chore(deps): update dependency posthog-js to v1.421.2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.410.10 → 1.421.2

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.421.2

Compare Source

1.421.2

Patch Changes

• #​4653 712223a Thanks @​posthog! - Fix request timeouts never firing on pages where a browser extension makes Error.prototype.name non-writable
  (2026-08-27)

• #​4036 718beee Thanks @​emmayusufu! - Fix logs.captureConsoleLogs set in init() not enabling console autocapture, capture console calls made before the logs script loads, and drop captured console records when the user opts out
  (2026-08-27)

• #​4036 718beee Thanks @​emmayusufu! - Fix session replay and posthog-js leaving each other's console wrapper in the call path when either one stops
  (2026-08-27)

• Updated dependencies [718beee, 712223a]:

  • @​posthog/core@​1.49.0

v1.421.1

Compare Source

1.421.1

Patch Changes

• #​4657 9c09bd4 Thanks @​marandaneto! - Use the best available compression for browser feature flag requests, preferring gzip when supported.
  (2026-08-27)

• #​4520 362d081 Thanks @​veksa! - Drop sourcesContent from the source maps published to npm. The maps themselves still ship, so downstream source-map chaining and the //# sourceMappingURL references are unaffected — only the copy of our TypeScript sources embedded in each map is gone, taking the package from 40.8 MB to 17.4 MB unpacked. CDN artifacts are built separately and keep their inlined sources.
  (2026-08-27)

• Updated dependencies [7902e44, e899b1c]:

  • @​posthog/core@​1.48.12

v1.421.0

Compare Source

1.421.0

Minor Changes

• #​4655 4f80973 Thanks @​robbie-c! - Add the 2026-08-30 config defaults. These defaults enable sanitized JSON-LD replay events.
  (2026-08-26)

Patch Changes

• Updated dependencies [4f80973]:
  • @​posthog/types@​1.407.0

v1.420.0

Compare Source

1.420.0

Minor Changes

• #​4640 0d2cf49 Thanks @​robbie-c! - Add opt-in Schema.org JSON-LD capture to session replay through session_recording.captureJsonLd. When enabled, the recorder emits sanitized JSON-LD as custom replay events and excludes all script elements from replay snapshots.
  (2026-08-26)

Patch Changes

• #​4635 ab1383a Thanks @​robbie-c! - Capture paste interactions with clipboard autocapture without collecting pasted text.
  (2026-08-26)

• #​4594 1d88b4e Thanks @​posthog! - Fix session replay playback ending when a recording contains a shadow host the browser refuses. The player now skips that one subtree instead of aborting the rebuild.
  (2026-08-26)

• Updated dependencies [ab1383a, 0d2cf49]:

  • @​posthog/types@​1.406.2

v1.419.4

Compare Source

1.419.4

Patch Changes

• #​4592 ca540f9 Thanks @​dustinbyrne! - Add typed stable-name lookup for installed browser extensions and use it when independently loaded survey code resolves feature flags.
  (2026-08-25)

• #​4533 53fcb2d Thanks @​dustinbyrne! - Fix console log autocapture silently failing when an older posthog-js core loads a newer logs bundle.
  (2026-08-25)

• #​4476 ed4dd97 Thanks @​posthog! - fix(browser): refresh configured feature flags when a hidden tab becomes visible

  Feature flags now own their automatic refresh timer and visibility listener.
  Hidden tabs reload due flags when they become visible. The existing five-minute
  default and remote_config_refresh_interval_ms behavior remain unchanged. (2026-08-25)

• Updated dependencies [53fcb2d, ca540f9, ed4dd97]:

  • @​posthog/browser-common@​0.6.0
  • @​posthog/types@​1.406.1

v1.419.3

Compare Source

v1.419.2

Compare Source

1.419.2

Patch Changes

• #​4645 cb7cc12 Thanks @​turnipdabeets! - Type declarations no longer import the JSX namespace from react, so they typecheck against @types/react back to the declared 16.8.0 floor. Component return types are now spelled ReactElement<any, any>, which is the definition of JSX.Element — the same type, so consuming code is unaffected.

  JSX only became an exported member of the react types module in @types/react@18.2.6, so projects on older React types previously saw TS2305: Module '"react"' has no exported member 'JSX' when checking these declarations with skipLibCheck: false. (2026-08-25)

v1.419.1

Compare Source

1.419.1

Patch Changes

• #​4638 d166e54 Thanks @​github-actions! - Declare react and @types/react as optional peer dependencies so the posthog-js/react entry point can resolve React on strict node_modules layouts — pnpm and bun isolated linkers backed by a global store, where the package is installed outside the project tree and Node's directory walk never reaches the app's React.

  Projects that do not import posthog-js/react are unaffected: the peers are optional, so npm, pnpm, yarn, and bun install them only when React is already present and emit no unmet-peer warnings. (2026-08-25)

v1.419.0

Compare Source

1.419.0

Minor Changes

• #​4598 334159b Thanks @​posthog! - Web vitals now capture attribution by default for INP and LCP, so a slow interaction or paint arrives with the target element and phase breakdown that make it diagnosable. CLS stays without attribution by default, because its attribution holds detached DOM nodes and can leak memory in single-page apps. Set capture_performance.web_vitals_attribution to false to opt out, true for every metric, or an array to name the metrics. The captured metric also drops the empty entries array and bounds attribution to a small set of useful fields, and the attributed INP observer no longer collects the processedEventEntries we never read.
  (2026-08-25)

Patch Changes

• Updated dependencies [334159b]:
  • @​posthog/types@​1.406.0

v1.418.17

Compare Source

1.418.17

Patch Changes

• #​4612 e8a2c2a Thanks @​marandaneto! - Prevent session recordings from emitting failed CSSOM changes and fix shadow DOM, cross-origin iframe, blocked and unsupported canvas, and deep DOM serialization edge cases.
  (2026-08-25)

• #​4611 d4eee8f Thanks @​marandaneto! - Share survey property matching between the browser and React Native SDKs while preserving their existing missing-value behavior.
  (2026-08-25)

• Updated dependencies [930de19, d4eee8f]:

  • @​posthog/core@​1.48.11
  • @​posthog/browser-common@​0.5.2

v1.418.16

Compare Source

1.418.16

Patch Changes

• #​4607 7ec4f0d Thanks @​posthog! - Drop exceptions thrown by user scripts the browser injects into every page (Firefox for iOS, Chrome for iOS) instead of reporting them as the page's own errors. Set error_tracking.captureExtensionExceptions: true to keep capturing them.
  (2026-08-24)
• Updated dependencies [7ec4f0d]:
  • @​posthog/types@​1.405.3

v1.418.15

Compare Source

1.418.15

Patch Changes

• #​4532 60ee0ac Thanks @​dustinbyrne! - Migrate surveys to the shared browser extension lifecycle.
  (2026-08-24)
• Updated dependencies [60ee0ac]:
  • @​posthog/browser-common@​0.5.1

v1.418.14

Compare Source

1.418.14

Patch Changes

• #​4513 cb7e4a6 Thanks @​dustinbyrne! - Migrate browser autocapture to the shared extension lifecycle.
  (2026-08-24)

• #​4623 be299df Thanks @​turnipdabeets! - Fix logs and metrics batches being dropped instead of retried after HTTP 408
  (2026-08-24)

• Updated dependencies [be299df]:

  • @​posthog/core@​1.48.10

v1.418.13

Compare Source

1.418.13

Patch Changes

• #​4418 be2161d Thanks @​posthog! - feat: add granular automatic pageview options for SPA navigation

  capture_pageview now accepts an object with path, search, and hash options. Each selected URL component triggers a $pageview when it changes, including direct hash changes used by hash-based routers. The existing 'history_change' option continues to capture pathname changes. (2026-08-24)

• Updated dependencies [be2161d]:

  • @​posthog/types@​1.405.2

v1.418.12

Compare Source

1.418.12

Patch Changes

• #​4501 9e853c1 Thanks @​posthog! - Session replay: fixed a stale element left rendered in the player when a mutation re-added a node id with changed attributes. Affects both useVirtualDom modes.
  (2026-08-24)

v1.418.11

Compare Source

1.418.11

Patch Changes

• #​4603 ca030a6 Thanks @​martinfrancois! - Stop adding PostHog's optional feature scripts, such as the session replay recorder and exception autocapture, to the page more than once. Sites that proxy PostHog through their own domain, by setting api_host to a path like /ingest rather than a full URL, ended up with the same <script> tag three or four times: the check meant to spot the duplicate compared the browser's resolved absolute URL against the relative one, so it never matched. The network tab showed a single request either way, because the browser served the repeats from its cache, which is why this was easy to miss. Nothing measurable got slower as a result, so this is a correctness fix rather than a speed one.
  (2026-08-24)

• #​4453 325870a Thanks @​posthog! - When session replay is waiting on a trigger, debug mode now names the conditions that haven't matched yet (for example buffering: URL condition not matched, or the named trigger group whose condition is pending) instead of only reporting buffering. Enable it with posthog.debug(). Logged once per change, not once per flush.
  (2026-08-24)

v1.418.10

Compare Source

1.418.10

Patch Changes

• #​4451 e1d993c Thanks @​posthog! - Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandled TypeError (querySelectorAll on a node without that method) and stopped session recording playback mid-stream.
  (2026-08-21)

• #​4557 4451274 Thanks @​posthog! - Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied.
  (2026-08-21)

v1.418.9

Compare Source

1.418.9

Patch Changes

• #​4588 c8df61c Thanks @​clr182! - fix(replay): attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot
  (2026-08-21)

v1.418.8

Compare Source

1.418.8

Patch Changes

• #​4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji.
  Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated].
  Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7
  • @​posthog/types@​1.405.1

v1.418.7

Compare Source

v1.418.6

Compare Source

1.418.6

Patch Changes

• #​4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event.
  (2026-08-20)

• #​4582 aef2f49 Thanks @​ablaszkiewicz! - Stop building a stack frame for a window.onerror report that carries no code position, such as the ResizeObserver loop warning. The frame named the document URL rather than a script, so no source map could resolve it. These exceptions now arrive with no stack trace.
  (2026-08-20)

• Updated dependencies [bae46bf, aef2f49]:

  • @​posthog/core@​1.48.6

v1.418.5

Compare Source

1.418.5

Patch Changes

• #​4572 9701637 Thanks @​ablaszkiewicz! - Stop counting Chromium <anonymous> stack frames (extension-injected, devtools or string-evaluated code) as in-app code.
  (2026-08-19)
• Updated dependencies [9701637]:
  • @​posthog/core@​1.48.5

v1.418.4

Compare Source

1.418.4

Patch Changes

• #​4309 b564d61 Thanks @​posthog! - Fix session recording in the full browser bundles. array.full.js and module.full.es.js only inlined rrweb, so they still fetched the recorder script at runtime - the request the full bundles exist to avoid. They now inline the whole recorder. Also flags the session with $sdk_debug_recording_script_not_loaded when the recorder script fails to load, so a blocked recorder is visible in analytics rather than only in the console.
  (2026-08-19)

v1.418.3

Compare Source

1.418.3

Patch Changes

• #​4558 3f9ba71 Thanks @​posthog! - Fall back to the synthetic exception stack when a captured Error has no stack, so frameless failures (such as a Firefox network fetch TypeError) keep their call-site frames and group per call site instead of merging into one issue.
  (2026-08-19)
• Updated dependencies [3f9ba71]:
  • @​posthog/core@​1.48.4

v1.418.2

Compare Source

1.418.2

Patch Changes

• #​4555 3e0edff Thanks @​HaynesPostHog! - Fix a Chrome renderer crash (grey "Aw, Snap" tab, "Error code: 5") that could still occur when closing an in-app survey on a heavy page such as a large dashboard.

  Closing a survey animated the fade-out with document.startViewTransition, which snapshots the entire page viewport. The survey applied no view-transition-name scoping, so on a heavy host page capturing that whole-page snapshot could exhaust renderer memory and crash the tab. A previous fix addressed a related crash (a snapshot pointing at a removed node) but left the document-level transition — and its whole-page snapshot cost — in place.

  The survey renders in an isolated shadow root, so it never needed a document-level transition. The close now fades the popup out with a plain CSS opacity transition scoped to the survey's own container, then unmounts it once the fade has run. No whole-page snapshot, no crash, same fade-out UX. (2026-08-19)

v1.418.1

Compare Source

1.418.1

Patch Changes

• #​4549 0599fe0 Thanks @​ablaszkiewicz! - Recognise Firefox and Safari extension frames when filtering extension exceptions, and stop counting Safari's masked webkit-masked-url:// frames as in-app code.
  (2026-08-18)
• Updated dependencies [0599fe0]:
  • @​posthog/core@​1.48.3

v1.418.0

Compare Source

1.418.0

Minor Changes

• #​4496 1ade666 Thanks @​marandaneto! - Add cookieWinsOnConflict to keep shared cross-subdomain identity and session state ahead of stale per-origin localStorage, deprecate __preview_cookie_wins_on_conflict, and enable the new behavior for the 2026-08-29 defaults.
  (2026-08-18)

Patch Changes

• Updated dependencies [1ade666]:
  • @​posthog/types@​1.405.0

v1.417.4

Compare Source

1.417.4

Patch Changes

• #​4509 8d74821 Thanks @​ksvat! - Take a full snapshot when session recording wakes from idle if DOM mutations were dropped while idle, so replay no longer shows duplicated or overlapping DOM after an idle period.
  (2026-08-17)

v1.417.3

Compare Source

1.417.3

Patch Changes

• #​4540 ce8fc13 Thanks @​marandaneto! - Restore exception autocapture compatibility for posthog-js clients through version 1.141.0.
  (2026-08-17)

v1.417.2

Compare Source

1.417.2

Patch Changes

• #​4413 7b61aa4 Thanks @​posthog! - Fix error tracking coercion reporting the wrong exception type for non-Error objects (e.g. TypeError, ReferenceError) that are thrown by browser extensions or other cross-realm code. Previously these always reported as type Error, burying the real type in the message string. Also fixed a local isError helper shadowing the more robust cross-realm-aware implementation, which caused some errors thrown from iframes or extension isolated worlds to be misclassified.
  (2026-08-17)
• Updated dependencies [7b61aa4]:
  • @​posthog/core@​1.48.2

v1.417.1

Compare Source

1.417.1

Patch Changes

• #​4521 0a0206f Thanks @​marandaneto! - Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core.
  (2026-08-14)

• #​4523 6230b5b Thanks @​marandaneto! - Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts.
  (2026-08-14)

• #​4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

• Updated dependencies [0a0206f, eb05237]:

  • @​posthog/core@​1.48.1
  • @​posthog/types@​1.404.1

v1.417.0

Compare Source

1.417.0

Minor Changes

• #​4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode.
  (2026-08-13)

Patch Changes

• Updated dependencies [8bc63c3]:
  • @​posthog/types@​1.404.0

v1.416.1

Compare Source

1.416.1

Patch Changes

• #​4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):

  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

• Updated dependencies [c9086de, b2c6830]:

  • @​posthog/core@​1.48.0
  • @​posthog/types@​1.403.1

v1.416.0

Compare Source

1.416.0

Minor Changes

• #​4495 e4b9947 Thanks @​marandaneto! - feat(browser): add rewriteRequestPath to customize API, feature flag, and asset paths for reverse proxies
  (2026-08-12)

• #​4493 e34ebf9 Thanks @​marandaneto! - Add reset options for applying bootstrapped identity, feature flag, and session values after posthog.reset() while preserving the legacy boolean argument.
  (2026-08-12)

Patch Changes

• Updated dependencies [e4b9947, e34ebf9]:
  • @​posthog/types@​1.403.0

v1.415.7

Compare Source

1.415.7

Patch Changes

• #​4318 847d963 Thanks @​dustinbyrne! - Migrate browser feature flags to the shared extension lifecycle while preserving the public feature flag facade, persistence compatibility, request behavior, and event enrichment.
  (2026-08-12)

v1.415.6

Compare Source

1.415.6

Patch Changes

• #​4500 d773405 Thanks @​ksvat! - Fix session recording starting from arbitrarily old persisted configs.

  Recording configs persisted by SDK versions before 1.347.2 carry no cache_timestamp. The core freshness check treated these undated configs as always fresh, so the recorder started immediately under their settings. A device whose stored config predated a customer's config change kept recording under the old triggers, sample rate, and masking settings indefinitely.

  The core now treats undated persisted configs as stale. Recording waits for a fresh remote config before it starts, the same path every dated config older than one hour already takes. The lazy recorder bundle is unchanged: it still accepts undated configs, because old cores that load the latest bundle cannot recover from a rejected config (INC-749). (2026-08-11)

v1.415.5

Compare Source

1.415.5

Patch Changes

• #​4497 d62e42e Thanks @​hpouillot! - Fix a Chrome renderer crash (grey "Aw, Snap" tab) that could occur when closing an in-app survey.

  The survey close path wrapped the survey container's DOM removal in document.startViewTransition. Removing the element inside the transition callback left the captured snapshot pointing at a removed node, which on heavy SPAs triggered a Chromium renderer crash and took down the whole tab.

  The close path now only animates a fade-out inside the transition and lets React tear the container down once the transition settles. It also guards against overlapping transitions (a second close while one is animating) and always settles the popup state if the transition is skipped or interrupted, so the survey can never be left visible with a stale reference. (2026-08-11)

v1.415.4

Compare Source

1.415.4

Patch Changes

• #​4494 deb6bb0 Thanks @​marandaneto! - fix(types): accept current and legacy Segment Analytics SDK types in the Segment integration config
  (2026-08-11)
• Updated dependencies [deb6bb0]:
  • @​posthog/types@​1.402.3

v1.415.3

Compare Source

1.415.3

Patch Changes

• #​4488 23db844 Thanks @​TueHaulund! - fix(replay): never ship a buffer swapped in by a re-entrant session rotation mid-flush
  (2026-08-11)

• #​4474 e06bf52 Thanks @​dependabot! - dependencies updates: - Updated dependency dompurify@^3.4.13 ↗︎ (from ^3.4.12, in dependencies) (2026-08-11)

• #​4435 1cbbe6a Thanks @​arnohillen! - fix(replay): stop dropping adopted stylesheets that arrive before the host's shadow root is attached. When the recorder's full snapshot races a web component's hydration, the AdoptedStyleSheet event can be recorded before the mutation that attaches the host's shadow root. The replayer silently dropped those styles for the rest of the page view, so components styled via shadowRoot.adoptedStyleSheets (Stencil, Lit) rendered completely unstyled. The replayer now constructs the stylesheet even when the shadow root does not exist yet and keeps retrying adoption until it is attached.
  (2026-08-11)

v1.415.2

Compare Source

1.415.2

Patch Changes

• #​4316 f999394 Thanks @​dustinbyrne! - Support removing multiple persisted properties in one operation.
  (2026-08-11)
• Updated dependencies [f999394]:
  • @​posthog/browser-common@​0.5.0

v1.415.1

Compare Source

1.415.1

Patch Changes

• #​4477 6f9adf8 Thanks @​TueHaulund! - fix(replay): don't open a recording that holds only idle lifecycle markers
  (2026-08-10)

v1.415.0

Compare Source

1.415.0

Minor Changes

• #​4436 80f15a3 Thanks @​jakesciotto! - feat(surveys): optional intro screen shown before the first question

  Surveys can now display an intro screen before question 1, configured via the new
  displayIntroScreen, introScreenHeader, introScreenDescription,
  introScreenDescriptionContentType, and introScreenButtonText appearance fields.
  The intro is dismissed with a button and records no response, does not affect
  completion or partial-response metrics, does not re-fire "survey shown", and is
  skipped when a survey is resumed with answers in progress. Intro copy is
  translatable like the thank-you message. renderSurveysPreview accepts
  previewPageIndex: -1 (exported as INTRO_SCREEN_PREVIEW_INDEX) to preview the
  intro screen. (2026-08-10)

Patch Changes

• Updated dependencies [80f15a3]:
  • @​posthog/core@​1.47.0

v1.414.0

Compare Source

1.414.0

Minor Changes

• #​4330 5bd8b83 Thanks @​darkopia! - Add posthog.conversations.getUnavailableReason() to expose why the conversations API is unavailable (bundle blocked/failed to load, disabled in project, remote config pending/failed, still initializing, …) instead of collapsing every case into isAvailable() === false. Lets callers that fall back to another channel record the specific cause. ConversationsUnavailableReason is exported from the package entry points, so consumers can name the type.
  (2026-08-07)

v1.413.3

Compare Source

1.413.3

Patch Changes

• #​4414 1b88c2f Thanks @​marandaneto! - Clear properties registered for a session when the PostHog session rotates.
  (2026-08-06)

• #​4374 b39b577 Thanks @​dustinbyrne! - Persist in-place object and array mutations when properties are re-registered.
  (2026-08-06)

• #​4434 75fb719 Thanks @​arnohillen! - Make the session replay attribute masking options mutually exclusive: when both maskAllElementAttributes and maskAttributeFn are set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask what maskAllElementAttributes hides.
  (2026-08-06)

• Updated dependencies [64ba193, 75fb719]:

  • @​posthog/core@​1.46.9
  • @​posthog/types@​1.402.2

v1.413.2

Compare Source

1.413.2

Patch Changes

• #​4425 ee7fab0 Thanks @​posthog! - Fix a benign network failure (e.g. TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up
  (2026-08-05)

v1.413.1

Compare Source

1.413.1

Patch Changes

• #​4390 1160403 Thanks @​posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes.
  (2026-08-05)

• #​4286 d108d66 Thanks @​posthog! - fix(replay): preserve privacy masking for initial network metadata

  Initial navigation and performance-timing entries are now passed through maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)

• Updated dependencies [d108d66]:

  • [@​posthog/types](htt

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	4aef0cb	Commit Preview URL Branch Preview URL	Aug 30 2026, 02:02 PM