Update dependency posthog-js to v1.413.3

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.392.0 → 1.413.3

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.413.3

Compare Source

1.413.3

Patch Changes

• #​4414 1b88c2f Thanks @​marandaneto! - Clear properties registered for a session when the PostHog session rotates.
  (2026-08-06)

• #​4374 b39b577 Thanks @​dustinbyrne! - Persist in-place object and array mutations when properties are re-registered.
  (2026-08-06)

• #​4434 75fb719 Thanks @​arnohillen! - Make the session replay attribute masking options mutually exclusive: when both maskAllElementAttributes and maskAttributeFn are set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask what maskAllElementAttributes hides.
  (2026-08-06)

• Updated dependencies [64ba193, 75fb719]:

  • @​posthog/core@​1.46.9
  • @​posthog/types@​1.402.2

v1.413.2

Compare Source

1.413.2

Patch Changes

• #​4425 ee7fab0 Thanks @​posthog! - Fix a benign network failure (e.g. TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up
  (2026-08-05)

v1.413.1

Compare Source

1.413.1

Patch Changes

• #​4390 1160403 Thanks @​posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes.
  (2026-08-05)

• #​4286 d108d66 Thanks @​posthog! - fix(replay): preserve privacy masking for initial network metadata

  Initial navigation and performance-timing entries are now passed through maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)

• Updated dependencies [d108d66]:

  • @​posthog/types@​1.402.1

v1.413.0

Compare Source

1.413.0

Minor Changes

• #​4376 2da12b8 Thanks @​posthog! - Add attribute-level masking to session replay: maskAttributeFn provides per-attribute control over the final serialized value, while maskAllElementAttributes masks all source DOM string attributes (including rendering attributes and synthesized form values) at the cost of replay fidelity.
  (2026-08-05)

Patch Changes

• #​4376 2da12b8 Thanks @​posthog! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)
• Updated dependencies [2da12b8]:
  • @​posthog/types@​1.402.0
  • @​posthog/browser-common@​0.4.0

v1.412.2

Compare Source

1.412.2

Patch Changes

• #​4417 3acadfe Thanks @​marandaneto! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)

v1.412.1

Compare Source

1.412.1

Patch Changes

• #​4404 a348fb3 Thanks @​dependabot! - Update PostCSS to include upstream security fixes.
  (2026-08-05)

v1.412.0

Compare Source

v1.411.0

Compare Source

1.411.0

Minor Changes

• #​4266 43d1850 Thanks @​posthog! - feat: add opt-in capture_performance.__preview_web_vitals_soft_navs to fix inflated web vitals on single-page apps

  Client-side route changes in SPAs previously left web vitals (LCP especially) accumulating against the original hard-navigation timestamp, inflating the top tail of Core Web Vitals. Setting capture_performance: { __preview_web_vitals_soft_navs: true } now scopes metrics to the browser's Soft Navigation entries so each route change starts a fresh measurement window. It's a preview option because it relies on Chrome's experimental Soft Navigation Detection API and loads pinned stable web-vitals 6.x callbacks; when disabled (the default), the existing web-vitals 5.x behavior remains unchanged. (2026-08-04)

Patch Changes

• #​4287 d3c4538 Thanks @​posthog! - Keep $referring_domain and canonical utm_*/campaign parameters on minimal $feature_flag_called events. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics.
  (2026-08-04)
• Updated dependencies [d3c4538, 43d1850]:
  • @​posthog/core@​1.46.7
  • @​posthog/types@​1.401.0

v1.410.10

Compare Source

1.410.10

Patch Changes

• #​4271 3d4e2fd Thanks @​felipeatom! - Fix inline surveys rendering an empty container when a stale persisted question index (left over from a prior completion) points past the last question. When the persisted index is out of range the whole in-progress record is now discarded and the survey starts fresh, instead of clamping the index while keeping the equally-stale responses and visited indices. Restored visited indices are also filtered to valid questions so the Back button can never navigate to a non-existent question and re-empty the container.
  (2026-08-04)

• #​4412 5f2b78a Thanks @​TueHaulund! - fix(replay): hold fresh interaction-less session recordings until there is evidence someone cares

  A tab that loads but never sees any user interaction (prefetched pages, background tabs, in-app browser preloads) no longer ships a billable recording while it sits untouched. Like rotation-born sessions, a fresh recording epoch is held until there is evidence someone cares about it: a user interaction, an event trigger match, or an explicit override (posthog.startSessionRecording(...)) releases the hold and ships the buffer on the normal flush cadence, so released recordings are playable from the session's start. A clean unload also ships a fresh-start hold, so passive visits (reading, watching a video) are still captured exactly as before; rotation-born holds are discarded on unload as before. A held buffer that reaches the size cap is dropped to bound memory, and a later release takes a fresh full snapshot so the recording resumes playable. (2026-08-04)

• #​4410 064874a Thanks @​ioannisj! - Fix held rotation-born session replay buffers not flushing when a V2 event trigger matches
  (2026-08-04)

• #​4343 83a9b67 Thanks @​arnohillen! - Session replay no longer freezes the page re-encoding base64 images that are already small. When canvas recording is enabled, every <img> with a data: URL was synchronously redrawn and re-encoded through canvas.toDataURL during full snapshots and attribute mutations. The encode cost scales with pixel dimensions, not payload size, so a page of base64 lazy-load placeholders (measured: 18 images of 4096x3072 at ~33KB each) blocked the main thread for 7+ seconds to produce outputs that were larger than the inputs. Recompression now skips data URLs under 100KB (where it cannot save meaningful payload), keeps the original when the re-encoded output is not smaller, and memoizes by input so repeated snapshots and src-swapping mutations never pay for the same image twice. Genuinely large base64 images are still recompressed as before.
  (2026-08-04)

• #​4339 f865818 Thanks @​posthog! - Report privacy-aware dropped-event count, page and session context in the client rate limit warning
  (2026-08-04)

• Updated dependencies [f865818]:

  • @​posthog/types@​1.400.2

v1.410.9

Compare Source

1.410.9

Patch Changes

• #​4314 feb9e2a Thanks @​posthog! - fix: warn when reset() silently opts the user back out

  reset() clears stored consent along with the rest of the user's state. With opt_out_capturing_by_default, this returns the instance to the opted-out default, so calling reset() after opt_in_capturing() would stop capturing without warning. It now logs a warning when that happens and documents the required ordering. (2026-08-04)

• #​4288 877418e Thanks @​posthog! - Fix event-triggered survey popup delays resetting on every page navigation. The popup delay now resumes from when the trigger fired (persisted for the session) instead of restarting a fresh countdown on each page load, so a survey configured with an event/action trigger and a popup delay no longer gets lost when the user navigates before the delay elapses.
  (2026-08-04)

• Updated dependencies [feb9e2a]:

  • @​posthog/types@​1.400.1

v1.410.8

Compare Source

1.410.8

Patch Changes

• #​4402 a31bd1e Thanks @​NVolcz! - Publish TypeScript declarations for browser extension entrypoints under their public dist paths.
  (2026-08-04)

v1.410.7

Compare Source

1.410.7

Patch Changes

• #​4400 9811a43 Thanks @​marandaneto! - Avoid promoting handled transport failures to error logs in surveys, product tours, remote config, conversations, and logs while preserving error severity for HTTP and unexpected failures.
  (2026-08-04)

v1.410.6

Compare Source

1.410.6

Patch Changes

• #​4407 6d5e314 Thanks @​ioannisj! - Fix session replay shipping one billable recording per session rotation for tabs the user never interacts with. A session born from an idle rotation now holds its buffer until the first user interaction, then ships a recording playable from the session's start; without interaction nothing is sent — a further rotation, stop, opt-out, or page unload discards the held data instead of shipping it. An event trigger match (for example record-on-exception) also releases the hold, since it is explicit intent to record the session.
  (2026-08-03)

v1.410.5

Compare Source

1.410.5

Patch Changes

• #​4273 8ec3499 Thanks @​felipeatom! - Fix selector-widget surveys being abruptly removed while open when their trigger element is unmounted from the DOM (e.g. a dropdown or menu that hosts the trigger closes). The survey is now kept in place while open and only torn down once the user has closed it. Also fixes a related leak where, if the selector resolved to a different element while the survey was open, the old element's click listener was never removed and kept dispatching the show-widget event for the lifetime of the page.
  (2026-08-03)

v1.410.4

Compare Source

v1.410.3

Compare Source

1.410.3

Patch Changes

• #​4399 662fb4c Thanks @​christiaan-ph! - Conversations widget: bullet and numbered lists in a support reply now keep their markers on host pages with an aggressive CSS reset (for example Tailwind preflight's ol, ul { list-style: none }). The widget renders into the host page's DOM, so the list style is now set inline on <ul>, <ol>, and <li> rather than left to the page's own styles.
  (2026-08-03)

v1.410.2

Compare Source

v1.410.1

Compare Source

1.410.1

Patch Changes

• #​4386 0854095 Thanks @​marandaneto! - Prevent the inline canvas recording worker from requesting an unusable source map from its blob URL.
  (2026-08-03)
• Updated dependencies [eb0a793]:
  • @​posthog/core@​1.46.3

v1.410.0

Compare Source

1.410.0

Minor Changes

• #​4125 fde7145 Thanks @​DerGeraetK! - Add session_recording.sampling to disable or throttle mousemove capture (and optionally mouseInteraction) in session replay. Canvas recording now merges its canvas sampling with user-provided sampling instead of overwriting it.
  (2026-08-03)

Patch Changes

• #​4387 10ef759 Thanks @​NVolcz! - Share extension bundle types between the slim and slim no-external entrypoints.
  (2026-08-03)
• Updated dependencies [fde7145]:
  • @​posthog/types@​1.400.0

v1.409.6

Compare Source

1.409.6

Patch Changes

• #​4299 8a7bb3f Thanks @​posthog! - Mark our bundles as third-party code in the source maps we publish (the x_google_ignoreList extension). Browser devtools now attribute console.* messages to the code that called them instead of to posthog-js's console wrapper, which previously showed every message as coming from logs.ts when captureConsoleLogs or session replay's enable_recording_console_log was enabled.
  (2026-08-03)
• Updated dependencies [7c3a9af]:
  • @​posthog/core@​1.46.2

v1.409.5

Compare Source

1.409.5

Patch Changes

• #​4354 6c500f1 Thanks @​ablaszkiewicz! - Fail open when an error tracking suppression rule cannot be evaluated, so an unknown operator or a key outside $exception_types / $exception_values no longer drops the exception.
  (2026-07-31)

v1.409.4

Compare Source

1.409.4

Patch Changes

• #​4338 c458807 Thanks @​turnipdabeets! - Fix canvases staying blank after seeking in session replay by re-sending one frame per canvas after each full snapshot
  (2026-07-31)

v1.409.3

Compare Source

1.409.3

Patch Changes

• #​4312 4729871 Thanks @​darkopia! - Fix hosted (external) surveys with URL prefill: the auto-submitted response now includes caller-provided event properties (extra URL query params), and a later manual submit no longer clears the prefilled answer from the partial-response merge.
  (2026-07-31)

v1.409.2

Compare Source

1.409.2

Patch Changes

• #​4340 4b8867c Thanks @​marandaneto! - Avoid redacting session replay network bodies when timestamps or UUID fragments resemble social security or credit card numbers.
  (2026-07-31)
• Updated dependencies [4b8867c]:
  • @​posthog/browser-common@​0.3.1

v1.409.1

Compare Source

1.409.1

Patch Changes

• #​4301 4b36c44 Thanks @​dustinbyrne! - Add the browser-v1 client adapter for shared extensions, including analytics, request, persistence, replayed remote-config outcomes, and synchronous best-effort cleanup.
  (2026-07-31)
• Updated dependencies [6b48a59]:
  • @​posthog/browser-common@​0.3.0

v1.409.0

Compare Source

1.409.0

Minor Changes

• #​4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read.
  (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

v1.408.3

Compare Source

1.408.3

Patch Changes

• #​4327 232b06a Thanks @​github-actions! - Refresh campaign parameters after SPA URL changes.
  (2026-07-30)

• #​4328 95a3d02 Thanks @​marandaneto! - Fix identify() creating a person profile when the supplied ID already matches an anonymously persisted distinct ID.
  (2026-07-30)

v1.408.2

Compare Source

1.408.2

Patch Changes

• #​4325 3bd8a2d Thanks @​marandaneto! - Fix dead-click false positives on WebKit when the SDK uses an iframe-sourced MutationObserver fallback.
  (2026-07-30)
• Updated dependencies [3bd8a2d]:
  • @​posthog/browser-common@​0.2.5
  • @​posthog/core@​1.45.3

v1.408.1

Compare Source

1.408.1

Patch Changes

• #​4226 3b02a78 Thanks @​ksvat! - The replayer can now yield to the event loop while fast-forwarding to a seek target, via the new opt-in seekYieldBudgetMs player config. Seeking in a long, event-dense recording rebuilds the target frame by re-applying every event since the last full snapshot in one uninterrupted main-thread pass, which can block the page for many seconds and trigger the browser's "Page Unresponsive" dialog; when a yield budget is set, the rebuild runs in time-budgeted chunks instead, and a newer seek cancels any rebuild still in flight so rapid scrubbing only pays for the last seek. A superseded rebuild also resets the machine's lastPlayedEvent so the next seek performs a full rebuild rather than trusting a partially-applied history. The default (0) keeps the previous fully-synchronous behavior.
  (2026-07-30)

v1.408.0

Compare Source

1.408.0

Minor Changes

• #​4270 92427a1 Thanks @​turnipdabeets! - Add canvas mask regions to session replay canvas capture: session_recording.canvasCapture.maskRegionsFn is called once per canvas per captured frame, and the returned regions (CSS pixels, relative to the canvas) are painted black in the captured frame before it is encoded — letting apps that render into canvas (e.g. Flutter web via CanvasKit) mask content that DOM-based masking cannot see.

  The return value decides what happens to that canvas's frame:

  • [] — nothing to mask; the frame is recorded as is.
  • null — regions could not be computed; the frame is skipped rather than recorded unmasked.
  • maskRegionsFn not set — canvases are recorded unmasked and canvas capture behavior is unchanged.

  Configuring maskRegionsFn also disables canvas pixel serialization in DOM full snapshots (rr_dataURL) — that path never sees the mask regions, so skipping it closes the route that could otherwise embed unmasked canvas stills in a snapshot; the canvas repaints from the masked frame stream instead. Every canvas the provider answers — with regions or [] — re-sends an unchanged frame as a keyframe every 30s, so after a full snapshot or a seek an idle canvas repaints within at most 30s.

  An app whose real provider only exists once its runtime has booted chooses what happens in between by what it declares in posthog.init: a function covering the whole canvas blacks those frames out, () => null skips them, and declaring nothing records them. Client-side only, cannot be set via remote configuration. (2026-07-29)

Patch Changes

• Updated dependencies [92427a1]:
  • @​posthog/types@​1.399.0

v1.407.8

Compare Source

1.407.8

Patch Changes

• #​4311 c1818e2 Thanks @​marandaneto! - fix(react): restore CommonJS default import interop in UMD bundles

  React hooks used without a PostHogProvider now receive the default PostHog instance again when the UMD build is loaded through CommonJS. (2026-07-29)

v1.407.7

Compare Source

1.407.7

Patch Changes

• #​4304 c7099e9 Thanks @​lucasheriques! - fix(surveys): only wait for feature flags on surveys that repeat

  Surveys stopped being shown while feature flags were still loading, even when a cached
  enabled value for their internal targeting flag was already available. Popover and widget
  surveys recovered on the next evaluation, but a survey your own code renders (type api)
  is evaluated once, so it was dropped for that page load and never reappeared.

  That wait is only needed for surveys that repeat, where stored per-survey state is keyed by
  iteration and cannot be relied on to record that someone already answered. Other surveys
  keep one stable key that already prevents a repeat display, so they are now evaluated
  against the cached flag right away. (2026-07-29)

• Updated dependencies [c7099e9]:

  • @​posthog/core@​1.45.2

v1.407.6

Compare Source

1.407.6

Patch Changes

• #​4305 b4250a7 Thanks @​marandaneto! - Fix extension bundles when used with the slim no-external browser build.
  (2026-07-29)

v1.407.5

Compare Source

1.407.5

Patch Changes

• #​4278 a19ba65 Thanks @​marandaneto! - Fix paused replay seeks at an exact full snapshot timestamp so the snapshot frame is rebuilt before playback pauses.
  (2026-07-28)

v1.407.4

Compare Source

1.407.4

Patch Changes

• #​4290 a08c226 Thanks @​marandaneto! - Send session recording request timestamps in request bodies instead of query strings.
  (2026-07-28)

v1.407.3

Compare Source

1.407.3

Patch Changes

• #​4214 f7399a0 Thanks @​felipeatom! - Fix canRenderSurvey / canRenderSurveyAsync reporting a survey as renderable before its event/action activation trigger has fired. Surveys gated on a "User sends events" filter are now only eligible once the trigger event is received.
  (2026-07-27)

• #​4231 eabe2ef Thanks @​marandaneto! - Send analytics request timestamps in capture bodies while retaining query timestamps for session recordings.
  (2026-07-27)

• #​4102 fa4844b Thanks @​marandaneto! - Send SDK library identity in feature flag person properties instead of URL query parameters.
  (2026-07-27)

• #​4220 11330b3 Thanks @​SegFaultZero! - fix(replay): prevent server timings from dropped ingestion requests causing an endless capture loop
  (2026-07-27)

• Updated dependencies [7210789]:

  • @​posthog/browser-common@​0.2.2

v1.407.2

Compare Source

1.407.2

Patch Changes

• #​4224 ba7042b Thanks @​turnipdabeets! - Fix session replay recordings being unplayable after the session rotated in a tab with no user interaction. When a session expired and rotated (for example in a long-lived background tab), a recorder that had not yet seen user interaction kept attributing snapshots — including full snapshots — to the previous session, so the new session never received a playable full snapshot. The recorder now restarts on rotation in this state, re-syncs its session id from the session manager if they ever diverge, and flushes its buffer on the normal cadence before the first user interaction instead of holding data until the next rotation or page unload.
  (2026-07-23)

v1.407.1

Compare Source

1.407.1

Patch Changes

• #​4218 33f0bd7 Thanks @​marandaneto! - Send ISO feature flag timestamps in request bodies, use numeric sent_at query timestamps for capture POSTs, and preserve _ cache busting for dynamic GET requests.
  (2026-07-23)

v1.407.0

Compare Source

1.407.0

Minor Changes

• #​4222 0f2407b Thanks @​turnipdabeets! - feat: add a default-value option to isFeatureEnabled

  isFeatureEnabled(key, { defaultValue: false }) now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to boolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without defaultValue, behavior is unchanged: boolean | undefined. (2026-07-22)

Patch Changes

• #​4203 90e7483 Thanks @​posthog! - fix(conversations): let users start a new conversation while a ticket is still open

  The support widget now surfaces the ticket list navigation (and its "New conversation"
  button) whenever the user has any ticket, instead of only when they have multiple tickets
  or a single resolved one. Previously a user sitting on one open, unresolved ticket was
  locked into that conversation with no way to raise a second issue. (2026-07-22)

• #​4221 da6e082 Thanks @​posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable

  The wrapped window.onerror, window.onunhandledrejection, and console.error handlers
  chained to the page's original handler using optional chaining, which only guards against
  null/undefined. When a page had one of these set to a truthy non-callable value (e.g.
  via Object.defineProperty, or clobbered by another script/extension), our wrapper threw a
  TypeError from inside its own handler. We now check the original handler is actually
  callable before invoking it and fall back to false otherwise. (2026-07-22)

• #​4209 569fc62 Thanks @​posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation from the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous original.set.call(this, value) still ran with a non-native this (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native this is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and getInputType are similarly guarded against reading native accessors on a non-native this.
  (2026-07-22)

• #​4068 d5e1188 Thanks @​posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.
  (2026-07-22)

• #​4205 de3ad61 Thanks @​posthog! - Warn when session recording masking options in posthog.init shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.
  (2026-07-22)

• Updated dependencies [0f2407b]:

  • @​posthog/core@​1.45.0
  • @​posthog/types@​1.398.0

v1.406.2

Compare Source

1.406.2

Patch Changes

• #​4206 a3112d9 Thanks @​posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag

  Recurring surveys could re-display and record a duplicate response when the eligibility
  check ran against a cached internal targeting flag before fresh flags had loaded. The
  display loop now waits for feature flags to actually load before trusting the internal
  targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
  promptly. (2026-07-21)

v1.406.1

Compare Source

1.406.1

Patch Changes

• #​4127 220fa2c Thanks @​sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts
  (2026-07-21)

v1.406.0

Compare Source

1.406.0

Minor Changes

• #​4194 d39b903 Thanks @​dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js.
  (2026-07-21)

Patch Changes

• #​4204 ba977d0 Thanks @​turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.
  (2026-07-21)
• Updated dependencies [d39b903]:
  • @​posthog/browser-common@​0.2.0

v1.405.3

Compare Source

1.405.3

Patch Changes

• #​4200 91505ba Thanks @​pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches
  (2026-07-21)

v1.405.2

Compare Source

1.405.2

Patch Changes

• #​4198 fbfc84f Thanks @​pauldambra! - feat: make the pending session recording trigger buffer interval configurable
  (2026-07-20)
• Updated dependencies [fbfc84f]:
  • @​posthog/types@​1.397.1

v1.405.1

Compare Source

1.405.1

Patch Changes

• #​4193 dec8fe7 Thanks @​turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.
  (2026-07-20)

v1.405.0

Compare Source

1.405.0

Minor Changes

• #​4172 9621830 Thanks @​haacked! - send minimal $feature_flag_called events when the server enables it

  When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

• Updated dependencies [9621830]:
  • @​posthog/core@​1.44.0

v1.404.1

Compare Source

1.404.1

Patch Changes

• #​4191 66c1666 Thanks @​turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.
  (2026-07-17)

v1.404.0

Compare Source

1.404.0

Minor Changes

• #​4149 607bf54 Thanks @​pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility cha

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@​1.392.0 ⏵ 1.413.3	-51

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Telemetry collection: npm posthog-js Note: The file package/dist/array.full.no-external.js implements client-side telemetry instrumentation for session replay, DOM/form capture, fetch/XHR request/response data (including potential body capture), console/error handling, and browser storage persistence, with upstream transmission of structured snapshots and optional UI surveys. Misconfiguration or permissive data collection could enable excessive data capture or data leakage, and survey content may introduce XSS risk if not properly sanitized. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The file package/dist/all-external-dependencies.js implements invasive client-side telemetry instrumentation that patches fetch/XHR, potentially captures request/response headers and bodies, wraps console/error handlers, and records DOM/performance data and survey responses, transmitting telemetry to configured endpoints. It may render UI via innerHTML and persist data in localStorage, creating privacy and data-exfiltration risks and potential XSS if upstream content is not sanitized; review configuration for recordBody/recordHeaders, consent controls, and the actual transport endpoints to determine data scope. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: A PostHog browser analytics/telemetry SDK that can dynamically load and execute externally sourced scripts for remote configuration and experimentation, collecting extensive user, session, and environment data. This creates supply-chain, runtime integrity, and privacy risks due to remote payloads and broad telemetry, with additional risk from configurable hooks (before_send) that can leak data and a UUID fallback to Math.random when crypto RNG is unavailable. Mitigations include CSP, SRI, trusted hosting, version pinning, allowlists, data minimization, and monitoring of loaded assets. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The rrweb session-recording library instruments browser activity (DOM, console, network requests, and related payloads) and can capture sensitive data depending on configuration. It forwards recorded data to an emit destination or host pipeline, creating privacy and data-harvesting risks rather than showing signs of active malware. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The rrweb session-recording library instruments browser activity (DOM, console, network requests, and related payloads) and can capture sensitive data depending on configuration. It forwards recorded data to an emit destination or host pipeline, creating privacy and data-harvesting risks rather than showing signs of active malware. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: A client-side session-recording library (rrweb/PostHog recorder) that intercepts and records sensitive browser data, including DOM content, inputs, and potentially network headers and bodies when enabled, and transmits data to an analytics backend. It presents privacy risks and possible PII leakage if masking and controls are misconfigured; security review should enforce conservative defaults (recordHeaders/recordBody off) and robust masking and deny/allow configurations. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: Both alerts describe a module that loads external JavaScript at runtime by injecting script tags whose source is derived from application-provided values. This enables arbitrary code execution if the remote assets, URL construction, or caller hooks are compromised or untrusted, representing a supply-chain/integration threat. The root cause is untrusted remote code execution via dynamic script loading, mitigated by strict URL allowlisting, trustworthy token handling, and restricting who can modify the script-loading behavior. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm posthog-js Note: The package/dist/main.js file embeds a client-side analytics/telemetry SDK (similar to the PostHog web analytics/session-replay SDK) that collects browser/DOM signals and transmits data to remote endpoints. It supports optional dynamic loading of extensions and DOM-based web experiments, which introduces privacy concerns, supply-chain/exfiltration risk, and potential XSS risks if remote experiment payloads are not strictly controlled; it is not evidence of overt malware but requires strict CSP, sanitization, auditing of loading paths, and tight remote-config controls. From: package.json → npm/posthog-js@1.413.3 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.413.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report