chore(deps): update dependency posthog-js to v1.407.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.374.4 → 1.407.0

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.407.0

Compare Source

1.407.0

Minor Changes

• #​4222 0f2407b Thanks @​turnipdabeets! - feat: add a default-value option to isFeatureEnabled

  isFeatureEnabled(key, { defaultValue: false }) now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to boolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without defaultValue, behavior is unchanged: boolean | undefined. (2026-07-22)

Patch Changes

• #​4203 90e7483 Thanks @​posthog! - fix(conversations): let users start a new conversation while a ticket is still open

  The support widget now surfaces the ticket list navigation (and its "New conversation"
  button) whenever the user has any ticket, instead of only when they have multiple tickets
  or a single resolved one. Previously a user sitting on one open, unresolved ticket was
  locked into that conversation with no way to raise a second issue. (2026-07-22)

• #​4221 da6e082 Thanks @​posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable

  The wrapped window.onerror, window.onunhandledrejection, and console.error handlers
  chained to the page's original handler using optional chaining, which only guards against
  null/undefined. When a page had one of these set to a truthy non-callable value (e.g.
  via Object.defineProperty, or clobbered by another script/extension), our wrapper threw a
  TypeError from inside its own handler. We now check the original handler is actually
  callable before invoking it and fall back to false otherwise. (2026-07-22)

• #​4209 569fc62 Thanks @​posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation from the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous original.set.call(this, value) still ran with a non-native this (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native this is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and getInputType are similarly guarded against reading native accessors on a non-native this.
  (2026-07-22)

• #​4068 d5e1188 Thanks @​posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.
  (2026-07-22)

• #​4205 de3ad61 Thanks @​posthog! - Warn when session recording masking options in posthog.init shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.
  (2026-07-22)

• Updated dependencies [0f2407b]:

  • @​posthog/core@​1.45.0
  • @​posthog/types@​1.398.0

v1.406.2

Compare Source

1.406.2

Patch Changes

• #​4206 a3112d9 Thanks @​posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag

  Recurring surveys could re-display and record a duplicate response when the eligibility
  check ran against a cached internal targeting flag before fresh flags had loaded. The
  display loop now waits for feature flags to actually load before trusting the internal
  targeting flag, and forces a flag reload after a survey is completed so the flag recomputes
  promptly. (2026-07-21)

v1.406.1

Compare Source

1.406.1

Patch Changes

• #​4127 220fa2c Thanks @​sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts
  (2026-07-21)

v1.406.0

Compare Source

1.406.0

Minor Changes

• #​4194 d39b903 Thanks @​dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js.
  (2026-07-21)

Patch Changes

• #​4204 ba977d0 Thanks @​turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field.
  (2026-07-21)
• Updated dependencies [d39b903]:
  • @​posthog/browser-common@​0.2.0

v1.405.3

Compare Source

1.405.3

Patch Changes

• #​4200 91505ba Thanks @​pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches
  (2026-07-21)

v1.405.2

Compare Source

1.405.2

Patch Changes

• #​4198 fbfc84f Thanks @​pauldambra! - feat: make the pending session recording trigger buffer interval configurable
  (2026-07-20)
• Updated dependencies [fbfc84f]:
  • @​posthog/types@​1.397.1

v1.405.1

Compare Source

1.405.1

Patch Changes

• #​4193 dec8fe7 Thanks @​turnipdabeets! - Internal restructuring of remote config failure handling across SDK extensions; no behavior change.
  (2026-07-20)

v1.405.0

Compare Source

1.405.0

Minor Changes

• #​4172 9621830 Thanks @​haacked! - send minimal $feature_flag_called events when the server enables it

  When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

• Updated dependencies [9621830]:
  • @​posthog/core@​1.44.0

v1.404.1

Compare Source

1.404.1

Patch Changes

• #​4191 66c1666 Thanks @​turnipdabeets! - Honour the project-level autocapture opt-out when the remote config request fails. Previously a failed config fetch (network error, timeout, blocked request) enabled autocapture on opted-out projects and persisted that state for later page loads. Autocapture now keeps the last successfully received server value, and stays off until the first successful config response.
  (2026-07-17)

v1.404.0

Compare Source

1.404.0

Minor Changes

• #​4149 607bf54 Thanks @​pauldambra! - Add dead swipe detection to dead clicks autocapture. When dead clicks autocapture is enabled, touch swipe gestures that produce no observable screen change (no scroll, mutation, selection or visibility change) are now captured as $dead_swipe events, surfacing failed navigations on touch devices. Configurable via capture_dead_swipes (default true) and swipe_threshold_px (default 30) on the capture_dead_clicks config. Swipes over surfaces whose response cannot be observed (canvas, video and other media elements under the finger) are skipped, and captures are limited per page load via max_dead_swipes_per_page_load (default 10).
  (2026-07-16)

