Skip to content

chore(deps): update dependency posthog-js to v1.386.6#3960

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/posthog-js-1.x-lockfile
Open

chore(deps): update dependency posthog-js to v1.386.6#3960
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/posthog-js-1.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
posthog-js (source) 1.374.3 → 1.386.6 age confidence

Release Notes

PostHog/posthog-js (posthog-js)

v1.386.6

Compare Source

1.386.6

Patch Changes

  • #​3804 a27b163 Thanks @​pauldambra! - fix(product-tours): drop the cached tours blob when product tours is not enabled

    Tours fetched while product tours was enabled are cached under ph_product_tours in the main persistence blob. Once product tours is disabled (remote config or the disable_product_tours option) that cache was never cleaned up, so a potentially large stale blob kept riding on every persistence write — and on every cross-tab storage event those writes broadcast. onRemoteConfig now clears the cached tours whenever product tours resolves to disabled; they are re-fetched if it is ever re-enabled. (2026-06-11)

v1.386.5

Compare Source

1.386.5

Patch Changes
  • #​3801 bd06ac7 Thanks @​ksvat! - fix(replay): prevent silent recorder teardown on session-id rotation. When the session id rotates during active rrweb capture, _updateWindowAndSessionIds calls stop() then synchronously start('session_id_changed'). If stop() took the _stopAfterCompressionQueueDrains path (which fires whenever the compression queue is non-empty — common during steady recording), its async cleanup would later resolve and call _teardown() against the freshly-started recorder, stopping rrweb, removing event listeners, and emptying the V2 trigger-group matchers. From that point on, the recorder's status getter kept reporting active/sampled (the _strategy reference was still set), but rrweb was no longer producing events, no listeners were registered, and no $snapshot data reached the server — the session looked recording-eligible from event metadata yet produced no replay. start() now invalidates the compression-queue state (generation bump plus reset of the stop-in-progress flag and queued-event count), so any pending cleanup from a prior stop() bails at its existing generation check and a later stop() of the new recorder is not mistaken for the old in-progress one. Affects long-running tabs that rotate session id mid-use (idle timeout, session-past-max-length, or posthog.reset()).
    (2026-06-11)

v1.386.4

Compare Source

1.386.4

Patch Changes
  • #​3767 fdc07f3 Thanks @​arnohillen! - replay: jump scrolls instantly when seeking past pages that use scroll-behavior: smooth. During fast-forward the replayer applied scrolls with behavior: 'auto', which inherits the page's CSS scroll-behavior — so on sites that set scroll-behavior: smooth (e.g. Silk bottom sheets/modals) a seeked scroll animated from 0 instead of jumping, leaving scroll-revealed content (the open sheet) out of view and showing only the backdrop until the animation caught up. Sync scrolls now use behavior: 'instant', matching the method's stated intent that smooth scrolling be disabled while fast-forwarding. Full snapshot rebuilds apply their initial offset with behavior: 'instant' too, so the document-level scroll doesn't animate either.
    (2026-06-11)

v1.386.3

Compare Source

1.386.3

Patch Changes

  • #​3760 5ddfd44 Thanks @​benben! - fix(conversations): re-attach the support widget after SPA navigations that replace document.body (e.g. Turbo Drive), so the widget no longer disappears until a full page reload
    (2026-06-11)

  • #​3690 dbf2377 Thanks @​pauldambra! - fix(sessionid): keep the session id stable across tabs

    A session now rotates only when every tab has been idle past the timeout, rather than whenever a single background tab decides it is idle. On the active event path an idle tab re-reads the session id from storage before rotating: if a sibling tab kept the session alive it does not rotate, and if a sibling already rotated it adopts that id instead of minting a new one. This removes spurious cross-tab session fragmentation (inflated session counts, truncated session durations, split replays). When a sibling session is adopted, onSessionId handlers fire with changeReason.crossTabAdoption: true so session recording, pageview state, and session-scoped properties follow the new session. When persistence_save_debounce_ms > 0 (the 2026-05-30 default) the refresh reads only the session-id key so it cannot clobber a sibling's write.

    Note: projects with significant multi-tab usage will see fewer but longer sessions after upgrading — this is a correction of previously over-counted sessions, not a traffic change. (2026-06-11)

  • #​3795 21441a8 Thanks @​pauldambra! - fix(persistence): stop per-request metadata rewriting the split-storage entries on every load

    $feature_flag_evaluated_at, $feature_flag_request_id, and $surveys_loaded_at change on every /flags (or /surveys) load even when the flag and survey content is unchanged. With split_storage enabled that made the multi-hundred-KB __flags / __surveys localStorage entries dirty on every SPA navigation, re-broadcasting the full payload to every open same-origin tab via cross-tab storage events — the exact pressure the split exists to remove. These keys are now marked volatile: a value-only change neither dirties the group nor alters its fingerprint, so the write is skipped and the freshest value rides along on the next real content write. Adding or deleting a volatile key still writes through (presence is fingerprinted, the moving value is not), and the in-memory value is always current — only the on-disk copy may lag until the next content change. (2026-06-11)

  • Updated dependencies [dbf2377]:

v1.386.2

Compare Source

1.386.2

Patch Changes

v1.386.1

Compare Source

v1.386.0

Compare Source

1.386.0

Minor Changes

  • #​3634 612f97a Thanks @​lucasheriques! - feat(surveys): add opt-in appearance.allowGoBack for multi-question surveys, and make button labels translatable

    Renders a "Back" button on web surveys after the first question. Default is off — existing surveys are unchanged. Uses a visited-index history stack so back-navigation respects branching paths (response_based, specific_question), and abandoned-branch responses are pruned before submission so analytics aren't polluted. Returning to a question pre-fills the prior answer. appearance.backButtonText overrides the default label. The button uses the survey's text color so it stays readable on any background, and it also shows in survey previews.

    Also adds submitButtonText and backButtonText to survey-level translations, so both the submit and back button labels can be localized via appearance translations (previously only the per-question button text was translatable). (2026-06-10)

Patch Changes

v1.385.0

Compare Source

1.385.0

Minor Changes
  • #​3777 f601c49 Thanks @​dustinbyrne! - Promote external dependency script versioning to supported strict_script_versioning and asset_host config options.
    (2026-06-10)
Patch Changes

v1.384.3

Compare Source

1.384.3

Patch Changes

v1.384.2

Compare Source

1.384.2

Patch Changes

v1.384.1

Compare Source

1.384.1
Patch Changes
  • #​3787 0e22d77 Thanks @​TueHaulund! - replayer: stop corrupting recordings when events are added behind the playhead. addEvent() used to apply any event older than the playback baseline synchronously onto the current DOM — correct for live-mode catch-up, but wrong for on-demand playback where snapshot chunks can finish loading after the user has seeked ahead. Applying those past mutations onto a DOM at a different position made their removes fail mirror lookups, and applyMutation then deleted the failed entries from the event objects themselves, so every later seek rebuilt from corrupted data (DOM nodes accumulating, e.g. duplicated text) and exports serialized the stripped events. Past events are now only applied synchronously in live mode (otherwise they are just inserted for the next seek to pick up), and applyMutation filters removes into a local copy instead of mutating the event data.
    (2026-06-10)
  • Updated dependencies []:

v1.384.0

Compare Source

v1.383.3

Compare Source

1.383.3

Patch Changes

v1.383.2

Compare Source

1.383.2

Patch Changes

v1.383.1

Compare Source

1.383.1

Patch Changes

v1.383.0

Compare Source

1.383.0

Minor Changes

  • #​3771 227c9b0 Thanks @​dustinbyrne! - feat(persistence): add split_storage config option to store the feature-flag config cluster in its own localStorage entry (<name>__flags) instead of the single main persistence blob. This payload is large and changes rarely, so keeping it out of the main blob stops it riding on every high-frequency main-blob write and broadcasting on cross-tab storage events. Reads are unchanged: on load the entry is merged back into the in-memory props, and the old main-blob location is read once and migrated forward so upgrades never miss a cached flag. The split only applies when persistence resolves to localStorage / localStorage+cookie (it is pointless for memory / sessionStorage and impossible for cookie), and reset() / opt-out wipe every entry. Defaults to false for backwards compatibility; the new 2026-05-30 config default opts in automatically.
    (2026-06-08)

  • #​3727 393f9e2 Thanks @​pauldambra! - feat(surveys): extend split_storage to also move the survey config ($surveys) out of the main persistence blob into its own <name>__surveys localStorage entry, on top of the feature-flag split. Surveys now stamp a $surveys_loaded_at freshness timestamp on every /surveys load — the survey analogue of $feature_flag_evaluated_at — so a stale __surveys entry can no longer win over a fresher survey payload written back into the main blob by a gate-off / older-SDK tab. With no timestamp on either side (migration leftover) the group entry still wins, so the migration path is unchanged. Same backend and reset() / opt-out semantics as the flag split.
    (2026-06-08)

Patch Changes

v1.382.0

Compare Source

1.382.0

Minor Changes

  • #​3749 9877710 Thanks @​pauldambra! - Stop classifying intentional repeated clicks as rageclicks. From the 2026-05-30 config defaults, rageclick detection now ignores:

    • text-editing surfaces (textarea, text-like inputs, and contenteditable elements), where rapid clicks are double/triple-click text selection rather than rage (rageclick.ignore_text_selection)
    • +/- stepper buttons, added to the default content_ignorelist

    Symbol-only keywords in content_ignorelist (e.g. +, -, >, <) now match the element's text exactly instead of as a substring, so labels like sign-up, 5 > 3, or C++ are no longer treated as repeatedly-clicked controls. The heatmaps rageclick marker now applies the same suppression as the $rageclick event.

    A partial rageclick config object is now merged with the date-gated defaults instead of replacing them, so e.g. rageclick: { threshold_px: 50 } keeps the default content_ignorelist / ignore_text_selection. Pass an explicit value (e.g. content_ignorelist: false) to override a specific default, or a boolean to opt out entirely.

    Behaviour change for existing content_ignorelist: true users (available since 2025-11-30): the default list already includes > and <. After this release, buttons whose text contains > or < but is not exactly that symbol (e.g. Learn more >, < Back, home > settings) will no longer be suppressed. Bare > and < buttons remain suppressed. This is the intended fix, but if you rely on the old substring behaviour for those keywords, replace content_ignorelist: true with an explicit array listing the exact terms you want to suppress. (2026-06-06)

Patch Changes

v1.381.0

Compare Source

1.381.0

Minor Changes
  • #​3719 a7bd828 Thanks @​lricoy! - Add __preview_cookie_wins_on_conflict opt-in config to prefer cookie values over localStorage when merging persistence state in localStorage+cookie mode, fixing cross-subdomain identify and session disconnects.
    (2026-06-05)
Patch Changes

v1.380.1

Compare Source

1.380.1
Patch Changes
  • #​3743 ced0039 Thanks @​robbie-c! - fix(surveys): stop the survey CSS from using :has(.survey-question:empty), which crashes some WebKit builds during text-node style invalidation while a survey renders. The empty-header margin tweak now keys off a JS-set question-header--empty class and a sibling selector instead.
    (2026-06-05)
  • Updated dependencies []:

v1.380.0

Compare Source

1.380.0

Minor Changes
  • #​3715 2387084 Thanks @​dustinbyrne! - Promote browser tracing header configuration to the public tracing_headers option while keeping addTracingHeaders and __add_tracing_headers as deprecated aliases.
    (2026-06-04)
Patch Changes

v1.379.3

Compare Source

1.379.3

Patch Changes
  • #​3741 32de5d2 Thanks @​clr182! - logs: the console-log integration now respects opt_out_capturing() — it checks is_capturing() before emitting, so log events stop on opt-out (and resume on opt-in).
    (2026-06-04)
  • Updated dependencies []:

v1.379.2

Compare Source

1.379.2

Patch Changes
  • #​3736 374962a Thanks @​arnohillen! - replay: re-apply scroll positions after fast-forward/seek. Scrolls applied mid-catch-up could clamp to 0 when the target wasn't scrollable yet (e.g. scroll-revealed sheets/modals whose content sits below the fold), leaving the content scrolled out of view on replay. The last scroll per node is now re-applied in the flush stage once layout has settled. posthog-js is bumped too so the rebuilt bundle containing the fix is published.
    (2026-06-03)
  • Updated dependencies []:

v1.379.1

Compare Source

1.379.1

Patch Changes

  • #​3570 4a27ced Thanks @​gruessi! - fix(record): release iframe documents and observers on iframe removal — same-origin iframes mounted and unmounted while session recording is active no longer leak their Document, every node serialized into the mirror, or one MutationObserver per mount. Closes eight retainer chains: load-listener disposers, named pagehide handlers, the recordCrossOriginIframes cleanup gate (now applied to same-origin too), captured Document / Window sets that survive iframe.src swap-to-about:blank before removal, and the global mutationBuffers[] / handlers[] arrays which previously accumulated forever. Validated end-to-end: a host page that mounts/unmounts 5 blob-URL iframes every 2s for 110s went from +118 MB / +390 leaked HTMLDocuments to ~0 MB / 0.
    (2026-06-03)

  • #​3717 1688b38 Thanks @​turnipdabeets! - Move the OpenTelemetry logs dependencies to devDependencies. They are only used to build the CDN-served logs extension chunk, which inlines them, so consumers no longer install the transitive protobufjs (whose eval("require") tripped unsafe-eval Content Security Policies).

    If you imported @opentelemetry/* directly while relying on it being hoisted from posthog-js, add it to your own dependencies. (2026-06-03)

  • Updated dependencies []:

v1.379.0

Compare Source

1.379.0

Minor Changes
Patch Changes

v1.378.1

Compare Source

1.378.1

Patch Changes

v1.378.0

Compare Source

1.378.0

Minor Changes
  • #​3688 8181354 Thanks @​pauldambra! - feat(persistence): add persistence_save_debounce_ms config option to coalesce rapid storage saves into a single write. Setting a positive value debounces writes to localStorage/cookie by that window; the in-memory props object still updates synchronously so within-tab reads see the latest values immediately, and pending writes flush on beforeunload and pagehide so no state is lost on tab close. Cross-tab storage events are reduced proportionally to the debounce window. Defaults to 0 (no debouncing) for backwards compatibility. On pages that capture many events per second, 250 is a reasonable starting point. The new 2026-05-30 config default opts into persistence_save_debounce_ms: 250 automatically.
    (2026-06-01)
Patch Changes

v1.377.0

Compare Source

1.377.0

Minor Changes

  • #​3708 3d4a76f Thanks @​pauldambra! - Detect Brave (desktop, Android, iOS), Vivaldi, Yandex, Naver Whale, DuckDuckGo, Pale Moon, and Waterfox so users on these browsers no longer get bucketed as Chrome or Firefox.

    detectBrowser / detectBrowserVersion now accept an optional third argument, BrowserDetectionHints, with a brave flag (set when navigator.brave exists). The browser SDK populates this automatically to catch desktop / Android Brave, which is Chromium-based and carries no UA marker. Brave on iOS is picked up purely from the Brave/ UA marker — WebKit doesn't ship navigator.brave. The original two-argument signature still works for non-DOM callers. (2026-06-01)

Patch Changes

v1.376.6

Compare Source

1.376.6

Patch Changes
  • #​3687 663e250 Thanks @​pauldambra! - fix(persistence): skip the storage write when the serialized props are unchanged. Callers spam save() after every property change, and many of those changes leave the serialized payload identical (e.g. resetting a value to its current value). Writing identical bytes to localStorage still fires a cross-tab storage event in every same-origin tab, where Chrome allocates the payload buffer in mojo IPC even though no listener reacts. Now save() compares the serialized payload against the last successful write and bails out when nothing changed.
    (2026-05-31)
  • Updated dependencies []:

v1.376.5

Compare Source

1.376.5

Patch Changes
  • #​3686 66cbc59 Thanks @​pauldambra! - fix(persistence): throttle session-activity timestamp writes to a 5s granularity. The in-memory value still moves at full resolution; only writes to localStorage/cookie are coalesced. Activity-timestamp-only updates within the granularity window are skipped, dropping localStorage write pressure and cross-tab storage event broadcasts on pages that capture many events per second. The pending in-memory value is flushed on destroy and beforeunload so a tab close inside the window does not leave the persisted value up to 5s stale for sibling tabs. The flush re-reads storage first and bails out if a sibling tab has rotated the session, so the flush cannot clobber the new session with the old id/start.
    (2026-05-31)
  • Updated dependencies [d9ad199]:

v1.376.4

Compare Source

1.376.4

Patch Changes

  • #​3685 f59f35a Thanks @​ioannisj! - fix(cookieless): enable request queue when opting out in on_reject mode. When using cookieless_mode: "on_reject", calling opt_out_capturing() correctly switched the SDK into cookieless capturing but never enabled the RequestQueue — so batched events were enqueued but never flushed over the network. At init time the queue was not started because consent was PENDING and is_capturing() returned false; opt_out_capturing() is the first moment capturing becomes active but was missing the _start_queue_if_opted_in() call that opt_in_capturing() already had.
    (2026-05-28)

  • #​3692 f01cd93 Thanks @​ksvat! - fix(replay): take a fresh full snapshot after session ID rotates via forcedIdleReset. Previously, when the session manager's idle enforcement timer rotated the session id, the recorder tore down rrweb and set _isIdle = 'unknown' before the new session id was observed. Neither restart path then fired (the _onSessionIdCallback guard only restarted when _isIdle === true, and _updateWindowAndSessionIds could not run with rrweb stopped), so the new session received only incremental mutations until a later snapshot — leaving the player stuck on "Buffering". The restart guard now also fires when rrweb isn't running.
    (2026-05-28)

  • #​3691 cc71f3f Thanks @​ksvat! - fix(replay): ship ph-no-capture absolute-position fix from #​3678 to posthog-js. The original changeset only bumped @posthog/rrweb and @posthog/rrweb-snapshot; because posthog-js depends on @posthog/rrweb via workspace:*, the cascade did not bump posthog-js, so the rebuilt bundle containing the fix was not published. This changeset re-publishes posthog-js with the fix.
    (2026-05-28)

  • #​3695 e1ff722 Thanks @​ksvat! - chore(replay): expose $sdk_debug_rrweb_attached and $sdk_debug_rrweb_start_attempted debug properties on captured events. Today the SDK already stamps several $sdk_debug_* properties (start reason, linked-flag trigger status, recording status) that report the SDK's intent to record — they all flip to "active" as soon as the state machine evaluates the configured triggers. None of them observe whether rrweb actually attached and is producing events. The new booleans close that gap: $sdk_debug_rrweb_start_attempted is set when _startRecorder() is first entered, and $sdk_debug_rrweb_attached reflects whether _stopRrweb is currently a non-falsy stop handle (i.e. rrwebRecord({...}) returned successfully and the recorder has not been torn down). No behavior change — this only adds two booleans to the existing sdkDebugProperties channel, used to diagnose cases where a session reports trigger_activated / recording_status: active but no $snapshot data is ever uploaded.
    (2026-05-28)

  • Updated dependencies [7b84b75]:

v1.376.3

Compare Source

1.376.3

Patch Changes

v1.376.2

Compare Source

1.376.2

Patch Changes
  • #​3667 cafa9cc Thanks @​pauldambra! - fix(replay): stop polling preload-as-style <link> elements forever. Session recorder treated <link rel="preload" as="style" href="*.css"> as if it were a stylesheet and waited for link.sheet to populate. Per spec preload links never instantiate a CSSStyleSheet, so the wait timed out, re-serialized the link, scheduled another wait, and leaked a load listener on every cycle — multiplying further on every real load event. Pages with Next.js-style CSS preloads accumulated thousands of active polling chains, saturating the main thread and freezing the tab on refocus
    (2026-05-26)
  • Updated dependencies []:

v1.376.1

Compare Source

1.376.1
Patch Changes

v1.376.0

Compare Source

1.376.0

Minor Changes
  • #​3655 6e8d349 Thanks @​arnaudhillen! - Expose the in-repo @posthog/rrweb, @posthog/rrweb-types, and @posthog/rrweb-plugin-console-record packages as subpath entry points on posthog-js. Consumers can now import { Replayer } from 'posthog-js/rrweb', import type { eventWithTime } from 'posthog-js/rrweb-types', and import { LogLevel } from 'posthog-js/rrweb-plugin-console-record' instead of installing the underlying rrweb packages directly. The rrweb worker sourcemap (image-bitmap-data-url-worker-*.js.map) is also shipped from posthog-js/dist/ so downstream bundlers no longer need to reach into node_modules/@&#8203;posthog/rrweb.
    (2026-05-22)
Patch Changes

v1.375.0

Compare Source

1.375.0

Minor Changes
  • #​3641 2e1d5f4 Thanks @​dustinbyrne! - Add flag_keys config to restrict browser feature flag remote evaluation to specific flag keys.
    (2026-05-21)
Patch Changes

v1.374.4

Compare Source

1.374.4

Patch Changes

  • #​3638 87e2145 Thanks @​marandaneto! - Apply tracing headers to matching XMLHttpRequest requests
    (2026-05-21)

  • #​3646 4f87827 Thanks @​marandaneto! - Avoid throwing or initializing PostHogProvider when no API key or client is provided
    (2026-05-21)

  • #​3645 280832b Thanks @​TueHaulund! - Capture <link rel="stylesheet"> URLs from link.sheet.href and try link.sheet directly for inlining, so recordings survive SPA history.pushState navigations between routes of different path depths (where link.href re-resolves against a new baseURI but link.sheet.href preserves the URL the browser actually fetched).

    Ships the fix landed in #​3635, which only bumped the internal @posthog/rrweb-snapshot package — that package is bundled into posthog-js at build time but is not published to npm on its own, so a posthog-js bump is needed to actually deliver the change. (2026-05-21)

  • Updated dependencies []:

Configuration

📅 Schedule: (in timezone US/Eastern)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch 3 times, most recently from 8fb4c4e to 2be9a31 Compare June 15, 2026 15:03
@renovate renovate Bot force-pushed the renovate/posthog-js-1.x-lockfile branch from 2be9a31 to 221d93f Compare June 15, 2026 17:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants