chore(deps): update dependency posthog-js to v1.417.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-js (source)	1.410.10 → 1.417.0

---

Release Notes

PostHog/posthog-js (posthog-js)

v1.417.0

Compare Source

1.417.0

Minor Changes

• #​4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode.
  (2026-08-13)

Patch Changes

• Updated dependencies [8bc63c3]:
  • @​posthog/types@​1.404.0

v1.416.1

Compare Source

1.416.1

Patch Changes

• #​4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):

  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

• Updated dependencies [c9086de, b2c6830]:

  • @​posthog/core@​1.48.0
  • @​posthog/types@​1.403.1

v1.416.0

Compare Source

1.416.0

Minor Changes

• #​4495 e4b9947 Thanks @​marandaneto! - feat(browser): add rewriteRequestPath to customize API, feature flag, and asset paths for reverse proxies
  (2026-08-12)

• #​4493 e34ebf9 Thanks @​marandaneto! - Add reset options for applying bootstrapped identity, feature flag, and session values after posthog.reset() while preserving the legacy boolean argument.
  (2026-08-12)

Patch Changes

• Updated dependencies [e4b9947, e34ebf9]:
  • @​posthog/types@​1.403.0

v1.415.7

Compare Source

1.415.7

Patch Changes

• #​4318 847d963 Thanks @​dustinbyrne! - Migrate browser feature flags to the shared extension lifecycle while preserving the public feature flag facade, persistence compatibility, request behavior, and event enrichment.
  (2026-08-12)

v1.415.6

Compare Source

1.415.6

Patch Changes

• #​4500 d773405 Thanks @​ksvat! - Fix session recording starting from arbitrarily old persisted configs.

  Recording configs persisted by SDK versions before 1.347.2 carry no cache_timestamp. The core freshness check treated these undated configs as always fresh, so the recorder started immediately under their settings. A device whose stored config predated a customer's config change kept recording under the old triggers, sample rate, and masking settings indefinitely.

  The core now treats undated persisted configs as stale. Recording waits for a fresh remote config before it starts, the same path every dated config older than one hour already takes. The lazy recorder bundle is unchanged: it still accepts undated configs, because old cores that load the latest bundle cannot recover from a rejected config (INC-749). (2026-08-11)

v1.415.5

Compare Source

1.415.5

Patch Changes

• #​4497 d62e42e Thanks @​hpouillot! - Fix a Chrome renderer crash (grey "Aw, Snap" tab) that could occur when closing an in-app survey.

  The survey close path wrapped the survey container's DOM removal in document.startViewTransition. Removing the element inside the transition callback left the captured snapshot pointing at a removed node, which on heavy SPAs triggered a Chromium renderer crash and took down the whole tab.

  The close path now only animates a fade-out inside the transition and lets React tear the container down once the transition settles. It also guards against overlapping transitions (a second close while one is animating) and always settles the popup state if the transition is skipped or interrupted, so the survey can never be left visible with a stale reference. (2026-08-11)

v1.415.4

Compare Source

1.415.4

Patch Changes

• #​4494 deb6bb0 Thanks @​marandaneto! - fix(types): accept current and legacy Segment Analytics SDK types in the Segment integration config
  (2026-08-11)
• Updated dependencies [deb6bb0]:
  • @​posthog/types@​1.402.3

v1.415.3

Compare Source

1.415.3

Patch Changes

• #​4488 23db844 Thanks @​TueHaulund! - fix(replay): never ship a buffer swapped in by a re-entrant session rotation mid-flush
  (2026-08-11)

• #​4474 e06bf52 Thanks @​dependabot! - dependencies updates: - Updated dependency dompurify@^3.4.13 ↗︎ (from ^3.4.12, in dependencies) (2026-08-11)

• #​4435 1cbbe6a Thanks @​arnohillen! - fix(replay): stop dropping adopted stylesheets that arrive before the host's shadow root is attached. When the recorder's full snapshot races a web component's hydration, the AdoptedStyleSheet event can be recorded before the mutation that attaches the host's shadow root. The replayer silently dropped those styles for the rest of the page view, so components styled via shadowRoot.adoptedStyleSheets (Stencil, Lit) rendered completely unstyled. The replayer now constructs the stylesheet even when the shadow root does not exist yet and keeps retrying adoption until it is attached.
  (2026-08-11)

v1.415.2

Compare Source

1.415.2

Patch Changes

• #​4316 f999394 Thanks @​dustinbyrne! - Support removing multiple persisted properties in one operation.
  (2026-08-11)
• Updated dependencies [f999394]:
  • @​posthog/browser-common@​0.5.0

v1.415.1

Compare Source

1.415.1

Patch Changes

• #​4477 6f9adf8 Thanks @​TueHaulund! - fix(replay): don't open a recording that holds only idle lifecycle markers
  (2026-08-10)

v1.415.0

Compare Source

1.415.0

Minor Changes

• #​4436 80f15a3 Thanks @​jakesciotto! - feat(surveys): optional intro screen shown before the first question

  Surveys can now display an intro screen before question 1, configured via the new
  displayIntroScreen, introScreenHeader, introScreenDescription,
  introScreenDescriptionContentType, and introScreenButtonText appearance fields.
  The intro is dismissed with a button and records no response, does not affect
  completion or partial-response metrics, does not re-fire "survey shown", and is
  skipped when a survey is resumed with answers in progress. Intro copy is
  translatable like the thank-you message. renderSurveysPreview accepts
  previewPageIndex: -1 (exported as INTRO_SCREEN_PREVIEW_INDEX) to preview the
  intro screen. (2026-08-10)

Patch Changes

• Updated dependencies [80f15a3]:
  • @​posthog/core@​1.47.0

v1.414.0

Compare Source

1.414.0

Minor Changes

• #​4330 5bd8b83 Thanks @​darkopia! - Add posthog.conversations.getUnavailableReason() to expose why the conversations API is unavailable (bundle blocked/failed to load, disabled in project, remote config pending/failed, still initializing, …) instead of collapsing every case into isAvailable() === false. Lets callers that fall back to another channel record the specific cause. ConversationsUnavailableReason is exported from the package entry points, so consumers can name the type.
  (2026-08-07)

v1.413.3

Compare Source

1.413.3

Patch Changes

• #​4414 1b88c2f Thanks @​marandaneto! - Clear properties registered for a session when the PostHog session rotates.
  (2026-08-06)

• #​4374 b39b577 Thanks @​dustinbyrne! - Persist in-place object and array mutations when properties are re-registered.
  (2026-08-06)

• #​4434 75fb719 Thanks @​arnohillen! - Make the session replay attribute masking options mutually exclusive: when both maskAllElementAttributes and maskAttributeFn are set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask what maskAllElementAttributes hides.
  (2026-08-06)

• Updated dependencies [64ba193, 75fb719]:

  • @​posthog/core@​1.46.9
  • @​posthog/types@​1.402.2

v1.413.2

Compare Source

1.413.2

Patch Changes

• #​4425 ee7fab0 Thanks @​posthog! - Fix a benign network failure (e.g. TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up
  (2026-08-05)

v1.413.1

Compare Source

1.413.1

Patch Changes

• #​4390 1160403 Thanks @​posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes.
  (2026-08-05)

• #​4286 d108d66 Thanks @​posthog! - fix(replay): preserve privacy masking for initial network metadata

  Initial navigation and performance-timing entries are now passed through maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)

• Updated dependencies [d108d66]:

  • @​posthog/types@​1.402.1

v1.413.0

Compare Source

1.413.0

Minor Changes

• #​4376 2da12b8 Thanks @​posthog! - Add attribute-level masking to session replay: maskAttributeFn provides per-attribute control over the final serialized value, while maskAllElementAttributes masks all source DOM string attributes (including rendering attributes and synthesized form values) at the cost of replay fidelity.
  (2026-08-05)

Patch Changes

• #​4376 2da12b8 Thanks @​posthog! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)
• Updated dependencies [2da12b8]:
  • @​posthog/types@​1.402.0
  • @​posthog/browser-common@​0.4.0

v1.412.2

Compare Source

1.412.2

Patch Changes

• #​4417 3acadfe Thanks @​marandaneto! - fix(replay): discard held interaction-less recordings when a background document unloads without ever becoming visible
  (2026-08-05)

v1.412.1

Compare Source

1.412.1

Patch Changes

• #​4404 a348fb3 Thanks @​dependabot! - Update PostCSS to include upstream security fixes.
  (2026-08-05)

v1.412.0

Compare Source

v1.411.0

Compare Source

1.411.0

Minor Changes

• #​4266 43d1850 Thanks @​posthog! - feat: add opt-in capture_performance.__preview_web_vitals_soft_navs to fix inflated web vitals on single-page apps

  Client-side route changes in SPAs previously left web vitals (LCP especially) accumulating against the original hard-navigation timestamp, inflating the top tail of Core Web Vitals. Setting capture_performance: { __preview_web_vitals_soft_navs: true } now scopes metrics to the browser's Soft Navigation entries so each route change starts a fresh measurement window. It's a preview option because it relies on Chrome's experimental Soft Navigation Detection API and loads pinned stable web-vitals 6.x callbacks; when disabled (the default), the existing web-vitals 5.x behavior remains unchanged. (2026-08-04)

Patch Changes

• #​4287 d3c4538 Thanks @​posthog! - Keep $referring_domain and canonical utm_*/campaign parameters on minimal $feature_flag_called events. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics.
  (2026-08-04)
• Updated dependencies [d3c4538, 43d1850]:
  • @​posthog/core@​1.46.7
  • @​posthog/types@​1.401.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)
• Automerge
  • Between 08:00 AM and 05:59 PM, Monday through Friday (* 8-17 * * 1-5)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	a4219e6	Commit Preview URL Branch Preview URL	Aug 13 2026, 09:34 PM