Skip to content

chore(deps): update dependency posthog-js to v1.376.4#142

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/posthog-js-1.x-lockfile
Closed

chore(deps): update dependency posthog-js to v1.376.4#142
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/posthog-js-1.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
posthog-js (source) 1.369.21.376.4 age confidence

Release Notes

PostHog/posthog-js (posthog-js)

v1.376.4

Compare Source

1.376.4

Patch Changes
  • #​3685 f59f35a Thanks @​ioannisj! - fix(cookieless): enable request queue when opting out in on_reject mode. When using cookieless_mode: "on_reject", calling opt_out_capturing() correctly switched the SDK into cookieless capturing but never enabled the RequestQueue — so batched events were enqueued but never flushed over the network. At init time the queue was not started because consent was PENDING and is_capturing() returned false; opt_out_capturing() is the first moment capturing becomes active but was missing the _start_queue_if_opted_in() call that opt_in_capturing() already had.
    (2026-05-28)

  • #​3692 f01cd93 Thanks @​ksvat! - fix(replay): take a fresh full snapshot after session ID rotates via forcedIdleReset. Previously, when the session manager's idle enforcement timer rotated the session id, the recorder tore down rrweb and set _isIdle = 'unknown' before the new session id was observed. Neither restart path then fired (the _onSessionIdCallback guard only restarted when _isIdle === true, and _updateWindowAndSessionIds could not run with rrweb stopped), so the new session received only incremental mutations until a later snapshot — leaving the player stuck on "Buffering". The restart guard now also fires when rrweb isn't running.
    (2026-05-28)

  • #​3691 cc71f3f Thanks @​ksvat! - fix(replay): ship ph-no-capture absolute-position fix from #​3678 to posthog-js. The original changeset only bumped @posthog/rrweb and @posthog/rrweb-snapshot; because posthog-js depends on @posthog/rrweb via workspace:*, the cascade did not bump posthog-js, so the rebuilt bundle containing the fix was not published. This changeset re-publishes posthog-js with the fix.
    (2026-05-28)

  • #​3695 e1ff722 Thanks @​ksvat! - chore(replay): expose $sdk_debug_rrweb_attached and $sdk_debug_rrweb_start_attempted debug properties on captured events. Today the SDK already stamps several $sdk_debug_* properties (start reason, linked-flag trigger status, recording status) that report the SDK's intent to record — they all flip to "active" as soon as the state machine evaluates the configured triggers. None of them observe whether rrweb actually attached and is producing events. The new booleans close that gap: $sdk_debug_rrweb_start_attempted is set when _startRecorder() is first entered, and $sdk_debug_rrweb_attached reflects whether _stopRrweb is currently a non-falsy stop handle (i.e. rrwebRecord({...}) returned successfully and the recorder has not been torn down). No behavior change — this only adds two booleans to the existing sdkDebugProperties channel, used to diagnose cases where a session reports trigger_activated / recording_status: active but no $snapshot data is ever uploaded.
    (2026-05-28)

  • Updated dependencies [7b84b75]:

v1.376.3

Compare Source

1.376.3

Patch Changes

v1.376.2

Compare Source

1.376.2

Patch Changes
  • #​3667 cafa9cc Thanks @​pauldambra! - fix(replay): stop polling preload-as-style <link> elements forever. Session recorder treated <link rel="preload" as="style" href="*.css"> as if it were a stylesheet and waited for link.sheet to populate. Per spec preload links never instantiate a CSSStyleSheet, so the wait timed out, re-serialized the link, scheduled another wait, and leaked a load listener on every cycle — multiplying further on every real load event. Pages with Next.js-style CSS preloads accumulated thousands of active polling chains, saturating the main thread and freezing the tab on refocus
    (2026-05-26)
  • Updated dependencies []:

v1.376.1

Compare Source

1.376.1

Patch Changes

v1.376.0

Compare Source

1.376.0

Minor Changes
  • #​3655 6e8d349 Thanks @​arnaudhillen! - Expose the in-repo @posthog/rrweb, @posthog/rrweb-types, and @posthog/rrweb-plugin-console-record packages as subpath entry points on posthog-js. Consumers can now import { Replayer } from 'posthog-js/rrweb', import type { eventWithTime } from 'posthog-js/rrweb-types', and import { LogLevel } from 'posthog-js/rrweb-plugin-console-record' instead of installing the underlying rrweb packages directly. The rrweb worker sourcemap (image-bitmap-data-url-worker-*.js.map) is also shipped from posthog-js/dist/ so downstream bundlers no longer need to reach into node_modules/@&#8203;posthog/rrweb.
    (2026-05-22)
Patch Changes

v1.375.0

Compare Source

1.375.0

Minor Changes
  • #​3641 2e1d5f4 Thanks @​dustinbyrne! - Add flag_keys config to restrict browser feature flag remote evaluation to specific flag keys.
    (2026-05-21)
Patch Changes

v1.374.4

Compare Source

1.374.4

Patch Changes
  • #​3638 87e2145 Thanks @​marandaneto! - Apply tracing headers to matching XMLHttpRequest requests
    (2026-05-21)

  • #​3646 4f87827 Thanks @​marandaneto! - Avoid throwing or initializing PostHogProvider when no API key or client is provided
    (2026-05-21)

  • #​3645 280832b Thanks @​TueHaulund! - Capture <link rel="stylesheet"> URLs from link.sheet.href and try link.sheet directly for inlining, so recordings survive SPA history.pushState navigations between routes of different path depths (where link.href re-resolves against a new baseURI but link.sheet.href preserves the URL the browser actually fetched).

    Ships the fix landed in #​3635, which only bumped the internal @posthog/rrweb-snapshot package — that package is bundled into posthog-js at build time but is not published to npm on its own, so a posthog-js bump is needed to actually deliver the change. (2026-05-21)

  • Updated dependencies []:

v1.374.3

Compare Source

1.374.3

Patch Changes

v1.374.2

Compare Source

1.374.2

Patch Changes
  • #​3550 df91995 Thanks @​TueHaulund! - Preserve session-recording remote config across posthog.reset().

    posthog.reset() was clearing the entire persistence store, which wiped
    $session_recording_remote_config along with user state. On the next session
    rotation triggered by the reset, start('session_id_changed') would early-return
    because the remote config was missing — leaving rrweb torn down and the new
    session opening with no Meta + FullSnapshot until the next periodic 5-minute
    checkout.

    This affected any flow where an app calls posthog.reset() mid-session
    (e.g. on sign-out / sign-in) and was particularly visible on Flutter Web
    recordings that depend on a fresh FullSnapshot to anchor the CanvasKit DOM. (2026-05-18)

  • Updated dependencies []:

v1.374.1

Compare Source

1.374.1

Patch Changes

v1.374.0

Compare Source

1.374.0

Minor Changes
  • #​3620 594ea11 Thanks @​pauldambra! - Dead clicks: add a .ph-no-deadclick CSS class (and capture_dead_clicks.css_selector_ignorelist config option) to exclude specific elements from dead-click detection without affecting autocapture, session replay, or heatmaps. Mirrors the existing .ph-no-rageclick pattern.
    (2026-05-18)
Patch Changes
  • #​3621 3c0a09f Thanks @​pauldambra! - Dead clicks: a click on an <a> (or any element inside an <a>, including across shadow DOM) is no longer flagged as a dead click — the browser navigates / downloads / opens a new window and we can't observe that. Reuses autocapture's existing DOM walker for the ancestor walk. Direct clicks on <button>, <input>, <select>, <textarea>, <label>, and <form> (previously all skipped) are now eligible for dead-click detection: if their JS handler ran, the existing mutation / scroll / selection observers see the effect; if it didn't, dead-click correctly surfaces the bug. A broken <button> with no handler, or an <svg> icon inside one, will now flag — which is exactly the dead-click case we want to catch.
    (2026-05-18)
  • Updated dependencies [594ea11]:

v1.373.5

Compare Source

1.373.5

Patch Changes
  • #​3613 221973e Thanks @​lucasheriques! - Surveys: submit open text questions with Cmd/Ctrl+Enter. The textarea still inserts a newline on plain Enter (native behaviour), matching the convention used by Slack, GitHub, Discord, and ChatGPT for multi-line inputs. Single-line "Other:" inputs continue to submit on plain Enter as before.
    (2026-05-15)
  • Updated dependencies []:

v1.373.4

Compare Source

1.373.4

Patch Changes

v1.373.3

Compare Source

1.373.3

Patch Changes

v1.373.2

Compare Source

1.373.2

Patch Changes

v1.373.1

Compare Source

1.373.1

Patch Changes

v1.373.0

Compare Source

1.373.0

Minor Changes
Patch Changes

v1.372.10

Compare Source

1.372.10

Patch Changes
  • #​3544 d120042 Thanks @​ksvat! - fix: stop session recording before destroying sessionManager in opt_out_capturing() with cookieless_mode: "on_reject". Previously, queued/throttled rrweb events (e.g. mousemove) could fire after the sessionManager was set to undefined and throw [SessionRecording] must be started with a valid sessionManager. Also adds a defensive early-return in onRRwebEmit so any remaining late events bail out instead of throwing.
    (2026-05-07)

  • #​3542 94a5ba0 Thanks @​TueHaulund! - Preserve <style> textContent when the browser's CSSOM serialization would
    emit empty longhands from var() inside a shorthand. When a stylesheet has
    e.g. padding: var(--p); padding-bottom: var(--pb);, browsers store the
    shorthand's longhands with empty token lists per the CSS Custom Properties
    spec, and CSSStyleRule.cssText re-emits them as padding-top: ; padding-right: ; padding-left: ;. The previous behavior replaced the
    <style> text with that corrupted output, silently dropping layout rules
    on replay. We now detect the empty-longhand pattern and keep the original
    textContent in that case. Affects users of any CSS-in-JS framework that
    combines var() with shorthands (Chakra UI v3, Panda CSS, Emotion, etc.).
    Same class of bug as rrweb-io/rrweb#1667. (2026-05-07)

  • Updated dependencies []:

v1.372.9

Compare Source

1.372.9
Patch Changes
  • #​3537 026e09d Thanks @​TueHaulund! - Pull in the canvas-manager fix from @posthog/rrweb 0.0.61: skip canvas
    snapshots while the WebGL context is lost so transparent bitmaps don't
    poison the worker's fingerprint dedup map and silently kill canvas
    recording for the rest of the session. Also wraps getCanvas() in
    try/catch so DOM/shadow-root traversal errors can't cancel the rAF
    loop. See PR #​3527 for context. (2026-05-05)
  • Updated dependencies []:

v1.372.8

Compare Source

1.372.8
Patch Changes

v1.372.7

Compare Source

1.372.7
Patch Changes

v1.372.6

Compare Source

1.372.6
Patch Changes

v1.372.5

Compare Source

1.372.5

Patch Changes

v1.372.4

Compare Source

1.372.4

Patch Changes

v1.372.3

Compare Source

1.372.3
Patch Changes

v1.372.2

Compare Source

1.372.2
Patch Changes

v1.372.1

Compare Source

1.372.1

Patch Changes

v1.372.0

Compare Source

1.372.0

Minor Changes
Patch Changes

v1.371.4

Compare Source

1.371.4

Patch Changes

v1.371.3

Compare Source

1.371.3

Patch Changes

v1.371.2

Compare Source

1.371.2

Patch Changes
  • #​3453 96f19b7 Thanks @​turnipdabeets! - Lift OTLP log serialization helpers from posthog-js into @​posthog/core so the
    upcoming React Native logs feature consumes the same builders. Browser gains
    two fixes as a side effect: NaN and ±Infinity attribute values no longer get
    silently dropped during JSON encoding, and the scope.version OTLP field is
    now populated with the SDK version (changes the server's instrumentation_scope
    column from "posthog-js@" to "posthog-js@"). (2026-04-23)
  • Updated dependencies [96f19b7]:

v1.371.1

Compare Source

1.371.1

Patch Changes
  • #​3425 2da17e8 Thanks @​marandaneto! - Classify SDK-owned persistence keys with an explicit event exposure policy so new internal persistence state must be intentionally marked as event-visible, hidden, or derived.
    (2026-04-23)
  • Updated dependencies []:

v1.371.0

Compare Source

1.371.0

Patch Changes
  • #​3432 1a8b727 Thanks @​richardsolomou! - refactor: rename __add_tracing_headers to addTracingHeaders. The __ prefix signalled an internal/experimental option, but the config is a public API (documented for linking LLM traces to session replays). __add_tracing_headers continues to work as a deprecated alias on the browser SDK.

    Also exposes patchFetchForTracingHeaders from @posthog/core so non-browser SDKs can reuse the implementation. (2026-04-23)

  • Updated dependencies [1a8b727]:

v1.370.1

Compare Source

1.370.1

Patch Changes

v1.370.0

Compare Source

1.370.0

Minor Changes
Patch Changes

v1.369.5

Compare Source

1.369.5

Patch Changes

v1.369.4

Compare Source

1.369.4

Patch Changes

v1.369.3

Compare Source

1.369.3

Patch Changes

Configuration

📅 Schedule: (in timezone America/Sao_Paulo)

  • Branch creation
    • "on thursday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from vitingr as a code owner May 14, 2026 08:46
@vercel

vercel Bot commented May 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frontend Ready Ready Preview, Comment May 29, 2026 1:30am

@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.373.4 chore(deps): update dependency posthog-js to v1.373.5 May 15, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 6622195 to 4c1db0c Compare May 15, 2026 17:39
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.373.5 chore(deps): update dependency posthog-js to v1.374.0 May 18, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 4c1db0c to c48bcd6 Compare May 18, 2026 10:01
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.374.0 chore(deps): update dependency posthog-js to v1.374.2 May 19, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from c48bcd6 to 10f2dc3 Compare May 19, 2026 00:13
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.374.2 chore(deps): update dependency posthog-js to v1.374.3 May 20, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 10f2dc3 to ac40cfa Compare May 20, 2026 14:07
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from ac40cfa to f3138fe Compare May 21, 2026 15:49
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.374.3 chore(deps): update dependency posthog-js to v1.374.4 May 21, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from f3138fe to bd1960e Compare May 21, 2026 18:00
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.374.4 chore(deps): update dependency posthog-js to v1.375.0 May 21, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from bd1960e to 4852a95 Compare May 22, 2026 14:50
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.375.0 chore(deps): update dependency posthog-js to v1.376.0 May 22, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 4852a95 to 917ec9c Compare May 26, 2026 12:29
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.376.0 chore(deps): update dependency posthog-js to v1.376.1 May 26, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 917ec9c to 4065b96 Compare May 26, 2026 23:06
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.376.1 chore(deps): update dependency posthog-js to v1.376.2 May 26, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 4065b96 to 8981f23 Compare May 27, 2026 17:49
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.376.2 chore(deps): update dependency posthog-js to v1.376.3 May 27, 2026
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 8981f23 to 6506926 Compare May 28, 2026 15:50
@renovate
renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 6506926 to 604589e Compare May 29, 2026 01:28
@renovate renovate Bot changed the title chore(deps): update dependency posthog-js to v1.376.3 chore(deps): update dependency posthog-js to v1.376.4 May 29, 2026
@vitingr vitingr closed this May 30, 2026
@renovate

renovate Bot commented May 30, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^1.281.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/posthog-js-1.x-lockfile branch May 30, 2026 13:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant