[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
posthog-js	1.435.6	1.438.21
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
sharp	0.35.4	0.35.5
postcss	8.5.28	8.5.31
prettier	3.9.9	3.9.10

Updates posthog-js from 1.435.6 to 1.438.21

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.21

1.438.21

Patch Changes

• #5346 f91145d Thanks @​sebxt! - Reject a prefilled survey rating of 0 on rating scales that start at 1. (2026-10-23)

• #5399 02616e1 Thanks @​ARXHHHH! - Ship the IE11 Math.trunc and Number.isInteger polyfills only in array.full.es5.js, so the modern bundles no longer trigger Lighthouse's "Legacy JavaScript" audit. (2026-10-23)

• Updated dependencies [f827137, f91145d, 02616e1]:

  • @​posthog/core@​1.60.1
  • @​posthog/browser-common@​0.9.11

posthog-js@1.438.20

1.438.20

Patch Changes

• #5292 d73e6c7 Thanks @​sarmah-rup! - Read query params with form-encoding rules: an encoded plus (%2B) is kept as + instead of becoming a space, and values that contain = are no longer cut off. This fixes UTM, click ID and search keyword properties such as utm_term=c%2B%2B. (2026-10-23)
• Updated dependencies [d73e6c7]:
  • @​posthog/browser-common@​0.9.10

posthog-js@1.438.19

1.438.19

Patch Changes

• #4994 bcd33ce Thanks @​dustinbyrne! - Share autocapture across browser SDKs while preserving existing event capture behavior. (2026-10-22)
• Updated dependencies [bcd33ce]:
  • @​posthog/browser-common@​0.9.9

posthog-js@1.438.18

1.438.18

Patch Changes

• #5189 2aacdcb Thanks @​posthog! - Log why capture() dropped an event (capturing disabled or a bot user agent) when debug: true is set (2026-10-22)

• #5383 0faf643 Thanks @​sarankumar1325! - Conversations: the widget now comes back after reset(), and after a cookieless (on_reject) visitor calls opt_in_capturing(), instead of staying unavailable until the next page load. (2026-10-22)

posthog-js@1.438.17

1.438.17

Patch Changes

... (truncated)

Commits

• a0b18d4 chore: update versions and lockfile [version bump]
• f827137 fix(flags): fall back for incompatible local regex matching (#5354)
• faacff0 fix(aio): keep content out of ai events in privacy mode (#5385)
• 02616e1 fix(browser): ship uuidv7 polyfills only in the es5 bundle (#5399)
• d778694 fix(examples): use gpt-image-2.5-flare in the OpenAI image generation example...
• c481b82 ci(release): name excluded approvers in the Slack approval request (#5379)
• 997d4ff feat(react-native): attach $recording_status and $sdk_debug_* to captured eve...
• f91145d fix(surveys): reject a prefilled rating of 0 on scales that start at 1 (#5346)
• e291b87 chore: update versions and lockfile [version bump]
• 13c21ae docs: require signed commits in contributor docs (#5394)
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view