Patch Changes

• #​4171 df17ddc Thanks @​posthog! - Catch synchronous throws from a monkey-patched window.fetch so they no longer escape as unhandled exceptions. A synchronous throw is now routed through the same handling as an async rejection, so the request queue retries instead of the error leaking into error tracking.
  (2026-07-16)
• Updated dependencies [607bf54]:
  • @​posthog/types@​1.397.0

v1.403.0

Compare Source

1.403.0

Minor Changes

• #​4159 fad6d9a Thanks @​haacked! - add $feature_flag_has_experiment to $feature_flag_called events

  $feature_flag_called events now carry a $feature_flag_has_experiment boolean sourced from the server's has_experiment flag metadata (the /flags?v=2 response for remote evaluation, the /api/feature_flag/local_evaluation definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports has_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)

Patch Changes

• Updated dependencies [fad6d9a]:
  • @​posthog/core@​1.43.0
  • @​posthog/types@​1.396.0

v1.402.3

Compare Source

1.402.3

Patch Changes

• #​4157 4a2ecf5 Thanks @​posthog! - Session recording no longer emits an uncaught NotAllowedError ("Sharing constructed stylesheets in multiple documents is not allowed") when a page assigns a CSSStyleSheet constructed in a different document to adoptedStyleSheets. That assignment is the host page's own invalid operation, but the recorder's patched setter sat on the call stack, so the exception was attributed to rrweb and churned fingerprints in error tracking. The recorder now contains this specific rejection (matched by its standardized NotAllowedError name, so it works even when the setter throws from an iframe realm) and skips recording those sheets, while still re-throwing any other native-setter error so host-page behaviour is preserved.
  (2026-07-15)

• #​4158 0dc389e Thanks @​posthog! - fix(replay): session recording no longer throws TypeError: Converting circular structure to JSON when replay event data contains a circular reference. The circular-reference guard now also detects cycles that pass through an array, and affected events are captured with [Circular] markers instead of surfacing an unhandled error and being dropped.
  (2026-07-15)

• Updated dependencies [fc2cb2e]:

  • @​posthog/core@​1.42.1

v1.402.2

Compare Source

1.402.2

Patch Changes

• #​4151 81adbfd Thanks @​posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation when a programmatic input-value change happens on an object that is not a genuine native input element (for example a proxy on the element prototype chain). The recorder drops that one replay update instead of throwing.
  (2026-07-15)

v1.402.1

Compare Source

1.402.1

Patch Changes

• #​4117 1eddff7 Thanks @​DanielVisca! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alpha

  Backend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup:

  const client = new PostHog('phc_...', { metrics: { serviceName: 'billing-worker' } })
  client.metrics.count('invoices.processed', 1, { attributes: { plan: 'pro' } })
  client.metrics.gauge('queue.depth', 42)
  client.metrics.histogram('job.duration', 187, { unit: 'ms' })

  Samples aggregate in memory and flush as OTLP/JSON to /i/v1/metrics (one data point per series per window). Pending metrics are flushed on shutdown(). Core gains _sendMetricsBatch on PostHogCoreStateless (same outcome contract as _sendLogsBatch) and a shared resolveMetricsConfig, so any core-based SDK can host PostHogMetrics. (2026-07-15)

• Updated dependencies [1eddff7]:

  • @​posthog/core@​1.42.0

v1.402.0

Compare Source

1.402.0

Minor Changes

• #​4143 0e8ad14 Thanks @​robbie-c! - Stamp the current hostname as $snapshot_host on every $snapshot event the session recorder sends. The value is derived from the page URL after it passes through the existing replay URL masking pipeline (maskCapturedNetworkRequestFn / deprecated maskNetworkRequestFn, hash stripping, personal-data query-param masking), so it cannot bypass a customer's masking config. When masking removes the URL or the masked result doesn't parse as a URL, the property is omitted entirely. This gives ingestion consumers a per-message host signal even for mid-session snapshot batches that contain no URL-bearing events.
  (2026-07-15)

v1.401.0

Compare Source

1.401.0

Minor Changes

• #​4129 800af7c Thanks @​pauldambra! - feat: add session_recording.attributeFilter option that passes an attribute allowlist through to the native MutationObserver, so mutations to unlisted attributes (e.g. animation-driven inline style churn) never cost recording CPU (port of upstream rrweb #​1873)
  (2026-07-15)

Patch Changes

• Updated dependencies [800af7c]:
  • @​posthog/types@​1.395.0

v1.400.1

Compare Source

1.400.1

Patch Changes

• #​4090 6dd8827 Thanks @​lucasheriques! - chore: survey seen-key and repeat-activation helpers now live in @​posthog/core, shared by the web and React Native SDKs. Core's survey enums are now const-object literal unions (matching the web SDK's existing pattern), so the same values type-check across both SDKs. No behavior change. Type-level note: enum members no longer work as standalone type annotations (e.g. SurveyType.Popover as a type); use the exported union types instead. Runtime values are unchanged.
  (2026-07-14)
• Updated dependencies [6dd8827]:
  • @​posthog/core@​1.41.1

v1.400.0

Compare Source

1.400.0

Minor Changes

• #​4101 dc2aa5b Thanks @​posthog! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now reads exceptionRateLimiterRefillRate / exceptionRateLimiterBucketSize on error_tracking, with the previous double-underscore __exceptionRateLimiterRefillRate / __exceptionRateLimiterBucketSize options deprecated but still honoured as a fallback. The option shape (ExceptionRateLimiterConfig) and default-resolution logic (resolveExceptionRateLimiterConfig) now live in @posthog/core and are shared between the browser and Node SDKs.
  (2026-07-14)

Patch Changes

• #​4140 1eabd30 Thanks @​turnipdabeets! - Handle sendBeacon quota rejections instead of silently dropping events. A beacon rejected by the browser (over the page's shared ~64KiB in-flight keepalive quota) is now split in half and re-sent recursively so the batch delivers as far as the quota allows; a rejected payload that cannot be split falls back to a non-keepalive fetch and logs a warning. Previously the boolean return of sendBeacon was ignored and an over-quota unload batch was lost with no signal.
  (2026-07-14)
• Updated dependencies [dc2aa5b]:
  • @​posthog/core@​1.41.0
  • @​posthog/types@​1.394.0

v1.399.5

Compare Source

1.399.5

Patch Changes

• #​4134 ab10064 Thanks @​posthog! - Bound autocapture's DOM ancestor walks against abnormal host-page DOM trees. autocapturePropertiesForElement and shouldCaptureElement now stop climbing the parentNode chain after 1000 ancestors or if they revisit a node (only possible when a page patches parentNode, since native DOMs cannot contain cycles), instead of walking indefinitely. When shouldCaptureElement cannot finish checking ancestors for ph-no-capture/ph-sensitive, it fails closed and reports the element as not capturable. Behavior on normal DOM trees is unchanged.
  (2026-07-14)

• #​4141 17d956c Thanks @​posthog! - Log network-level fetch failures from posthog-js's own request layer (ad blocker, dropped connection, CORS, page teardown) at warn instead of error. The browser rejects these with a generic TypeError (Failed to fetch, Firefox's NetworkError..., or Safari's Load failed); they are already caught and retried by the request queue, so they are expected noise rather than SDK errors — _fetch now gives them the same warn treatment as our own timeout aborts. Genuine, unexpected errors still log at error.
  (2026-07-14)

v1.399.4

Compare Source

1.399.4

Patch Changes

• #​4139 7c339be Thanks @​turnipdabeets! - Encode uncompressed sendBeacon bodies as base64 form data so the beacon keeps a CORS-simple content type. Previously an uncompressed unload beacon was sent as application/json, which forces a CORS preflight — a preflight cannot complete while the page unloads, so on cross-origin hosts the browser silently dropped the POST and the final batch of events was lost. Compression is inactive whenever the remote config request fails (flaky network, blocked endpoint), when the config response omits supportedCompression, or with disable_compression: true.
  (2026-07-13)

v1.399.3

Compare Source

1.399.3

Patch Changes

• #​4133 4ebb618 Thanks @​mikenicholls88! - Make jsonStringify circular-safe so event serialization never throws. Previously a captured property holding a circular value — most commonly a DOM node that retains a React fiber pointing back at the element — made JSON.stringify throw Converting circular structure to JSON; with capture_exceptions enabled that throw was recaptured as a new $exception, at times in a loop. On a throw we now fall back to safeJsonStringify from @posthog/core. The fast (non-circular) path is unchanged, and only true cycles become "[Circular]", so shared-but-acyclic references keep their real values.
  (2026-07-13)

v1.399.2

Compare Source

1.399.2

Patch Changes

• #​4118 f630394 Thanks @​posthog! - Fix a RangeError: Maximum call stack size exceeded originating from the shared rrweb patch() helper. It patches shared globals such as Element.prototype.attachShadow (shadow-dom-manager) and the DOM/canvas observers, so multiple recorder instances or repeated start/stop cycles wrap the same global more than once. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated cycles grew the wrapper chain without bound until a real call walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable per-layer link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Recording behavior is unchanged. This applies the same fix as #​4063 (fetch/XHR) to the shared helper so every rrweb-record caller inherits the bounded-chain behavior.
  (2026-07-10)

v1.399.1

Compare Source

v1.399.0

Compare Source

1.399.0

Minor Changes

• #​4115 86bb3a5 Thanks @​DanielVisca! - add the posthog.metrics API (count, gauge, histogram) — alpha

  A statsd-style pre-aggregating metrics client for the PostHog Metrics product (alpha). Samples are folded into per-series aggregates in memory (counts sum, gauges keep the last value, histograms accumulate buckets) and flushed periodically as OTLP/JSON to /i/v1/metrics — one data point per series per flush window, no matter how many calls. No OpenTelemetry SDK setup required:

  posthog.metrics.count('orders_created', 1)
  posthog.metrics.gauge('active_connections', 42)
  posthog.metrics.histogram('api_latency', 187, { unit: 'ms' })

  Configure via metrics: { serviceName, environment, flushIntervalMs, maxSeriesPerFlush, beforeSend, ... }. (2026-07-08)

Patch Changes

• Updated dependencies [86bb3a5]:
  • @​posthog/core@​1.40.0
  • @​posthog/types@​1.393.0

v1.398.7

Compare Source

1.398.7

Patch Changes

• #​4113 45f17ee Thanks @​TueHaulund! - fix session replay leaking a shadow-root observer when a same-origin iframe is removed

  Follow-up to the shadow-observer iframe-teardown fix: takeFullSnapshot's onSerialize registers every shadow root with the top-level document, so a root nested in a same-origin iframe was keyed to the wrong document and its observer/buffer were not disconnected when that iframe was removed (they lingered until the next full snapshot). addShadowRoot now derives the owning document from the host element, so per-document teardown matches iframe-nested roots too. (2026-07-08)

v1.398.6

Compare Source

1.398.6

Patch Changes

• #​4114 c75c0ba Thanks @​hpouillot! - fix: avoid throwing when rrweb recorder cleanup cannot remove a listener
  (2026-07-08)

v1.398.5

Compare Source

1.398.5

Patch Changes

• #​4103 be8242a Thanks @​rafaeelaudibert! - Publish the code-split ESM toolbar bundle when the build emits one. The release tooling now recursively includes dist/toolbar/ (with explicit JS content types for the strict-MIME ESM chunks) across the immutable, major-alias, and compatibility upload prefixes, and the workflow accepts the canonical toolbar.js/toolbar.css layout. This is a no-op against today's single-file build.
  (2026-07-08)

v1.398.4

Compare Source

v1.398.3

Compare Source

1.398.3

Patch Changes

• #​4112 38bb185 Thanks @​TueHaulund! - fix session replay silently dropping shadow DOM mutations after an iframe teardown

  The single shared ShadowDomManager observes every shadow root on the page, but MutationBuffer.reset() disconnected it. That reset fires whenever any one buffer is torn down, so an iframe being removed or navigating away disconnected every shadow-root observer page-wide. Shadow DOM content (for example a widget mounted in an open shadow root) then stopped recording until the next periodic full snapshot re-registered it. Buffer teardown now releases only its own resources; global shadow observation is reset by takeFullSnapshot and on recording stop. (2026-07-08)

v1.398.2

Compare Source

1.398.2

Patch Changes

• #​4063 24aadd5 Thanks @​posthog! - Fix a RangeError: Maximum call stack size exceeded that could originate from the shared patch() fetch/XHR wrapper. posthog-js wraps window.fetch in two independent places (tracing headers and session-recording network capture), so their restores routinely ran out of order. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated start/stop cycles grew the wrapper chain without bound until a real fetch walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Header-injection and network-capture behavior is unchanged.
  (2026-07-07)

• #​4100 e250a24 Thanks @​marandaneto! - Stop adding the gzip compression query parameter to browser SDK requests.
  (2026-07-07)

• #​4083 f07e241 Thanks @​posthog! - fix(replay): harden session-replay network capture so instrumentation that throws (e.g. new Request() rejecting a URL/method) degrades gracefully and never breaks or misattributes the host application's own xhr.open() / fetch() calls
  (2026-07-07)

v1.398.1

Compare Source

1.398.1

Patch Changes

• #​4096 5013ab6 Thanks @​marandaneto! - Stop sending the deprecated ver query parameter to capture and session recording endpoints.
  (2026-07-07)

v1.398.0

Compare Source

v1.397.0

Compare Source

1.397.0

Minor Changes

• #​4089 cc340db Thanks @​bs1180! - feat(web): add a posthog-js/customizations subpath entry point exposing the optional customizations (setAllPersonProfilePropertiesAsPersonPropertiesForFlags, the before-send sampling helpers, and the redux/kea loggers) as a proper ES module with bundled types, replacing the internal posthog-js/lib/src/customizations deep import. Also fixes the TypeScript definitions so setAllPersonProfilePropertiesAsPersonPropertiesForFlags accepts the instance passed to the loaded callback (the documented usage), and the loaded callback's instance type now includes config.
  (2026-07-06)

v1.396.9

Compare Source

v1.396.8

Compare Source

1.396.8

Patch Changes

• #​4062 2af0026 Thanks @​posthog! - fix(web): prevent an infinite-recursion stack overflow in the logs console capture. The console wrapper's own capture path can emit internal debug lines through PostHog's logger, which wrote back to the wrapped console and re-entered capture until the stack blew (RangeError: Maximum call stack size exceeded). The wrapper now exposes the original console method via __rrweb_original__ (so the internal logger bypasses it) and guards against re-entrancy from any code that logs mid-capture.
  (2026-07-06)

v1.396.7

Compare Source

v1.396.6

Compare Source

1.396.6

Patch Changes

• #​4053 45d1b36 Thanks @​posthog! - feat(web): add a graceful shutdown() to the browser client for parity with posthog-node, so isomorphic teardown code (e.g. the Nuxt module) that calls posthog.shutdown() on the client no longer throws TypeError: shutdown is not a function. It best-effort flushes the queued events and always resolves.
  (2026-07-03)

• #​4054 f0657eb Thanks @​posthog! - fix(web): detect our own feature-flag request timeouts via a timedOut flag instead of the abort reason, so they are logged at warn (not error) on browsers that don't propagate controller.abort(reason) — keeping benign timeouts out of error tracking's console-error capture
  (2026-07-03)

• #​4031 94a0530 Thanks @​posthog! - Improve survey display reliability:

  • posthog-js: refresh the cached $surveys definitions after a short TTL (stale-while-revalidate) so server-side changes such as switching a survey from popover to API propagate to long-lived tabs without a page reload.
  • posthog-js: add posthog.surveys.markSurveyAsSeen(surveyId, { iteration }) so custom integrators that render surveys through their own backend can honour the "already seen" and wait-period checks.
  • posthog-react-native: guarantee the survey Modal notifies its parent on close even when iOS Modal.onDismiss fails to fire, so the transparent full-screen modal can no longer stay mounted intercepting touches and freezing the app. (2026-07-03)

• Updated dependencies [45d1b36]:

  • @​posthog/types@​1.392.1

v1.396.5

Compare Source

1.396.5

Patch Changes

• #​4050 d7cf13b Thanks @​turnipdabeets! - Prevent uncaught getComputedStyle crashes in heatmaps and autocapture when the event target is a cross-realm element (e.g. from an iframe or synthetic event)
  (2026-07-02)
• Updated dependencies [5e7e132]:
  • @​posthog/core@​1.39.5

v1.396.4

Compare Source

1.396.4

Patch Changes

• #​4035 18e543b Thanks @​posthog! - fix(web): isolate onFeatureFlags callbacks so a throwing user handler no longer breaks the remaining callback chain or gets misattributed as an SDK error
  (2026-07-01)

• #​4039 15bcb42 Thanks @​github-actions! - fix(replay): measure $snapshot_bytes as UTF-8 byte length instead of UTF-16 string length, so non-ASCII session replay payloads are counted accurately against the message size limit
  (2026-07-01)

v1.396.3

Compare Source

1.396.3

Patch Changes

• #​4020 e0ad8ef Thanks @​posthog! - Fix TypeError: ....at is not a function thrown by the bundled web-vitals dependency on browsers that predate Array.prototype.at() (Chrome <92, iOS Safari <15.4). The web-vitals entrypoints now install a tiny Array.prototype.at polyfill before web-vitals runs, so web vitals capture works again on older browsers instead of crashing with an unhandled error.
  (2026-06-30)

v1.396.2

Compare Source

1.396.2

Patch Changes

• #​4003 b6261e7 Thanks @​marandaneto! - Include a Promise polyfill in the IE11 bundle and avoid Promise-dependent async compression paths when Promise support is unavailable.
  (2026-06-29)

v1.396.1

Compare Source

1.396.1

Patch Changes

• #​3999 cdeae17 Thanks @​marandaneto! - Fall back to uncompressed browser requests when gzip encoding fails.
  (2026-06-29)

v1.396.0

Compare Source

1.396.0

Minor Changes

• #​3987 74cc6bb Thanks @​TueHaulund! - Add a get_current_url config option that overrides the URL used for client-side URL targeting — session replay URL triggers, the session replay URL blocklist, survey URL display conditions, product tour URL conditions, web experiment URL conditions, and autocapture URL allow/ignore lists. These match against window.location.href directly, which does not reflect a $current_url rewritten in before_send. Apps where the browser URL is not meaningful for targeting (e.g. Electron/desktop builds served from a generated host) can now return the logical URL to match against. Defaults to window.location.href when not set.
  (2026-06-29)

Patch Changes

• Updated dependencies [74cc6bb]:
  • @​posthog/types@​1.392.0

v1.395.0

Compare Source

1.395.0

Minor Changes

• #​3977 6200888 Thanks @​turnipdabeets! - Add getAllFeatureFlags(), which returns all currently loaded feature flags as structured FeatureFlagResults (key, enabled, variant, payload). It is a synchronous read of the cached flags and does not send a $feature_flag_called event.
  (2026-06-26)

Patch Changes

• Updated dependencies [6200888]:
  • @​posthog/core@​1.38.0

v1.394.0

Compare Source

1.394.0

Minor Changes

• #​3986 919abca Thanks @​ioannisj! - Capture the $device_model super-property on Android Chromium via navigator.userAgentData.getHighEntropyValues(['model']). Resolved once during init and sent on subsequent events; opt out with disableDeviceModel: true.
  (2026-06-26)

v1.393.6

Compare Source

1.393.6

Patch Changes

• #​3965 6ef9179 Thanks @​marandaneto! - Handle request serialization errors without throwing or blocking queued requests.
  (2026-06-26)

v1.393.5

Compare Source

1.393.5

Patch Changes

• #​3960 619d318 Thanks @​marandaneto! - Improve console log capture performance for truncated large objects.
  (2026-06-25)

v1.393.4

Compare Source

1.393.4

Patch Changes

• #​3942 c9c8925 Thanks @​hpouillot! - Fix browser console log capture when session activity timestamps are missing and refresh session attributes for each log.
  (2026-06-24)
• Updated dependencies [c9c8925]:
  • @​posthog/core@​1.37.2

v1.393.3

Compare Source

1.393.3

Patch Changes

• #​3945 f94deaf Thanks @​ioannisj! - fix(surveys): guard handlePageUnload against version-skewed surveys instance missing the method
  (2026-06-24)

[v1.393.2](https://redirect.git

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	be26dc4	Commit Preview URL Branch Preview URL	Jul 22 2026, 07:58 PM