question index (left over from a prior completion) points past the last question. When the persisted index is out of range the whole in-progress record is now discarded and the survey starts fresh, instead of clamping the index while keeping the equally-stale responses and visited indices. Restored visited indices are also filtered to valid questions so the Back button can never navigate to a non-existent question and re-empty the container.(2026-08-04)
#4412
5f2b78aThanks @TueHaulund! - fix(replay): hold fresh interaction-less session recordings until there is evidence someone caresA tab that loads but never sees any user interaction (prefetched pages, background tabs, in-app browser preloads) no longer ships a billable recording while it sits untouched. Like rotation-born sessions, a fresh recording epoch is held until there is evidence someone cares about it: a user interaction, an event trigger match, or an explicit override (
posthog.startSessionRecording(...)) releases the hold and ships the buffer on the normal flush cadence, so released recordings are playable from the session's start. A clean unload also ships a fresh-start hold, so passive visits (reading, watching a video) are still captured exactly as before; rotation-born holds are discarded on unload as before. A held buffer that reaches the size cap is dropped to bound memory, and a later release takes a fresh full snapshot so the recording resumes playable. (2026-08-04)#4410
064874aThanks @ioannisj! - Fix held rotation-born session replay buffers not flushing when a V2 event trigger matches(2026-08-04)
#4343
83a9b67Thanks @arnohillen! - Session replay no longer freezes the page re-encoding base64 images that are already small. When canvas recording is enabled, every<img>with adata:URL was synchronously redrawn and re-encoded throughcanvas.toDataURLduring full snapshots and attribute mutations. The encode cost scales with pixel dimensions, not payload size, so a page of base64 lazy-load placeholders (measured: 18 images of 4096x3072 at ~33KB each) blocked the main thread for 7+ seconds to produce outputs that were larger than the inputs. Recompression now skips data URLs under 100KB (where it cannot save meaningful payload), keeps the original when the re-encoded output is not smaller, and memoizes by input so repeated snapshots and src-swapping mutations never pay for the same image twice. Genuinely large base64 images are still recompressed as before.(2026-08-04)
#4339
f865818Thanks @posthog! - Report privacy-aware dropped-event count, page and session context in the client rate limit warning(2026-08-04)
Updated dependencies [
f865818]:v1.410.9Compare Source
1.410.9
Patch Changes
#4314
feb9e2aThanks @posthog! - fix: warn whenreset()silently opts the user back outreset()clears stored consent along with the rest of the user's state. Withopt_out_capturing_by_default, this returns the instance to the opted-out default, so callingreset()afteropt_in_capturing()would stop capturing without warning. It now logs a warning when that happens and documents the required ordering. (2026-08-04)#4288
877418eThanks @posthog! - Fix event-triggered survey popup delays resetting on every page navigation. The popup delay now resumes from when the trigger fired (persisted for the session) instead of restarting a fresh countdown on each page load, so a survey configured with an event/action trigger and a popup delay no longer gets lost when the user navigates before the delay elapses.(2026-08-04)
Updated dependencies [
feb9e2a]:v1.410.8Compare Source
1.410.8
Patch Changes
a31bd1eThanks @NVolcz! - Publish TypeScript declarations for browser extension entrypoints under their publicdistpaths.(2026-08-04)
v1.410.7Compare Source
1.410.7
Patch Changes
9811a43Thanks @marandaneto! - Avoid promoting handled transport failures to error logs in surveys, product tours, remote config, conversations, and logs while preserving error severity for HTTP and unexpected failures.(2026-08-04)
v1.410.6Compare Source
1.410.6
Patch Changes
6d5e314Thanks @ioannisj! - Fix session replay shipping one billable recording per session rotation for tabs the user never interacts with. A session born from an idle rotation now holds its buffer until the first user interaction, then ships a recording playable from the session's start; without interaction nothing is sent — a further rotation, stop, opt-out, or page unload discards the held data instead of shipping it. An event trigger match (for example record-on-exception) also releases the hold, since it is explicit intent to record the session.(2026-08-03)
v1.410.5Compare Source
1.410.5
Patch Changes
8ec3499Thanks @felipeatom! - Fix selector-widget surveys being abruptly removed while open when their trigger element is unmounted from the DOM (e.g. a dropdown or menu that hosts the trigger closes). The survey is now kept in place while open and only torn down once the user has closed it. Also fixes a related leak where, if the selector resolved to a different element while the survey was open, the old element's click listener was never removed and kept dispatching the show-widget event for the lifetime of the page.(2026-08-03)
v1.410.4Compare Source
v1.410.3Compare Source
1.410.3
Patch Changes
662fb4cThanks @christiaan-ph! - Conversations widget: bullet and numbered lists in a support reply now keep their markers on host pages with an aggressive CSS reset (for example Tailwind preflight'sol, ul { list-style: none }). The widget renders into the host page's DOM, so the list style is now set inline on<ul>,<ol>, and<li>rather than left to the page's own styles.(2026-08-03)
v1.410.2Compare Source
v1.410.1Compare Source
1.410.1
Patch Changes
0854095Thanks @marandaneto! - Prevent the inline canvas recording worker from requesting an unusable source map from its blob URL.(2026-08-03)
eb0a793]:v1.410.0Compare Source
1.410.0
Minor Changes
fde7145Thanks @DerGeraetK! - Addsession_recording.samplingto disable or throttle mousemove capture (and optionally mouseInteraction) in session replay. Canvas recording now merges its canvas sampling with user-provided sampling instead of overwriting it.(2026-08-03)
Patch Changes
10ef759Thanks @NVolcz! - Share extension bundle types between the slim and slim no-external entrypoints.(2026-08-03)
fde7145]:v1.409.6Compare Source
1.409.6
Patch Changes
8a7bb3fThanks @posthog! - Mark our bundles as third-party code in the source maps we publish (thex_google_ignoreListextension). Browser devtools now attributeconsole.*messages to the code that called them instead of to posthog-js's console wrapper, which previously showed every message as coming fromlogs.tswhencaptureConsoleLogsor session replay'senable_recording_console_logwas enabled.(2026-08-03)
7c3a9af]:v1.409.5Compare Source
1.409.5
Patch Changes
6c500f1Thanks @ablaszkiewicz! - Fail open when an error tracking suppression rule cannot be evaluated, so an unknown operator or a key outside$exception_types/$exception_valuesno longer drops the exception.(2026-07-31)
v1.409.4Compare Source
1.409.4
Patch Changes
c458807Thanks @turnipdabeets! - Fix canvases staying blank after seeking in session replay by re-sending one frame per canvas after each full snapshot(2026-07-31)
v1.409.3Compare Source
1.409.3
Patch Changes
4729871Thanks @darkopia! - Fix hosted (external) surveys with URL prefill: the auto-submitted response now includes caller-provided event properties (extra URL query params), and a later manual submit no longer clears the prefilled answer from the partial-response merge.(2026-07-31)
v1.409.2Compare Source
1.409.2
Patch Changes
4b8867cThanks @marandaneto! - Avoid redacting session replay network bodies when timestamps or UUID fragments resemble social security or credit card numbers.(2026-07-31)
4b8867c]:v1.409.1Compare Source
1.409.1
Patch Changes
4b36c44Thanks @dustinbyrne! - Add the browser-v1 client adapter for shared extensions, including analytics, request, persistence, replayed remote-config outcomes, and synchronous best-effort cleanup.(2026-07-31)
6b48a59]:v1.409.0Compare Source
1.409.0
Minor Changes
6e7f3ae](https://redirect.github.com/PostHog/posthog-js/commit/6e7f3aeaf65d66d015508aec0618cConfiguration
📅 Schedule: (in timezone America/New_York)
* 0-23 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.