Bump the posthog group with 3 updates

[dependabot]

Bumps the posthog group with 3 updates: posthog-js, @posthog/core and @posthog/types.

Updates posthog-js from 1.417.1 to 1.418.10

Release notes

Sourced from posthog-js's releases.

posthog-js@1.418.10

1.418.10

Patch Changes

• #4451 e1d993c Thanks @​posthog! - Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandled TypeError (querySelectorAll on a node without that method) and stopped session recording playback mid-stream. (2026-08-21)

• #4557 4451274 Thanks @​posthog! - Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied. (2026-08-21)

posthog-js@1.418.9

1.418.9

Patch Changes

• #4588 c8df61c Thanks @​clr182! - fix(replay): attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot (2026-08-21)

posthog-js@1.418.8

1.418.8

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7
  • @​posthog/types@​1.405.1

posthog-js@1.418.7

1.418.7

Patch Changes

• #4459 caed377 Thanks @​posthog! - fix(browser): stop the $posthog_cookieless sentinel from leaking into identify() and real events. A tab that missed a cross-tab consent flip could emit the sentinel as a durable distinct_id — merging distinct real users into a single person. It now adopts the identity persisted by the tab that handled consent, falling back to a fresh anonymous device id when persistence is not shared. (2026-08-21)

• #4567 5bd2c8d Thanks @​github-actions! - Render React component stacks as linked exception causes so error tracking identifies the crashing component. (2026-08-21)

posthog-js@1.418.6

1.418.6

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

... (truncated)

Commits

• 3508c05 chore: update versions and lockfile [version bump]
• 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
• 4451274 fix(replay): keep playback alive when a stylesheet adoption is rejected (#4557)
• e1d993c fix(replay): keep playback alive when a hover target is not an element (#4451)
• ab5c30c chore: update versions and lockfile [version bump]
• 556d235 fix(core): settle displaced flag reloads against a request that carried their...
• 6ccc78e chore: update versions and lockfile [version bump]
• 00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
• c81aeb8 chore: update versions and lockfile [version bump]
• c8df61c fix(replay): keep backdated idle lifecycle markers out of rotation-born sessi...
• Additional commits viewable in compare view

Updates @posthog/core from 1.48.1 to 1.48.8

Release notes

Sourced from @​posthog/core's releases.

@​posthog/core@​1.48.8

1.48.8

Patch Changes

• #4581 556d235 Thanks @​turnipdabeets! - Fix reloadFeatureFlags and reloadFeatureFlagsAsync returning flags evaluated before the caller's most recent identity or person-property change when several reloads overlap, and stop overlapping reloads from skipping the remote config refresh (2026-08-21)

@​posthog/core@​1.48.7

1.48.7

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/types@​1.405.1

@​posthog/core@​1.48.6

1.48.6

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

• #4582 aef2f49 Thanks @​ablaszkiewicz! - Stop building a stack frame for a window.onerror report that carries no code position, such as the ResizeObserver loop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace. (2026-08-20)

@​posthog/core@​1.48.5

1.48.5

Patch Changes

• #4572 9701637 Thanks @​ablaszkiewicz! - Stop counting Chromium <anonymous> stack frames (extension-injected, devtools or string-evaluated code) as in-app code. (2026-08-19)

@​posthog/core@​1.48.4

1.48.4

Patch Changes

• #4558 3f9ba71 Thanks @​posthog! - Fall back to the synthetic exception stack when a captured Error has no stack, so frameless failures (such as a Firefox network fetch TypeError) keep their call-site frames and group per call site instead of merging into one issue. (2026-08-19)

@​posthog/core@​1.48.3

1.48.3

Patch Changes

... (truncated)

Changelog

Sourced from @​posthog/core's changelog.

1.48.10

Patch Changes

• #4623 be299df Thanks @​turnipdabeets! - Fix buffered logs being dropped instead of retried after HTTP 408, 429 or 5xx (2026-08-24)

1.48.9

Patch Changes

• #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)

1.48.8

Patch Changes

• #4581 556d235 Thanks @​turnipdabeets! - Fix reloadFeatureFlags and reloadFeatureFlagsAsync returning flags evaluated before the caller's most recent identity or person-property change when several reloads overlap, and stop overlapping reloads from skipping the remote config refresh (2026-08-21)

1.48.7

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/types@​1.405.1

1.48.6

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

• #4582 aef2f49 Thanks @​ablaszkiewicz! - Stop building a stack frame for a window.onerror report that carries no code position, such as the ResizeObserver loop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace. (2026-08-20)

1.48.5

Patch Changes

• #4572 9701637 Thanks @​ablaszkiewicz! - Stop counting Chromium <anonymous> stack frames (extension-injected, devtools or string-evaluated code) as in-app code. (2026-08-19)

1.48.4

... (truncated)

Commits

• ab5c30c chore: update versions and lockfile [version bump]
• 556d235 fix(core): settle displaced flag reloads against a request that carried their...
• 0832e6e chore: update versions and lockfile [version bump]
• 6322f09 fix(logs): encode OTLP attributes in the canonical spec shapes (#4583)
• 960cef8 chore: update versions and lockfile [version bump]
• aef2f49 fix(error-tracking): skip frames for onerror reports with no position (#4582)
• bae46bf fix: drop events when beforeSend hooks throw (#4578)
• ef3d7f4 chore: update versions and lockfile [version bump]
• 9701637 fix(error-tracking): stop counting <anonymous> frames as in_app (#4572)
• 4d9952f chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates @posthog/types from 1.402.2 to 1.405.1

Release notes

Sourced from @​posthog/types's releases.

@​posthog/types@​1.405.1

1.405.1

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

@​posthog/types@​1.405.0

1.405.0

Minor Changes

• #4496 1ade666 Thanks @​marandaneto! - Add cookieWinsOnConflict to keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate __preview_cookie_wins_on_conflict, and enable the new behavior for the 2026-08-29 defaults. (2026-08-18)

@​posthog/types@​1.404.1

1.404.1

Patch Changes

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

@​posthog/types@​1.404.0

1.404.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

@​posthog/types@​1.403.1

1.403.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.

... (truncated)

Changelog

Sourced from @​posthog/types's changelog.

1.405.1

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

1.405.0

Minor Changes

• #4496 1ade666 Thanks @​marandaneto! - Add cookieWinsOnConflict to keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate __preview_cookie_wins_on_conflict, and enable the new behavior for the 2026-08-29 defaults. (2026-08-18)

1.404.1

Patch Changes

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

1.404.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

1.403.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

1.403.0

Minor Changes

... (truncated)

Commits

• 0832e6e chore: update versions and lockfile [version bump]
• 6322f09 fix(logs): encode OTLP attributes in the canonical spec shapes (#4583)
• 09d10b0 chore: update versions and lockfile [version bump]
• 1ade666 feat(browser): keep cross-subdomain cookie state in sync (#4496)
• 6872a1c chore: update versions and lockfile [version bump]
• 0a0206f fix: normalize SDK timestamps to UTC (#4521)
• eb05237 fix(dead-clicks): treat visibility and focus changes as liveness signals, not...
• 9b41d8a chore: update versions and lockfile [version bump]
• 8bc63c3 feat(browser): default script versioning to fallback (#4485)
• 5c5d26c chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions